Application Development Discussions
Join the discussions or start your own on all things application development, including tools and APIs, programming models, and keeping your skills sharp.
cancel
Showing results for 
Search instead for 
Did you mean: 

Another system upgrade question

Former Member
0 Kudos

This is what happened after we've done the support level...

While running PFCG_TIME_DEPENDECY, we get pop-ups saying that "User XXX does not exist". Some of these users still have master record in the system, but many of them are no longer exist. What's the reason for this?

*Julius, does this have something to do with the composite roles, and is this what you meant by the PRGN_COMPRESS_TIMES?

1 ACCEPTED SOLUTION

Former Member
0 Kudos

> While running PFCG_TIME_DEPENDECY, we get pop-ups saying that "User XXX does not exist". Some of these users still have master record in the system, but many of them are no longer exist. What's the reason for this?

It might be that the person has left the company and their User ID has been moved to a "RETIRED" user group for authorization checks (S_USER_GRP object), but your user which is running PFCG_TIME_DEPENDENCY for all users in all groups is not authorized to PFUD for that user ID (which the system knows is there, because it's assigned to the role).

Check this by running an SU53 immediately on this message to see whether S_USER_GRP was failing with the field CLASS being checked but not found in your authorizations?

If this is the case, then you can ignore it, but the message is a bit misleading.

Cheers,

Julius

20 REPLIES 20

Former Member
0 Kudos

> While running PFCG_TIME_DEPENDECY, we get pop-ups saying that "User XXX does not exist". Some of these users still have master record in the system, but many of them are no longer exist. What's the reason for this?

It might be that the person has left the company and their User ID has been moved to a "RETIRED" user group for authorization checks (S_USER_GRP object), but your user which is running PFCG_TIME_DEPENDENCY for all users in all groups is not authorized to PFUD for that user ID (which the system knows is there, because it's assigned to the role).

Check this by running an SU53 immediately on this message to see whether S_USER_GRP was failing with the field CLASS being checked but not found in your authorizations?

If this is the case, then you can ignore it, but the message is a bit misleading.

Cheers,

Julius

0 Kudos

Hi Julius

I used my own ID to run the comparison with SAP_ALL.

The authorisation check in SU53 was successful though.

Does this have anything to do with Indirect Role Assignment, (again) the composite role... or anything?

0 Kudos

Perhaps the user ID has infact been deleted (can you display it in SU01?) or perhaps someone renamed the user ID...?

Cheers,

Julius

0 Kudos

Hi,

I suppose too, that this message comes form the HR-Org-part of pfcg_time_dependency...

Maybe there is still an HR-link to that (non existing) User, which the comparison cannot find. To find out, which part of the job produces the message, you yould

start the comparison in PFUD. Select one option after the other (user comparison, composite role,....) seperatley and mark 'display error messages'.

Alternatively you can schedule the 4 jobs seperately after creating the corresponding varieants for reprot rhautupd_new.

If the message comes up during HR-org-comparison, the cause shall be identified by your hr-admins....

I hope, this helps.

b.rgds,

Bernhard

0 Kudos

Julius, I am glad that you're still with me...

We are getting approximately 30 pop-ups saying that "user xxx does not exist".

All these users do not exist in SU01, and I do not find them in SUIM and CUA.

But one thing I just found out is that (through a query report), all these user IDs are used in some of the 0105 communication infotype. I just wondered why did'nt we receive this before the upgrade. I guess I can get rid of their subtype record in 0105 manually, or is there a way to update this automatically by running a program or update some table?

Also I realized that when running PFUD, with the processing type "HR Organizational Management: Reconciliation" unchecked, the run is successful and I don't get those pop-ups at all.

So tell me, this gotta be something to do with the position based security or what?

0 Kudos

Hi Bernhard

Sorry I missed your message before I posted my previous one.

Yes, I believe it comes from the Org-part. Guess I just have to manually remove them?

0 Kudos

As Bernhard has suggested, check with HR why they were not removed from IT0105, what else is still active on the HR side and why there are "only" 30 of them...

... it might also be that only these 30 retired employees were deleted on your SU01 side. (see the sticky thread at the top for discussions are deleting user IDs).

Cheers,

Julius

0 Kudos

Hi guys

thanks Julius, I will ask my HR-admin to check those 30 UserIDs!

We set up a variant in PFUD now to run customer-specific roles. Now we don't get any of those SAP* standard roles anymore during the user comparison.

But if we run PFCG_TIME_DEPENDECY, we still get those standard SAP roles included in the run. As you know there is no way to set up variant in PFCG_TIME_DEPENDECY itself, how can we get PFCG_TIME_DEPENDECY to run the same variant as in PFUD?

Appreciate your help once more.

0 Kudos

Hi Theoz,

PFCG_TIME_DEPENDENCY is the standard, that covers all.

If you need it, deschedule PFCG_TIME_DEPENDENCY and use your rhautupd_new-variants instead.

To modify the standardcoding of report PFCG_TIME_DEPENDENCY is not advisable....

b.rgds, Bernhard

0 Kudos

Hi Bernhard

PFUD and PFCG_TIME_DEPENDENCY are running the same RHAUTUPD_NEW isn't it?

We have a variant already schedule for RHAUTUPD_NEW_VARIANT and that part works fine. <<-- this one is made via PFUD

Just that when we run PFCG_TIME_DEPENDENCY in dialog (also in background), we have all SAP standard roles included in the user comparison and that's not what we want. I tried to use variant in PFCG_TIME_DEPENDENCY, but I got couple of messages that say:

"No objects correspond to the selection criteria", and

"Program PFCG_TIME_DEPENDECY has not selection screen"

What should be my next step?

0 Kudos

I agree with Bernard. At least one of my posts to your other thread regarding variants for PFUD should also have related to RHAUTUP_NEW and not PFCG_TIME_DEPENDENCY.

> What should be my next step?

Perhaps re-read this thread and your other one about the role naming convention, think about it and try it.

I think you are on the right track now

Cheers,

Julius

0 Kudos

> think about it and try it.

Julius... you're giving me the hardest thing of all --> which is to think, and that is especially hard for me this time of the day after over 8 hours of SAP-ing... 🐵

In your old message at my previous thread, you said "run PFCG_TIME_DEPENDECY from SA38 via that variant".... now "via that variant" is what I found mysterious.

Please guys, give me one last shot, then I am good to go.

0 Kudos

> Please guys, give me one last shot, then I am good to go.

Okay. What do you still need or where is your doubt?

Cheers,

Julius

0 Kudos

Julius,

In SA38 > PFCG_TIME_DEPENDECY: I can't create variant, neither can I choose any variant.

0 Kudos

Sorry guys I am still struggling with this one. Lets forget about PFUD for a while because that's not the issue now since it works.

I am only wondering about the PFCG_TIME_DEPENDENCY. It's a very practical transaction and we run it more often that PFUD, especially in the test environment where roles and profiles constantly change...

Right now after each run, we're still getting hundreds of warning messages that come from SAP standard roles. How to get rid of those.

0 Kudos

Hello, it has been a while since this thread was created, I don't know if anyone still with me... but this is what I've recently tried:

SE38 > RHAUTUPD_NEW > Source code > Display

GOTO > Variant > Create

Enter customer-specific roles in Selection of reles

Attributes > Enter description > Select "Only for backgroun processing" > Press "Copy Screen Assignment" > Save

Next, go to SA38 > PFCG_TIME_DEPENDECY > Execute

After all these, I am still getting the same warning messages:

Roles SAP_XXXX does not contain a profile or authorisations, or

Authorisation profiles for role SAP_XXXXX does not exist

0 Kudos

Hi Theoz,

you have created a variant for rhautupd_new.

If you now start pfcg_time_dependency, the pfcg_time_dependency will run, not rhautupd_new with your variant. pfcg_time_dependency runs always for all existing roles.

So schedule rhautupd_new with your variant instead of pfcg_time_dependency... thats the trick....

b.rgds, Bernhard

0 Kudos

Thanks Bernhard..

Is there a way to disable the "display log" in PFCG_TIME_DEPENDENCY, as in the PFUD? I think as long as I can get the logs away, then I am through with this. Somemore, these are just the warning messages, not errors.

As you mentioned PFCG_TIME_DEPENDECY takes all existing roles into consideration and it is not changeable. So I guess the variant-option in SA38 > PFCG_TIME_DEPENDENCY is useless although it seems to make people think that there is a possibility to run this with a variant.

We didn't have any problem to run PFCG_TIME_DEPENDENCY via SA38 before the upgrade.

0 Kudos

Hi,

pfcg_time_dependency has to be taken 'as it is'....

So removing the flag for 'output messages' would be a modification.

There is no problem, if you will not use pfcg_time_dependency in the future, if you have your own variants for rhautupd_new, which meet your requirements.

If you want to use pfcg_time_dependency, you can ignore the messages regarding sap-roles, as they often have no profiles and they should not have users assigned.....

Furthermore I recommend to delete the sap roles in your PRD to reduce the amount of existing roles....

It shall be sufficient to have them in DEV to be able to use them as draft for copying to customer namespace. I think there are some exceptions (for instance I remember java guys use SAP-roles

directly without copy to customer namespace, but in general the sap roles shall not be used.

Further recommendations....:

It shall be enough to schedule rhautupd_new variants with option

profile matchup daily (only if you use hr-org, this option shall be run also with short interval), if you use composite roles, this shall also run daily, but 'cleanups' shall be sufficient to be run once a week or so (depending on how many roles you transport....).

b.rgds, Bernhard

0 Kudos

Thanks again Bernhard

Now I got this really clear. This thread can finally closed with honor!

Cheers