Indirect Role Assignment: Composite roles

[Former Member]

Can anyone shed some light regarding the following scenario:

We have a user previously assigned to a managerial position and this position is attached to a MSS-composite role in PO13 (thorugh the AG relationship). Now this user has been delimited from that managerial position, and is now assigned to a new position as a normal staff, so he shouldn't have the MSS-composite role anymore. We updated the run in PFUD with HR Org-assignment reconcilation, but we still find the Composite role for Managers in his user master record in SU01.

What might be wrong?

[Former Member]

Hi,

Could you please ensure that the prevoius composite role has been removed from his user master record and the new role corresponding to his new position assigned to him.

While executing the PFUD please put both the roles corresponding to this previous and current position and then execute.

Thanks,

Saby..

[Former Member]

Hi Saby

This is what I'm trying to ensure -- running the PFUD, do the HR-Org reconcilation in order to remove old composite which comes with the previous position. But the problem is that, the old role from the previous position doesn't want to go away after the comparison.

We are running the PFUD only with our own customer specific roles.

Previous position is a managerial position, so it has a manager-composite role attached to the position.

New position is just a normal staff, there is no indirect role assignment there.

Therefore, by running PFUD, the user should get the old Manager-composite role removed since he is no longer a manager.

But that doesn't work as I've mentioned.

[Former Member]

Hi Theoz,

I think of the following reasons for seeing the composite role still in the User Master record in SU01:

Has the composite role directly assigned to the user through SU01/PFCG and bypassing the Position based security.

If the color of the technical name of the role in SU01 is blue then it is indirectly assigned through HR Position based security.

If the color of the technical name of the role in SU01 is black then it is directly assigned through Role based security via SU01/PFCG

Hope this helps.

Regards,

Kiran Kandepalli

[Former Member]

Hi Kiran

We have the composite roles highlighted in blue under the user master record in SU01, so these are indirect role assignment.

Cheers

[Former Member]

>

> Can anyone shed some light regarding the following scenario:
> 
> We have a user previously assigned to a managerial position and this position is attached to a MSS-composite role in PO13 (thorugh the AG relationship). Now this user has been delimited from that managerial position, and is now assigned to a new position as a normal staff, so he shouldn't have the MSS-composite role anymore. We updated the run in PFUD with HR Org-assignment reconcilation, but we still find the Composite role for Managers in his user master record in SU01.
> 
> What might be wrong?

Theoz,

You are missing a step before you run PFUD. You need to run RHPROFL0 with the affected position number then PFUD.

Items to check for before running RHPROFL0:

PA Records info for the User

==================

1. Was the HR check pointer on when the position was delimited?

2. Is the position truly delimited

3. Does the IT105/ST0001 match the person's user ID

4. How many position does this person hold in the PA record

5. Check if the new position have the correct roles for this person, it might actually have the MSS composite role you are trying to remove access from the user.

Good Luck!

[Former Member]

> Items to check for before running RHPROFL0:

> PA Records info for the User

> ==================

> 1. Was the HR check pointer on when the position was delimited?

> 2. Is the position truly delimited

> 3. Does the IT105/ST0001 match the person's user ID

> 4. How many position does this person hold in the PA record

> 5. Check if the new position have the correct roles for this person, it might actually have the MSS composite role you are trying to remove access from the user.

Hi John, thanks for your response to this thread.

We have not scheduled RHPROFL0 to run. Correct me if I'm wrong, isn't this is only needed when PD-profile is used? We are not assigning structural profile though PD-profile in PO13, we do it manuall instead in OOSB. Besides, I am not able to run that program anyway, because we have the CUA set to Global, and no indirect role asssignment is possible. We can only do the comparison via the HR-org assignment reconciliation in PFUD. Can this be the main reason somehow?

I also found out that our PRGN_CUST has no entries in it: HR_ORG_ACTIVE is not on. <<--- Does this only need to be switch-on if our CUA is set Local? Do I need this?

Then, my answers below to your questions:

1. Do you mean the "pink-arrow-up" icon from the old position? Then the answer is yes.

2. Then position itself it not delimited, only the user assignment is. In PPOSE, it shows that the person is assigned to this old position from 01.04.2007 until 31.01.2008. So I guess in that sense, it tells that the position is truly delimited.

3. Yes

4. In PA records I can see many records under different validity dates, but they are all records of the new position. The earliest record (the one at the end of the list) was a record attached to a default position and without any organization assignment. Then, in PA > List Organizational Assignment screen, there is a system message that says "Employee has more than one position". --> Does this refer to the non-listed old position? or default position + new position in PA record?

5. No. The new position is just an ordinary employee without any indirect role assigment.

We also tried to remove the MSS-composite role from the old position in PO13, but it doesn't make any difference to the user master record in SU01.

For your reference as well, this is how our US_ACTGR looks like:

40 > AG > A > 007 > S

50 > AG > A > 007 > US

60 > AG > A > 007 > P

70 > P > B > 208 > US

110 > S > A > 008 > *

Hope this information tells something.

I appreciate your time and many thanks in advance for your help!

[Former Member]

Theoz,

Since you have CUA do this first. Run SE16->AGR_USERS, enter the user ID and see if the role you are wanting to remove is assigned.

Report back and we can proceed with the next step.

[Former Member]

Hi John

I did what you said by calling up the user in AGR_USERS, and the answer is yes, the MSS-composite is still there.

The Composite was marked with X under "HR Org Mgt", and the 3 single roles that come with this MSS-composite were marked with "Assgmt Comes From Composite Roles".

Once again I appreciate your help!

[Former Member]

>

> Hi John
> 
> I did what you said by calling up the user in AGR_USERS, and the answer is yes, the MSS-composite is still there.
> 
> The Composite was marked with X under "HR Org Mgt", and the 3 single roles that come with this MSS-composite were marked with "Assgmt Comes From Composite Roles".
> 
> Once again I appreciate your help!

In that case you have to run RHPROFL0 (only for the position numbers affected) and yes, it can be run with CUA.

Technical details:

1. Run SE16->PA0001, enter the PERNR for the user, select PLAN/Position. Copy the position number report output.

2. SCUM->Roles->Role Assignment->Local

3. SE38->RHPROFLO, enter S for "Object Type", enter the position numbers from step 1 for "Object ID"

4. Select "Test sesion" and Execute. The test output will give you an idea if it removes the MSS composite role. If the test output is desirable execute without test.

5. SCUM->Roles->Role Assignment->Global

6. PFUD affected role/roles (Do NOT run PFUD if the SCUM setting is Local, it will compound your problem).

Regards,

-John N.

[Former Member]

Hi John

Thank you so much for the instructions! Unfortunately I am currently on business trip and I won't have access to the system until tomorrow afternoon. I definitely will check this and let you know how it goes!

I will get back to you soon. Thank you, once again!

[Former Member]

Hi John

Hope you're still with me. Sorry for the late response though, I didn't managed to get to do this until late today and I did what you said, but it didn't bring any output upon execution in Step 4. The output screen was totally empty, thus no changes were made.

But then we tried something different by going to PFCG:

- Enter the MSS-composite

- Select User tab > Organizational Management

- On the Role:Change Agent Assignment screen > we select the affected user, and manually delete the assignment from there and it worked!

Does this have something to do with the period of valitidy or some sort?

I asked because, in the old position of which this user was previously assigned was actually a superior-position and it had the relationship AG B 007 linked to it. But for some unknown reason, this specific relationship disappeared from PO13 and the indirect role assignment was not removable from the user in SU01 until we used the above mentioned delete-assignment option via PFCG.

How would anyone explain this?

[Former Member]

>

> Does this have something to do with the period of valitidy or some sort?

Yes, the validity periods a crucial. Just like step 4 the key date is important. RHOPROFLO is a batch job we run every night to align the positions to roles to users assignment. If RHOPROFLO does not run for 1 day it won't delimit or reassign/remove roles to users for that specific date, you have to go back a day on your key date and rerun. I have a lot of user movement on our area so this is a key to our task.

The manual deletion in PFCG can also be done but is difficult to automate, that would have been my next suggestion.

I'm glad you are back on track.

Regards,

-John N.

[Former Member]

Thanks John

Thing are pretty clear now. But one more about the CUA, do you guys have the role assignment set to Local all the time? Ours is set to global, and if I changed that, then the role assignment will show an empty list in the SU01 master record. Can we make RHPROFLO to run and still having the global setting at the same time?

[Former Member]

>

> Thanks John
> 
> Thing are pretty clear now. But one more about the CUA, do you guys have the role assignment set to Local all the time? Ours is set to global, and if I changed that, then the role assignment will show an empty list in the SU01 master record. 

It is always set to Global Roles in SCUM. The only time it is set to Local is during our automated batch process. The batch job first sets scum to local, run rhproflo, set scum back to global then run pfud.

>

No, RHPROFLO will not run with SCUM Global enabled.

[Former Member]

Thanks John!