Comparison Required for the large role with multiple profiles

[Former Member]

Hello,

We are small SAP team of only several people. I have created a large functional role for our functional person. Everything was fine for a while, but now whenever I need to add/remove code from the role and push it over to production I get an unusable role (in red) and some type of "Comparison Required" message. I am not sure how to do this Comparison so I have to remove this role (and underlying profiles) from user than add it again to the user's profile. This fixes the issue of an unusable role, but raises auditing questions.

I tried to address the issue via transaction SUC but it seems I am not using it properly. Please, advise.

Thanks in advance

Galina

[Former Member · Accepted solution]

Hi Galina,

You said you push the change in production system, Could you please explain me how you push it?

Do you create a transport request with the changed role and do you include the corresponding profile too?

Thanks.

[Former Member · Accepted solution]

Hello, Adrian

Yes, I create a transport with the changed role. but I am not sure what it means "and include profile too". where does it explicitely asks me to include or not ot include a profile?

Thanks

Galina

[Former Member · Accepted solution]

In transaction PFCG type in the name of role that you want to transport than click on the little truck (CtrlShiftF9) and than in the next window check the box "Also transport Generated Profiles for Single Roles" like this you will transport the generated profile too and it should be fine in production system when you are importing the transport request.

Thanks.

[Former Member · Accepted solution]

Hi, Adrian

I see what you are saying. We have this box checked by default. So, this would not be a reason, I think.

Thanks

Galina

[Former Member · Accepted solution]

Adrian,

This is large role, and it has multiple profiles generated behind it, like:

T-D8730080 Profile for role Z_BBN_FUNCTIONAL_ROLE

T-D87300801 Profile for role Z_BBN_FUNCTIONAL_ROLE

T-D87300802 Profile for role Z_BBN_FUNCTIONAL_ROLE

T-D87300803 Profile for role Z_BBN_FUNCTIONAL_ROLE

In PFCG it shows only the first profile....

Profile Name T-D8730080

Profile Text Profile for role Z_BBN_FUNCTIONAL_RO

Status Authorization profile is generated

I thought that issue could be that as a result of the changes and moving role over there was some discrepancy in the size/number of these multiple profiles. I could not find any relevant info to figure out how to avoid this problem.

Thanks

Galina

[Former Member · Accepted solution]

I understand, than check in the transport request where you included the role and profiles to see if you have all the profiles inside.

You can see them in SE01 (Display Tab), fill in the transport request number, click on DISPLAY button, than expand to Customizing: Table contents -> SUSPR -> USR10 -> you should see here something like this:

XXXT-D8730080 A

XXXT-D87300801 A

XXXT-D87300802 A

XXXT-D87300803 A

Where XXX stands for client number (Example 300)

If you see all of those profiles inside of you transport request than you are sure you'll transport your entire profile for your role.

Thanks.

Adrian

[former_member308058 · Accepted solution]

Please do a User Comparison... or run PFUD..

[Former Member · Accepted solution]

Hello, Adrian

Yes, I see profiles. I think profiles get transported fine. Because after I remove role and profiles from the user and then assign the role back again, everything is working. The problem is auditors object to an unexplained change to the user setup. And it is hard to explain by saying that it stopped working after the role transport and required such manipulations.

thanks

Galina

[Former Member · Accepted solution]

Akhilesh,

thanks a lot for your reply. Yes, the problem could be in the user master data. However, at this point I see that user comparison is in red, but nevertheless, role is working fine after I removed it fro mthe user and then reinstated it back into the user's account. I wonder what makes these discrepancies to appear. I have never did this user comparison before so it is opening a whole new lack of knowledge area for me. Does it make sense to do it as a periodic background job/

Thanks

Galina

[Former Member · Accepted solution]

Yes you should schedule it at least once a day, in my systems it's running around midnight.

Use transaction PFUD or schedule a background job with one of this reports:

PFCG_TIME_DEPENDENCY (this is the old report)

RHAUTUPD_NEW (this is the new version of report) <- I'm using this in R/3 4.7 and Netweaver 7.0

Short text

User Master Data Reconciliation

Description

This report runs the user master comparison for roles you have selected. For single roles you can also start the user master comparison in transaction PFCG.

You can either execute it with the single processing types in dialog mode or schedule it as a complete reconciliation in the background.

To run only specific processing types in the background, schedule a variant of program RHAUTUPD_NEW.

You can choose the following processing types:

Profile Comparison

/>: Start the profile comparison directly after the profiles have been generated or imported. Provided you are using time-dependent role assignments, we recommend you schedule daily background jobs. The authorization profiles will then be reconciled with the user master data. Profiles no longer current will be deleted from the user master records and the current profiles will be entered.

Composite Role Comparison : Start the composite role comparison, if you want to make changes to a composite role definition (that is, add to or delete single roles from a composite role) or if you want to import a change. Single role assignments will then be reconciled with the composite role assignments for the user. If you want to include single roles in the composite role, the single roles are assigned to those users who are assigned to the composite role. Conversely, the single roles assigned to users are deleted, if the single role is removed from the composite role.

HR Comparison : Start the HR comparison, if you want to make changes to the HR Org Model, which affect the indirect role assignment. You can only select this processing type, if HR Org is active. The switch HR_ORG_ACTIVE in table PRGN_CUST must be set to YES.

Cleanups: Carry out a cleanup, if you want to generate or import profiles. Generated profiles that do not have any roles are deleted.

Further options:

Issuing error messages: In dialog mode all error mesasges are displayed on the screen.

Replicating local HR assignments centrally (You can only select this option, if this client is an active child system of a CUA group and HR org. Role assignments in the child system that have arisen from links in the local HR Org model are replicated for information in the central system

Thanks,

Adrian

[Former Member · Accepted solution]

Adrian,

I appreciate your help.

Galina

[Former Member]

Hi Galina,

You are missing the profile generation in the Role. Maku sure that you genereate the role when you add/minus a tcode from the role in PFCG transaction.

When you go to Change Authorizaton data, there will be a round symbol in the top to generate the role.

You must also do the User Comparison for the role in PFCG transaction, so that the change reflects to all users assigned to the role.

You can also acheive the User Comparison by scheduling a background job for PFUD transaction every day.

Hope this helps,

Regards,

Kiran Kandepalli.

[Former Member]

Hello, Kiran

Thanks you for your reply. I never forget to generate profiles. There is something else which makes this Comparison appear....

Thanks

Galina