No provisioning of User Group for authorization field in user master

[s_pados]

We are implementing CUP 5.3 workflows. Both in manual proviosing and automated provisioning based on User Defaults the user group gets only provisioned to the Groups tab in SU01. The field User Group for authorization on the Logon data tab remains empty (field CLASS from system table USLOGOND, filling CLASS field in table USR02).

In User defaults both under user default as on the user group tab the user groups have been defined. In manual provisioning the correct list of user groups get displayed for selection.

Under field mapping in the Application field I only find User Group in user master maintenance, but not User group for authorization. However I would assume I do not need to use field mapping, as I want to automate this provisioning based on user defaults.

Am I missing a configuration setting here? If so, where can I set it?

I would assume the provisioning of this field is possible. RAR reports the user group also based on the User group for auhtorization and not from the Groups tab.

[s_pados]

Anyone?

Basicly I would already be happy if someone can confirm if CUP is capable to provision the User Group for authorization field in SU01 on the Logon data tab.

A simple YES CUP can provision, or NO not possible will do.

[koehntopp]

YES CUP can provision

Want to know how?

Frank.

[s_pados]

Hi Frank,

Thanks. That is what is expected as well.

And yes I would like where to configure that as currently only under the groups tab it gets perovisoned and not on the logon tab.

[Former Member]

Hi

Here are the steps in CUP -->config ;

1. You can do this in the the User Defaults -> User Defaults section where there is a User Group field (drop down) which corresponds to the Logon data - user group in SU01.

2. Create user default mappings using the attributes you require to determine the right user default (New Request, location, department, etc.)

Note:

You'll have to create new user defaults and mappings for each user group you have.

Thanks

Kee

[s_pados]

Thanks Kee for you reply. However that is exactly what I already had configured. And in that way it only provisions the user group on the groups tab.

I must note however that we have made the user group field on the logon tab in SU01 mandatory, but the tabel and fields it refers to in the technical info are still SAP standard. So I would expect that it should not matter in this case as CUP will enter an existing value when provisioning.

[Former Member]

Hi,

I am running AE 5.2 and recently needed to provision the Logon Data Group field also on our NEW and CHANGE request

I created a CUSTOM FIELD called Logon Data Group; FIELD NAME of Logon Data User Group

The Data Source value is SAP

The Source System is SAPPRD300 (our sid name)

Table Name is USGRP

Field Name is USERGROUP

Under Provisioning>Field mapping I define the following values:

For AE FIELD: Logon Data User Group

For matching Application Field: Group In User Master Maintenance

On the Request under Additional Informnation or Custom Information depending on the login I am able to select from a dropdown based on the SAP entries in the table USGRP; this entry is provisioned to the field on the Logon Data tab; I also made this custom field a required field so that it is entered for NEW and CHANGE request

Hope this helps a bit

Jerry Synoga

Ryerson,Inc

[s_pados]

Jerry,

That is what we tried as well but it will only provision to the user group field on the SU01 Groups tab.

For your environment this scenario can work, however we intend to provision to dozens of systems. For each system we would then need to add a custom field. What we also found is that even if we made this custom field mantatory, if the requestor does not open the additional section where the custom field is located then he/she will be able to save the request without having to fill in that mandatory field.

Next the that the access requestors are not knowledgeable what user group to select and therefore we want to work with user defaults so that based on the input on the request the right user group is automatically selected.

Until know however AE/CUP only provisions to the Groups tab and not the logon tab.

Think we will open a message for this so SAP can examine our issue.

[Former Member]

S.Pados,

I can assure you that what I said in my last response does provision the User Group For Authorization Check on the Logon Data tab; in fact, I was having the opposite issue where the Group tab was not being provisioned; however, I am ruunning AE 5.2 and you said you are running 5.3; maybe something did change or got lost in the releases; it probably is good to see what SAP has to say about this; I would hate to lose this capapbility when I upgrade to AE 5.3

As far as using the custom field for multiple applications, would that field not be usable for any of the applications you would select in the request form?; if you are using the same table names in the different SAP systems (selectable by the application field on the request) would the drop down selections be whatever the table has defined for that system? I may not be understanding something here so I am just asking;

It would be great to have a Group field automatically filled in by another selection to avoid the user involvement; I agree with you there; because of our concerns on users entering the AE request, our shop has decided to continue with the users submitting the request through normal email and the security administrators perform the AE entering; this way we have a better idea on something like the GROUP field; we have an option to include the original email as an attachment for justification of the request

Sorry I could not be of more help

Jerry

Ryerson,Inc.

[s_pados]

Found issue ourselves. Due to active custom fields for user group on the request form, and field mapping from AC custom field to application user group field, it most likely conflicted for the user group for authorization field. Deactivated field mapping provisioning and now field gets provisioned. Still strange it worked correctly for user group field on Groups tab in SU01.