Upload Roles into RAR 5.3

[yudittzruya]

Hi All,

for initial data synchronization, we want to upload only some of roles (we don't want to upload roles there are old and not in use). is there a way to upload only some of the back-end system data ?

Thanks

Yudit

[Former Member · Accepted solution]

Hello Yudit,

There r 2 ways 2 do dis:

1.OPTION 1:To import roles:

On the Configuration tab, navigate to Roles > Import Roles.

The Import Roles screen appears.

a. From the System dropdown list, select the system that contains the roles you want to

import.

b. From the Role Source dropdown list, select either the SAP back end or Enterprise Role

Management.

c. In the Last Sync Date field, select a date.

All roles that have been changed since the specified date are selected for import.

d. Select the setting in which to import your roles which is --> Import "SELECTED ROLES" roles from an SAP business system.

Now for this option in your scenario, you need to either enter each of the role names you want selectively or you have the option to use wildcards.

OPTION 2: USING ROLE TEMPLETE SPREADSHEET:

To import selected roles, you can download a spreadsheet template to your local system. After

downloading the spreadsheet, populate the fields with your own roles, and then import the

information. You can find the template details in the section - Role Import/Export Template Details in the Cofig guide for the tool.

Regards,

Hersh.

[http://www.linkedin.com/in/hersh13|http://www.linkedin.com/in/hersh13]

Edited by: HERSH GUPTA on Jan 29, 2009 4:30 PM

[yudittzruya · Accepted solution]

Hi Hersh,

Thanks for the quick and detailed response.

i believe your answer is in regards to the CUP component...

What are the possibilities in the RAR ?

thanks

yudit

[koehntopp · Accepted solution]

Yudit,

is your question in regard to management reports or synchronisation in general?

Generally, the synchronisation backend job will only download a list of available role names into RAR, not any of their content.

The background risk analysis will then work on that list and analyse the roles - this is where you can filter what to analyse.

So you can sync anything, and then filter during analysis.

Frank.

[yudittzruya · Accepted solution]

Hi Frank,

my question was in regarding the general sync.

i want to avoid having a long list of un relevant roles in every selection box...

i know that we can filter every action and report but it's realy making life harder...

thanks

yudit

[Former Member]

Hi Yudit,

If you have RAR 5.3 installed, what Suppport Package level do you have in place?

Because in SP 5 you can use the exclusion function to exclude users, user groups, roles, and profiles from the batch risk analysis. This means that the data reflected in managenent reports will no contain those users, user groups, roles, and profiles excluded, which is what I think you are trying to do, am I correct?

Take a look at the pdf document contained in note 1282351 "Access Control 5.3 Support Package 05 Supplemental Note" to find more details about this feature.

Regards,

Pablo

[yudittzruya]

Thanks Pablo,

i saw this document and indeed we have this option in the batch risk analysis but not in the inital upload.

Thanks

Yudit

[Former Member]

Hello Yudit,

This is not possible.

When SYNC jobs runs, you don't have option to select RANGE of ROLES.

You have this option while doing BATCH risk analysis.

There is one work around for this. Delete the unwanted roles from table

virsa_cc_genobj, once sync have completed, for given VSYSKEY.

Regards,

Surpreet Singh Bal

[Former Member]

Dear Yudit,

Sorry for my earlier post - misinterpreted it for CUP. Well, as Surpreet has said for deleteing the roles already uploaded in RAR the only method is to delete them from the tables itself. This is because in RAR you only have the option to either do a full sync or an incremental sync for getting the roles into RAR tables. For removing them, no such provision is there.

However, what I would suggest you is that you should avoid deleting them from the table yourself and raise a message to SAP asking for the script to do the same for you. This is what is recommended and will save your time too.

Regards,

Hersh.

http://www.linkedin.com/in/hersh13

[yudittzruya]

Hi Hersh,

Thanks,

i'll try to get the script from SAP

Thanks

Yudit

[Former Member]

You are most welcome Yudit. Please let us know too when this is done and whether this was the only way out of it or there are alternatives too, based on your talks with the support team . This is a very common problem faced by many of us.

Regards,

Hersh.

http://www.linkedin.com/in/hersh13