Mass generation of Derived Roles

[former_member759680]

Hello,

SUPC helps me in Mass generation of Master Roles. But how do I generate Derived roles in a lot?

Thanks.

[jurjen_heeck]

The fastest way I've found was to go into each parent and generate the derived roles from there. This can be automated with SECATT.

[Former Member]

Yes,The best way is to go into each master role and then going into the change authorizations:

Authorizations Tab->Adjust Derived ->Generate Derived Roles

[jurjen_heeck]

Which is different from my comment in which way?

[former_member759680]

So, nothing new there..... eCATT it is then.

[jens_hoetger]

Hello,

we also missed this function when we started using derivation of roles. I developed some years ago a program which does this, also possible to start it in background mode. It runs daily (in front of PFCG_TIME_DEPENDENCY) and adjust derived roles from updated parent roles (which came into the system via transport request).

Because I developed the program in my working time it's owned by my company, therefore I can not post the source. Just a few hints:

- parent roles and derived roles: you will find them in table AGR_DEFINE

- roles imported into the system: with function module TMS_TM_GET_TRLIST you can get yesterday's imported transport requests, you can read the object list with function module TMS_WBO_READ_REQUEST (those with R3TR ACGR have roles in it).

- build up an internal table of parent roles (consider the derivation level: first process the top level role, then it's derived roles, and then their derived roles and so on).

- use function module SUPRN_TRANSFER_AUTH_DATA for adjusting the derived roles of a parent role.

HTH and kind regards

Jens Hoetger