Updated org values in roles missing after re-transport

[Former Member]

Hej

sometimes after re-transporting already existing authorization roles with updated organisational values, the updated values are missing in the target system.

The transported role looks fine in PFCG, but when looking at the profile, the values are missing.

When re-generating the role, the missing values returns.

Sometimes these transports are imported with with RC=4, but the problems seems to occur even with RC=0.

Does anyone have a clue why this happens?

[Former Member]

Hi,

Once request released in SE09/SE10 , updated organisational values within same role have to be transported with new request.So create new request for updated organisational values and transport.After transporting do the user comparison on particular tole.

Rgds,

Gadde.

[Former Member]

So how do I transport the org values separately from the authorization roles?

The org values are part of the roles, so how can they be transported separately

[jurjen_heeck]

I guess he means you have to enter your roles into new transports.

[Former Member]

Hi,

Yes, i mean when u made changes to exiting / new roles(either org. vales or any thing) u have to create new request for transport wihin ur lanscape.Organisations values individually cannot be transported .

Rgds,

Gadde.

[Former Member]

Hi

I'm not sure I understand your anwer, but let me explain our transport routine:

1. Roles are modified with new org values (such as new plant, company code etc) in the development environment

2. Transport request is created with these roles

3. Roles are transported to test environment.

4. In the test environment, the new organisational values are missing in the transported role.

5. Re-generation of the roles in test regains the missing values.

[jurjen_heeck]

> 5. Re-generation of the roles in test regains the missing values.

Looks as if you're transporting the roles but not the generated profiles.

[Former Member]

When I transport the roles, I do so through "Mass transport of roles"

I fill in the opions below:

"Also transport the generated profiles of the single roles"

So I do transport the profiles aswell!

Also, the profiles seems to be transported since when I generate the role, the missing values appear!

[jurjen_heeck]

Hang on, there may be something with customizing settings as well. I'll get back on this one.

Found it:

Have a look at the value for

PROFILE_TRANSPORT

YES (default), NO - when transporting roles, transport generated profiles as well (notes 571276, 568178, 727085)

This is to be found in table PRGN_CUST

Edited by: Jurjen Heeck on Mar 5, 2009 11:20 AM

[Former Member]

Hi, thanks for the answer, but isn't these notes related to when profiles has not been transported?

In my case, the profiles are infact transported since they re-occur in the target system when re-generating the role. If the profiles were not transported, the values wouldn't be regained after a re-generation

[jurjen_heeck]

> In my case, the profiles are infact transported since they re-occur in the target system when re-generating the role. If the profiles were not transported, the values wouldn't be regained after a re-generation.

This can also be done based on information in the roles as far as I know. How else would you initially generate a profile when building a role.....

[Former Member]

How do you mean?

When I in the development machine enter the new organisational values in a role, ofcourse I generate it and check that the profile is generated with the new values. So far so good. But after transport to the target system, only the old organisational values values are shown in the profile.

After regenerating the role in the target system, the new values are regained.

This indicates that the profile with the new organisational values are in fact transported.

[jurjen_heeck]

I'm lost at the moment. I also think this discussion is not adding a lot In pfcg all visible information comes from the role (AGR* tables) not from the profile. So I'm now wondering what is transported and what isn't. Obviuosly all neccesary information does reach the target system.

Maybe this system is supposed to automatically regenerate profiles at the time of import.

[Former Member]

Yes, at this point, I'm not getting any wiser =)¨

To add to the cofusion, the updated organisational values are actually present in the role in PFCG in the target system. But the role doesn't fuction properly, and does not give access to the updated org. values that is shown in "Organisational levels".

So I discovered that when looking at the profile by SUIM/Profiles/By role, the values was missing in the profile. So after re-generation, the role was working properly.

[Former Member]

Here is what I understand -

You modified the existing role in dev.

You generated the profile.

You transported it.

It reached quality/test system

Here you find some values missing. - is the authorization tab green here ..or is it yellow/red ?

Now you regenerate it in quality system and everything looks okay - did you verify it by comparing the role in dev and in test..are the authorizations are exactly matching now ?

Also when u generate it in test system are you giving the same profile name as you had in dev or you generate a new one ?

I maybe making a wild guess here ..but is it possible that your role is reaching some kind of maximum # of authorizations in a role and hence deleting the old authorizations for the new one.

[Former Member]

Here is my answers in Bold:

You modified the existing role in dev - Yes

You generated the profile - Yes

You transported it - Yes

It reached quality/test system

Here you find some values missing. - is the authorization tab green here ..or is it yellow/red ?

The authorization tab is green

Now you regenerate it in quality system and everything looks okay - did you verify it by comparing the role in dev and in test..are the authorizations are exactly matching now ?

Yes, after regeneration, the profiles and roles match

Also when u generate it in test system are you giving the same profile name as you had in dev or you generate a new one ? Yes, it's the same profile name

I maybe making a wild guess here ..but is it possible that your role is reaching some kind of maximum # of authorizations in a role and hence deleting the old authorizations for the new one?

This is a possibility that I have concidered, but it also seems to happen with just a few amount or roles aswell. Also I have considered it it has something to do with Unicode (our dev system is Unicode, but not all our test systems) but it seems to occur regardless if the target system is in unicode or not

[Former Member]

Hi,

Is pfcg_time_dependency report running every day in the quality system. Make sure that this job runs every day, this issue may be resolved.

Regards,

Gowrinadh

[jurjen_heeck]

> Is pfcg_time_dependency report running every day in the quality system.

I'm sorry but this is a completely irrelevant answer. User comparison is not the issue here. Profile generation and/or transport is.

[Former Member]

Hello Ulrika,

Not sure why this happening.

Can you please confirm if you are using Re-organize after entring the Org lvl values and when you check for same in Dev box in AGR_1252, are they appearing.

Regards,

Surpreet

[Former Member]

I have not always used the re-organize function, but I will definetly investigate if this has some impact.

Thank's, I''ll be back!