Mass Role Maintainence

[Former Member]

Hi Experts,

Need your advise.Is there any way in SAP, thru which we can perform mass changes in 200 roles at once.I need to make some changes in an objects .The object has presence in more than 200 roles and doing changes one by one is very tough task,please let me know any way thru which i can save time and do changes perfectly.

Regards,

Mukesh

[Former Member]

Hi

You can check as per your requirements in PFCg -> Utilities -> Mass generation.

Hope this will help you out

Thx

Shilpa

[jurjen_heeck]

This topic has been covered several times and there is no simple way to do mass maintenance with SAP standard tools.

For 200 roles searching for automation is not worth the trouble in my opinion. Once experienced a pace of 50 roles/hour is within reach so the manual job can be done in about 4 hours.

[Former Member]

Hi Jurjen,

I was trying to confirm that again.You rightly said, i think i need to perform those changes manually.

I thought if their would have any solution for my question !

Thanks for your clarification, i like doing hard work

Mukesh

[jurjen_heeck]

> I thought if their would have any solution for my question !

No easy ones. The best advise I have is to memorize all keyboard shortcuts for PFCG so you can use the mouse as little as possible.

paste role name

enter

tab

right-arrow

right-arrow

enter

tab

tab

tab

tab

tab

enter

enter

ctrl-f

paste object name

tab

tab

enter

change field values

shift-F5

F3

[Former Member]

As others have already stated, there is no mass change capability for roles. However, there are some options that can help but it really depends on the type of change that you are making.

If you are attempting to add authorizations associated with a particular transaction, you can populate the change in SU24 have have it propagate the new values for you. Just be careful that the values you put in SU24 are appropriate for all roles containing this transaction. You will still have to go through the manual process of re-reading the authorizations for each role and then regenerating it, but this may save you some typing. Even then, if there are no further values to populate in each role then you can consider a CATT script for the steps above. A CATT won't be good for making any changes inside a role, but it can be used to tell PFCG to re-read the authorizations and then regenerate.

Another option is to consider the use of derived roles. If you're not already using them, then this will be of no immediate help but if your role design fits then these are very helpful. Derived roles are a huge time saver if all that is different between roles is organizational-level values. Changes to org-level values in derived roles are still manual and time consuming, but any non org-level field that is changed in the parent will be propaged to all the derived roles and generated.

Good luck.

[sdipanjan]

Hi Mukesh,

The simple and Single answer to your queson us NO.

Also for your information, Catt tool can be used for Text description changes but NOT for authorization maintenance. For example, if you have made changes in some objects and they present with "Maintained" and "Changed" status, then you will surely want to take precautions while (mapping Customer Tables) entering into the authorization tab with. So, we should not think of CATT here.

The way that can be followed is already discussed by all above. Manual maintenance.

The generation of profiles for mass roles can be done... TCode: SUPC

Regards,

Dipanjan

[Former Member]

> The object has presence in more than 200 roles and doing changes one by one is very tough task,please let me know any way thru which i can save time and do changes perfectly.

If this object is a standard or maintained authorization in the 200 roles and you know exactly which transaction (or a handfull of them) this authorization is coming from, then there is a way to do it by changing SU24 once only, then triggering the PFCG "read new and merge old" function and generate the profiles (SUPC).

Likewise, if your roles are all on yellow and the object is in a mix of changed and manually authorizations and clubbed into composites, then they are mucked already and you might as well do a mass change to the authorization data itself using an LSMW or little ABAP program which calls the function in PFCG which does the same.

But, as you have more than 200 functionally different roles with the same object in them, the 2nd case is more likely and the 4 hours manual work is probably faster than writting the program and testing it.

At least 4 hours of click & save is stress-free...

Cheers,

Julius

[Former Member]

Hi Experts,

I have done the changes Manually yesterday.However, i have got some alternate ways too,which could be very meaningful while performing mass changes of roles.I will try LSMW or ABAP way to get thru.

Let see how reliable are these ways

Thank You All and Have a Nice Day

Mukesh

[Former Member]

Hi Mukesh ,

If it is the same changes that you are going to do for all the 200 roles then you can use SECATT scripts to maintain the changes. If changes are not the same to all the roles then you need to make changes manually no other way.

Also remember even if you use secatt to make the chnages at time to all the roles you need to generate each and every role manually.secatt scripts will not generate profiles.

Also make sure that client settings of your development system should have " catt and ecatt allowed " option allowed else you will not be able to run the catt scripts.

Regards

Kanti

[jurjen_heeck]

> If it is the same changes that you are going to do for all the 200 roles then you can use SECATT scripts to maintain the changes. If changes are not the same to all the roles then you need to make changes manually no other way.

Basically changes to field values will differ for roles so SECATT is hardly ever usable for this. If it were, I surely would have mentioned it in my earlier post.

> Also remember even if you use secatt to make the chnages at time to all the roles you need to generate each and every role manually.secatt scripts will not generate profiles.

Manually? What happened to SUPC?

Why can not you not generate profiles with SECATT? I use it frequently to re-generate/adjust child profiles from parent roles.

[Former Member]

Jurjen

just curious why do you use SECATT for adjusting derived roles?

do you have problems with the standard functionality in PFCG for that?

[jurjen_heeck]

> just curious why do you use SECATT for adjusting derived roles?

> do you have problems with the standard functionality in PFCG for that?

Am I missing something? Where do we mass adjust? Not with SUPC...

Please make me look stupid

[Former Member]

I mean the derived upgrade function in PFCG, when you are in the master role??

or do you do this differenly??

[jurjen_heeck]

> I mean the derived upgrade function in PFCG, when you are in the master role??

> or do you do this differenly??

No, no, that's the button I hit with ecatt if there are more than 20 parents to handle

Once did a mass download-upload and found out I had to re-adjust all children of 100+ parents......

[Former Member]

Jurjen

nice to know untill now had never had a problem with that button, but i will keep this in mind!

[Former Member]

We can do mass maintenance of roles through Tcode: SUPC

Roles with Non Current profiles

Roles to be compared

Roles with no authorization data

All roles

Roles with current Profiles for new generation

There is addittional selection: Additional restrictions where we can enter no of roles at time

in Multiple selection button .

warmregards

Vikas

[Former Member]

Hi Vikas ,

Please be noted that SUPC tranaction code is for mass generation of profiles only not for maa maintainence of roles.

Regards

Kanti

[Former Member]

Hi Kanti

First , we can do MASS ROLE MAINTENANCE thorugh SUPCI want to clear to you ,If roles which dont have generated profiles and we want to generate profiles for that roles .Then we can put that roles and generate mass roles and ultimaitely y thats known as Mainteance .We did mass role mainteance here nothing more than that .

Secondly , Can i know what actually you want to do ?Means what maintenance you are seeking to do .?

Regards

Vikas

[Former Member]

Vikas ,

I wonder how you do mass maintainence thro' SUPC ? where as functionality provided by SAP for this t-code is mass generation only ....

[jurjen_heeck]

> Means what maintenance you are seeking to do .?

The thread started out with a question about mass changing object field values. This was the kind of maintenance I was talking about earlier on.

Generating profiles is a part of maintenance, true, but this wasn't the case/question here. That's why SUPC does not serve any purpose here.