ERM 5.3: Role Generation to Backend

[Former Member]

Hi GRC experts,

I have setup the landscape in ERM 5.3 and associated the actions to the configured systems:

Role risk analysis is assigned to QA1 connector

Role generation is assigned to DEV connector

However, when generating role as a background job, the risk analysis has been performed successfully, but, error is coming for role generation:

Error generating role for system Q01: Function template /VIRSA/RE_BAPI_CREATE_ROLE could not be retrieved from Q01.

It seems that it is attempting to generate role in Q01 and this should not be the case as it is against the change management procedures. Also, I have assigned DEV connector to role generation.

Is this an error due to SP07?

Appreciate any feedbacks.

Thanks & regards,

Debbie

[Former Member]

Debbie,

This is a strange error. It should not look for CREATE ROLE BAPI in QA1. On the side note, do you have necessary RTA installed on QA1. Real time agents (RTA) are required on QA1 and DEV both. Can you paste error logs here?

Regards,

Alpesh

[Former Member]

Hi all,

Here's the error log:

2009-04-23 10:29:43,360 [SAPEngine_Application_Thread[impl:3]_21] ERROR Requested navigation control not found

java.lang.Throwable: Action not found - getchart

at com.virsa.framework.ScreenDefn.getActionDefn(ScreenDefn.java:62)

at com.virsa.framework.NavigationEngine.execute(NavigationEngine.java:125)

at com.virsa.framework.servlet.VFrameworkServlet.service(VFrameworkServlet.java:230)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)

at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.runServlet(FilterChainImpl.java:117)

at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.doFilter(FilterChainImpl.java:62)

at com.virsa.comp.history.filter.HistoryFilter.doFilter(HistoryFilter.java:43)

at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.doFilter(FilterChainImpl.java:58)

at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:384)

at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)

at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)

at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)

at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)

at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)

at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)

at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)

at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)

at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)

at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)

at java.security.AccessController.doPrivileged(AccessController.java:219)

at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:102)

at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:172)

2009-04-23 10:30:40,164 [Thread-315] ERROR Function template /VIRSA/RE_BAPI_CREATE_ROLEcould not be retrieved from Q01

java.lang.Throwable: Function template /VIRSA/RE_BAPI_CREATE_ROLEcould not be retrieved from Q01

at com.virsa.service.sap.SAPConnectorHelper.getFunctionTemplate(SAPConnectorHelper.java:347)

at com.virsa.service.sap.BaseSAPDAO.getFunctionTemplate(BaseSAPDAO.java:54)

at com.virsa.re.service.sap.dao.GenerateRoleDAO.generateRole(GenerateRoleDAO.java:435)

at com.virsa.re.bo.impl.GenerateRoleBO.generateRoleAsBackGroundOnMultipleSystems(GenerateRoleBO.java:505)

at com.virsa.re.backgroundjobs.RiskAnalysisAndRoleGeneration.execute(RiskAnalysisAndRoleGeneration.java:238)

at com.virsa.service.backgroundjobs.BackgroundTask.run(BackgroundTask.java:53)

at java.util.TimerThread.mainLoop(Timer.java:461)

at java.util.TimerThread.run(Timer.java:408)

I have reassigned the connectors to the respective actions:

Role Risk Analysis - QA1

Role Generation - DEV

This time, I did not get an error. However, the role is generated successfully in QA1.

Regards,

Debbie

[Former Member]

Hi all,

Some updates to the issue.

This time, I tried role generation with the DEV connector assigned to action role generation and no connectors are assigned to the role risk analysis. In miscellaneous, conduct risk analysis before role generation is set to 'No' and saved. With these settings, the role is generated successfully to the DEV system.

When QA1 connector is assigned to action role risk analysis and DEV connector to action role generation, the role is generated into QA1 instead or DEV.

Regards,

Debbie

[Former Member]

Hi Debbie,

It should generate role for the destined system if all configurations are fine. We have tested it in our scenario where Risk analysis will run to Prod bur Role generation will be done to QA system and our patch level is 7.

Neccessary configurations for this scenario -

1. Connectors established successfully

2. Relevent RTAs are installed on backend systems and they are in sync.

3. in ERM - configuration settings are correct.

4. In ERM - Ststem Landscape-Landscape-

System Landscape is defined and both systems are associated with it.

Then appropriate actions are also defined - DEV for default role generation and QA for default risk analysis.

It should work. Please post the error log details to further check the problem.

Regards-Sabita

[Former Member]

Hi Debbie,

Is the role getting generated in DEV (where you have defined it to be)?

Regards,

Hersh.

[Former Member]

Hi Hersh,

I have checked the SAP backend and It is also not generated into the DEV backend.

Hi Sabita,

I have verified the connector setups for DEV and QA1. They are correct and connection is successfully tested. The actions are associated respectively to the connections as stated in my previous post. The relevant RTAs have been installed in the SAP backend and are working fine. I have also set the following configurations in ERM:

Conduct risk analysis before role generation = 'Yes'

Allow role generation with violations = 'Yes'

SAP note 1168120 doesn't specify that it will resolve the role generation issue. Anyway, we will try applying the hotfix1 for CC patch 7 to see if this fixes the problem.

Thanks & regards,

Debbie