user comparsion

[Former Member]

Hello All ,

we run user comparison job daily for all roles.

for some users there are roles assigned but they are no longer valid .

say now it is taking 10000 sec to complete the Job .

if we delete the roles which are not valid from users.

will it be any difference in run time ?

[Former Member]

Hi,

If you have scheduled the time dependency job then the roles which are expired must be removed from the user master record.

You can delete the expired roles from the roles tab from user maintenace screen, but my only concern is if the job was scheduled (on daily basis) then why are the expired roles still in the roles tab.

Debug the job log and look into the root cause for this because manual deletion of roles is tedious task.

Rakesh

[Former Member]

Not sure on the improvement, but its worth a shot

This program removes expires roles : PRGN_COMPRESS_TIMES

Cheers

Abhishek

[Former Member]

Is it not a good practice not to remove the expired roles from an AUDIT perspective?

My two cents on this issue will be a trade off between system performance gain versus the cost for not providing the correct data during the AUDIT.

[Former Member]

Hi Venkateshwara ,

My apologies, your question has too many 'not''s which has confused me

Let me know if this what you asked :

>

> Is it not a good practice not to remove the expired roles from an AUDIT perspective?

Well, you have the change logs for users. So, why retain expired roles.

> My two cents on this issue will be a trade off between system performance gain versus the cost for not providing the correct data during the AUDIT.

Maybe the auditors might be more interested in what they currently have.

[sdipanjan]

This is the Table access and update dependency. If there are less updates need to be done and less data to be accessed then of course the Job will last for less time..

Regards,

Dipanjan

[Former Member]

Hii,

User comparsion should be done for only for valid users ,if u have any invalid users but role assigned to it if u run a report PFCG_TIME_DEPENDENCY in the background all the users which are invalid are automatically deleted

regards

[Former Member]

> all the users which are invalid are automatically deleted

I think what you meant to say is that the users which are out of the account validity date are not considered for the role validity ("deleted" from the selection, not deleted from the system... :-).

That would make sense and I agree with you that using the validity on the account is a very usefull approach to take. It also restricts authentication (e.g. non-password based authentication methods).

Other tactics which can be taken is to build roles at a higher level than a job task or step in a process and therefore have less roles (and less duplicated authorizations to assign).

For roles which are assigned to all users or large groups of them, the possibility to use the reference user concept to speed up the user compare is also worth taking a look into.

Cheers,

Julius