General questions on RAR

[Former Member]

I am currently trying to reconcile the information in RAR with the source information in a connected ECC 6.0 IDES system. When I run the management report update in RAR I can see that the RAR system appears to have loaded the following data from the IDES system:

6270 users corresponding to the number of users in USR01 in the IDES system

2502 profiles corresponding to all active profiles in USR10

1925 roles corresponding to what exactly???

I have more than 4000 roles in the IDES system, so I am wondering what kind of selection is used for RAR?

Another thing... When I have run the management report job and look at the users analysis it looks like only 6081 users are analyzed out of the 6270? Why don't the numbers match?

Best regards,

Anders

[Former Member · Accepted solution]

Hi Anders,

Please check your configuration settings in RAR-Configuration-Risk Analysis-Default Values-

1. Default user type- if it is dialog, then it will pick diolog user only.

2. Exclude locked user - YES will exclude locked users.

3. Exclude expired users - YES will exclude expired users.

In RAR-Configuration-Risk Analysis-Additional Options-

1. Ignore critical roles and profiles- YES will ignore roles defined as critical.

Check the parameters values for batch risk analysis being performed whether there is also some selection criteria like Roles started from Z* etc.

I hope you will find the reason. If it is not, then may be it is a bug. raise an CSS message with SAP.

Regards,

Sabita

[Former Member · Accepted solution]

Would any of you out there know exactly how the roles are exported from the source system to the RAR system? When starting the batch job on the RAR side, is it an ABAP report that is run in the ECC 6.0 source system or is it an RFC that is run? I have found a number of /VIRSA/ programs and function modules in the source system, so I am just wondering which ones are the ones that are actually run by the batch job on the RAR side?

./Anders

[koehntopp · Accepted solution]

Hi Anders,

RAR will make an RFC call to the RTA Communications user you have configured in the comnnector and call several BAPIs.

Note 1179717 will also help: https://service.sap.com/sap/support/notes/1179717

Most likely some of your roles have not been generated, and therefore cannot be analyzed.

Frank.