CUP 5.3 Line Manager AEappover assignment

[Former Member]

Hi GRC Expert

We have a workflow which includes the line manager. Th problem is this there a thousands of managers in the organisation and the org structure changes constantly and new managers are assigned constantly is there a way we can get the AEapprover role to be assigned to these managers without having to do constant maintenance. We using SAP HR as the user data source and detailed data source.

Thanks for the assistance...

Edited by: Donovan Mathews on Oct 15, 2009 2:39 PM

[former_member532485 · Accepted solution]

Hi Donovan,

On my system we connect to an LDAP rather than a SAP HR system so my answer may not quite fit your situation.

In the UME for CUP, you can assign the role AEApprover to the Everyone group. All users in the UME by default are in the Everyone group and therefore all users will get the AEApprover role without having to make an explicit assignment. However, there might be some permissions in the AEApprover role that you do not want all users to have access to and therefore you should review the permissions in the role before doing this.

I created a copy of AEApprover, removed some access and used the copy as the role for all users.

Regards,

Mark

[Former Member · Accepted solution]

Donovan,

I totally agree with Mark. To make sure that all the approvers can approve the request, I mostly assign the AEApprover role to all the users. If you are maintaining names of all approvers then you can assign them AEApprover role directly.

Regards,

Alpesh

[Former Member · Accepted solution]

Just a note of caution to this approach! Make sure that you have got tight control over the Approvers as defined by your workflow. If you have a few administrators who can amend the workflow settings then be very careful as they will then also be able to update who can legitimately approve a request.

You may find that auditors will give you a kicking for assigning the AEApprover authorisations out without the associated workflow and configuration controls in place.

[Former Member · Accepted solution]

Hi Experts

Thanks for the responses so far.

What if your users do not exist on the UME and you are using SAP HR as you data source and the UME is not pointing to your ABAP stack?

Regards,

[Former Member · Accepted solution]

> What if your users do not exist on the UME and you are using SAP HR as you data source...

An important prerequisite for many integration and interoperability features is you have first harmonized the user names and naming conventions.

Some applications offer the possibility to map external ID's to internal ones for authorization purposes (like your SNCname for SSO, or UNAME to PERNR within the HR system internally) but I would try to avoid mapping when it is possible.

Getting back to the question: How long does it take to approve a request? The line manager at the time of the request should still know what's going on after a few days and it is no excuse to be (more) irresponsible by just clicking the approval away...

Another option would be to create a detour for such a change in line manager --> if the "old" line manager does not approve or decline it in time, then it is sent to the admin group who check on what has changed and document the approval from the new boss manually.

Cheers,

Julius

[Former Member · Accepted solution]

Donovan,

What if your users do not exist on the UME and you are using SAP HR as you data source and the UME is not pointing to your ABAP stack?

It doesn't matter what your data source is. UME is used for authenticating aprpovers and administrators so you will need those particular users in UME. Either you create them in UME or associate UME with some datasource like ABAP, LDAP etc.

Alpesh