AGR_USERS is out of sync with SU01

[Former Member]

Hello!

Scenario:

So I'm having to replace roles for about 18 thousand users. We're delpoying the change a few thousand users at a time.

We created a couple of ecatts that first removes all the access and then adds all the new access. The ECATT is setup by placing the roles horizontally across for each user, which assigns all the roles in one change. The issue we've noticed, comes from a few workflow roles that require a confirmation. The ECATT doesn't know what to do and skips the process for that user which fails to delete all access, which in turn, fails to assign all access.

Issue:

When I looked up the AGR_USER table to validate the assignment I noticed the table indicates the user has access, but when I go to SU01for some users the role assignment is missing. From what I can tell, it seems if I reopen the user manually and save, it reflects the change in the AGR table. What I need to know is there a way to mass sync the table to reflect the actual assignments in SU01? Or is there an indicator on the AGR_USER table stating the user is not synced with SU01?

I need to find the users not synced between SU01 and AGR_USERS. Then assign the missing roles. Currently the AGR_USERS table is giving me false positives.

Thanks in advance!

Alex

[Former Member]

Hi Alex,

Try running User Master Data reconciliation program for the roles (transaction code PFUD). That should take care of sync

Cheers !!!

Zaheer

[Former Member]

Oh yea I forgot about PFUD, let me try that out and see if it works. Although I hate to run it for all the roles pushed out due to the amount but that maybe required as a final step. I'll post the results.

Thanks Zaheer!

[Former Member]

I would be very carefull of this behaviour and approach in a production system....

eCATT can create inconsistencies and leave temporary data in the buffered application server tables.

I am not logged on to check the field keys of AGR_USERS, but it sounds to me as if this workflow confirmation is not being skipped as you have described, but is rather stopping the process and leaving the roles you had wanted to assign in the application server memory.

When you then access SU01 soon enough afterwards and save, it writes this inconsistency to the DB tables. If you wait for long enough, the systems own memory invalidations will fix it for you. So you have actually commited an error by saving...

> What I need to know is there a way to mass sync the table to reflect the actual assignments in SU01?

In this case, your error will not only go "Bang"... it would go "Bang, bang, bang, bang, bang.... rrraaaatatatatatatatatatata..." or simply to nothing at other (slightly later) times...

Obviously that is not a reliable solution.

In higher releases, the buffering of these types of tables has (as a general trend) been removed to prevent these types of inconsistencies and strange behaviour when using such tools which are intended for test systems and sandboxes, where data intengrity is not the primary concern.

Cheers,

Julius

[Former Member]

Hi Alex,

Using SU10 (MASS CHANGE) try to modify any one default values for all the 18 thousand users like (basic role, validity, parametes etc.)

Now the role will be reflect in the table (Saved)

Regards,

Shrinivasan. KV

[Former Member]

Thanks Julius and Shrinivasan for your input! I totally agree, running an ecatt in prod for user provisioning is def. not the route we wanted to move forward with but we have a dead line to map these users over to the new roles ASAP.

In regards to SU10 the roles from user 1 do not match user 2, so the differences make it difficult to leverage the SU10 function.

PFUD seems to to sync up SU01 and AGR_USERS. We're developing a program to assign the access directly for each user but I'm sure we're going to run into this issue whether we use a program or ecatts.

Thanks Guys for your replys!

[Former Member]

Hi Alex,

The easiest way to use SU10 is to script it to add a line at a time. It takes longer than SU01 but it can perform an append or removal which I find to be more flexible than using SU01. The script will also just dump the lines which it does not like so that would be a single assignment and pick up only the roles requiring the additional confirmations.

It is not the quickest method but you can do a few thousand users in a couple of hours.

Cheers

Alex