Conflicting results between user list and roles list

[Former Member]

Ok guys I need some help here.

Basically, the question is that I am using the same parameters in "Roles by complex selection criteria" and "Users by complex selection criteria" and I am getting different results.

I am basically using SUIM to find out how many users have MM01 and MM02.

Along with this I am also checking for Objects M_MATE_BUK and M_MATE_WRK.

In RSUSR002, my inputs are:

Transaction Code: MM01

Authorization Object 1: M_MATE_BUK (Company Code)

Activity: 01

Authorization Object 2: M_MATE_WRK (Plant)

Activity: 01

The result is a list of users.

When use the same criteria for "Roles by complex selection criteria", I get roles which dont even show in the result of "User by complex selection criteria".

Please help.

Edited by: Akhan on Nov 18, 2009 5:47 PM

Edited by: Julius Bussche on Nov 18, 2009 6:04 PM

Please use meaningfull subject titles

[Former Member]

That is because they are not assigned to anyone.

Take a closer look at your selection options... they are there for a reason in the roles report but not relevant for the user report.

Cheers,

Julius

[Former Member]

Julius,

Thanks for the reply. However, I thought at some level the two reports should reconcile.

When I am selecting users with a Tcode and specific authorization objects with value. I get a list of users with those authorization.

Now if I use the same parameters values to find roles and then look at the users assigned to those roles, the users from the two reports should be the same.

[Former Member]

Yes, they would be exactly the same if every user only ever had one single role assigned to them.

As this is seldom the case... the per role returns a list of roles which have both objects with values in them.

The oer user returns a list of users which have both objects assigned to them somehow, regardless whether both are in the same role or not - as they will still have the access.

Cheers,

Julius

[Former Member]

Oh Ok. Now it makes sense.

Thanks a lot Julius.

Cheers

[Former Member]

What makes even more sense is to consider the cause of the difference between these two objects which are very related to each other....

Why would they be independently related with 01 activities in seperate roles?

When you build a role, it should ideally be able to survive on it's own when assigned to a user (hence, searching for roles to assign, you are returned those which contain all the objects with values you are looking for, to perform the task).

Why more users are returned than those who in total are assigned to the capable roles, is an indication that there are some "stray cats" around....

Good luck [herding cats|http://www.youtube.com/watch?v=1SmgLtg1Izw&feature=related] ...

Cheers,

Julius