User-Role Provisioning Problem

[Former Member]

Hi,

When I try provisioning a role to a User, if there are already some roles assigned to him, the valid from date of the previously assigned roles and the new role changes to the current date. I see this as a serious issue as the validity of the previous roles should not change when a new role is assigned to a user.

Note - I'm trying to provision roles to users in ECC system. I'm making use of the SAP Provisioning framework for provisioning/de-provisioning

Please let me know, if I'm required to make some change to the provisioning Tasks/Jobs that I'm employing here

Regards,

Joel Davis

IDM - Infosys Technologies

[Former Member · Accepted solution]

Hi Joel.

I've been investigating the same issue and noticed that valid-from dates for user's existing roles are already updated to the current date when the Initial Abap Load from SAP to IDM is done. Then when ever you e.g. add a new abap role for the user in IDM, SetABAPRole&ProfileForUser task updates valid-form dates to current date. Looks serious bug for me! Especially if you have valid-from date in the future to activate the role later.

Can any SAP personnel comment this? Perhaps Joel you should create SAP Note about this?

Br. Jukka

[Former Member · Accepted solution]

Ok. Thanks.

I have raised an SAP OSS message for this question. I got the answer that it is a technical limitaion that IDM has.

Regards,

Joel Davis.

[Former Member]

Hello,

We are also facing this issue Its been a week that we are using Role Provisioning functionality.

Did SAP provide a solution for it now? 

[Former Member]

Hi Deepali,

This limitation can be overcome in IDM7.2 using customised scripts.

The date of the newly assigned privileges will not be changed. We can also have the delta roles assigned to the SAP system by avoiding the present overwrite policy of IDM.

regards,

Dileep Reddy

[Former Member]

Hi Deepali,

Can you please let me know which version of IDM you are in ?

We are using the SAP PF for prov & de-prov and we are on IDM 7.2 SP7 at present. We never faced such issue.

There is a script which returns a list of all privileges of the passed user for the passed repository and the passed privilege type. It contains all already assigned privileges plus/minus the delta of the current pending added and/or removed privileges without affecting the validity of the assignment.

You can refer to the scripts sapc_getNameOfAssignedPendingPrivileges which comes with IDM.

Regards,

Krishna.