Profile not generated after transport.

[Former Member]

Hi All,

We are facing an issue in which I transported a role from DEV to PRODUCTION through Q.

Our role is generated in DEV......but not in Q and Production.

As per earlier posts in the forum,I checked table PRGN_CUST in the DEV and PROFILE_TRANSPORT value is set to YES.

Also,the role was added to the transport only after profile was generated

Has anyone faced similar issues?

Peeyush.

[Former Member]

I assume you checked the transaport log in the STMS and it told you to open a post on SDN?

If not, what does it say?

Cheers,

Julius

[Former Member]

Hi Julius,

Thanks for your reply.

The logs were all green.It was that the users were not able to access the tcodes in the role.

Then we saw this issue.

Peeyush.

[Former Member]

Hi Peeyush,

Have u execute the PFUD after transport for particular roles. If not run the same to do the comparison.

[Former Member]

Hi

We already have job scheduled for PFUD.

Peeyush.

[Former Member]

> Profile not generated after transport

What do you mean by "after transport"?

PFCG does not do a recording at the time of creating the transport, but rather when you release it. Are you deleting the profiles again?

Cheers,

Julius

[Former Member]

Hi Julius,

I just transported one role after profile generation.But it is not generated in Q and PROD ,so users cant access the related tcodes in the roles.

Peeyush .

[Former Member]

Hi Peeyush,

When you transprot a role(PFCG) you get two option which are by default checked.

1st one - To transport the single roles inside the composite roles.

2nd one - To generate the roles before transporting it.

I guess you might have unchecked the 2nd option thats the reason the updated profiles were not transported. Also check status of transport request , is it RC=0 or RC=4/8 . Check out the error message if RC=4/8.

Also check if you have added any objects/tcode to the role which do not exist in your Q or Prod system in this case as well it sometimes leads to inconsistency of the roles.Leaving them ungenerated.

PS: If you have added a Tcode in parent role then you have to transport both parent and all its childs

[Former Member]

Then you will have to start looking for more exotic things...

What are the last changed by dates and names on the roles and profiles (in SUIM)?

Are there any locks in SM12?

Check the system log (SM21) also?

Are you sure there are no profile name collisions? (What is the SID name of DEV and PROD?)

Does the user in QAS have any other profiles or a reference user in QAS?

Does the role in DEV or QAS or PROD on the menu tab have any entry in the DEST field?

Are your SU24 settings out of sync between PROD and the rest?

etc

etc

Cheers,

Julius

[Former Member]

Hi Akshay,

It is a single role and all tcodes are in all systems.

Also,by default we have ticked "Also transport generated profiles for single role".So no issue here too.

Peeyush

[Former Member]

Hi Julius,

Then you will have to start looking for more exotic things...

What are the last changed by dates and names on the roles and profiles (in SUIM)?--SAME in all systems.

Does the user in QAS have any other profiles or a reference user in QAS?--this is the issue with multiple users.

Does the role in DEV or QAS or PROD on the menu tab have any entry in the DEST field?---NO

Are your SU24 settings out of sync between PROD and the rest?--NO

Peeyush

[Former Member]

> Does the user in QAS have any other profiles or a reference user in QAS?--this is the issue with multiple users.

Then some authority to actually use the transaction is not in this role, but in some other.

A further possibility is that the users have many more roles assigned in PROD than in QAS, and although the role is fine... the user IDs themselves have reached the maximum number of profiles limit.

Go to SU01 in PROD and try to yet add another role to the user to test and see what happens?

Cheers,

Julius

[Former Member]

Hi Julius,

The issue is with multiple users,not just one.

The issue appears to be with the role.Here the auth tab is yellow with the message against profile "Current Version" is not generatred .This is the role status in both Q and PROD but not DEV.

Peeyush.

[Former Member]

Is the role a derived role?

If is is a derived role, has the master been changed and not all the child roles transported through the landscape?

[Former Member]

Hi Alex,

No it is a single role

Peeyush

[Former Member]

Hi Piyush,

Can you check if there is any old transport which has over write the updated one. Check this in SE03 and let us know.

[Former Member]

Okay, I give up. What's the answer?

(Just joking - I will think about it further).

Are you by any chance on a 46B system with an SP level lower than 60 and have changed any of the number of generic key fields of the user buffer?

As a test, can you please try to regenerate the profiles for one of the roles in QAS and see whether it gives you a message and whether it then works?

Cheers,

Julius

[Former Member]

Hi Julius,

We are at ECC 6.

And this issue we have faced for the first time

Peeyush

[former_member1061482]

Hi Piyeeush,

Was any change made to the roles after transport creation?

Please see note 571276

Also see:

[Former Member]

Hi Piyeeush,

Did you found a solution to your problem? I have the same issue!

I've created a new role in Dev, created & generated the profile. Once role is transported in Quality, the profile is transported but with the status : Current version not generated.

the strangest part is that i didn't realize that directly... in the meanwhile, the role was already in used in production by a test user who didn't encountered any problem while testing!

basically, the role is now in production, used by one user who can execute all transaction listed in the role... but the profile isnt generated and the user comparison cannot be complete due to that.

any explanations?

maybe i should create a new topic tho

[Former Member]

It might be worth running tx SE38 and the program pfcg_time_dependency - this can clean up some issues with the profiles. After that, do a transport of roles as normal.

Regards

Tony

[Former Member]

Hi, any updates on the issue. We are facing similar issue in our systems.

[Former Member]

Hi

Bit of an old thread - have you tried checking all of the hints?

Is the role derived/auth objects missing in Q/P/profile collisions/what does the transport log give away etc?

Cheers

David

[Former Member]

Hi Hemangini,

The error may occurs in PFCG when you generate a profile for a role in display mode.Although generation is completed successfully...the indicator on the Auth tab appears to be yellow with the error message "Current Version not generated".

In your case...Try checking the difference(between Display mode and Change mode in Auth Tab status) in Dev system and the other systems you have transported.

Regards,

Malti

[Former Member]

I had the same issue. We had new Z auth object that was not transported before in the QA system.

[srikanth_devavarapu]

This message was moderated.

[kunalshinde209]

I can answer you better for this question because I have faced this issue multiple times.

There are two reason behind this issue.

1. Check if ABAP team has created any new custom Authorization object or program that you have added into your role. If ABAP changes have not moved to Quality or if moved then after security role changes.

2. This when your profile is not being displayed in Authorization tab after role movement. In this case copy the role profile from dev system and check if that profile is assigned to any other role in Quality in AGR_prof table.

Regards,

Kunal Shinde