Add/delete child roles directly in table AGR_AGRS- Is it safe to do so?

[Former Member]

We have an implementation coming up where we need to delete roles from a large number of composite role. I've been trying to do an eCATT for it, but no luck yet.

Is it safe to make changes directly in table AGR_AGRS to accomplish the same thing? I normally would stay out of the security tables (in update mode), but I'm looking for a way to make a large number of changes in a short period of time - in production.

Thank you in advance,

Allen

[Former Member]

> Is it safe to make changes directly in table AGR_AGRS to accomplish the same thing? I normally would stay out of the security tables (in update mode), but I'm looking for a way to make a large number of changes in a short period of time - in production.

Normally?? Bad idea!!

> We have an implementation coming up where we need to delete roles from a large number of composite role. I've been trying to do an eCATT for it, but no luck yet.

So you not only mucked up the single role design, but the composite workaround as well?

I would use copies of SAP standard single roles and go live with them. You will most likely achieve the same security and process alignment level, or possibly an even better one than crows nests of singles in composites and DB updates...

My 2 cents,

Julius

[Former Member]

The role design goes back years, and is way before my time on the account. The composites are being used in organizational management and don't even exist in development, so doing it in advance and transporting when needed is not an option.

Anyway, thank you for input

[Former Member]

> The composites are being used in organizational management and don't even exist in development, so doing it in advance and transporting when needed is not an option.

Hmmm... that is a tough call.

To my knowledge there are not many customers which actually went live with this, but I heard of one which even did it in combo with CUA.

I think the survival chances of the concept are low - that is what I meant.

Cheers,

Julius

[Former Member]

>

> The role design goes back years, and is way before my time on the account. The composites are being used in organizational management and don't even exist in development, so doing it in advance  and transporting when needed is not an option.
> 
> Anyway, thank you for input

Hi Allen,

[there is note 313587|https://websmp230.sap-ag.de/sap%28bD1lbiZjPTAwMQ==%29/bc/bsp/spn/sapnotes/index2.htm?numm=313587] providing a Z*-report for exactly the purpose you have in mind.

As it is from SAP, it is official. No warning is attached to it. I have been using it on messed-up systems several times and it works sufficiently.

[Former Member]

Guys,

Thank you for the great input I really appreciate it!

Allen

[Former Member]

Hi Allen

Don't directly add into AGR_AGRS, there is an FM or BAPI that you can use (I can't remember the exact one) that you can integrate with some custom code to automatically populate your composite roles.

A previous client of mine had a very similar situation and they had tried lots of different approaches.

I tried eCATTs and LSMW as an alternative but they were just too slow.

If coded incorrectly the table update can (and has...) completely wipe the table contents which is not a good idea....

[mvoros]

Hi,

there are no BAPIs for role manipulation but FM PRGN_RFC_DEL_AGRS_IN_COLL_AGR should remove a role from composite role. I haven't tested it. I just briefly read the code.

Cheers