Super users access in CUP

[Former Member]

Hi Friends,

I have configured the work flow for Super user access in CUP. But when I going to approve the request it is showing "Error processing your request, Request no: NN in stage : XXXXX".( here I am selecting a perticular FF id to access)

FYI

If I m not selecting any firefighter user id and approving the request it is showing the message "Request no: NN is approved and closed and auto provisioning done".

But in both the case, when I am checking it in my back end system,the firefighter ID is not assigned to the user id requested for .

Can Any one suggest whether I missed some thing.

I have done the configs as per the document available in the forum, still I believe there is not enough information.

I will appreciate if any one can guide me through stadard practice of the configuration steps.

Thanks,

Satyabrat

[Former Member]

Hi

Check out the How-to document by Harleen...

https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/2086538f-038e-2b10-da83-b84afc04...

Kind Regards,

Vit

[Former Member]

Hi Vit,

I did the configurations according to this guide only, but the approver part I have configured my self where I put the approver ID and alternate approverID in CAD which in not reflecting in this guide.

Thanks,

Satyabrat

[former_member366047]

Satyabrat,

Please check out our AC5.3 Best Practice site. Superuser Privilege Management configuration and executiion via CUP is covered.

http://help.sap.com/bp_grc53/GRC_US/HTML/index.htm

You might need your S-number, not sure.

Thanks!

Ankur

SAP GRC RIG

[Former Member]

Hi Ankur,

I need the configuration steps to make provisioning done through CUP for SPM. I have checked the SAP note 1239186 (the exact error described here). I have checked the configuration and it is OK. I think there is some configurtaion error in stage or in the backend system where the fiefighter owner and controller is defined.

Can you please guide me with the stage configurations for SPM.

Thanks & Regards,

Satyabrat

[former_member366047]

Satyabrat,

Who is the approver in your stage where you receive the error?

Ankur

SAP GRC RIG

[Former Member]

Hi Ankur,

I have configured the user id as approver who is owner and controller of the firefighter id and I am requesting the firefighter access for my user id.

The request is showing in the ID that is configured as approver, when I am approving it, in 1st step it is showing the process yellow and when I am approving it second time it is showing the error on stage.

Thanks,

satyabrat

[former_member366047]

Satyabrat,

Access the log right after you receive that error, in CUP --> Configuration --> Monitoring --> System Log.

Copy and paste the log into a text file paste it here.

Thanks!

Ankur

SAP GRC RIG

[Former Member]

Hi Ankur,

Please check the system log below :

2010-01-31 07:07:01,915 [SAPEngine_Application_Thread[impl:3]_18] ERROR Exception occured while Provisioning User in SAP System

com.virsa.ae.core.BOException: Exception occured while Provisioning User in SAP System

at com.virsa.ae.accessrequests.bo.ProvisioningBO.autoProvision(ProvisioningBO.java:243)

at com.virsa.ae.accessrequests.bo.RequestBO.autoProvisioningForApprove(RequestBO.java:5879)

at com.virsa.ae.accessrequests.bo.RequestBO.callAEExitService(RequestBO.java:6974)

at com.virsa.ae.accessrequests.bo.RequestBO.callExitService(RequestBO.java:6748)

at com.virsa.ae.accessrequests.bo.RequestBO.approveRequest(RequestBO.java:6600)

at com.virsa.ae.accessrequests.bo.RequestBO.approveRequest(RequestBO.java:6393)

at com.virsa.ae.accessrequests.actions.RequestViewAction.confirmRequestApproval(RequestViewAction.java:949)

at com.virsa.ae.accessrequests.actions.RequestViewAction.execute(RequestViewAction.java:104)

at com.virsa.ae.commons.utils.framework.NavigationEngine.execute(NavigationEngine.java:295)

at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:431)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)

at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)

at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)

at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)

at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)

at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)

at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)

at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)

at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)

at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)

at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)

at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)

at java.security.AccessController.doPrivileged(AccessController.java:219)

at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:102)

at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:172)

Caused by:

com.virsa.ae.service.ServiceException: Error

at com.virsa.ae.service.sap.ProvisionSAPUserDAO.provisionSuperUserAcces(ProvisionSAPUserDAO.java:226)

at com.virsa.ae.service.sap.ProvisionSAPUserDAO.provisionUser(ProvisionSAPUserDAO.java:121)

at com.virsa.ae.accessrequests.bo.ProvisioningBO.autoProvision(ProvisioningBO.java:216)

... 24 more

Caused by:

com.virsa.ae.service.ServiceException: Field COMMENT not a member of INPUT

at com.virsa.ae.service.sap.SAPProvisionDAO.provisionSuperUserAccess(SAPProvisionDAO.java:3241)

at com.virsa.ae.service.sap.ProvisionSAPUserDAO.provisionSuperUserAcces(ProvisionSAPUserDAO.java:221)

... 26 more

Caused by:

com.sap.mw.jco.JCO$Exception: (127) JCO_ERROR_FIELD_NOT_FOUND: Field COMMENT not a member of INPUT

at com.sap.mw.jco.JCO$MetaData.indexOf(JCO.java:9534)

at com.sap.mw.jco.JCO$Record.setValue(JCO.java:14923)

at com.virsa.ae.service.sap.SAPProvisionDAO.provisionSuperUserAccess(SAPProvisionDAO.java:3208)

... 27 more

2010-01-31 07:07:01,925 [SAPEngine_Application_Thread[impl:3]_18] ERROR Ignoring exception : com.virsa.ae.service.messaging.MessageNotFoundException: Code: '9867', Locale: 'en'

com.virsa.ae.service.messaging.MessageNotFoundException: Code: '9867', Locale: 'en'

at com.virsa.ae.service.messaging.MessageFormatter.formatAsText(MessageFormatter.java:103)

at com.virsa.ae.commons.utils.JSValidationUtil.getMessage(JSValidationUtil.java:439)

at com.virsa.ae.commons.utils.JSValidationUtil.formatMessage(JSValidationUtil.java:495)

at com.virsa.ae.commons.utils.JSValidationUtil.formatMessage(JSValidationUtil.java:520)

at jsp_req_selected_roles_multi_path1261552538189._jspService(jsp_req_selected_roles_multi_path1261552538189.java:238)

at com.sap.engine.services.servlets_jsp.server.jsp.JspBase.service(JspBase.java:112)

at com.sap.engine.services.servlets_jsp.server.servlet.JSPServlet.service(JSPServlet.java:566)

at com.sap.engine.services.servlets_jsp.server.servlet.JSPServlet.service(JSPServlet.java:190)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)

at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)

at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.include(RequestDispatcherImpl.java:473)

at com.sap.engine.services.servlets_jsp.server.jsp.PageContextImpl.include(PageContextImpl.java:178)

at jsp_show_request_selected_roles1261552536330._jspService(jsp_show_request_selected_roles1261552536330.java:19)

at com.sap.engine.services.servlets_jsp.server.jsp.JspBase.service(JspBase.java:112)

at com.sap.engine.services.servlets_jsp.server.servlet.JSPServlet.service(JSPServlet.java:566)

at com.sap.engine.services.servlets_jsp.server.servlet.JSPServlet.service(JSPServlet.java:190)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)

at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)

at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.include(RequestDispatcherImpl.java:473)

at com.sap.engine.services.servlets_jsp.server.jsp.PageContextImpl.include(PageContextImpl.java:178)

at jsp_show_request_tab1261552534368._jspService(jsp_show_request_tab1261552534368.java:118)

at com.sap.engine.services.servlets_jsp.server.jsp.JspBase.service(JspBase.java:112)

at com.sap.engine.services.servlets_jsp.server.servlet.JSPServlet.service(JSPServlet.java:566)

at com.sap.engine.services.servlets_jsp.server.servlet.JSPServlet.service(JSPServlet.java:190)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)

at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)

at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.include(RequestDispatcherImpl.java:509)

at com.sap.engine.services.servlets_jsp.server.jsp.PageContextImpl.include(PageContextImpl.java:163)

at jsp_approver_request_view1264416466745._jspService(jsp_approver_request_view1264416466745.java:899)

at com.sap.engine.services.servlets_jsp.server.jsp.JspBase.service(JspBase.java:112)

at com.sap.engine.services.servlets_jsp.server.servlet.JSPServlet.service(JSPServlet.java:566)

at com.sap.engine.services.servlets_jsp.server.servlet.JSPServlet.service(JSPServlet.java:190)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)

at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)

at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)

at com.sap.engine.services.servlets_jsp.server.jsp.PageContextImpl.forward(PageContextImpl.java:199)

at jsp_request_view_controller1264416464910._jspService(jsp_request_view_controller1264416464910.java:15)

at com.sap.engine.services.servlets_jsp.server.jsp.JspBase.service(JspBase.java:112)

at com.sap.engine.services.servlets_jsp.server.servlet.JSPServlet.service(JSPServlet.java:566)

at com.sap.engine.services.servlets_jsp.server.servlet.JSPServlet.service(JSPServlet.java:190)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)

at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)

at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)

at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:461)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)

at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)

at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)

at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:461)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)

at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)

at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)

at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)

at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)

at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)

at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)

at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)

at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)

at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)

at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)

at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)

at java.security.AccessController.doPrivileged(AccessController.java:219)

at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:102)

at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:172)

Thanks,

Satyabrat

Edited by: Satyabrat Mohanty on Jan 31, 2010 9:57 AM

[Former Member]

Hi Satyabrat,

Error message 9867 suggests that the initial xml files are not uploaded correctly. After upload you will be seeing "only role owners can reject their roles" instead of an error code. If not done, please finish all the post-installation steps before proceeding.

Are you set up as owner in the backend aswell in the frontend?

BTW, have you configured your "normal" provisioning workflow, is it working properly including auto provisoning? If that is working we could rule out many causes.

Verify that your JCo's working properly.

Kind Regards,

Vit

[Former Member]

Hi,

Strange things are happening. when I tested the risk analysis and approval of roles from ERM, It is not working, Before It was working fine and I had created no of roles in ERM. Recently we have updated to SP10. Because it was working fine before I am bit confused. I have also uploaded text files for SP10 in ERM as there is error in miscellenious in ERM and the strange thing is after the file upload the error is rectified and I am getting the same error in BACKGROUNDJOBS. Please let me know if I have to upload the new files in CUP also.

I

Thanks,

Satyabrat

Edited by: Satyabrat Mohanty on Feb 1, 2010 12:17 PM

[Former Member]

Hi,

Please find the logs as below

NOTE: It was working fine before upgrade to SP10. I think It is not recognizing the user, I am using user id "SAP_GRC".

Please found the logs:

2010-02-01 09:42:27,530 [SAPEngine_Application_Thread[impl:3]_18] ERROR com.sap.security.api.NoSuchUserAccountException: USER_AUTH_FAILED: User account for logonid "" not found!

java.lang.Throwable: com.sap.security.api.NoSuchUserAccountException: USER_AUTH_FAILED: User account for logonid "" not found!

at com.virsa.service.umi.ume.UMESearchUser.getUserById(UMESearchUser.java:145)

at com.virsa.re.bo.impl.SearchUserBO.getUserById(SearchUserBO.java:96)

at com.virsa.re.cache.RECacheUtil.getUser(RECacheUtil.java:2803)

at com.virsa.re.cache.RECacheUtil.getUserFullName(RECacheUtil.java:2772)

at com.virsa.re.cache.RECacheUtil.getUserFullNameWithUserId(RECacheUtil.java:2936)

at jsp_re_lib_cockpit1261551617448._jspService(jsp_re_lib_cockpit1261551617448.java:330)

at com.sap.engine.services.servlets_jsp.server.jsp.JspBase.service(JspBase.java:112)

at com.sap.engine.services.servlets_jsp.server.servlet.JSPServlet.service(JSPServlet.java:566)

at com.sap.engine.services.servlets_jsp.server.servlet.JSPServlet.service(JSPServlet.java:190)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)

at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)

at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)

at com.virsa.framework.servlet.VFrameworkServlet.service(VFrameworkServlet.java:286)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)

at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)

at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)

at com.virsa.framework.servlet.VFrameworkServlet.service(VFrameworkServlet.java:286)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)

at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.runServlet(FilterChainImpl.java:117)

at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.doFilter(FilterChainImpl.java:62)

at com.virsa.comp.history.filter.HistoryFilter.doFilter(HistoryFilter.java:43)

at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.doFilter(FilterChainImpl.java:58)

at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:384)

at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)

at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)

at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)

at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)

at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)

at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)

at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)

at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)

at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)

at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)

at java.security.AccessController.doPrivileged(AccessController.java:219)

at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:102)

at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:172)

2010-02-01 09:42:27,531 [SAPEngine_Application_Thread[impl:3]_18] ERROR User : not found to get full name

2010-02-01 09:42:39,304 [SAPEngine_Application_Thread[impl:3]_13] ERROR java.lang.NullPointerException

java.lang.Throwable: java.lang.NullPointerException

at com.virsa.re.bo.AuthDataHelper.getConsolidatedFieldList(AuthDataHelper.java:1015)

at com.virsa.re.bo.impl.RiskAnalysisBO.getPFCGFieldList(RiskAnalysisBO.java:863)

at com.virsa.re.bo.impl.RiskAnalysisBO.getFldValLst(RiskAnalysisBO.java:621)

at com.virsa.re.bo.impl.RiskAnalysisBO.performTranLvlRiskAnalysis(RiskAnalysisBO.java:536)

at com.virsa.re.bo.impl.RiskAnalysisBO.performRiskAnalysisOnSystemFromRiskAnalysisPage(RiskAnalysisBO.java:167)

at com.virsa.re.role.actions.RiskAnalysisAction.performAndShowRiskAnalysis(RiskAnalysisAction.java:1657)

at com.virsa.re.role.actions.RiskAnalysisAction.execute(RiskAnalysisAction.java:105)

at com.virsa.framework.NavigationEngine.execute(NavigationEngine.java:273)

at com.virsa.framework.servlet.VFrameworkServlet.service(VFrameworkServlet.java:230)

at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)

at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.runServlet(FilterChainImpl.java:117)

at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.doFilter(FilterChainImpl.java:62)

at com.virsa.comp.history.filter.HistoryFilter.doFilter(HistoryFilter.java:43)

at com.sap.engine.services.servlets_jsp.server.runtime.FilterChainImpl.doFilter(FilterChainImpl.java:58)

at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:384)

at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)

at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)

at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)

at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)

at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)

at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)

at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)

at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)

at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)

at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)

at java.security.AccessController.doPrivileged(AccessController.java:219)

at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:102)

at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:172)

Thanks ,

Satyabrat

[Former Member]

All, I see you're working on the error message issue, but what was the solution for the FF ID not showing up when the requestor logs into the ABAP system and runs the VFAT tcode? I'm having a similar issue in AC5.3 SP10. My superuser workflow is working appropriately, but after approval the FF ID does not show up in the table with I execute the VFAT tcode. Any ideas?

Thanks,

Daniel

[Former Member]

Hi,

We have upgraded the RTA in backend system. Everything is working fine now.

Thanks,

Satyabrat