Business roles in GRC AC

[former_member242380]

Hello,

Is it possible in SAP GRC AC to create so-called business roles like in SAP IdM. This roles are not assigned to any backend system but derive backend system roles. The aim is to create set of roles that consist of roles in different backend systems.

As I understand role mapping can't fully implement this functionality, because main role is assigned to backend system.

Thanks,

Yakov

Edited by: Yakov Silin on Feb 24, 2010 7:00 AM

[koehntopp · Accepted solution]

Yakov,

have you tried creating a non-SAP system and designing the (fictional) business roles there, then map them to ABAP roles in the ERP systems?

Frank.

[former_member242380]

I think using roles for fictive system can be a workaround solution, thank you.

But I also want ro ask If another solution exists?

[former_member788628]

Hi Yakhov,

I was wondering if this is your dilemma. We want to use this role mapping feature for the purposes of adding an Enterprise Portal role for every ABAP role that gets approved for the user in an ABAP component system (i.e. ECC, BW, CRM etc). We will have a 1:1 mapping of Enterprise Portal role to ABAP role defined in the role mapping section in GRC.

- We want to set up the workflow in such a way that the main role (ABAP role) is the only role that needs to be approved. The dependent role (Enterprise Portal role) should be added or not added based on the approval or denial of the main role (ABAP role). In other words if the role owner for the abap role approves the abap role, then both the abap and EP role will be provisioned by GRC and if the role owner rejects/denies the role, then neither the abap or EP role will be provisioned by GRC.

Is this similar to the challenge you ar facing?

[former_member242380]

Hello, Rene,

Yes, it is partially similar. The difference that under business role I mean role that doesn't assigned to any system. It asigned to business process or functional area and may contain roles form different backend systems.

I think question is answered. I will use role mapping. Thanks to all.