- SAP Community
- Groups
- Interest Groups
- Application Development
- Discussions
- PFUD - profiles are removed, but role is in
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
PFUD - profiles are removed, but role is in
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-29-2010 9:02 PM
Hello,
I am testing background job based on report RHAUTUPD_NEW. I assign role to a user via SU01 and time-limit it. When limit expires I check user's record via SU01. I see that the profile is being removed from the user's record, but role's assignment still shows in the user's record. Is this a correct behavior? Is there a way to remove role from the user's master record as well?
Thanks
Galina
- SAP Managed Tags:
- Security
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-29-2010 9:09 PM
Report PRGN_COMPRESS_TIMES could help you. And you could have searched it easily.
- SAP Managed Tags:
- Security
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-29-2010 9:09 PM
Report PRGN_COMPRESS_TIMES could help you. And you could have searched it easily.
- SAP Managed Tags:
- Security
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-30-2010 6:57 PM
Nishant,
Thank you for your reply. I started with scheduling job containing step RHAUTUPD_NEW and found out that role is still in. I read that this report also cleans and synchronizes user master data. Do I schedule PRGN_COMPRESS_TIMES as a second step in the same job? I am not sure if having just PRGN_COMPRESS_TIMES is sufficient for both, removal of expired roles and synchronization.
Thanks
Galina
- SAP Managed Tags:
- Security
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-29-2010 9:59 PM
In addition to having searched it, I don't understand why it bothers you?
Do the same roles have other access dependent implications? Personalizations? Java mappings?
Cheers,
Julius
- SAP Managed Tags:
- Security
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-29-2010 10:48 PM
Julius,
Thanks for your reply. I have my reasons. One of them is that auditors like to see set of roles assigned to users. If we assign role temporary to a user, we want to show that this role has been removed exactly when it was supposed to be removed.
I am testing with newly created single role. No associations with any other users or roles.
Thanks
Galina
- SAP Managed Tags:
- Security
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-29-2010 11:10 PM
That is indeed interesting question.
If might make sense to agree on an approach with them.
If your provisioning of access support model and infrastructure supports it, then removing the role is a better option in my opinion. SAP seems to be going that way as well, since IdM also without deleting the user ID which is usefull.
It helps a lot if you do not have too many (sets of) roles and the tools interogate their validity.
It is without a doubt a very usefull control to set the date of expiry when assigning the access. At that point in time you know most about the user and their request for access!
Cheers,
Julius
Edited by: Julius Bussche on Mar 30, 2010 12:14 AM
- SAP Managed Tags:
- Security
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
03-30-2010 4:42 PM
