Merge or Compare two or more like roles

[Former Member]

We have 3, almost identical roles with roughly 50 of the same transactions in them. I would like to merge all roles into one. My fear, is that different authorizations have been maintained in each one and/or extra authentication objects have been added to one or the other. All users are assigned to each of these three roles. I want to merge all 3 roles into one but don't want to lose any of the changes that have been made to the authorizations. They were maintained by different Admins who are no longer here. Is there a way that I can compare the 3 roles to identify their differences? Can I merge them without having to create a Composite role from them?

[Former Member]

you can use the comparison utility in SUIM.

I don't think you can merge roles. You may try creating a single role and include all the tcodes and authorizations that are there in the 3 roles.

Thank you,

Partha

[Former Member]

Thank you to everyone who responded. The role comparison under SUIM is exactly what I was looking for. I've run it already against two of the roles, found which objects existed in one but not the other and also if the values were different in which case I manually compared the objects. Thanks again, I have been able to eliminate two of the three roles.

[Former Member]

Yes, if the roles are intact then that is IMO a better option.

Thanks for sharing the solution!

Julius

[mvoros]

Hi,

as it was mentioned there is a report for role comparison in SUIM. It works only for two roles hence you need to run it for all 3 possible pairs. This should give you an overview of differences. I don't know about any way of merging two roles but you can import whole authorization profiles into role. IF you go to PFCG and then to authorization data there is a option Edit -> Insert Authorization(s) -> From profile. So you could import authorization profiles from all three roles. Obviously, in this case you don't get menu but you can copy menu from other roles as well. So after some time you should be able to consolidate menu as well as authorizations.

Cheers

[Former Member]

There is a trick to compare multiple roles: Copy one of the user ID's with the roles amd then merge them into a new role assigned to the copy.

Then run the remote comparison of user against user.

Merging the roles is fairly straightforward if you only have standard and maintained authorizations in them. Org. Levels will be the biggest hurdle and should be compared upfront.

On a project I developed a tool to generate a delta-role making up the difference - just incase something didn't work after the changes. You can also assign this delta role to the copied user, and assign the copy as a reference user back to the original when needed. You have won when all delta-roles are eliminated

Cheers,

Julius

[Former Member]

Hi,

As told earlier, you can first find out the profiles assigned to each role and then insert them one by one through Change Authorization Tab> Insert Authorizations-> From Profile .

Once this is done, all the authorizations will be maintained but you need to manually maintain the organization values.

The menu of this new role will be empty so you will have to add the TCODES existing in the 3 roles. After doing this, remember to generate the profile of the role using the" Edit Old Status " Profile Generation Option. This way you won't have to re-maintain the authorizations which must have popped up because of the addition of TCODES in the menu.

Hope it helps.

Regards,

Manisha

[Former Member]

The problem with that is waiting down the line.

You will never be able to use SU24 changes nor new menu entries for the role again and cannot use the upgrade tools.

Big loss!

Merging the menus and generating a delta role is the best sustainable option in my experience.

Cheers,

Julius