Strange Behavior with Authorization Objects in Transports

[Former Member]

In our ECC6 systems, I've got a couple of strange occurences I have not seen before.

1) If an Auth. Object is deactivated in a role, generated and then added to a transport and transported, the deactivated objects are reactivated and have a status of 'Unmaintained' and looking for values. I've reviewed OSS, SAP Library and Google but can;t find anything.

Thanks

Chris

[Bernhard_SAP]

Hi Chris,

are you sure?

Please open the authorizations in display mode first after you have imported the role - are the authorizations really replaced by active ones?

I have the impression, that the merge function replaced the authorizations, not the transport. So please check in display mode once....

b.rgds, Bernhard

[Former Member]

Thanks Bernhard/Julius.

I'm trying to help a friend out so I'll have to get her to check these. Something does seem amiss either in the information I'm getting or the systems. It's like something funny with the generation (she does have the profiles in the role before generating) and I just found out today that, she is having issues with executing SUPC in the target system after a transport, saying sh has to manully to a compare and regenerate each role .

I found some old notes I asked her to review

Review note 571276

Go into PFCG in both systems from PFCG->Utilities->Settings->Select: Automatic Master Adjustments when Saving Roles

Generating roles select 'Read old version and and adjust to new data'

Are these deravitive roles? You have to change the Master role first

Review setting up PFUD/PFCG_TIME_DEPENDANCY for compares

http://help.sap.com/saphelp_sm40/helpdata/en/6d/7c 8cfd410ea040aadf92e1f78107a4/content.htm

http://help.sap.com/saphelp_bw21c/helpdata/en/52/6 711ec439b11d1896f0000e8322d00/content.htm

And is she is still having issues, talk to OSS since I don't have access to her systems.

Anyway thanks again guys, I'kk uopdate the message if I hear back.

Chris Sugg

Basis/Security

[Former Member]

> ... she does have the profiles in the role before generating

Here is her mistake.

Take a carefull read through this thread:

Profiles are recorded at thetime of creating the TP request!

Cheers,

Julius

[Former Member]

Thanks Julius

I told my friend about the note and hadn't reviewed it in forever. I ahve re-highlighted the possible issue with Profiles again and asked to pay close attention to the note for any changes made to roles after they have been added to a transport. Just waiting to hear back.

TTFN,

Chris Sugg

[Former Member]

If you did not mean "in the transport" (as I assumed the mistake to be) then inconsistencies between the SU24 between the systems are another likely candidate.

Compare your usobt_c tables for the tcodes in the menu.

Cheers,

Julius

[Former Member]

No you are correct Julius. She is saying transported roles are re-activating previously de-activated Auth. Objects and marking them as 'Unmaintained' in the target system requiring they be regenerated and compared again according to her. She also said that to her knowledge, once a role is generated in DEV with green lights, it gets transported without any other changes occuring. Very strange.

TTFN,

Chris Sugg

[Former Member]

I read this again closely and observed this comment:

> she is having issues with executing SUPC in the target system after a transport, saying sh has to manully to a compare and regenerate each role .

Why is she doing this? Only to solve the problem or intentionally?

Did the transport log say anything about profile name collisions? You can check this in the target system in table AGR_NUM_2.

Sometimes people create roles with profiles in "target systems"... If you want to do this even once... you must first reset the number range in this table so that you do not have collisions when transporting older roles again.

Unfortunately there is no "super easy" way to fix this and you will need to analyze the problem at table/field level if it is the case.

Cheers,

Julius

[Former Member]

This message was moderated.

[Former Member]

This message was moderated.

[Former Member]

This message was moderated.

[Former Member]

This message was moderated.

[Former Member]

This message was moderated.

[Former Member]

Hi Julius

I really need more information from her but she in South Africa (currently after midnight tommorow I beleive) so emails are delayed. From what she said, some of the transported roles she is getting a message saying a User Compare needs to be done as the reason, in addition to the atuhorization objects and ungenerated roles.

Not real sure about changing/duplicate Profile Names which I never do so I didn't think about it. I will forward your information to her but will let her know that if she's in a real bind, an OSS message might be the quckest fix to have someone access the systems to review the logs, TMS settings and such.

Thank you and Bernhard so much for you help and information which I will definately keep.

TTFN

Chris

[Former Member]

This message was moderated.

[Former Member]

Perhaps it would be easiest if you showed her this thread and she explained directly what is going on?

PS: What does TTFN mean?

Cheers,

Julius

[Former Member]

Hi Julius

That would problably be best but have not heard from her in a couple of days. I will forward the link of the message to her. Also sorry for all the extra postings I did last night. I keep getting a Could not find Parent link 500/900 type message when I was trying to update your responses and that was the only way I knew to remove the unwanted items.

TTFN = "Ta Ta for Now" from my Scotish friends over in Ireland. I was told that was a common ending for most people over the big pond from the US.

Thanks, (US)

Chris

[Former Member]

>

> Perhaps it would be easiest if you showed her this thread and she explained directly what is going on?
> 
> PS: What does TTFN mean?
> 
> Cheers,
> Julius

i can help on this

TTFN (ta ta for now...)

It was the good bye that Tigger used in all "Winnie the Pooh" books

Edited by: Shekar.J on Jun 10, 2010 2:18 PM

[Former Member]

Hi Again Julius

I just heard from my friend and she is actually at a client site which I didn't know before and reviewing TMS config along with applied notes and changed profiles in the target system before she got there, she says she has found several issues that need adjustments. She is also checking on tsome of the tables previously mentioned. Hopefully she will be able of correct the issue from here so we will see.

Thanks Again,

Chris

[Former Member]

Yes, I think it would be more efficient if she explains what she wants and what she has done (and responds), otherwise I don't see much reason to continue the guess work...

Contacting SAP support might not be classed as a software defect (they will ask to open a connection to the system if it is described in the same way you have here...) but rather an implementation specific faulty config (possibly a combination of them).

Some things cannot be done remotely, and certainly not efficiently.

Cheers,

Julius

[Former Member]

OK, from friend has said that there was an issue with one of the underlying logical system names in a child systems with the RFC connection. Not sure why that couldn;t have been spotted early on with status lights logs etc . but anyway she seems good to go.

Thanks Again

Chris Sugg

[Former Member]

Also check the transport log for errors. A possibility is a profile name collision with a different role created "directly" in the target system..

Cheers,

Julius

[Former Member]

This message was moderated.