CUP and autoprovisioning

[former_member182655]

Hello!

I have two questions:

1)

If user created request in CUP with a number of roles, and after this I delete requested roles. Will theese roles be assigned during auto-provisioning at the end of request? Other words, will theese roles be assigned in my back-end system?

2)

How could I restrict CUP radio button to restrict synchronization mechanism? I mean options - All Roles/Groups, All Roles except SAP Predefined Roles, Selected Roles, From File. I would like to leave only "Selected Roles" point.

Regards,

Artem

Edited by: Artem Ivashkin on Nov 8, 2010 3:41 PM

[koehntopp · Accepted solution]

Hi Artem,

1) if you have rejected the roles they will not be provisioned. You can check that in the request audit trail - at the very end it wiull say what happened at the point of provisioning.

2) unfortunately that's not possible - but that's not the only point where an administrator could mess up the system

Frank.

[Former Member · Accepted solution]

Hi Artem,

If I understood your questions correctly, here is my response.

1) If you are talking @ deleting the roles from back-end system then CUP won't provision them and will error out. If you try to delete the roles from CUP database after the request creation, it won't allow you to delete the roles.

2) This is not possible. 95% of the screens are not customizable.

Alpesh

[former_member182655 · Accepted solution]

Thank you for answers!

Excuse me for unclear questions. Let me describe my issue. Users created request, later I was in clouds and selected wrong points for Import roles in CUP from ERM, but I've switched to another menu quickly. May be my actions brought me to wrong synchronizations of roles. When user request has been completed I saw that no roles were assigned.

If you try to delete the roles from CUP database after the request creation, it won't allow you to delete the roles.

Yes, I agree with this point. But what will happened if I delete system assignment from the role? For example: role has DEV150 system, after deletion (or deassign DEV150) role has no system.

Has assignment to be made in this case?

Regards,

Artem Ivashkin

[former_member182655]

Open again if the same problem happened

[Former Member]

First point --> CUP will not provision the requested roles which do not exist in backend system. Instead it will show message in audit trail that role <role name> do not exist in system <system id>. it will not through any error message to last stage approver.

2nd point --> there is no straight way to do this. Although, there is a workaround. Sync all the roles from back end. then download the roles in file. The in the downloaded file change the role status from enable and provisioning to inactive.

Disclaimer - SAP AG has nothing to do with my answers.

[former_member182655]

I use the next mechanism for role management:

download files with roles

upload files in ERM

sychronize roles in CUP from ERM

And I delete roles only in Front-End system.

How could it be that roles (before deletion in Systems tab of CUP) in approved request have not been assigned in backend system (where they were)?

Regards,

Artem

[Former Member]

I might be getting off topic, but if you aren't using ERM and you are importing roles directly from more than one ABAP backend system, be aware that the table that CUP uses for that doesn't include a system identifier! We found this out quite by accident when we imported roles from several backend systems like SND, DEV etc. using the overwrite existing roles option.

This probably is still the case when you import roles from ERP, but we don't use ERM to test for you.

That means that when you load roles from several B/E's that the user may have the ability to select a role from DEV that's not in PRD etc. We assumed that it functioned like RAR & ERM.

[koehntopp]

I can't confirm that.

When I import rules, the system that the rules come from is in the role details. You may be confused - the role data is distributed along several CUP tables.

You can also maintain the avaiability per system in the role details, or do a mass correction through Excel export/import.

Frank.