Manual CUP provisioning

[Former Member]

We are using CUP (BO AC 5.3 SP14) with role provisioning via SAP CUA. Whenever there is a system upgrade etc on our CUA systems, we would prefer if any role requests could be "put on hold" in CUP, ie keep all workflow functionality but just not provision the role to the user in the last step. There are also other reasons why we during certain periods would like to control when roles are provisioned from CUP to SAP

When turning off "Auto provision at end of each path" the system completes all workflow steps without problems, but the request is closed and the role not assigned in SAP

Just turning off "Role auto provisioning" does not fulfill our requirements, as this assigns the role to the user in SAP but do not run the last user compare step

So, is there any way to manually trigger/import the role assignment from CUP request database that have been approved in e.g the last 12h, or since the last manual import (delta)?

Many thanks

Mikael

[Former Member]

Hello Frank, and thanks for your reply - interesting alternative solution, though you also confirm this cannot easily be "imported" from the CUP database. I think we need to test this scenario in order to find the best option.

I assume we need to setup a specific user for the CUA connector, so that all other connectors are still available when the CUA user is disabled. We already have a Manager and Role owner approval in our CUP workflow. The SAP role is assigned following role owner approval. If possible, we could perhaps redirect all requests that fails due to technical connector issues in the last approval/role assignment step to a Basis admin. That might mean we would automatically manage all technical scenarios whithout changing workflows

Indeed this is not a very common scenario, but due to upgrades we will have several periods with downtime on our central CUA in the next coming months. We also have regular "freeze periods" in our environment, meaning no roles are allowed to be assigned. If we can still manage to run the workflow seamless for an end-user, then that would very useful

Thanks for your input

Mikael

[koehntopp]

That's not exactly a good idea, but anyway - two options:

- lock the CUA RTA user for the time of the upgrade, then provisioning will fail and the request should stay open on the last stage. You'd have to make sure approvers know how to deal with the error message.

- create a second path that you switch to in case of an upgrade, with an extra approval step at the end that's done by a Basis person. Of course that only works for new requests created after you decide to do an upgrade.

How often would you need that anyway...?

Frank.