Role management in a child client of CUA

[Former Member]

I have to make some role changes in our DEV box. This role has been assigned to a number of people via CUA. Now, as it turns out, this role is so badly off, that it would take me a lot of time to make these changes, and it would just be easier to rebuild the role correctly.

What I want to do is to delete the poorly built role, and then rebuild it correctly. To do this, I went into CUA and used SU10 to "remove" the role from the users, and all that it did was to expire the role. This means I'm still unable to delete the offending poorly built role.

Do you know how I'd be able to remove the users assigned to that role without disconnecting the client from CUA?

Thanks,

Santosh

[Former Member]

After you expire the roles with SU10 you can use the program PRGN_COMPRESS_TIMES. This program deletes the expired role assignments from selected roles or users.

[Former Member]

Hi Santosh

You needed to enter an earlier date in SU10 to remove completely.

Cheers

David

[Former Member]

To David: The date is automatically set to a few days ago ... are you saying I need to manually select an older date? Wouldn't that end up doing the same thing as what's currently going on?

To Alex: Thanks, I entered the program name one letter at a time with excitement, and then SE38 told me that CUA is active.

Dang it ...

Thanks guys, I really appreciate the help, and if you do have another alternative, please let me know.

Santosh

[Bernhard_SAP]

yes, you need to enter an earlier date, as per default the actual date is entered. Good value is for instance 01.01.1900...

Another alternative:

Go to child system and delete the old role (pfcg).

Now you have an incosnsistency, as the central system does not know about that and there are still users assigned.

To clean that up:

in central system->edit a user->start textcomparison

On the selection screen select for instance only that one child system. Then set the 'X' into the 'Delete Invalid Assignements' checkbox. That is the miracle box for your task...

then run it.

For your reference: if you press the 'I'-button:

quote

Cleanups

In the central system, you can also clean up the CUA assignments for

deleted roles and profiles. This can be necessary, for example, if you

delete roles or profiles in the central system or a child system by

importing a transport request. If you set the corresponding parameter on

the selection screen, the invalid CUA role and profile assignments are

deleted after the check tables are updated.

The local role and profile assignments in each system may also need to

be cleaned up. To do this, start transaction PFUD with the option

"Cleanups" in every system in which roles or profiles were deleted by

the import of a transport request.

unquote

b.rgds, Bernhard

Edited by: Bernhard Hochreiter on Mar 23, 2011 9:15 AM

[Former Member]

Hi Santosh,

In order to remove a role from users using SU10 via CUA

1. Go to SU10 in CUA

2. Enter the user IDs

3.Click on change mode

4. Go to roles tab

5. Select radio button "Remove"

6. Enter the child system, role name, Valid From and Valid To date

Note : Make sure to change the valid from date to a past date ex: 01.01.1900 , and the Valid to date should be 31.12.9999 (DD.MM.YYYY)

7. Save

This should should remove all the users assignments in the child system.

Alternatively you can remove all the existing authorization data in the same role and populate it with the new data, this step do not require you to remove the users assigned to that role

Regards,

Laxman