SAP GRC RAR - User Synchronization shows no results

[Former Member]

Dear,

I'm currently having the following issue with RAR:

When running a full synchronization in my GRC production system, the user synchronization background job completes immediately and without errors, but gives me no results. The log mentions "User Sync Search Obj Result is - Result is count is 0".

The role synchronization and the profile synchronization however work fine.

Hence, I am able to perform role & profile analysis, but no user analysis based on the synchronized data.

When I go into the Informer tab and choose "Role Analysis", I can get an overview of roles in the selection field. I cannot get an overview of users in "User Analysis" (user list is empty). I can however perform a direct user analysis with results when I put in the name of a user I know.

I checked tables VIRSA_CC_GENOBJ and VIRSA_CC_SYSUSR with the debugger and both tables contain no user information, only role and profile data.

The connectors seem to work fine (I chose SAPJCO connectors). The back-end user currently has SAP_ALL and is a system user.

My GRC test system has the exact same configuration as my GRC production system and there I have no issues with the user synchronization.

Any thoughts?

[koehntopp · Accepted solution]

Please check whether the versions of the RTA in the backend match the frontend version.

Then check for completed post-installation steps and authorizations for the RFC user.

Frank.

[Former Member]

Hi all,

RTA is correct and ruleset is generated.

I have contacted SAP and apparently this is a bug in SP12 which has been resolved in SP13. So we will upgrade the SP version.

FYI - a workaround to this problem is possible by doing an incremental user synchronization instead of a full.

Thanks for your help

[Former Member]

Have you set the master USer Source?

regards,

Chinmaya

[Former Member]

Yes, set to my HR system.

Changed it to my ECC system just to be sure. Still the same result (no user data, job completes immediately), although it doesn't show the "count is 0" entry in the log.

[Former Member]

Update on the issue:

I just tried my GRC test system and I appear to have the same issue. I must have changed something in the test system without realizing this impact and took the same configuration in the production system. Hence a configuration issue, but I have no idea where to look.

Doing a debug in the back-end system, I noticed that whenever I try to do a full sync, the back-end program /VIRSA/ZCC_GET_USER_LIST goes looking for all entries EQUAL to * (values "I" "EQ" "*"). However, when doing an incremental sync, the program goes looking for all entries CONTAINING a PATTERN like * (values "I" "CP" "*").

If you open table USR02 and filter BNAME = * no results show up, while BNAME [x] * shows the list of users.

Anyone any idea why GRC is sending the "=" variable to the back-end instead of the "[x]"? Do you know what RAR config causes this?

Thanks!

[Former Member]

Also, Is your ruleset generated?

Regards,

Chinmaya