SPM not working as intended! 5.3 version

[Former Member]

1) Hello Experts,

I have recently configured SPM at the client place. The config worked well in Dev. When I implemented the same config in production I am facing the following problem. When a user clicks on the Firefighter IDs assigned to him/her it doesn't take you to the Firefighter session directly, a new screen appears asking for a user name and password. Do any of you have a solution for this.

Thanks----

---

For this Raghu Boddu replied letting me know the below

2) Hi Britney,

Your have posted the question in a wrong forum. Please post GRC Access control related questions in the BPE -> GRC forums.

Well.. here is the solution

Does your production environment has CUA. If yes, please implement the below steps:

Goto transaction SCUM and change the password setting from u2018Globalu2019 to u2018Everywhereu2019. When this option is set to Everywhere the CUA does not have to regenerate the password and the SAP Easy Access button will allow the new Firefighter session to be opened.

However, this is a workaround. But, to resolve the issue completely, the GRC RTA u2013 VIRSANH should be installed on the CUA master and the Child systems. This will not prompt users to enter the username and password while using the Firefighter ID.

The further solution is available in the SAP Note 1528178.

If you don't have a CUA, ensure that all the SPM parameters are properly configured in SSM_CUST.

Regards,

Raghu

3) VIRSA NH is installed in both CUA and Child systems but I am still not able to login to FF directly. It asks me for a login and password to enter into the FF-ID Session after I select the valid FF-ID assigned.

In the CUA System - VIRSANH 530_700 0015 SAPK-53315INVIRSANH SAP GRC Access Controls 5.3 for 700 HR a

In the child system - VIRSANH 530_700 0016 SAPK-53316INVIRSANH SAP GRC Access Controls 5.3 for 700 HR a

Do anyone have a resolution for this

[simon_persin4]

Hi Britney,

Changing the CUA config as Raghu recommends should fix this.

You'll also need to give the SPM Users the authorisation to Lock (05) users in the usergroup defined for your SPM IDs as well otherwise you'll get errors when the user tries to login with the SPM ID.

Simon

[Former Member]

If I change the initial password paramater to everywhere then I need to go and manually reset the password in the individual clients instead of CUA. For the sake of Firefighter I think that is not a good strategy. Is there an alternative??

Thanks----

---

[Former Member]

Hi,

With this setting the changed password on the child system will not be send to the other systems. I don't see any issues with enabling this option since your central system still behaves the same way.

Regards,

Raghu

[Former Member]

Hi,

Did you try this:

Goto transaction SCUM and change the password setting from u2018Globalu2019 to u2018Everywhereu2019. When this option is set to Everywhere the CUA does not have to regenerate the password and the SAP Easy Access button will allow the new Firefighter session to be opened.

Regards,

Raghu