Role Reaffirm in GRC10

[Former Member]

Hi all,

did anyone use the Role Reaffirm functionality within GRC10?

The functionality seems to be available, but we cannot get any roles listed to be reaffirmed.

We have defined approvers for roles in GRC, have users assigned, ran the RR Reminder background job.

Is there anything missing?

The config parameters seem to have magically disappeared from the list of available parameters.

Also could not find any documentation on Role Reaffirm in AC 10

Thanks for some input,

Daniela

[Former Member · Accepted solution]

Hi Daniela

check the next info:

http://wiki.sdn.sap.com/wiki/display/GRC/Role+Reaffirm+in+Role+Management+-+Access+Control+10.0

Note 1687422

I have the same problem, I always get the message No record found when I search roles that I want to reaffirm.

do you still have the same problem?

Thank you.

Leon

[Former Member · Accepted solution]

Hi Daniela,

Please check that you have maintained the following configuration-

Role with role reaffirm fields in Role Maintenance.

Role Reaffirm area with fields like, Reaffirm Period in Days,

Next Reaffirm, Last Reaffirm and Reaffirmed by.

The role owner does the role reaffirm for that role that has all the

fields maintained whether it's approved, removed or hold. The role

owner has to perform role reaffirm in

Access Management > Role Mining > Role Re- affirm.

Best Regards,

Nandita

[former_member136769]

Hi Daniela,

Do you still have the issue? I have latest information on role reaffirm.

Set up Role Reaffirm period in BRM.  For example if role expires in one month, it will send email notification to role owner.  Not tied to workflow.

See how-to from WIKI:

http://wiki.sdn.sap.com/wiki/display/GRC/Role+Reaffirm+in+Role+Management+-+Access+Control+10.0

This is User Access review, which is tied to workflow:

https://websmp105.sap-ag.de/~sapidb/011000358700001229052010E

This is the SOD User review is tied to worfklow.

https://websmp105.sap-ag.de/~sapidb/011000358700001229032010E

Let me know if you need further info!

Thanks

Luciana.

[Former Member]

Hello experts,

I get the same issue:

I have 1 role with reaffirm expiration on 05/16/2013 and 1 role which already had expired on 05/08/2013.

In order of the fact, that today is 05/15/2013, I expect in 'Access Management > Role Mining > Role Reaffirm' a result of 2 roles which have to be reaffirmed.

But it already gives the warning "No records found"!

In advice of Leon I tried to type the value '1' in "Number of days before Duedate", so I would expect 1 role as result... but: "No records found"!

I attached some screenshots of my configuration.

Any ideas?

EDIT: can somebody tell me the reminder email notification Job for role reaffirm? I only know the Job "GRAC_ERM_ROLE_CERTIFY_NOTIF" for role certification

Thanks in advance 🙂

Edgar

[Former Member]

try executing the report with user ROLE_BK1.

Regards.

Leon

[Former Member]

Hi Leon,

i already logged in as ROLE_BK1... so unfortunately "no records found" 😞

are there any other configurations or customizing activities I have to proceed?

[kevin_tucholke1]

I don't beleive that Role Reaffirm is still being used via the SAP Workflow.  there is a Generation program  GRAC_ROLE_REAFFIRM_REQUEST_GEN.  Then you need to go to the Role Reaffirm quick link under Access Management, and then search for the roles that you are looking for.

I hope this helps.

[Former Member]

Hi Kevin,

thank you for your reply.

I never heard of the program GRAC_ROLE_REAFFIRM_REQUEST_GEN before, but i still get the warning "No records found" in Role Reaffirm quick link under Access Management.

[Former Member]

1. Review that user ROLE_BK1 is in access control users as a role owner

2. Verify that ROLE_BK1 user has the role: GRAC_ROLE_MGMT_ROLE_OWNER

3. Perform a Trace to identify permission issues

4. Leave target connector filter blank

What version of SAP GRC AC do you have?

[former_member136769]

Kevin is correct. The Access Management>Role management>Role reaffirm will only show data if youhave requests generated for role reaffirm.

You need to first of all, generate the reaffirm requests. And this is done by running report GRAC_ROLE_REAFFIRM_REQUEST_GEN.

Please schedule the Job in SM36 for the above program for the desired

interval.

There are known issue, fixed on Notes: 1528895

Just confirming the steps to make it work:

TO SET THE REAFFIRMATION PERIOD:

-Go to Role Maintenance > Select the role to set the reaffirmation period.
-open the Role and click on Properties.
-New screen will appear showing Role Reaffirm area with fields like,
Reaffirm Period in Days, Next Reaffirm, Last Reaffirm and Reaffirmed by.
-Enter the number of days for the reaffirmation period.
-The next reaffirm field will show the date on or before the Role needs
to be reaffirmed.

RUN JOB in SE38

TO REAFFIRM THE ROLES:

-Go to Access management > Role Mining > Role Re-affirm
-Click on Role Reaffirm
-To retrieve the Roles data, there are two options:
a) If Role owner wants to have specific data shown on the screen, data
can be filtered by choosing different search attributes.
b) Or Role owner can see all the Roles, assigned by Role Owner

Once the Roles data appear on the screen, the User (Role owner) can do
the following actions on it:
- Approve
- Reject
- hold

Please ensure that you check these Roles after their due date has passed.

It should work..

[Former Member]

Hi Luciana,

I implemented note 1528895 and followed your steps described above, but unfortunately it still says "No records found".

Btw 'Access management > Role Mining > Role Re-affirm'  doesn't exist for me.

"Role Reaffirm" is only under 'Access management > Role Management'.

???

[former_member136769]

It may be, as the NWBC links got rearranged in some SP. Did you open a ticket with SAP? is the issue still there?

[Former Member]

yes the issue still exist.

no i didn't open a ticket because that's just a demo system... but would be nice if that would have worked

[former_member136769]

Edgar

Let me have a look again on this topic, will post any updates, thanks

[Former Member]

When you search roles in Role Reafirm page you need to especify a valid value for "Number of days before Duedate" criteria, default is 0.

Example:

Role Reafirm date = 28/07/2012

Today is = 27/07/2012

So you need to especify 1 in  "Number of days before Duedate" in order to get records.

Regards.

Leon

[Former Member]

Hi Daniela,

Have you maintained 'Reaffirm Period' in role maintainence ?

Can you also go to 'Role Reaffirm' application and see if you are getting any roles( you have to be approver of roles which require reafirm) ?

Please see that role reaffirm dont has any workflow.

Best Regards,

Aman

[Former Member]

Hi Aman,

thanks for your reply.

Yes, we have set the role reaffirmation period to 1 day for all the roles and in the meantime this already has expired (= next reaffirm date is 21/12/2011).

Also yes we have defined myself as role approver and also a colleague for other roles.

None of us has roles listed in the "Role Reaffirm" option of the frontend.

Any idea what could be the issue?

Regards,

Daniela