what background job for transactions to be updated in GRC CUP

[Former Member]

Hi,

Is there any background job available in GRC CUP for transactions to be updated for roles.How transactions can be updated in GRC CUP,So requestor,role approver can able to see by clicking the role in GRC CUP.

Thanks

Mash

[Former Member]

Hello Mash,

The roles that you see in CUP are the roles that are present in CUP module. Check configuration tab, roles->search roles.

This is an "issue" of GRC 5.3. because there's no central repository for roles. the changes that you've made in ERM are not reflected in CUP automatically. This is really a thing that I hate of GRC. Every time I change a role in ERM I have to import (overwrite option) in CUP. Maybe someone knows a different alternative ...

Cheers,

Diego.

[Former Member]

Hi Diego,

As far I know, we need to import a role only once in CUP which updates Role Name and attributes. Role authorizations are in backend system and when we assign a role in CUP, it will update the updated role in backend. No need to reimport a role after any changes in ERM, only new roles need to be imported.

We initially used ERM for some time, but as there were issues in ERM. So we stopped using after a while. We change role in backend and transport it to Production. The role attributes are in CUP for existing roles, we never reimport the roles. Check it works for you, it will save time.

Regards,

Sabita

Edited by: Sabita Das on Jan 11, 2012 11:47 PM

[Former Member]

Hello Sabita,

Thank you for the info. The point is, as you said, that if you want to re-import a role in CUP you don't need auth data there. But, there's a "Transaction Code" tab in CUP roles. I faced problems because this tab wasn't getting updated after a role change in ERM.

The configuration guide states the following:

"The role status is used by the system for integration with Compliant User Provisioning role synchronization, with Enterprise Role Management set as the role source. If the role status is set to Production, Enterprise Role Management synchronizes the role to Compliant User Provisioning for user provisioning. Therefore, role status is predefined and delivered with Enterprise Role

Management. You can change the role status description only."

Then if the role status is set to production in ERM, it should be in sync with the role in CUP (I mean the "Transaction Code" Tab).

The problem arises if you don't use ERM, If you want updated info. you need to re-sync CUP role with the back-end.

Cheers,

Diego.

[Former Member]

Hi Diego,

I couldn't find Transaction Code Tab in CUP Role info. Where is it? I see System, Detailed Description, Role Approver, Functional Area, Company, Custom Attributes, Verification /Training system. I checked in patch 8.1 and Patch 12.

I always have impression that there is no CUP repository for Transaction/Auth details and it only holds Role and its attributes.

Let us know where can we check transaction code tab. This will definitely help us.

Regards,

Sabita

[Former Member]

Sabita,

If you go to "search role", select one of the roles and change you won't see the transaction tab. If you just click in the role name after search you'll be able to se these tabs: System , Detailed Description,Role Approver , Functional Area ,Company ,Functional Area and Company ,Transaction Code ,Custom Attributes and Verification/Training System .

I've checked with VIRAE 15.5.

Anyway, I've found this in config guide:

"If a role is updated (for example, a transaction code is added), does the role need to be re-imported?

No. Compliant User Provisioning does not import role details other than names and descriptions. If required, transaction code information is obtained from the SAP system and is therefore always in sync."

The guide is really clear!! but it doesn't explain how the sync is done!!! as per the statement it seems that this is automatic.... Does it works for you? Maybe I'm missing some configuration...

Cheers,

Diego.

Edited by: Diego I. Yaryura on Jan 15, 2012 3:40 PM

[Former Member]

Hi Diego,

Yes now I can see the transaction code. We never checked it. In CUP, our task is to make the role available and assign to a user when they need it. Role details are with Role Owner or request initiator anyway so they never look in CUP. Transaction code only gives tcodes name and not authorizations so it is not complete. The actual role assignment happens in backend so authorizations are up-to-date there. Users don't face any issue.

I will check if the sync is done automatically. If I find it working, I will let you know.

No, there is no other configuration or sync job we have done apart from what is there in config guide.

Regards,

Sabita

[Former Member]

Hi Diego,

Yes I checked, it is in sync with backend. So as soon as a role is modified and regenerated either via ERM or directly in backend, CUP Role Transaction code tab shows the new values.

May be system fetches data directly from backend via connector. Is it not working in your system?

Regards,

Sabita

Edited by: Sabita Das on Jan 16, 2012 12:31 AM

[Former Member]

Hello Sabita,

Thank you very much indeed for your answer.

The reason for what I think it's important to have the transaction information in CUP roles is that, when an approver receives a CUP request, there is a link that opens the role and then, the approver can check for the transactions. Actually, this is mash's question.

I've realized that it works!. As soon as you generate the profile in the back-end, the transaction tab in CUP is automatically updated

The problem in my case was that, only the CUP conector to the productive system was enabled, because CUP isn't used for DEV and QA. Then, I've always changed roles in ERM (connected to DEV system) and I was expecting to get the updated data in the transaction tab in CUP. But the CUP connector to DEV was disabled!

In my case, I should have waited, and as soon as the role were transported to PRD system, the CUP connector would have fetched the new transaction data and updated the transaction tab.

Thank You!

Diego.