SAP GRC10 - UAR Review

[Former Member]

Hello All,

SAP GRC10 u2013GRCFND_A u2013 05

We are configuring UAR in GRC10 but not able to generate UAR request. Following parameters and Background job configure and ran successfully

UAR Review 2004 023 Request Type for UAR

UAR Review 2005 014 Default Priority

UAR Review 2006 ROLE OWNER Who are the reviewers?

UAR Review 2007 YES Admin. review required before sending tasks to reviewers

Job Description

GRAC_ROLEREP_ROLE_SYNC Synchronizes all roles in the repository.

GRAC_ROLEREP_USER_SYNC Synchronizes all users, and roles used by these users.

GRAC_ACTION_USAGE_SYNC Retrieves the action usage for users.

GRAC_ROLE_USAGE_SYNC Retrieves the role usage.

Please View result of u201CGenerates data for access request UAR reviewu201D executed job.

12.01.2012 08:01:17 JagatBir Singh Extraction from ERM started

12.01.2012 08:01:17 JagatBir Singh Total Number of Users: 0 Total Number of Role Assignments: 0

12.01.2012 08:01:17 JagatBir Singh Extraction from ERM completed

12.01.2012 08:01:17 JagatBir Singh Request to be group by managers

12.01.2012 08:01:17 JagatBir Singh Admin review is configured as Not required

12.01.2012 08:01:17 JagatBir Singh 0 UAR requests has to be created

12.01.2012 08:01:17 JagatBir Singh Request generation started

12.01.2012 08:01:17 JagatBir Singh Request generation started

12.01.2012 08:01:17 JagatBir Singh Total number of request created: 0

12.01.2012 08:01:17 JagatBir Singh Job completed successfully

Please let me know if I am missing any configuration.

Thanks,

Jagat

[Former Member]

Hello JagatBir,

We had similar issues not so long ago, and to be honest, I am not convinced that UAR and SOD data is generated as it says on the tin.

However, I have realised that one of my early mistakes was that not all roles were imported into GRC, as it seems you require the roles to be imported into the GRC repository, i.e. BRM, as the roles will need owners assigned etc. The first thing I would do is import the roles into GRC via BRM and have the owners assigned to them, then try and run the Data Generation job again.

After some tweaks and twists, I have got UAR working, but not the SOD review. With the UAR data generated, I am not convinced it pulls the data through in accordance to the criteria set, i.e. if I want all roles from SYSTEM_ X, I have observed that some roles are missing from the review.

As for SOD review, so far not getting anythhing generated for that

All the best and interested to know how you get on.

[simon_persin4]

Jagat,

I can certainly back up Kaushal's findings on this. It seemed that you need all of the roles imported to BRM and all of the associated master data around owners and reviewers assigned completely before generating the data. It seems like if there are any missing data elements in the generation, then the whole job fails (but it looks like it completes with nothing returned).

Simon

[Former Member]

Hello Kaushal / Simon,

Step 1- We have create one role in the SAP Backend and assigned the same role to the user ( User comparison is done) , Same role imported into the BRM with environment "Production" and Assigned Approver / Role Content owner.

Step 2- Executed Following jobs

GRAC_ROLEREP_ROLE_SYNC - Completed Successfully

GRAC_ROLEREP_USER_SYNC - Completed with warning " @5D\QWarning@ User Adapter is empty "

GRAC_ACTION_USAGE_SYNC -Completed Successfully

GRAC_ROLE_USAGE_SYNC -Completed Successfully

Step 3- Did Role import one more time - Successfully

But unfortunately getting the same message in " Generates data for access request UAR review' Job

12:23:20 17.01.2012 JagatBir Singh Job scheduled successfully

12:23:21 17.01.2012 JagatBir Singh Job ID : 16532000 created

12:23:21 17.01.2012 JagatBir Singh Extraction from ERM started

12:23:21 17.01.2012 JagatBir Singh Total Number of Users: 0 Total Number of Role Assignments: 0

12:23:21 17.01.2012 JagatBir Singh Extraction from ERM completed

12:23:21 17.01.2012 JagatBir Singh Request to be group by role owner

12:23:21 17.01.2012 JagatBir Singh Admin review is configured as required

12:23:21 17.01.2012 JagatBir Singh 0 UAR requests has to be created

12:23:21 17.01.2012 JagatBir Singh Request generation started

12:23:21 17.01.2012 JagatBir Singh Request generation started

Please help .....

Thanks,

Jagat

[simon_persin4]

Hi,

Are there any other roles sync'd from that System or is it only that one?

We've certainly seen issues when there are additional roles in the GRC system but they do not have the role owners and reviewers content updated fully.

Simon

[Former Member]

Hello Simon,

yes we did full role sync and import from ECC System , But for few roles role owners are maintained. But at least it will works for those roles who having role owners.

Thanks,

Jagat

Edited by: JagatBir Singh on Jan 18, 2012 12:53 PM

[Former Member]

Just a quick observation,

Are you on SP 05?

SAP GRC10 u2013GRCFND_A u2013 05

I do recall that on SP05, I couldn't get UAR data generated for roles without owners, but once we moved to SP06, the generation job sometimes did generate requests for roles without any owners assigned. Now that all roles have an owner assigned, I have not really noticed this issue as of late.

Not sure if others have experienced this, but thought it is worth mentioning.

[Former Member]

Hi Jagat,

as you have enabled the admin review, did you run the "generated data for UAR request" job first and check in Access Mgmt -> Compliance Cert. Reviews -> Request review, if any data was generated?

Only then the job to create the request makes sense.

Regards

Daniela

[anand_ogirala]

Jagat,

Did you eventually make it working. Please let me know how you reslolved it. We are facing the same issue.

Thanks

[Former Member]

Hi Kaushal, Can you provide input on how you able to see requests in Admin review ..

[Former Member]

Did you create your number range GRACREQNO and insure it's active?