Missing Z* roles after ehp 5 upgrade on ECC6

[Former Member]

Hello,

On our ECC6 sandbox system which has been initialized from our production system, we performed ehp5 upgrade in order to analyze impact and test new functionality.

We just discover that in comparison of our production system we lost 1478 Z* roles which are not listed in transaction PFCG.

Moreover one transaction code is not available after the upgrade.

After investigation, we found that all missing roles are coming from our dev project system and all available roles are coming from our dev maintenance system.

Is it something to do in order to restore missing roles ?

Did I miss something during my upgrade in order to keep all roles ?

Thanks in advance for your help.

Regards,

Fred

[Former Member]

Upgrade steps doesn't remove roles from the system. Please consult with Basis Team whether they did their part properly or not while upgrading Sandbox. It might be they didn't restore AGR tables properly.

Check PRG_CORR2 table for the missing t-code and whether it is being replaced by a new t-code during upgrade.

Thanks,

Deb

[Former Member]

Sounds like someone fiddled with a transport and imported an instruction to delete the target roles.

Check the change documents of those roles (SUIM) and in which transport they were in (SE03).

Anyway, toasting everything and starting over from scratch is as Debs already mentioned not one of the standard upgrade steps, usually...

Cheers,

Julius

[Former Member]

Thanks for your help.

@Debmalya :

I think also that upgrade activities doesn't remove any thing in the system.

I did the refresh and the upgrade and now security team is coming to me because roles are missing.

Refresh has been done by backup/restore, so nothing can be lost and no special thing has been done on AGR tables.

After the refresh we did an export/import in order to upgrade to Oracle 11g and then we apply the EHP5.

I'm a little bit lost to find the root cause af this issue.

Concerning PRG_CORR2 table, it seems that this table doesn't exist in my sandbox. I can't acces with se11 or se16 transaction.

@Julius

I checked in suim but the role seems to be non-existent in the system. There is no change document ...

I'm still investigating to understand in which step the roles disappeared.

If you have any other idea, let me know.

Thanks again for your help.

Fred

[Former Member]

Sorry for my typo, the table name is PRGN_CORR2. For the rest, there is no way I can think of or I am aware of by which Z roles should vanish from the system due to Upgrade.

[arpan_paik]

 I checked in suim but the role seems to be non-existent in the system. There is no change document ... 

Have you tried change documents for create/delete role?

Regards,

Arpan Paik

[Former Member]

Have you tried change documents for create/delete role?

Unfortunately I did it and no roles is listed.

I don't know also why only Z* roles coming from our dev project system have been deleted and not them coming from our dev maintenance system.

Regards,

Fred

[Former Member]

Possibly someone removed the client copy protection in SCC4 and when cleaning up transports an old client copy was imported.

Client copy of SAP_AUTH or SAP_PROF will first drop all the data in the tables...

Check the transport / import log!

You may need to export a copy from your QAS and import it into PRD again and then try to get the user assignnments puzzle put together again.

ps: You seem amazingly calm. It must be quite a chaos there on your side with everyone loosing their access....

Cheers,

Julius

[Former Member]

Thanks Julius. I will check what you told me.

I'm very calm because it isn't a production system :). We are currently working on our sandbox system

[Former Member]

That is nice(r) for you then..

A client copy is then quite likely. They basis guys sometimes make one before big changes or even system copies and then import them again afterwards - for example to have their old sandbox access back again and not be "stuck" with the source system roles afterwards.

Cheers,

Julius

[Former Member]

A client copy is then quite likely. They basis guys sometimes make one before big changes or even system copies and then import them again afterwards - for example to have their old sandbox access back again and not be "stuck" with the source system roles afterwards.

You're right !!! A export client with profile SAP_USER has been done before the refresh and has been imported afterwards.

I'm now checking with the security team to know if they applied their Transport request in sandbox system. But I already know the anwser :).

Thanks for your help !

Fred

[Former Member]

One more question !

In order to restore all profiles and roles of our production system into our sandbox, I think to do an export using client copy profile SAP_PROF and generate a transport request to import in our sandbox.

But our current production system is not yet upgraded and have not the same release level than our sandbox. Do you know if my scenario can be done ?

Thanks for your help !

Fred

[Former Member]

It depends on what you want to test in the sandbox.

Test upgrading the roles it will be fine to do that.

Just continue using them will not always work for all users. SAP_NEW would be an interim workaround (make sure to use only the sap_new's of that release gap).

Cheers,

Julius