GRC 10 ERM Not able to create Business/Single Role

[Former Member]

Hello Experts,

In GRC 10, ERM, i have completed all the pre-requisites i.e. Maintaining Connectors, Configuration for Role Management, Maintained and generated the default MSMP workflow (methodology), maintaining role owners.

Now when i am trying to create a business role or let's say a single role i am unable to to do so as the edit button is disabled.

I just can't get through this.

Have i missed anything, and for the record when i tried to Import the Role(Under Role mass maintenance) from backend system i was successfully able to do so and that way only i could get my first role in GRC via import.

Now if i open this role and try to edit it, can;t do again, because edit button is disabled. But if i perform Role Update(Under Role Mass Maintenance) i can successfully change the attributes and other information and am able to see the new values.

Why is it like this, i am not able to create Roles in GRC, just i am able to import and update from backend.

This is really frustrating..what i am missing over here.

Experts pl. Kindly help!

[Former Member]

This message was moderated.

[Former Member]

Hi Vivek,

Once you click on the addtional details button after defining the attributes, the edit button will be still in gray only.

The next step that you have to do is, click on " maintain authorizations" and maintain the authorizations which will take you to PFCG of the target system and once you finish that click on the "sync with pfcg" and then you can continue with the rest of the steps in the default role methodology.

Regards

Swarna

[Former Member]

Hello All,

When I am trying to import business roles ,I am getting the error as" the child role doesn't exist".

My understanding of the business roles concept is it basically a container which contains single role(s) or composite role(s) which exist in the backend system and they are just easy for business users to select rather than understanding the technical role name.

so I checked that they are available in backend system and also have been loaded into the BRM and then tried to create a business role by role import but it is giving above error.

Can you please let me know if something is missing or if anyone else have encountered similar error and how it has been solved.

Thanks

Uday

[simon_persin4]

It sounds like you might need to re-sync the repository objects to ensure that all of the roles are sync'd into GRC.

After that, the roles will be identified correctly in the right systems.

Simon

[Former Member]

Hi Simon,

I ran the GRAC_ROLEREP_ROLE_SYNC and also all roles are generated. All roles are in Production status. I am able to select the single/composite roles for access requests and once they are approved they are getting assigned to user's profile also on the backend but still when trying to import Business roles it says child roles doesn't exist..

Don't know what is missing..

[Former Member]

Hello Uday ,

I am also getting same issue .Were you able to solve this problem ? How ?

Thanks & regards

Asheesh

[Former Member]

Hello Asheesh,

The basic issue I had was that I didn't give the correct landscape of associated roles for Business roles.I attached a file with screenshot so the associated landscape should be of the associated roles.Hope this helps.

Thanks

Uday

[Former Member]

Hi Vivek,

Once you click on the addtional details button after defining the attributes, the edit button will be still in gray only.

The next step that you have to do is, click on " maintain authorizations" and maintain the authorizations which will take you to PFCG of the target system and once you finish that click on the "sync with pfcg" and then you can continue with the rest of the steps in the default role methodology.

Regards

Swarna

[Former Member]

Hi Vivek,

1) You said you are unable to create business role or single roles. When you open BRM, is the "Create" button greyed out?

2) You said you are unable to edit an existing role. If you select the role, click on the "Open" button, and when the role opens, click on the "More Details..." link, does the Edit button become enabled then?

~Triera

[Former Member]

Hi Triera,

1) After opening BRM, Create button is not greyed out. Its available, and if i click on it, then i see all the possible type of Roles that i can create i.e. Business role, composite role, Group, PD Profile, Profile, Single Role, Template etc.

2) When i try to edit a role by clicking on "Open" , and when the role opens, and then if I click on "Additional Details" (you said "More Details" , i believe you meant that only) link, then also the Edit button is not enabled. Its still greyed.

What else could this issue be possibly about.

Configuration- Check.

Authorizations- Check.

Workflow- Check.

Should i raise it with SAP.

Thanks.

[Former Member]

Hello!,

What are the roles assigned to your user in GRC box?? Are the profiles for those roles generated?

For more details regarding this point check Sec guide, under http://service.sap.com/instguides

SAP BusinessObjects -> SAP BusinessObjects Governance, Risk, Compliance (GRC) -> SAP GRC Access Control 10.0

Also re-check the configuration steps:

http://www.sdn.sap.com/irj/bpx/go/portal/prtroot/docs/library/uuid/80063a8e-1da6-2e10-aaa5-fda1f0936...

Cheers,

Diego.

[Former Member]

HI Diego,

I have got the following roles assigned & generated =>

- SAP_GRAC_ROLE_MGMT_ADMIN (Role management administrator)

- ZGR:FN_ALL (GRC Power User)

- ZGR:FN_BASE (GRC Base Role to run GRC applications)

- ZGR:FN_BUSINESS_USER (GRC Business User)

- ZGR:MSMP_WF_ADMIN (MSMP Overall Administrator)

- ZGR:MSMP_WF_CONFIG (MSMP Overall Configurator)

- ZGR:NWBC (For NWBC)

- SAP_GRAC_ROLE_MGMT_USER (Role Management Business User)

- SAP_GRAC_ROLE_MGMT_DESIGNER (Role Management Designer)

I have cross-checked the configuration,as mentioned in BRM guide.

Is there something else too, that i have missed.

Thanks.

[Former Member]

Hi Vivek,

Please check if the Role types are inactivated by any chance under SPRO - IMG - GRC - AC - Role Management - Deactivate Role Types. Ensure that the checkbox is not ticked for role types which you wish to create

Best Regards,

Srihari.K

[Former Member]

Hi Srihari,

Yes, i have checked that.

No role type is deactivated. All types are enabled.

And i am able to see all types when i click on Create button., but further i am not able to create it.

I feel as if this issue is something else, that no one has come across yet.

Thanks.