AC 10: SAP_GRAC_NWBC vs SAP_GRC_NWBC

[Former Member]

Hello Gurus,

i got a question. I got 2 roles:

• - SAP_GRAC_NWBC (without any authorization objects) and
• - SAP_GRC_NWBC (there is only the transaction NWBC)

I want to Audit Reports in NWBC and found out, that I need the role SAP_GRAC_NWBC to see the item “Audit Reports” in letter Reports and Analytics. When I got the role SAP_GRAC_NWBC i will get more options that i can do, but i only want that the user can see Audit Reports.

So I want to learn more about the authorization of SAP_GRAC_NWBC. In PFCG I got NO authorization objects.

Can anybody help.

With kind regards

Murat

[Former Member]

hi,

we came across the tabs stuff. If I remember correctly, the tabs in the GRC is controlled by the folder in the 'Menu' tab' in the role. If you see the role SAP_GRC_NWBC , there are several folders. Open each one and u will find the web dynpro application.

Make a copy of the role and then remove the folder for those you do not need.

[Former Member]

The "GRC" specific role seems to have the menu/tabs/folders mapped out in a slight generic format, i.e. combining AC-PC-RM type links on the same tabs, whilst the "GRAC" version seems to make the list of links/tabs more Access Controls centric.

When a end user is using GRC for just AC, I tend to provide the user with the GRAC version of the role. Mind you, I have also realised that S_TCODE = NWBC is sometimes missing from some of the roles where you would expect it, so its probably a good idea to provide the pre-delivered NWBC role also.

[kevin_tucholke1]

NWBC is a transaction on the ABAP side to execute the embedded NWBC client in GRC. 

I would look at the securitiy guide to see what you can limit on.  You can find on http://service.sap.com/instguides

NWBC uses ABAP roles, but they are authorization only roles for the most part.

You may need to have to create a new role with just the allows the My Home and Reports and Analytics screen.

Kevin