GRC 10.0 Access Control - Emergency Access

[Former Member]

Hi Gurus,

I have another question.

I configured the emergency access as described in the "AC 10.0 Pre-Implementation - From Post-Installation to First Emergency Access" guide.

When I finished, I logged on to the GRC Backend with the ZFFUSER and started the transaction GRAC_SPM.

The problem now is, that I am not able to see the Firefighter ID to logon to the remote system.

The User has the following roles:

SAP_GRAC_SUPER_USER_MGMT_USER

SAP_GRC_FN_BASE

SAP_GRC_FN_BUSINESS_USER

The User ZFFID is configured as a serviceuser in the remote system and hast the following roles:

SAP_GRAC_SPM_FFID

Do you know what I did wrong?

Regards,

Sebastian

PS: I read in the RKT Material, that the Firefighter User need the role SAP_GRAC_SPM_FIREFIGHTER in the AC System but this role does not exist.

[Former Member · Accepted solution]

I found the solution:

The Role which is delivered by SAP has insufficient rights.

[Former Member · Accepted solution]

Hi Sebastian,

Which role was it ?

Regards,

Ajesh.

[Former Member · Accepted solution]

The Role

SAP_GRAC_SUPER_USER_MGMT_USER

for the Firefighter User in the GRC System and the Role

SAP_GRAC_SPM_FFID

for the Firefighter ID in the target system.

I gave them SAP_ALL and the problem was solved. I have to trace with rights you realy need.

[Former Member · Accepted solution]

Thank you. Just wanted to know, also it might help others

Just a thought, see if assigning base roles solves the problem.(SAP_GRAC_BASE & SAP_GRAC_END_USER)

Regards,

Ajesh

[Former Member · Accepted solution]

The Role that you need to modify is a copy of SAP_GRAC_SUPER_USER_MGMT_USER.

Assign the object GRAC_FFOWN with the following values:

Activity (ACTVT) - 03

GRAC_OWN_T - *

GRAC_SYSID - *

GRAC_USER - *

Regards,
Mario Baez

[Former Member · Accepted solution]

Thanks, this worked.

[Former Member]

Hi Sebastian,

If you are not seeing any FFID to login, then there is none assigned to the user.

Try assigning a FFID from NWBC-->Access Management-->Emergency Access....

Before that make sure to maintain Owners and controllers:

1.NWBC-->Access Management-->GRC Role Assignments-->AC Owners (Here maintain User ID as FF owner & Controller)

2.NWBC-->Access Management-->Emergency Access Assignment--> FF IDs (Here maintain Owners and Controllers)

Regards,

Ajesh.

[Former Member]

Hi Ajesh,

I already did this, but nothing shows up.

Please find attached the screenshots.

Best Regards,

Sebastian