AC10: Error when creating a new user on a CUA connected backend

[former_member541582]

Dear forum,

We are trying to create a new user on a backend that is also a CUA child.Provisioning log returning auto-provisioning failed with message “User does not exist in target system <CUACLNT> “

My initial tests back in dec-11 showed me that it worked with no problem. I think we were on SP06 then. Meantime we have been doing testings on a non-CUA connector. Recently we patched to SP08 and also installed the plug-in on the GRC box itself. When I test now, it doesn’t work.

Both checkboxes for “Create user if does not exist” are checked, but seems to be ignored because it is still possible to assign roles to already existing users.

I don't have these issues on backends that are not CUA-childs.

Any input form you guys would be valuable.

Kind Regards,

Vit

[Former Member · Accepted solution]

Hi Vit,

This issue has been resolved in SP09. Kindly upgrade to resolve this issue.

Best Regards,

Smriti

[Former Member · Accepted solution]

Smriti,

could you kindly let us know which note(s) in SP9 fix the error. It is not an option to wait until the SP9 is installed for us, we can install notes much faster and transport to production. Did not know 9 was released already, jeez we just installed 8 on our non productive systems, thought we were up to date...

Cheers,

Sergiy

[Former Member · Accepted solution]

Hi Sergiy,

Sorry, SP09 is not released as yet. I would request you to raise CSS message for the same so that note can be provided to fix this issue for SP08.

Thanks.

Best regards,

Smriti

[Former Member · Accepted solution]

That seems to make more sense, I was quite surprised by your suggestion to upgrade to SP 9 for Vit. I sure hope SAP can provide some corrections to fix this as you said.

Thank you,

Sergiy

[former_member541582 · Accepted solution]

Hi all,

At least some kind of relief to hear that this is an application error. No update on my message from SAP Support yet. But this usually means that this is already reported and they working on a solution.

The bad thing is that SAPonce again forgot or omitted a regression test before releasing a new SP, causing essential functionality to fail. I’m really glad that we are not yet live with user provisioning, because this would be a real party pooper. SP08 has been available for quite a while and I’m certain that I’m not the first one reporting this issue. I think it is a fair and reasonable demand that in the future SAP support should post a note for every SP, describing verified, yet unsolved errors that compromise critical functionality.

For us it is a major undertaking to patch the system(s). We have to find an available maintenance window and coordinate both internal resources and an external service provider. So I really hope SAP Support will release a note soon.

Kind Regards,

Vit

[Former Member · Accepted solution]

Hi,

As per our information SP9 is supposed to be rolled out in early June. Can SAP not come out with an OSS note to fix the issue, if they acknowledge that CUA is having issues being provisioned through GRC.

[Former Member · Accepted solution]

Hi Vit and Naima,

For us SAP note 1691002 solved the issue. PLEASE NOTE that this note is in a pilot release as of today and you might want to add to you OSS message that you are implementing it so SAP notes your customer number. But it did fix the issue for me, no more errors when creating a user and no need to add the system to the request. Hope it solves your issue too.

Cheers,

Sergiy

[former_member541582 · Accepted solution]

Thanks for the update Sergiy! Good news that you were able to fix the problem.

However, the note is released internally only. I guess we others need to wait until they release it.

Regards,

Vit

[Former Member · Accepted solution]

Ah, OK. Yep, they have to add your customer number. Depending on your timing you can demand it I guess in an OSS message or wait till the general release. We were hard pressed to have this fixed...I hope it will work for you as well when you do receive it.

Regards,

Sergiy

[Former Member]

We are also seeing a similar issue with our client. GRC AC 10.0 is not able to provision into CUA and errors out with a message that "User does not exist in target system". On following with SAP we were recommended to have a line in our access request for system and remaining lines for the roles.

However the MSMP workflows fail as AC tries to look for a app-rover for the system, as it looks for a role approval. We were recommended to create a custom BRF+ rule to DETOUR the system line in the access request to a different path and role would go for approval. Please let me know if you see similar experiences. The above solutions seems a little hard to implement,

[Former Member]

Hi Naima,

the strange thing is that it worked fine before SP8. Thankfully we have not implemented SP8 on our production system so there it still works OK, but I will definitely be reaching out to SAP with this. There is a note 1698718 about the boxes for create user being set but as in Vit's and I am sure in your case they are both checked and the note seems to not be valid for when you also have the CUA in place.

In my case the system does not have an approver and maybe because in the config settings we have to auto approve roles without approvers it applies to systems to, but anyway the workflow fails when it tries to assign the role to the user with the same error, User does not exist in CUACLNT.

Don't know if BRF+ would work since it still has a problem with the user not being in CUA client, like in our case. You have to somehow finish one path, create the user and only then try to assign roles.

[Former Member]

Hi Vit,

have you resolved your issue. I am having the same issue after SP08 upgrade.

Cheers,

Sergiy

[Former Member]

Hi Vit,

If its working for non CUA systems, try checking SCUM Settings and see if you can find anything.

If nothing probably OSS message.

Regards,

Ajesh.