Dilemma using "Master Priv" and "Priv Only"

[Former Member]

Hi Experts

I'm using SAP ID Mgmt 7.2 SP4 Patch 1 with standard provisioning framework

Here is my configuration:

a "SAP" repository with :

• master priv set with "PRIV:SAP:ONLY"
• "master priv missing task" point to a job wich assign the "PRIV:SAP:ONLY" (if missing, set the master)
• no grouping rules (due to specific approval for each assignments)

PRIVs from "SAP" repository have "Validate Add task" pointing to a complex approvals workflow.

Here is the process:

1. When I assign a PRIV to a USER who has not "PRIV ONLY", the "Validate Add task" status is "25" : Waiting Add Privilege (the master one).
2. The task "Master Priv missing" is launched
3. The USER has "PRIV ONLY"
4. As soon as ONLY has been assigned to the USER, the approval workflow is launched.

Here is the dilemma :

1. If approvers decline the request, the user keep an account into SAP.
2. If I remove the ONLY because of decline, the user has already received an email with credentials (according to standard framework)

Do you have a way to launch the Approval Workflow even if Master Privilege is not present ?

We tried to add a task into the the provisioning workflow to add PRIV ONLY when required, but if the provisioning is launch is mass (via Business Role for exemple), even if we set "Wait for event task", we are facing issues (setABAPprivilege executed before CreateABAPUser) !!

Have you already faced this kind of issues ?

Thanks in advanced for your help,

Benjamin

[Former Member]

I have the same issue, have not found a workaround.

[Former Member]

Hi Chris,

As a SAP employee can you have some insights from fellow consultants or from projects drived by SAP?

Thanks,

Ben

[Former Member]

HI Ben,

The recommended approach, if possible, is to put the master privilege into the business role.  If that isn't possible, there is no better way to accomplish the "No master privilege" task, other than the way you already described.  I like your #2 procedure you described where you remove the master privilege on decline, perhaps you should turn off the e-mail for the master privilege task and don't send a confirmation e-mail until the other privileges have been approved.

Sorry, I don't have any further advice on this.

Thanks,

Chris

[Former Member]

Hi Ben,

to expand on the last post, put a validate add task on the ONLY:master privilege that will require an approval before the user is created.

Regards,

Chris