GRC AC 10: How to create custom Detour (Routing Rule)???

[former_member184114]

Hi All,

I want to create a custom routing rule for my workflow. However, it seems that I still have to understand how it is created in BRF+.

So far I have created Initiator and Agent rules using BRF+ and it worked fine.

Based upon my business requirements, now I need to create a Routing Rule (Detour) whenever there is SOD violations exists in a request. Therefore, I was trying to create the same using BRF+. In this regard, I have created a rule using SPRO->GRC->AC->Workflow For AC->Define Workflow-Related MSMP rules.

It got created successfully. However, I am lost while creating a "Decision Table". How can I create it?

I dont know on what basis I should create it and what fields I should include there.

Please suggest.

Regards,

Faisal

[Former Member · Accepted solution]

Hi Faisal,

You can create the custom Detour in BRF+. The conditions are default, but you can choose and customize their Attributes.

And, regarding the Decision table, you can find them in the same package where you defined the Rule.

You may refer this Note 1671150, to know more about Routing Rules and its creation.

Also refer the below Notes:

-1719584

-1731073

-1672088

Hope this helps!

Thanks & Regards,

Shreya Gupta

[former_member184114 · Accepted solution]

Shreya,

Thanks for you reply.

The note 1671150 is for ABAP based rules. However, I am looking for BRF+ solution for creating Routing Rules.

As pointed out earlier, I have learnt that BRF+ "Routing Rules" are not supported by SAP as of now.

Again I am pasting the same link below:

http://scn.sap.com/message/13365907

May you confirm the sam?

Regards,

Faisal

[Former Member · Accepted solution]

Hi Faisal,

Creation of routing rule is same as the creation of Initiator rule.

Its just that routing rule triggers whenever there is an SOD conflict.

For that you need to make the setting in "Modify task settings" for a stage and activate routing and then

enter the rule id.

After that whenever there is an SOD conflict it will route to the desired routing rule.

Thanks and Regards

Ankit sharma

[Former Member · Accepted solution]

Hi Ankit,

So we have to create BRF+ rule for Routing or we can use the Function module based routing rule.

Please share your input on this.

[Former Member · Accepted solution]

Hi Sachin

Predelivered function module can be used as routing rule and if you want to create you own,

Then it can happen using BRF+ as well.

Thanks and Regards

Ankit sharma

[Former Member · Accepted solution]

Hi Ankit,

Looking for your input & advice on this.

Case 1:If a request contains no SoD then it goes to approvers after this goes to security team & Then auto provisioning.

Case2:If a request contains  SoD then it goes to Local approvers after this goes to security team & Then auto provisioning.

Here Local approver is 2nd approver.

For case 1 i am using Directly Mapped users & tested its gone fine But for case 2 i am also looking for Directly Mapped users any advice on this.

So how i used both Cases in one Path with user of Function Module.

Please Advice me.

[Former Member · Accepted solution]

Hi Sachin,

I did not get you correctly,Is it that you want two paths for same request.

And could you explain what is local approver.

For my understanding, if you want both cases, you need to create 2 paths and ot could be by using BRF+ or Function module.

I would prefer BRF+ as you can create your own initator and agents and paths as you want.

Because when you go into MSMP in the route mapping tab there it asks for routing rule , from which path you want to redirect to. SO lets say if there is a SOD conflict in path 1 then in route mapping tab you could navigate to the path that you have created for Routing rule.

And inside a path you can have loical approver and security as stages.

thanks and Regards

Ankit sharma

[Former Member · Accepted solution]

Hi Ankit,

Let me explain you.

If any request which contain no SoD then after approval by approver or role owner its goes to security then auto provisioning.

Request rise->Approver-->Security-->Auto Provisioning [NO SoD]

If any request which contain SoD then it goes approver to Local approver or role owner then its goes to security then auto provisioning.

Request rise->Approver-->Local Approver[SoD]-->Security-->Auto Provisioning

Loacl Approver is just like a approver but for Location wise

So i have to create 2 paths 1 for no  SoD & Other for SoD.& in maintain route mapping connect both 2 paths

Please advice.

[Former Member · Accepted solution]

Hi Sachin,

That is perfect.

thanks andRegards

Ankit Sharma

[Former Member · Accepted solution]

Hi Ankit,

Need you help on this.

How i joined both 2 paths in one route.

Pls advice on this.

No SoD Path Contains 2 Stages[GRAC_Default stage & GRAC_Security]

SoD Path Contains 3 Stages[GRAC_Default stage, GRAC_Role Owner & GRAC_Security]

Correct me if i am worng

[Former Member · Accepted solution]

Hi Sachin,

Here you go:

First create a regular path1 with 2 stages[GRAC_Default stage & GRAC_Security] consisting of initiator rule.

Then create another path2 for SOD with 3 stagesGRAC_Default stage, GRAC_Role Owner & GRAC_Security] and then at the route maping tab select routing rule - rule id and then it asks from which path to which path you want to divert. Then in the "From" textbox enter path1 and in "To" textbox enter path2.

And you have your answer.

Thanks and Regards

Ankit sharma

[Former Member · Accepted solution]

Hi Ankit,

Follow that process what you said.

But when i activate it shows error.

MSMP process SAP_GRAC_ACCESS_REQUEST version IMG Configuration Tables contains errors

Version could not be generated

Maintain route mapping for rule GRAC_AR_INITIATOR for process ID SAP_GRAC_ACCESS_REQUEST

Configuration ID GRAC_SOD_STAGE check reported errors (BADI for task TS76308026 - class CL_GRAC_ACCESS_REQUEST_WF)

Please help.

[Former Member · Accepted solution]

Becuase you must not have done the "modify task settings" for the stages that you have maintained in the path.

Do the "Modify task settings" for each stage and then it will be activated.

Thanks and Regards

Ankit sharma

[Former Member · Accepted solution]

Hi Ankit,

I have already done the modified task settings.

Please see all stage screenshot.

Correct me if i am wrong.

Message was edited by: sachin sarswat

Message was edited by: sachin sarswat

[Former Member]

Hi Sachin,

Few things you have to do for making a perfect routing rule, while creating the stage make sure routing is enabled. please see the attached screenshot.

[Former Member]

HI Ankit,

Is this routing enable for Both ADMIN & ROLEOWNER Stage.

If i am using routing on both then i have to approve a request 4 times.

Any inputs on this

[Former Member]

Hi Sachin,

If you want that after SOD admin as well as role owner should also approve then do the routing enable for these stages as well.

Thanks and Regards

Ankit

[Former Member]

Hi Ankit,

Looking for your advice.

I have to create to 2 role owner 2 security.

1 for SoD and 2 for no SoD

[Former Member]

Hi Sachin , Are you able to resolve this ??

[Former Member]

Hi anil,

could you please share your scenario.

Thanks and Regards

Ankit sharma

[Former Member]

HI Anil,

Yes, Its done.

[Former Member]

Hi Faisal,

When you create Decision table in BRF+ , you can insert as many rows as required. Each line will match a specific condition based on request attributes depending on the columns you selected. Each line will be mapped to a path in the MSMP Workflow configuration, make sure you give it a unique result value in the column RULE_RESULT.

Once you have typed in all different conditions including the result values in the decision table click on Save and then Activate. After this you need to Activate the Function.

Before using this rule you need to make sure that the function, Application and the decision table should be marked with a green light.

Now if you navigate to the function and click on "Show More", then take note of the ID string as this will be used later when configuring the process ID with the new rule.

Now you can Configure this in your MSMP Workflow.

You can also ref to the attachments present in the below SAP Note

#1587505: AC10 Error while activating MSMP workflow with BRFplus rule

#1731073 - BRF+ expression value not visible in MSMP

#1671150: GRC AC Workflow Rules - API for Class Based Rules

Regards

Shaily

[former_member184114]

Shaily,

Thanks for  your kind reply.

I really appreciate for showing all the details for creating BRF+ rules. However, I was looking for the method to create a "Routing Rule" using BRF+.

I have learnt on this network that, routing rule creation using BRF+ is not supported by SAP as of now. Is it true?

I believe, I have to make use of default "GRAC_MSMP_DETOUR_SODVIOL" routing rule here.

Please find below link for the same:

http://scn.sap.com/message/13365907

Regards,

Faisal