MSMP Role Approver Workflow

[Former Member]

Hi Team ,

I am having issues troubleshooting my Role approver workflow in GRC Access Control 10.0 and would appreciate if you guys have any valuable inputs.

I have created an Custom BRF Intiator and have added it in my MSMP workflow and have my rule result mapped to the Path ID in MSMP. I am using the SAP delivered Role Owner (GRAC_ROLE_OWNER) as the agent for only stage that i have configured in the workflow Path. I have my role imported to GRC box and it has the Role Approver mapped to it (Role Owner has the MSMP Role Owner role assigned ). When i raise an CUP request , i am able to submit it , however its not getting routed to my path/agent.

When i look into the administration of this access request , it says Path and Stage are unknown. My BRF Intiator rule is fine as it works when i simulate it.

All my other workflows are working fine .

MSMP Configuration :

Step 1: Standard process id used

Step 2: BRF initiator rule used and mapped this rule to rule reset value.  Under Process imitator selected the BRF Initiator rule

Step 3: Choose the sap Standard Role Owner as the agent.

Step 4: No changes done to Variables and Templates

Step 5: Created a New Path for this Workflow. Added my Role owner as the only Agent for this path . Maintained the task as well as Stage configuration settings there for the Role Owner agent.

Step6: Choose the BRF initiator rule, select the relevant rule result value and map it to the path created in step 5.

This is driving me crazy . Am i missing something here ?

Vikas

[Former Member]

Hi Vikas

Have you added the agent in the stage by clicking on modify button and the hyperlink for show details.

There in you have to specify the details for the agent not in the task settings .

Can u please check...

Thanks!!

Jyotsna

[kevin_tucholke1]

Vikas: 

I know that this may sound elemntary, but after you did the Route Mapping (what you call step 6), did you complete the following items in step 7:  save/simulate, add to the transport, and then activate to get a new version??  did you get any 'red' issues?

Also, when you created your Initiator Rule in BRF+, did you activate the Expression, then the funciton and then the application?

Have you checked in the MSMP Instance Runtime Monitor (GRFNMW_DBGMONITOR_WD) to see if the Message Log can give you any details where it is failing?

Without seeing your config, it is very difficult to pinpoint the EXACT type of issue, I can only say that it seems like the result is somehow not mapped correctly to the workflow so it does not understand where it is supposed to go.

Thanks.

Kevin.

[Former Member]

Kevin,

Thanks for your inputs.

After I save and activate my MSMP version, I don’t get any red issues there. Also I have activated my Expression, function as well as Application in BRF+ initiator rule.

I also tried to looks for some MSMP logs using Grfnmwmsmpmon in SE80, however no luck there. Let me have a look at the MSMP Instance Runtime Monitor (GRFNMW_DBGMONITOR_WD) to see if the Message Log can give us any details there.

Vikas

[Former Member]

Kevin,

MSMP Instance Runtime Monitor (GRFNMW_DBGMONITOR_WD) pulls up the same information that we can see using Grfnmwmsmpmon in SE80 , so no luck there as well.

Anything else that we need to look for while configuring Role Approval workflow.

Vikas

[kevin_tucholke1]

Vikas:

Maybe I need to back up here....

Are you trying to do a former CUP request (SAP_GRAC_ACCESS_REQUEST) or an former ERM (SAP_GRAC_ROLE_APPR) request.

When you said Role Approver and CUP I immediately assumed this was an access request, but get the feeling that this is to be a ROLE APPROVAL (role maintenance approval) request.

These are entirely 2 separate workflows, just as they were in AC5.3.

Please let me know otherwise I will more than likely give you the wrong answer.

Thanks,

Kevin

[Former Member]

Kevin ,

Thanks for your valuable time.

Just to clarify . I am trying to configure my CUP (ARM) workflow , so that my users gets provisioned after their roles in access request are approved. After i submit my request , i am not able to get my workflow routed to roles owners for their approval.

I am using an Initiator Rule (BRF Plus Flat rule) where my condition column is REQUEST TYPE and Result columns are LINE_ITEM_KEY and RULE_RESULT.I am able to configure the values for RULE_RESULT (then map it to my MSMP Workflow) , however i am not sure about the value relevance for other column. Do i need this column if i only have one value configured for my condition columns or shall i use the BRF Plus rule here to get my initiator condition configured.

Thanks,

Vikas

[kevin_tucholke1]

Vikas:

whenever you have line item key, you need to enter the Context Parameter ITEMNUM....what this does is create a table where line item number and result key would be mapped together to send the data back since you are using a line by line BRF+ rule..

If you don't have the line item object there, this is probably why it is failing.

ANY Flat rule will need to have the LINE_ITEM_KEY column filled in with ITEMNUM or an equivalent in the context structure.

thanks,

Kevin

[Former Member]

Hi vikas,

Just to be sure :

1) Have you made the rule Id that you have created using BRF+ as Process Initiator.

2) Have you also added Owners/Approvers in the role maintenance for that particular role and also check the checkbox for "Assignment Approver".

Thanks and regards

Ankit sharma