GRC AC 10.0 with CUA, ¿where do I start?

[Former Member]

¿How to configure connectors?

¿Which connectors?

¿How to configure scnenarios AUTH, PROV, ROLMG, SUPMG?

¿How users are going to select target system in access request?

Please

Thank you.

Regards.

Leon

[former_member541582 · Accepted solution]

Hi Leon,

You don't need to take any special considerations to CUA connected childs. You configure the these connectors exactly the same as non-connected connectors.

In the SPRO tree, in the User Provisioning branch, you find Maintain CUA Settings. If you have set up everything correctly you will find your CUA system under CUA Global System and all your CUA connected child systems under CUA Model Distribution.

Kind Regards,

Vit

[Former Member · Accepted solution]

Hi Vit

I saw one one other sdn post where u were facing connection issues with CUA child system .

We also have same scenario where GRC is connecting to backend system (CUA child ) ,I am assuming i need to not to connect to CUA master as I want to directly proviosn into CUA chiild system not throught CUA master .

I have made chnages t oSCUM setting also but still cannot create user in CUA child system

Am i missing anything here ??

Please suhhest

Thanks & Regards

asheesh

[former_member541582 · Accepted solution]

Dear Asheesh,

First of all I don't like to hijack others threads, but anyway. If you want to provision to a client that is also a subject to CUA, then you MUST create a connector for the CUA master as well.

That means:

Install the plug-in on the CUA instance

Create connectors (on CUA and GRC)

Add the connector to all the scenarios

If done correctly, the system will automatically pick up which system is CUA and its childs.

Cheers,

Vit

[Former Member · Accepted solution]

Thanks Vit

Little confused .Can you please help with following doubts please :

1. do i need to install on CUA master and CUA child both or only on CUA child .

   I am expecting to do it only on CUA child as we are not connectign to CUA master at all .

2. If I  install pug in on CUA child only ,still do i need to create connecter to CUA master ????

Thanks & Regards

Asheesh

[former_member541582 · Accepted solution]

1. If you want to use GRC User Provisioning on a CUA child, then you need to install the plug-in on both CUA Master and the child system. Also evaluate the option to decommissioning CUA. Then you wouldn't have a CUA related head ache

2. See above answer.

[Former Member · Accepted solution]

Thanks Vit

It means i cannot provision to CUA child system without having plug in or CUA master which is not a case in our sceario .

Does it mean we cannot directly create user in CUA child syste??

Regards

Asheesh

[former_member541582 · Accepted solution]

Hi Ashees,

asheesh mishra wrote:
Does it mean we cannot directly create user in CUA child syste??

I'm not a CUA master myself But as far as I know you cannot create new users with SU01/SU10 on a CUA child. This is done centrally, through CUA and propagated to the child. 

The propagation of the other fields, name, email, roles and profiles are configurable, and can be either maintained globally or locally.

Cheers,

Vit

[Former Member · Accepted solution]

Hi Vit,

Please review the sap note- 1616121 and this should help.

Best Regards,

Nandita

[Former Member · Accepted solution]

Hi Vit

Have you tested this scenario (CUA existing in the same system as GRC)? If so, did it work for you? I reached out to SAP and they said that it's possible for CUA to be in same box as GRC but it's not a recommended approach.

Thanks

Anthony

[former_member541582 · Accepted solution]

Hi Anthony,

No I haven't tested such scenario.

The answer from SAP isn't surprising, they rarely recommends mixing things up.

What you could do is ask basis to copy a client which would serve as the CUA-master. It can, but doesn't need to be on the GRC-application server.

Best regards,

Vit

[Former Member · Accepted solution]

I don't see my child systems even after I have the CUA system as global system

[Former Member · Accepted solution]

I am unable to see my child systems in this section

[Former Member]

Thank you guys!

I could config Maintain "CUA Settings -> CUA Model Distribution" without install Plug-in at CUA system just at child system.

There are many opinios about install or not to install Plug-in at CUA system, I will try to verify this.

Thank you.

Regards.

Leon

[Former Member]

Hello Leon,

We are facing the same kind of issues with CUA configuration.

Did you figure out how to solve it ?

In our case everything seems to be configured properly, we can actually modify master data (name, phone number...) and this is being propagated but it is not working with role assignement

Thanks for your help !

Jérôme.

[Former Member]

Hello Jerome

could you share error messages, audit log info?  please

Regards

[Former Member]

Hi Leon,

The common component settings --> Integration Framework has the option for "Create Connectors" and this would take you to SM59 tcode. Usually Basis team sets up these RFC connections to the subsequent SAP systems that you intend to integrate via Access Control.

You would have to create one connector each for the SAP system that forms a part of the landscape.

Please note that your DEV/QAS systems may have a different set of connectors when compared to PRD as there can be different landscapes that can be used for testing scenarios.

In case of a CUA system in the landscape, the details have to be updated in the below location.

GRC --> Access Control --> User Provisioning --> Maintain CUA Settings --> CUA Model distribution.

Please refer to standard configuration guides and SPRO notes for additional information on each step that needs to be configured.

Hope the info helps.

Regards,

Sri

[Former Member]

Thank you Sri.

In fact I have already configured connectors to diferent backend systems but I have never worked with CUA, I do not know what is the difference of configuring a CUA connector and how to configure parent and child systems, in other words ¿what are the requirements in order to be able to perform activities at "Maintain CUA Settings" option?

Thank you.

Leon