PFCG: Problem with dependency of roles

[Former Member]

Hello all SAP colleagues, and thanks in advance for your replies.

I have a question/problem regarding time dependency of roles. I know that when we want to limit activities by time to any user, we schedule background job PFCG_TIME_DEPENDENCY with daily frequence, but my concern is about a bug I found recently:

Last Friday I went to modify a user via SU01 and I gave him a couple of roles which had to be activated today Morning.

In order to be fully assured the change would be effective because I do not have this background job running, I ran PFUD transaction with this role, to re-adjust the User Master.

To my surprise, this Monday morning I noticed the users were complaining they were lack of access, and when I checked their profiles in SU01, the status of the roles I assigned and compared via PFUD on Friday, were on RED STATUS. My question/concern, is this a normal behaviour? Or is it a bug?

In case of being a bug/program error, what note(s) should I consider revising/applying into my system to correct this problem?

My BASIS release is 701 Support Package 4

Thanks a lot for all of your replies!

Best regards.

[Former Member]

Hi Angel,

I am not sure if you were able to perform a user comparison in each of the roles. The Red Status could be because the user comparison is not done. You need to check that.

Cheers,

Rod

[Former Member]

Hello

Are the roles newly transported to your PRD system? Are they derived?

Kind regards

David

[Former Member]

Hi Ramirej,

  There may be couple of reason for this issue. First check if the roles were generated properly in the production system if the roles were RED, then user master comparison may not be completed properly.

Other reason could be I am not sure if you compared each and every role for user master data for those users.

Please check all the roles first which are assigend to those users if the profiles are genrated properly for them and then run the T-code PFUD for user amste comparison.

Thanks,

Varun Jain

[Bernhard_SAP]

Hello Ramirez,

it is clear, that if the validity of the assignements starts on for instance Monday, 12th Nov. and you run PFUD for that roles on Friday, 9th Nov, that the profile won't be assigned. Of course if you run PFUD on Monday, the profile will get assigned. Therefore it is necessary to have an authomatism and to schedule the job pfcg_time_dependency every night (or an appropriate variant fo report rhautupd_new).

PFUD assignes only profiles for roles, which are valid on the day of execution!

b.rgds, Bernhard

[Former Member]

Thanks a lot for your reply Bernard, it was very helpful.

You helped me to take as an advice, and have cleared more about PFUD transaction. So we are going to schedule job PFCG_TIME_DEPENDENCY with daily frequency in order to re-adjust the user master for those cases when we want to activate roles by a certain date.

Best regards.