Application Development Discussions
Join the discussions or start your own on all things application development, including tools and APIs, programming models, and keeping your skills sharp.
cancel
Showing results for 
Search instead for 
Did you mean: 

Mass roles changes

Former Member
0 Kudos

Hello All,

I have created a role with following t-codes.

CV01, CV02, CV03, CV04

But now, I need to change CV01 as CV01N, eg: I want role with CV01N, CV02N, CV03N, CV04N.

I can directly go to the role, delete cv01 and add cv01n but I have 90 roles. So, I have to go to each role and modify t-codes and also authorization fields which is a lengthy process.

Please let me know if we have any other solution for this.

Thanks,

Uday.

17 REPLIES 17

Former Member
0 Kudos

Hi...

you have the possibility of using the "transaction inheritance" feature of PFCG.

You'll have to create a "father role" and then use it on the "child roles":

0 Kudos

Hi,

If we create roles freshly we can create parent role and 90 derived roles but these roles are already created, we don't have concept of parent-derived roles here. There are 90 single roles.

1. Is it possible to create Parent role from derived roles?

2. If yes, can we add parent role for all derived roles at a time?

Thanks,

Uday.

0 Kudos

You need to create at least one parent role...

Former Member
0 Kudos

Hi Uday,

You need to create one parent role with transaction CV01N,CV02N, etc

You can then write an ECATT script, for adding this parent role to child roles.

Using ECATT, this addition can be done with in 5min.

Regards,

Laxman

Former Member
0 Kudos

Hello,

I've just checked in our system and, once you have maintained the set of roles currently in SAP which contain the CV01 tcodes, creating parent roles won't work as the 'derive from role' field is greyed out.

Are all the roles identical with just org levels being different?

Kind regards

David

Former Member
0 Kudos

Hello Uday,

  I am not sure if you can modify the roles using the scripts .. Quick solution would be create Parent Role, and derive the child roles either manually or via E-Catt script .

Thanks

Rajendra A

0 Kudos

Hello

As I mentioned previously - the parent/derived option is not an option as the original set of roles have already been built and the derive from option has expired as far as I can tell. If you want to try creating a new test role with CV01 in it and GENERATE it and see if you can then assign a parent role to it then it may behave differently in your systems but I doubt it...

For 90 roles I would just get on with the job - possibly make life a little more bearable if role maintenance is too much work by going in via SUPC. Not a massive job and the client is paying to have in done correctly afterall 🙂

Cheers

David

0 Kudos

Agreed. On both points.

90 roles over the 4 days that this thread has run so far - I reckon I could manage a work rate like that 😉

Former Member
0 Kudos

Hello Uday

Either you can follow the solutions provided by all gurus over here or you can go with thez solutions

Like If your management has anyhow decided to replace CV01 with CV01N then why you want to replace all the 90 odd roles with the new T-code ..Instead what you can do is you can lock the old T-codes and create a separate single role and  add all users who requires that particular transaction .

0 Kudos

Hello

What you are proposing is a 'work around'. If you are happy to use this method then that's your call. You're leaving a mess in the system, the admin team won't understand and the simplest way (even if Uday has left the building) is to get on and do the work properly.

Kind regards

David

0 Kudos

Very good observation David 🙂

Such tricks to make things work for a while are a massive pain at upgrades. Upgrades are the acid test!

A soft-change approach would however also be a temporary trick -> in SU24 you can also add the new tcode as an S_TCODE proposal for the old one. This does not disturb the sanctity of the old auths but merging will add the new tcode. Downside: The old one will still be available however for the "die hards" and those who are religious about user menu navigation.

Then you can in peace adjust, test, restrict the roles's SU24 proposals for the new tcodes and then switch the menus and remerge.

Ps: if a role once was derived, then the field is grey. If you navigate into change mode on the auths tab and then switch back to the description tab, then you can maintain it again as the field status is not set consistently in all the screen programming. You might find a secret toolbar here as well 🙂

Cheers,

Julius

paula_w_arnold
Explorer
0 Kudos

It is possible to build a parent role and then make the existing roles become the children.  The reason the existing roles do not allow for a parent/child connection to be made is because these roles contains transaction codes.  If you remove all of the transactions codes from the menu and then save the role - it will then allow for a parent/child relationship to be established.  The children roles inherit their transaction codes from the parent role. We have used this process successfully in ECC6. 

If you are in doubt and need to actually see this, then copy one of your roles to be a test case and give it a try.

0 Kudos

It I remember correctly, you can also delete, hit Enter twice. Enter the parent. Then adjust and save.

But that might have changed in new releases and the proposals will be diferrent.

This is the point where some folks give up unfortunately and start entering manual auths..  😞

Cheers,

Julius

fredrik_borlie
Contributor
0 Kudos

If you download the roles you will be able to edit them in a texteditor.

Then a simple search/replace function will easily solve the issue in 90 roles.

Save and then upload.

Done in 5 minutes.

Regards

Fredrik

0 Kudos

The original poster wants to replace CV01 with CV01N, so if he does a simple search and replace in the text files, he's going to end up with too many characters in a row.

Obviously you can get around that with a little more manipulation of the text file, but as has been mentioned here before, there is very little validation when you upload roles - so you need to make sure you get it right, or risk corrupting your 90 roles.

0 Kudos

Hello Will

And I think the SU24 values are possibly different too 🙂

Cheers

David

0 Kudos

Hi DB,

Yes, good point. I mentioned the characters because I still remember counting the number of white spaces when you created the "Thing of Evil"