Automating Roles Copy and Configuration

[Former Member]

Hi,

I need to copy a bunch of roles, rename the 3 digits suffix, and change the organisational values.

Can this be automated. I have 300 roles to copy and to adapt to new company.

Thanks for your reply.

[Former Member]

Hi beejan,

   you can copy role.

ifrole has assigned user(XXXX).Goto pfcg-->enter roles name--->selecte roles copy--->from and to role name .it  wil make copy and assigned authorization at authorization tab---> generate profile after assign autjhorization(there is one opption organization level,we can set company code)--->assign to user desire user Id.

It will help you.

Regards,

Prabaharan B

[Former Member]

Sure it can be automated.  For 300 roles I wouldn't bother though.  I would create a script (eCATT/LSMW) to copy and rename the role and then manually update the org values.  That's about 2 days work.  You will spend much longer than that automating the org level change in a way that doesn't give the potential to cause some major issue.

[Former Member]

PFCG is a single mode transaction (bar derived roles non-org fields, but that brings more disadvantages withit than advantages.

The bugger with eCatts and similar GUI scripting is release and SP dependencies. SAP changes things at various levels. With 7.31 there were several changes to PFCG but the core functions called are mostly quite stable.

What I use on projects is a "migration toolkit". It becomes worth while once you have enough use for it. You develop on the lowest release and code upward compatibility to the highest release. You then end up with something that looks similar to this and works like a charm...  🙂

If you are using GRC 10 and implement the ERM to manage your roles, then you can also create org sets as templates and assign them to functional roles, It should however not be mistaken for seperating org. fields from functional authorizations, as activity related fields assigned to the same objects as the org fields will hurt you.

Perhaps oneday we will have field sets which have the object as the variable. Using a combination of SU24 and org. sets and considering these restraints in the role design also works fine for me, but is different from customer to customer.

Carving the CO objects which use RESPAREA out of the rest of the concept helps a great deal to simplify the rest... then you end up with rob roles as robust single PFCG roles which are menu driven. I have not had any problems using this approach and when you need to change something you can do then very fast and see what the impact is from adding or removing proposals and org. values.

But... you MUST first build the roles correctly. If you have a spagetti of small single roles clubbed together under composites with a myriad of single assignments with manual authorizations then there is no way out of it again except by starting over from scratch.

Cheers,

Julius