GRC AC 10 BRM: Default Connectors with Multiple Back-end R/3 Systems

[Akshay_G]

Hello Experts,

I am setting up GRC AC 10 BRM Module.

So far i have been able to set up a default role methodology (minimal required steps) and create single/business roles in a back-end system (Read: Default Connector)

My GRC Box is integrated to multiple back-end R/3 systems and for each of them connectors have been maintained.

In SPRO config. there is a setting "Maintain mapping for Actions and Connector Groups".

I have maintained this setting for all the connectors in the landscape and also defined one connector as default for all the four recommended actions.

Now as per the above settings, when i create roles in BRM, in phase Maintain Authorizations, by default the Back-end system is the one that was selected as default connector as above.

I am trying to understand the functionality here.

How do i change that Back-end system for Maintenance, if i wish to create my role in another back-end system in the landscape other than default one.

1) I tried to not assign any default connectors, just maintain them with default un-checked. Then during maintain authorization phase i get error no default connector maintained. So i have to maintain at least one default.

2) I can't assign more than one default connector in the landscape.

So i am wondering how can i define new roles in another back-end without changing this SPRO setting every-time.

I believe in GRC AC 10, most of the features leverage centralization. Firefighting is centralized, so is Risk Analysis.

Please provide your insights, to clear my doubts.

Regards,

Akshay.

[Colleen · Accepted solution]

Hi Akshay

I would assume you have one golden development client per SAP component. So the default connector for maintain authorisations would mean you maintain the role in Development always (and then transport)

if you have multiple SAP components, then you could create a Connection Group for each (E.g SAP_ECC). You would then set up the connector group and map the Connector to it and set up the default connections.

When you choose to create a new role, you would choose which group it belongs to

In relation to centralised - you are right to an extend. However, SP10 has made provisions to decentralise Firefighter

[Akshay_G · Accepted solution]

Hi Colleen,

Hope you are having a nice day.

I have created more Connector Groups and assigned each connector to each group. That way i was able to achieve the target system landscape in a drop-down fashion while creating roles. Thanks a lot.

1) Correct me if I am wrong, Business Roles in AC 10 are always supposed to be within Business Roles Landscape. Because while creating Business Roles default landscape is Business Roles. Also I believe that implies, Business Roles always reside in GRC Box?

2) W.r.t. the point you made above that "for maintain authorisations would mean you maintain the role in Development always (and then transport)", I was wondering that if it is possible to create a workflow such that once the role is created and tested/approved in DEV it can be transported to QA via workflow and in similar fashion to PRD. Is this already an Out-of-the-Box functionality or can be customized accordingly?

Thanks again for your valuable inputs.

Regards,

Akshay.

[former_member652562]

Hi Akshay

You can configure in the BRM for multiple systems and clients for generation of roles.

need to set one parameter for multiple client/system generations allowed. and maintain the connectors in that group for integration scenarios for that client/s. when you want generate you need to select the client which required that role, it will create the role and generate, instead of transport. create scenario in dev and move the configurations to prd. but all required clients are should be in connect group/s.

Ravinder Nalla