Global rule set are not detecting SoD ....

[Former Member]

Hi,

I am working on an assignment and need your help to over the situation.

I am setting up GRC AC 10 demo system. So far ARA is configured and want to test SoD functionality before proceed next.

I made a "ztest_role" and put few basis tcodes in it to make conflict.

I ran risk analysis on a ztest-role with global rule set but no conflict/risk is being detected. When I do same with user-defined rule-set, It’s showing conflict.

I generated/regenerated SAP given global rule set many time but no difference.

Please help me to overcome this situation and guide me in right direction.

Thank you so much....

Regards,

Nasir

[Former Member · Accepted solution]

Hi Nasir,

Did you check the table GRACACTRULE table. Do you see any entries in it? Incase if the table is empty, the rule generation is not appropriate. Ensure to regenerate the rules.

I also recommend you  to run the batch risk analysis job in full sync mode. Additionally, execute the three additional sync jobs with SA38:

GRAC_ROLEREP_PROFILE_SYNC

GRAC_ROLEREP_ROLE_SYNC

GRAC_ROLEREP_USER_SYNC

You can refer SAP Notes # 1825119 and 1824956 which are relvant to the current issue.

Regards,

Raghu

[Former Member · Accepted solution]

Hi Nasir,

I guess you uploaded the rules against the custom rule set and not the global rule set.

You can check the rule set selected in any of the risk under the tab rulesets in the risk.

Thanks

Japneet Singh 

[Former Member · Accepted solution]

Hi Raghu,

First of all thank you for reply. I have checked table GRACACTRULE and found 169049 entries there. I already
done the sync job for role, use & profiles and regenerated rules many times
before this post.

Now looking into SAP notes. Any other idea or advice ……

Thanks, Nasir

[Former Member · Accepted solution]

Hi Japneet,

Thanks for your
attention, I hav’t uploaded any rules manually. I am working on GRC AC 10, I enabled relevant BC. Might be I am unable to understand you. If you explain it in more details that great. Thanks.

Regards, Nasir

[Former Member · Accepted solution]

Hi NAsir,

To me it looks as if you have uploaded the rules only for the custom rule set and hence you are getting

the violation only when you select the custom rule set.

Please check the check the report "Access rule detail" & "Access rule summary".You fill find the reports in NWBC-> Reports and Analytics.

Please run the reports by selecting both the rulesets one by one and let us know how it goes.

Thanks

Japneet Singh

[Former Member · Accepted solution]

Hi Nasir,

I doubt on the connector settings. Have you configured all the connections. Plz check.

Regards,

Raghu

[Former Member · Accepted solution]

Hi Raghu,

Your first reply was spot-on, sap notes fixed my problem. Thank you so much. Now I am fine with role level  but user level is still giving me blanks results. Any helpful hint......

Regards,

Nasir

[Former Member · Accepted solution]

Hi Nasir,

Do you see the user listed? What happens if you run a Risk Analysis on the user who has SAP_ALL profile (just to identify if the ARA is able to return risks at the user level or not). Also, make sure that there are no blank entries anywhere.

Regards,

Raghu

[Former Member · Accepted solution]

Hi Raghu,

I really much appreciate your quick reply and help. When I ran SoD on user level there are blanks, no nothing result appears.

And do you mean for "make sure that there are no blank entries anywhere"?

Regards,

Nasir

[Former Member · Accepted solution]

Hi Nasir,

Did you run the Risk Analysis on a user who has SAP_ALL? If yes, and the screen is blank, I recommend you to perform a Full sync again. Also, make sure that you are not running the risk analyis in Offline mode. Refer the parameter in SPRO IMG --> Maintain configuration settings --> Param ID 1027. The value should be No. This will make sure that it performs only online risk analysis.

Regarding blank entries -> Ensure that you didn't click + sign for system/user in the initial screen and left that row unfilled.

Rgds,

Raghu

[Former Member · Accepted solution]

Hi Raghu,

I checked config again and found that "1027=No" is correct.

I performed a full sync again but no difference. I am attaching snapshot for you.

Risk Analysis are good on role but blank on user, any other idea...

Regards,

Nasir

[Former Member · Accepted solution]

Hi Nasir,

Can you remove * for User group, and custom user group? Also, are both these users Dialog users? Can you select "All" and run the Risk Analysis.

Rgds,

Raghu

[Former Member · Accepted solution]

Hi Nasir,

Are you by an  chance on SP 11?  In SP 11 there were few bugs.These bugs were resolved in the note 1824956 & 1817251.

I also assume that you are able to find the user in the tables GRACUSERCONN for the specific connector.

Can you do one thing, Assign a couple of roles (That has violations) to a user, run the Sync job again and then run the risk analysis for that user.

Please make sure that the Value of the configuration parameter 1026 is set as '0'.

Also,if the value of the parameter 1037 is set to "yes",Make sure that you have the supplimentary rules otherwise change this to "NO".

I hope this will help.

Thanks & Regards

Japneet Singh

[Former Member · Accepted solution]

Hi Japneet Singh,

I would like to say thank you very much for this help. I am fine now.

Regards,

Nasir

[Former Member · Accepted solution]

Hi Raghu,

I would like to say thank you very much for this help. I am fine now.

Regards,

Nasir

[Former Member · Accepted solution]

Hi Nasir,

I am gald to hear that the issue is resolved.

I would request you to please share the root cause of the issue. Was my answer of any help for you?

Thanks

JP

[Former Member · Accepted solution]

Hi Japneet,

I am sorry to say that I can't pin point the season of problem but most likely SAP Notes  remediate the problem.

Regards,

Nasir