Model user connector issue

[Former Member]

We have implemented GRc AC10

1) New request

2) Change Request

3) Lock/Unlock Request

Steps

1) When raising  MODEL USER Request for Brand new user as Model of existing user

2) All roles are displaying with connector name ( System) too..

3) If we select system name request getting failed becasue we do not have maintained a owner for system

4) we maintained owners for only roles since request is failing with error : no agent found.

Here we can remove the system before submitting the request it wont be a problem. but our users getting confused how to remove.

Is there any option like where we can hide permanently and eliminate the connector name in MODEL USER access.

urgent help is required and highly appriciated please.

[former_member193066]

Hello,

You can create a routing rule. based on provision action.

Go to Spro>GRC>Access Control>>Workflow for access control>Maintain MSMP Releated rules.

The create a routing ule(BRF+LINEITEM)

seelct provision action from from GRAC_S_Ruleline item.

attaching screenshot.

what you can do is.

you can route system name to a seperate path which do nto have  any stages and auto provision settings to be comleted at end of request, so the user will get created once request get completed and role will also be assigned.

[Former Member]

Hi Prashant ,

Thx for the reply:)    and sorry for not replying to this as  i was an off

Please clear me two things here

1) I already created BRF+ with line item initiator rule for below request types same process ID ( GRAC_ACC_REQ

a) new user creation

b) change user

c) Lock/Unlock/user validity extension

Will it be possible to use same BRF+ to create routing rule as you said? and Please see attached screen shots and advice on the same please.

Reqtypes: 001; create 002: change = path 1

               004; Lock    005; Unlock and 003 ;User validity extn = Path 2

If possible to creat routing rule based on your inputs ,, how it will achieve this in MSMP

Please appriciate for the reply with some solution on this.

Thanks and Regards

Surender Chimarla

[former_member193066]

Hello,

Request type and select provision action as well,please refer my earlier post.

you need 3 path..

path1: request type001,002 prov action assign & retain.

path2 request  type 004,005,005 prov action  xxx

path3..path 3 request type 001 ,002,003,004,005, prov action not equal to assign & retain, remove and all..

Regards,

Prasant

[Former Member]

Hi Surender,

If you remove the Create User and Change User action from your request type then you will not be able to select the systems.

In such case only the roles can be selected and no systems can be selected in the request.

One problem that might arise due to this is that if you are creating the request for a user which does not exist in the systems through Model User, then in the SPRO Setting "Create user if user does not exist for role assignment should be checked" otherwise the request will again get failed saying that provisioning failed..

Let me know if you need more information on this.

Regards,

Khush Bafna

[Former Member]

Hi Khush,

If we select MODEL user, automatically shows a request type ( NEW) in the page so there is no way to remove the request type.

Thanks

Surender Chimarla

[Former Member]

Hi Surender,

You can create a new request type from the SPRO of the GRC box and use it for the request creation through Model User.

please let me know if you need more information on this.

Regards

Khush Bafna.

[former_member193066]

Hello,

You do not need to include system in model user, you can just select role from existing users.

Regards,

Prasant

[Former Member]

Hi Prashant,

Thankx for the reply!!

That we know how to remove the system..

Here the problem is END USER is facing the issue while raising the request..

They are forgoting to remove the system name, so is there any way to remove the systme automatically while selecting MODEL USER request.

Thanks

Surender Chimarla

[Former Member]

Dear Surendra,

Please provide more information. Do you have seperate line items for system and roles in the request?If this is the case,You can remove the line item for the system.

Secondly, Which system owner are you talking about?

Who is the approver of the stage in which the request is getting errored out?

Are you using custom approvers or SAP Deliver agents?

If the stage level approver is the role owner then i am sure there is a role in the request which does not have any role owner.

Thanks & Regards

Japneet singh 

[Former Member]

Hi Japneet,

Thank you for your reply

When raising the MODEL user access request we are able to see the connector name in the same ITEM box along with roles ,that should not happen.

So how to remove the connector name permanently from ITEM box.

Thanks

Surender Chimarla

[Former Member]

Hi Surender,

Assuming that there is a seperate entry for the connector that you see along with the roles.

You can simply select the entries and then click on Remove button (a small single triangle shape pointing upwards.)

This will move back the selected items from selected items window to available items window.

Let me know if you need more information on this.

Regards,

khush Bafna.

[Former Member]

Hi Khush,

I appriciate for your reply on this.

I can understand from your post, you had talking about the upword and down word arrows right.

The same we have proposed to the END USERS while raising MODEL access ... but my client was saying is which i snot good practice in all the times, users may get confused and forgot to do this activity and hence GRC request get failed.

So business is insisting that please remove permanently.

Thanks

Surender Chimarla