GRC 10:NO ROLE owner standard detour path issue

[Former Member]

Hi All,

We are on GRC 10 SP09.I have configured single stage path i.e(Q_PATH with ROLE_OWNER stage).

Enabled the routing rule i.e. GRAC_MSMP_DETOUR_NOROLE_OWNER

Routing Level is Line item level

Created one more path with no stage

Mapped NO ROLE OWNER detour path between main and detour path  at step 6 in MSMP but my request is closing as "No agent found, cancelling path Q_PATH (in stage no. 002 - Z_ROLE_ST01)"

Please suggest me where configuration is missing.

Thanks and Regards,

Sushma M

[former_member193066]

Hello Sushma,

you have not maintained detour for no role owner,

has to be maintained a stage ahead of Qpath.

Regards,

Prasant

[Former Member]

Hi Prasant,

Thank you for your reply.

I have also checked with enabling NO ROLE  OWNER detour path at stage level but didn't work.

Thanks and Regards,

Sushma M

[former_member193066]

lets take an example.

stage 1: manger stage gets approved.

stage 2: role owner stage.. role with role owner will move here , roles without rle owner should go to diffrent path.

++++++++++++++++++++++

during these scenario.. maintain detour at stage 1.. for no role owner once manger approves will go to 2 path.. based on line item.

++++++++++++++++++++

in your condition..

ad route at Stage 01..

go to stage > add route.

Let me know how it helps.

maintain mapping at step6

[Former Member]

Hi Prashant,

I have created path with single stage and enable NO_ROLE OWNER detour path at stage level..

Mapped at step at stage 1 only but didn't work.

Request is failing and also tried to map escape route with no stage but it is not allowing me.

Thanks and Regards,

Sushma M

[former_member193066]

Execute SPRO>GRC>ACCESS CONTROL>WORKFLOW FOR ACCESS CONTROL>MAINTAIN MSMP WORKFLOW

A NEW WINDOW POPS UP ON BROWSER.

SELECT THE PROCESS ID AS APPROPRIATE

EXAMPLE IS OF SAP_GRAC_ACCESS_REQUEST

CLICK DISPLAY CHANGE THEN CLICK NEXT

FOLLOW THAT TILL MAINTAIN PATH.

CLICK ADD (EXAMPLE OF NEW PATH AGRC_TEST)

MANITAIN STAGES FOR THAT PATH

CLICK SAVE.

NOW CREATE 1 MORE PATH WITHOUT ANY STAGE

THE EXAMPLE IS ON ROUTING OF ROLE WITHOUT ROLE OWNER TO AUTO APPROVAL.

YOU CAN ROUTE TO ANY OTHER PATH TO CERTAIN AGENT AS WELL.

CLICK NEXT GO TO MAINTAIN ROUTE

CLICK ADD

FILL THE DETAILS

CLICK SAVE.

GO TO GENERATE VERSION

CLICK SAVE AND ACTIVATE IT

[Former Member]

Hi Prasant,  I have set up as per your screen shot still requesting not taking no stage path in case of no ROLE OWNER.    Thanks and Regards, Sushma M

[former_member193066]

hello,

can u send screen shot..

of access request , which role u select and all.

and ensure your workflow is perfect like all task are maintained.

regards,

Prasant

[Former Member]

Hi Prasant,

Here am attaching my set up and for request log which was already added in my initial post.

Below Routing level was changed to stage level only.

Appreciate your  answer.

Thanks and Regards,

Sushma M

[former_member193066]

why are you enabling at task setting.

you can do it outside.

first>>

where you request hits.. initiator rule.. it goes to Qpath right.

Take example..

i have path A for request with 2 stages.

manager and role owner.

at manager stage i put no role owner detour condition, so once manger approver it checks for condition and route role without role owner to new path PATH B.

those have role owner will go to path A next stage.

Regards,

Prasant

[Former Member]

Hi Prasant,

In Path A-- Yes it is going to next  stage after manager's approval and detour path was enabled at line item level.

why are you enabling at task setting.you can do it outside. -- Can you please explain me where i need to enable out side.

Thanks and Regards,

Sushma M

[former_member193066]

AT manger level eable routing.

in manager stage you give details of stage config id(example 001)

click show details below it

select agent (manager agent)

approver type

then select routing enable

and provide the routing rule(GRAC_MSMP_ROUTE_NO_ROLEOWNER)

at line item level and save it.

map it at maintain route mapping

Regards,

Prasant

9611784434

[Former Member]

Hi Prasant,

We are able to enable No ROLE owner detour path in case we have two stages in our main path.

But we are facing an issue with single stage main path where our request is ended up with appover not found.

Appreciate quick response.

Thanks and Regards,

Sushma M

[Former Member]

Hi Sudha,

In case of single stage path, the logic of detour needs to be embedded in initiator rule itself. You can create a FM based rule or BRF based rule to include condition of no role owner.

Following blog shows how to check no role owner condition in BRF rule .

http://scn.sap.com/community/grc/blog/2013/03/15/using-brf-db-lookup-to-create-complex-msmp-rules

Best Regards,

Aman

[former_member193066]

Hello,

You need to check your requirement because you can have 1 initiator per process id.

if you can share requirement the we could provide approach .

Regarsd,

Prasant       

[Former Member]

Hi Amanjit,

I create the BRF+ rule with DB look up which is working 50% fine.

If we have request with combination of both roles example..Role which has no role owner and another role with Role owner and request is going to same path.

Please let me know am i missing some where.Here am attaching my BRF+ screen and request instance status.

Request instance status

Thanks and Regards,

Sushma M

[Former Member]

Hi Prasant,

We are using BRF+ for initiator in our enviorment.

Thanks and Regards,

sushma M

[former_member193066]

Hello,

What i am looking to help you is.

what are the conditions for you intiator rule.

You might have 2-3-4 or 5 path.

how initiator intiates request .

like on what basis request should go to path 1, on whats basis should go to path 2.

Regards,

Prasant

[Former Member]

Hi Prasnat,

Thanks for your reply.

Here am attaching my BRF+ Decision table how i have configured.

Thanks and Regars,

Sushma M

[Colleen]

Hi Sushama

Have you looked at your MSMP and track it back to the Agent Rule to see if any assigned?

If you use the MSMP default configuration, you still need to add the Agents in the Path/Stages section and then check for that Agent rule how a user is assigned (e.g. Role Owner in the Role definition or PFCG role, etc).

[Former Member]

Hi,

Thanks for your response.

My MSMP is working fine if i raise a request with a role where Role owner is mapped but it is failing to reach to No Role owner detour path in case of role owner missing in the request.

My concern is that if i create request with combination of two roles i.e with role owner and with out role owner then it is failing.

Step 5:

Step 6:

Thanks and Regards,

Sushma M

[Colleen]

Hi Sushma

Not sure if you meant to post screen shots but nothing appeared for Step 5 and Step 6.

In Step 1 for Process Global Settings have you configured default path for No Approver - log says "escape path is not enabled"

[alessandr0]

Dear Sushma,

as I see the path for no role owner is not available / enabled. Make sure that in stage 5 (Maintain paths) the path you are using is available and configured correctly.

Under stage 6 (Maintain Route Mapping) you have to define the path were the NO_ROLE_OWNER rule is going to. This path must be available.

Please check and keep me updated if it is working.

Regards

Alessandro