Role Import doesn't select all roles from source system

[Former Member]

Hi Experts,

I am trying to import all roles in the Z namespace into GRC from a source environment.

We currently have over 130 Z* roles in this system, but I am only able to find a few when following the Role Import guided proceedure.

Configuration:

Role list returned:

What am I missing?

Cheers,

Sam

[former_member225453 · Accepted solution]

Hi Sam,

It seems that Repostiroy does not have all the roles you are referring to. So, kindly run the repository

sync job in your GRC system. Once it gets completed, please check if all the roles (130 Z* roles) are fetched into GRC box or not.

If yes, then try again importing the roles same way.

In case the issue still persists, you need to analyze the short dump in ST22. The following parameters should be set as per sizing guidelines. The reason for the dump can be due to large number of Roles to be Imported.

ztta/roll_area, ztta/roll_extension,

abap/heap_area_total,

abap/heap_area_dia,

abap/heap_area_nondia, em/initial_size_MB.

Check for the adequate values for these parameters with the SAP Basis person.

If the above mentioned parameters are maintained correctly and you still receive a dump, you need to lower the value for the Parameter ID 1122 (Batch size for Role sync).

Hope this Information helps!

Best Regards,

Shreya Gupta

[Former Member · Accepted solution]

Hi Shreya,

Thanks for your response.

I had previously set up the repository sync job to run daily, and have confirmed there are no shortdumps.

I've subsequently run the repository sync manually - no short dumps occured - and can still only see the reduced list in the Role Import screen.

Cheers,

Sam

[former_member225453 · Accepted solution]

Hi Sam,

Try this Note. It should fix your issue.

1897975 -  Role import does not show roles in the preview

Good Luck!

Thanks & Regards,

Shreya

[Former Member · Accepted solution]

Hi Shreya,

Thanks for your time in helping to solve this matter.

I've implemented the SAP Note 1897975 and its prerequisite re-ran object sync jobs, but still no luck.

GET_RANGES:

Preview:

Cheers,

Sam

[former_member208271 · Accepted solution]

Hi Samuel

I had a similar issue where I could not Preview any Z* Roles for a specific system.

Implementing SAP Note 1897975 in the PLUG-IN SYSTEM resolved this issue.

Regards

Mustafa

[Former Member · Accepted solution]

Hi Mustafa,

Thanks for that, everything is working as expected now.

Cheers,

Sam

[former_member193066]

Hello,

Please use Z* in Roles from selection area , instead on roles to selection area

Regards,

Prasant

[Colleen]

HI Samuel

In your selection can you try the From Field as Z* and leave To Field Blank

Also, are any of these missing 130 roles already in your repository (you had update set as no for overwrite existing role).

Regards

Colleen

[Former Member]

Hi Colleen,

Thanks for you response.

There is currently nothing im my repository.

I've tried that selection values but no luck.

The only thing that makes a difference is z* or Z*:

Selection Z*:

Preview Z*:

Preview z*:

Cheers,

Sam

[former_member306258]

Hi Sam,

Just want to share with you. In our system, if we use z* as role from and to, there's no preview at all. We have to use Z* for both role from and to.

Couple of things I would check:

1- validate the connector and ensure the rfc is actually pointing to ZER 100 (hostname accidentally changed maybe)

2- any error or warning in slg1?

3- what is the user used to connector to the child system via rfc? Everything is ok with that user?

4- also check table GRACROLE for that particular connector group. If it's already there, try setting the Overwrite Existing to yes.

Share with us your results bro.

Thanks

aNuar

[Former Member]

Thanks for your response Anuar,

1. Connector is valid and working as expected. I can search for & find any role in that system through GRC.

2. There are a few warnings in SLG1:

3. User is unlocked & has SAP_ALL & SAP_NEW & the RFC role in the target environment.

4. GRACROLE now contains all the roles I've successfully uploaded via a spread sheet. But when testing the import previously there was no data & Overwrite Existing was set to 'yes'.

Cheers,

Sam

[former_member306258]

This one is tougher than I thought. As for the warnings, I've seen it in our system before. It is either due to the language the transaction descriptions is maintained, or there's no descriptions at all. We can compare your /ASU/MAINTAIN with ours.

In our SU24, it is maintained as below:

And this transaction does not appear as a warning in our sync job. Can you check on your end for this tcode?

How about the ID you are currently logged into the role import page (it's your ID i assume)? Do you the following auth for that ID (not the ID in RFC)

Thanks,

aNuar

[Former Member]

Hi Anuar,

I've cross checked with other environments & our SU24 for /ASU/MAINTAIN seems to be the same:

My user has a RFC specific role with the following authorisations:

The upload of all roles using the spread sheet template has been completed, making this just an exercise of my own curiosity.  I will close this post at the end of today if I'm unable to get this sorted.

Thanks for all your assistance.

Cheers,

Sam