User not exist error coming for DDIC while doing user level analysis.

[former_member144617]

Hello,

FYI the following steps have been carried out so far:

1. I I have run User level Risk Analysis with the following parameters.

• User:  DDIC
• System: *
• Access Risks: *
• User Type:  All
• Risk Type:  All
• Rule Set:  Global

But after running the report with these parameters for the critical permission i am getting the error that User Not Exist for DDIC even though DDIC is present.

But when we try to run the same report with the another rule set let suppose RS5 then the proper data is coming.

Don't know why this is happening even though we created the fresh function and risk too and assigned them to Global Rule set still we are getting the same error.    

Any advice would be greatly appreciated.

[alessandr0 · Accepted solution]

Dear Pranjal,

Did you create the rules for the rule set?

SPRO > GRC > AC > Access Risks Analysis > SOD Rules > Generate SOD Rules

Regards,

Alessandro

[former_member144617 · Accepted solution]

Yes Alessandro

All the necessary steps are done as this case is happening only with the DDIC User while performing the same activity on others users is fetching the right data,That is why this case is little bit confusing.

V

[dyaryura · Accepted solution]

Hi Pranjal,

Definitely is weird if you are performing the same analysis but just changing the ruleset.

Anyway, have you checked the user in the GRACUSER and GRACUSERCONN tables? how does it look like for DDIC user? is the user locked or expired? have you tried setting a specific connector instead of "*"?

have you tried removing the selection fields completely instead of setting "*" and "all"?

I think that the note 1853520 - Ad-hoc analysis not taking * in case of blank object range

in't specific to your issue but you might want to check.

Cheers,

Diego.

[former_member144617 · Accepted solution]

Hi Yaryura,

Thanks for the help,I tried by using * in the system for DDIC and then run the Report after that i get the result for all the systems to which DDIC is mapped even with the system (CP1510 system name in our case) which is not coming earlier when we are trying by giving single name only.

Can you please explain why this is happening as when giving individual system it is showing user not exist but when giving * its showing the data.

[dyaryura · Accepted solution]

HI Pranjal,

Probably there's an error in some code with the filters or the user isn't properly located in the tables GRACUSER and GRACUSERCONN.

Can you check via SE16 such tables in GRC box, filtering DDIC user and let's us know the results?

Many people have found issues related to such tables. By the way, have you scheduled the repository synch to run periodically?

Cheers!

Diego.

[former_member144617 · Accepted solution]

Ho Diego,

Yes all the repository jobs are running periodically.

I checked in both the tables and below is the findings:

GRACUSER:

DDIC is coming from GSP800(let assume this system in this case) System which is our CUA System .

GRACUSERCONN:

DDIC is mapped to different connectors even from the GSP800 too and also from the others system.

In this case when we are running the User Level analysis for a particular system this shows no data found but when i insert * instead of any system name this will show all results.