BRM: Can roles be moved to multiple systems???

[former_member184114]

Hi,

While creating roles in BRM, it picks up the default system maintained in "Action Mapping" in SPRO. I was wondering if the same role can be moved (created/modified) in multiple systems at the same time.

Please advise.

Regards,

Faisal

[AndrzejP · Accepted solution]

Hi Faisal,

Yes, if you create connection group (roles will be automatically created on each connector / system in group), maintain also parameter 3012 (Allow Role Generation on Multiple Systems).

Best regards, Andrzej

[former_member184114 · Accepted solution]

Hi Andrez,

Does it mean that roles will not be transported using TRs, which is a traditional method for transporting roles to different systems?

If these roles are created in multiple systems, then will they be created at once as soon as the role owner has approved or first development, then quality, and once UAT is completed in quality, it is moved to production system?

Please help me understand this further.

Regards,

Faisal

[AndrzejP · Accepted solution]

Hi Faisal,

if you create roles directly from BRM (e.g. in DEV & QA environments) those roles will be created directly in those systems together with generated profiles. BRM does not generate transports.

If your change management process requires transports to QA, you could create roles in DEV only (if you have more then one client/mandant roles could be created on all of them), then after unit testing create a transport and move them to QA and PROD.

Regards, Andrzej

[Former Member · Accepted solution]

Hi Andrzej / Faisal

So after generating a role from BRM in DEV, QA & PRD simultaneously, if that role was assigned to a user in PRD, this user could bypass testing in QA. Do you know any way to restrict access to generate roles in PRD, but without changing the connection group?

Thanks and regards!

Fernando

[former_member184114 · Accepted solution]

Hi,

I think you can do it by removing it from Action#3 in Mapping for actions and connectors

Just got a thought, so shared.

By the way, how a user can bypass the testing? It is a role which will be tested first and then generated.

Regards,

Faisal

[Former Member · Accepted solution]

Hi Faisal, thanks for your reply.

In my BRM methodology, role generation is before testing because I need the role to be generated in QA to assign it to the user.

The thing is that when I generate the role, I can select every connector in the same connector group. So, if parameter 3012 is enabled, I could regenerate an existing role that is assigned to users in PRD without testing new changes.

If I remove Action 3 then I won't be able to generate the role and will have to create a transport request.

Regards,

Fernando

[former_member184114 · Accepted solution]

Fernando,

Have you tried restricting the same with authorization? May be you can find something there?

Regards,

Faisal

[Former Member · Accepted solution]

Faisal,

I've tried doing so, but there's not an authozation object to restrict role generation on a particular system. The object GRAC_ROLED with ACTVT 64 restricts access to generate role, but this object doesn't have any field like connector or system.

Thanks again.

Regards,

Fernando

[former_member184114 · Accepted solution]

Fernando,

Can you please check using GRAC_SYS and restrict GRAC_SYSID to the desired system?

Regards,

Faisal

[former_member184114 · Accepted solution]

Fernando,

Can you please check how you can use parameter 3012?

Regards,

Faisal