GRC 4.0 running with GRC 10.1 plugins

[Former Member]

Hi Everyone,

I am commencing a GRC Access Control 10.1 migration Proof of Concept for my current customer. We do not have the luxury of a project environment or of system copying the ERP Development system. GRC AC 4.0 content is currently in use in ERP Production, so the ERP Development system is the configuration master for the GRC 4.0 content.

One of the ealry steps in the migration guide is installing the GRC 10.1 plugins. I have searched on here and on SAP notes but cannot find a definitive answer, though there are a number of threads which come very close to what I need.

My question is simple: once I have installed  the 10.1 plugins will the GRC AC 4.0 content still function?

This is important to us since there is no knowing whether out Proof of Concept will be approved to become a full project. If installing the GRC 10.1 plugins breaks the GRC AC 4.0 content and the project is not approved to continue, we will then have a broken system landscape.

If anyone has any personal experience of this scenario I would greatly appreciate hearing what you have to say. I assume that experience of the 10.0 plugins will be relevant if that is what you have.

Looking forward to hearing from you,

Kind regards,

Andy

[Former Member · Accepted solution]

Hi Andy,

I have a feeling it is not supported, unless you put on the 10.0 version first and then upgrade that to 10.1 (I know bizzare!).

Have you raised a call to SAP OSS via the customer for an official response?

Refer to following SAP note -  not much in there for what you want, but would expect SAP to maybe update this note with more information.

http://service.sap.com/sap/support/notes/1655924

[Former Member · Accepted solution]

Thanks for your response Harinam. Must admit I thought more people on here would have had experience of this jump, but clearly most people went from 4 to a 5.x system. In some ways it is a very good thing the customer has held back from jumping to Java.

Anyway, I had logged a message with OSS in parallel to posting here, thought I would get a good balance of views doing both.

Here is the official answer we received :

Once the GRC 10.1 plugin will be installed on the GRC 4.0 system,
though the 4.0 product is still accessible and the data will still
remain in the tables, it is no longer supported and it must be clear
to your users and administrators that the 4.0 product is not to be
used with the v10.1 plugin.
SAP Active Global Support
SAP Labs Palo Alto

So although I could argue that 4.0 is unsupported so what is the difference, this response is useful to our project team as it further justifies the need to upgrade.

I am still interested in hearing from anyone who has done this migration path and tried the old tcodes, to know for sure what the result would be.

I assume also based on the response from OSS we should lock the 4.0 tcodes to make sure no-one hits an old favourite, seeing as they clearly are not removed as part of the migration process.

cheers,

Andy

[Former Member · Accepted solution]

Hi Andy,

That response from SAP seems to say that "It can co-exist, but we will only support the 10.1 product thereon". That would be the same as 10.0, i.e. you can have 4.0 and 5.3 co-exist in parallel.

What is your next step? Are you going to attempt putting the 10.1 plug in on the system whilst 4.0 is still in use?

[Former Member · Accepted solution]

Hi Andy

To me Harinam SanKirtan  comments makes sense "unless you put on the 10.0 version first and then upgrade that to 10.1 (I know bizarre!)."" 

-Rgds!!!

Mansoor

[Former Member · Accepted solution]

Thank you for agreeing.

[Former Member · Accepted solution]

This message was moderated.

[Former Member · Accepted solution]

Hi Harinam

Apologies for the delay in replying, only just noticed your update.

I chose to heed the advice of SAP and I interpreted this as meaning lock all /VIRSA/ transaction codes to make sure they were not used by accident. We accepted that installing the 10.1 plugins was a committing step past which we could not return and adjusted the project plan accordingly, applying the plugins after a full backup that we could restore from. With agreed downtime (over a weekend) we configured the new 10.1 connectors on a single target system to prove the new plugins worked in principle, then also had the functional team run the test routines they usually do when a system is patched with a new service pack. Once signed off as a Go, and the target system was returned to up time, we ran the migration routine then configured and tested the new functionality.

In the next few months there were a couple of occasions where team members asked me if they could unlock some /VIRSA/ transactions, having forgotten that this was not allowed (aka. recommended) so I consider this to have been the right course of action. having discussed it with some other GRC experts since, there are some transactions it would probably be fairly safe to use, whereas a full batch risk analysis on the /VIRSA/ tcodes could be potentially damaging, or at least not a good idea, but I chose to take the advice very literally and shut off the old content. It is a shame it is not uninstalled or disabled in a more complete way.

Cheers,

Andy