Problem with deleting role assignments over Workflow

[Former Member]

Hello experts,

we face a strange problem, which until today i could not find the solution.

We are using GRC10 with SP 15 and we have several systems added.

I create a request for another user and i am choosing from existing role assignments one role from a backend system.

Role goes to approver, approver approves the role deletion and request is completed.

But when i check the user roles in the system the role is still assigned. In the provision logs, it says the role was succesfully removed.

In ST01 traces not errors.

Only error i see is in the SLG1 --> role XXXXXXX is not assigned to user XXXXXX

When i perform a deletion in the GRC system and want to remove a role from GRC itself, provision is working fine. When i add roles to user, it is working for all systems, no problems here.

So i am guessing something in the workflow is not working. any suggestions?

thanks

cheerz,david

[Former Member · Accepted solution]

The solution to the Problem is the Note 2036236

Cheerz,

david

[alessandr0]

Hi David,

did you check whether GRC synced correctly? Please see table GRACUSERROLE if the assignments are correct for user and connector. The USERROLEID field can be linked with ROLEID from table GRACROLE.

Just for my information: do you use business roles or technical roles? There are several notes regarding deprovisioning of business roles which doesn't work properly.

Regards

Alessandro

[Former Member]

Hi Alessandro,

we are using technical roles and i thing we have a problem with the data in the grac tables based on your answer for checking the GRAC tables.

I could not find a link between the tables, but i could find somethiing else which is interesting: IN the GRAC_User Table i have not an entry for my test user.. but i have an entry of him in the tables: GRACUSERROLE and CRACUSERPROFILE.

I performed a full sync and i could solve the inconsistent data in the GRAC_USER but the provisioning still not working..

thanks for your answer!

cheerz

[alessandr0]

Hi David,

very strange and I don't know how to fix yet. Did you try to change the assignment instead of removing the role? Actually I mean set provisioning action to retain and change the validity date. This shouldn't work either.

I have also checked some sap notes but don't find your case. Maybe you can check the following:

http://service.sap.com/sap/support/notes/2034986

Regards,

Alessandro

[Former Member]

Hi Alessandro,

i tried with changing the date of the validity of the role and it worked...

Strange case..

Anyway, i am working on it and let you know when i found the error

Thanks,

david

[FilipGRC]

Hi David,

we had similar issue, and reason for it was very simple - the user had the same role assigned twice.

This happens as users are often using action asign for roles which are currently asigned to them instead of 'retain' in order to extend the validity period.

Check if this was a case in your situation.

Filip

[Former Member]

hi Filip

thanks for your answer. We have faced also this issue in the past with the dates and double roles.. unfortunately this is not our case here.

thanks anyway!

cheerz,david

[alessandr0]

Filip,

to remove double assignments and also to remove expired roles from a user you can use the program PRGN_COMPRESS_TIMES. The program offers simulation functionality where you can check the output before perfoming.

Regards,

Alesssndro