User Access Review job in "In progress" status

[Former Member]

Hi All,

I am trying to configure UAR for the first time using SAP delivered rules in MSMP. The issue am facing is that after doing the config as per the doc when i run the UAR job for generate data, it stays in the In Progress status for a long time without any output. I did come across SAP note 1997960 and have requested SAP to release for my systems just to see if it helps. however, since its my first time not sure if there is some error on my part which could be leading to this.

As per note 1620493, i have checked the data sources again and the connectors are working fine. I have attached the screenshots of what i have maintained in the system. Please have a look and assist if am on the right track here.

Regards,

Vivek Jha

[Former Member · Accepted solution]

I have looked at your screeenshots, and not too concerned with the MSMP settings yet as we are trying to first fix your Generation job

I would enable the admin review in your setting to just see if all the necessary data is being generated, i.e. in case there are blank role owners for some roles, this could be causing an issue.

As for your criteria selection, ensure no blank fields were left in the selection made.

I would have a read of the following WIKI and see if any of the points mentioned are applicable. The first mistake made by many is to not perform the sync jobs in the correct order.

Troubleshooting UAR Request Generation - Governance, Risk and Compliance - SCN Wiki

From my memory, I know for SOD reviews "offline risk analysis" had to be enabled, but unsure if this is also necessary for UAR.

Also refer to the following general wiki User Access Review(UAR) Workflow Configuration and Description - Governance, Risk and Compliance - S...

[Former Member · Accepted solution]

Hey..Thanks again for response.

Turns out the config was all correct. The jobs indeed are taking >24 hours to finish and once completed are even generating triggers.

The thing is when i select a single role in selection criteria yet it takes this much amount of time which doesn't look right. How much time does it typically take for the job in your case ?

Any suggestions on reducing/optimising this(I tried restricting the selection criteria by entering most of the input parameters to have least possible blank fields.)

[Former Member · Accepted solution]

If the review generation is working (even if its taking more than a day to generate!) then we should have full faith on having the configuration being set up correctly. That is one big bonus.

The thing to be worried about is the actual performance of generating these reviews. I would have expected a quick generation on a particular role, unless many users have been assigned the particular role and it exists on multiple systems.

How many systems are you trying to generate the review against? Also how often is your background repository sync jobs running?

[Former Member · Accepted solution]

Well its justa test system.. so 1 ERP connected to 1 GRC. Not more that 10 users assigned to the role and the sync job freq is once a day for now. However, before running the UAR job, i execute them all on an immediate basis. and they dont take much time.

The role is of ERP system. Also how much do you reckon would it normally take for this job to execute in a situation like mine?

[Former Member · Accepted solution]

It should not take too long really.

What Support Pack are you on? Also have you tried to run the generation job with User based criteria instead? i.e. against a particular User ID? I am wondering if it is slower by selecting the job to generate with Role based criteria.

[Former Member · Accepted solution]

My bad..i should have given that info at the beginning. Following are the component versions:

GRCFND_A - SAPK-V1104INGRCFNDA

SAP_BASIS - SAPKB74005

Also, i see more merit in a role based scenario than user id based ones. Can you let me know the typical scenarios when a user based based access review(sound more restrictive unless we want to review users with specific attributes as firefighter etc) would be useful.

What bemuses me is the fact that a single role with 10-15 user assignment should not lead to such performance issues.

[Former Member · Accepted solution]

It might be the right time to go raise a OSS call to SAP and have them look at the performance issues you face with such a small criteria. I fully endorse your worries. I have a feeling something may have been changed in the 10.1 code if it is this slow. You may have found a new bug

[Former Member · Accepted solution]

Hmm... that seems to the way out now.

Off late response to OSS messages has been sluggish and thus i try to resolve the issues by other means as far as possible. Seems folks at SAP GRC are swamped with OSS messages..

Anyways thanks for the support ..Mogambo Khush hua

Cheers,

Vivek

[Former Member · Accepted solution]

Mogambo not khush with the bugs.....

Doesn't matter if SAP GRC support are swamped, whilst you are looking for a fix for your difficult issue I would still raise a call to SAP as it would help them refine their product if a new genuine bug is found That would benefit the rest of the user community in the long run.

[Former Member · Accepted solution]

Hey,

I noticed that when i configure the Admin stage as Yes and run the job am not able to locate the requests using Request Review by default.I have assigned myself the role of SAP_GRAC_ACCESS_REQUEST_ADMIN.

However,When i execute a blank search , i can see the request status as Admin_Review but even after opening the request i cant seem to take any action on it(mean send it to reviewer's queue). So for Admin Review, I believed just teh admin role indicated above should suffice. is there something more to it? Am i doing something incorrectly?

[Former Member · Accepted solution]

Have you managed to set up any co-ordinators yet in "Manage Coordinators"? I think you need to do a few before anything works properly.

[Former Member · Accepted solution]

HI,

All of that was already done and thus, without admin review stage it functioned as desired. thing is now i just maintined 2007 as "Yes" and wanted to check the behavior. I have the admin role(stated above) assigned but is there something more required for a user to get the requests in Admin Review stage?

[Former Member · Accepted solution]

I believe there is a secondary background job to perform once the reviewer has gone through the generated reviews and assigned them to the right approvers etc. This then kicks the reviews out for actual review and approval.

I am sure this is somewhere in the UAR guide in the responses above.

[Former Member]

Hi,

Out of interest, what selection criteria's did you define prior to running the Generation job on the NWBC front end?

If you are trying to analyse all the users and role assignments against many systems then this is likely to be the cause of the very long running job (that has not ended in error, but still in progress).

My advice would be to run the generation job by certain user groups (if using Manager review) or certain types of roles (if using Role Approver review).

[Former Member]

Hey,

Thanks for the response. Well i have actually selected couple of test roles for which owners and user id assignment has been done. So its not an all inclusive criteria.

Did you check the screenshots to see if there is something i might be missing?

Regards,

Vivek Jha