GRAC Repository Sync SP09

[Former Member]

Hi,

We are on GRAC SP09.  I run a Full Repository Sync Weekly on Monday at 00:30:00 in background batch mode.  It states it is successful.   A few users(they are always the same users) do not show each week on Monday after the sync runs when I check these same users in access review.

If I then run incremental in background mode at 8 am then these users will show up.  I run the incremental daily but not until later in the day.

Shouldn't the full sync pull these users?  They are active users and not users that have had roles changed, deletions or expired roles.

Thanks,

Mary

[Former Member · Accepted solution]

Hi

I wanted to update the discussion with the note that fixed the problem.  I applied SAP note 1757941.  User Synchronization incomplete.  If System A ran with the users then system B ran and the users from System B did not exist in System A it would not add users from System B to the GRACUSER table.  They would all be in the GRACUSERCONN table but the GRACUSER table was incomplete only keeping the system users that ran first in the repository sync.

I also believe setting up the Data Sources in SPRO is needed.

Thanks everyone for your help and suggestions,

Mary

[Former Member · Accepted solution]

Thanks for update. good to see you have summarized the chain well enough so that anyone getting similar issue can refer it...

You can mark the thread closed.

[Former Member]

Thank you for responding I will try what you have suggested and see if it corrects the issue.  We are only using the ARA portion of the GRAC software.

I did discovered yesterday if I run one system in the connector I get all the users for that system.  If I run the next system I get all users for the second system but then some users are missing from the first system and from the GRACUSER table but they are in the GRACUSERCONN table.  It seems to be whatever system I run as the last system shows all the users.  This is throwing off the SOD count which we report on.

[Former Member]

Marry, good that you updated about only ARA in use.

You just pick the notes which are only related to repository synch, its few note. If you deployed please let us know if issue got fixed.

But with your latest comment on GRACUSER table makes me suspect another problem. can you check your configuration under SPRO-> Governance Risk & compliance -> Access Control->Maintain Data Source Configuration. and try to see if any good information from this.

( I am suspecting if any sync via this setting is impacting the data rather than rep sync jobs)

[Former Member]

Hi Nishant,

Thank you for responding.  I did not configure this.  The documentation I had did not say I had to do anything in this setting.  We do not use HR in our SAP systems and all user ID's are the same across both landscapes.

Does this still need to be configured? Can you point me to document.

Thank you,

Mary

[Former Member]

Hi Nishant,

I took your advise and configured the Data Source and also added sequence numbers based on http://scn.sap.com/thread/3557597 this thread was very helpful explaining the datasource and sequence.

So far it looks like this may have corrected the problem, still testing to make sure.  I should know next week when I pull data to BW for Quarter end.

Thank you for pointing me in the right direction.

I will update the post when I know for sure if this was the fix.

Mary

[Former Member]

Yes Mary,

Full sync mode shall pull all the users handled before start of the background job.

Do you have any other job running in backend system like the one which deletes expired roles in system?  you may get some information from SLG1 log in AC 10.

Just a note- SP09- Have personally noticed a lot of problem with the sync jobs performance, most of the fixes is in SP10. if you can just open SP10 note list and deploy only the note related to performance/sync jobs then will be good..--- this may not be feasible for you to deploy notes, just a suggestion based on problem seen in SP09.. Jobs logic where not perfectly designed in SP09 hence SP10 notes will give good help.

[Former Member]

A recently released SAP note suggests there are also problems with the incremental sync for many grc users. The note recommends a full sync is performed to correct the issue.

http://service.sap.com/sap/support/notes/2033263

However, you seem to be facing the opposite. i agree with the comment above that SP09 has many bugs and performance issues, but so do all the later support packs . Be prepared to update to SP10 and test for any regressive behaviour.

[Former Member]

Going for SP10 will lead to new problem & time taking task.

Just putting few notes related will be a good idea.

[Former Member]

I agree with your approach Nishant, as that is the way I try to resolve the issue (drip feed separate notes in hope of the system not falling apart!)

But lately,  putting a note in from a support pack above leads to a whole bunch or pre-requisite notes being required to be imported also. When I wanted to fix an issue regarding role provisioning and risk analysis results in SP12, SNOTE ended up dragging in 85% of SP13 into the system via separate notes!

[Former Member]

Harinam,

Your experience with SP12 sounds exactly the same as ours, and we are now in process of starting to implement additional corrections that we thought were too risky to attempt before go-live. Then the next time you have an issue and are asked what level you are on, can you say- SP 12.85?

Gretchen

[Former Member]

"I am on 12.85 I think....oh wait.....just put a few notes in, that makes it 13.04...."