Error provisioning to GRC system - WF-Batch locking user

[Former Member]

We are having an issue when provisioning New Access requests to the GRC system itself (also a plugin system).

After 1st stage approver confirms approval in work inbox, only the user is being created, but the role assignment is not being added.

Upon review of SLG1 log and the Access request audit log, the following error message displays.

Maintenance of user xxxx locked by WF-BATCH

Then the request will instead take the escape path instead of ending due.  The user created and the role not assigned.

We are using GRC AC 10 SP13.  Can anyone assist.

Following version of GRC plugins installed on GRC system

GRCFND_A V1000 0013 SAPK-V1013INGRCFNDA GRC Foundation ABAP

GRCPINW V1000_731 0004 SAPK-10504INGRCPINW SAP GRC NW Plug-in

[former_member225180]

Hi Don,

we had the same error this week the first time.

In our case the server was offline for a short time.

Parallel a new virus scanner was implemented, we think this could have an effect on the server.

The problem was solved by execution of a new start of the server.

Hope this info will help.

BR

Melanie

[alessandr0]

Hi Don,

did that happen once? Or several times? Or always?

I am also using SP13 and had that a couple of times (5 times out of 3000 requests). As it occurs seldomly I accept that and re-submit the request within the escape path.

Regards,

Alessandro

[Former Member]

Hi Alessandro

It is happening a fairly often, but not all the time.  I would estimate about 30% of the time.

I can handle by the exception path, but due to the frequency, I don't that would be best solution.  Could this be related to system performance maybe?  It is occurring in the GRC development system.

Don

[Colleen]

Just wondering if it's intermittent... could Basis team have a look at system performance and see if there is any "tuning" that can be done to prevent the enqueue locks from releasing prior to the next step?

I assume creating a new user would call the BAPI to create. It should then release the lock before calling BAPI to assign access (my guess here).

[Former Member]

Hi Colleen

Any suggestions about what I should Basis to look for regarding "tuning".

Application or database level?  Which transactions?

Thanks

Don

[Colleen]

Hi Don

My comment was a thinking out-a-loud moment. If your issue is intermittant then perhaps Basis can try to run some traces and have a look at the enqueue lock, etc on their side. In relation to transactions to look at, it starts getting past my expertise.

If the entire issue is caused by the GRC calls to ERP for provisioning, then SAP will probably need to release a note (if they have not already) as it could be a programming error.

Regards

Colleen

[Former Member]

Hi Colleen,

I am facing this exact issue where id is locked by BAPI and in meawhile GRC tries to map the role to the user and then it throws the error.

Our plugin system is on CUA. Anyassistance will be appreciated.

Thanks