SAP GRC Attachment limitation

[Former Member]

Dear all.

I have the following doubts:

- Where is defined the maximum size for the possible attached files into the Access Request?

- How can i define this?

Kind regards and thank you in advance.

Sara.

[madhusap]

Hi Sara,

For restricting the files being attached with help of SAP we got a BADI delivered.

2058231 - No restriction on type of files that can be attached in Access Controls

Please implement note 2058231 (manual and automatic corrections) in your system. After implementing this note you will have to implement a BADI as shown in the document attached to the note. Then you can maintain configuration parameter 2401 in IMG for the allowed types of file

May be in the same BADI you can check with the ABAPer to include this requirement of file size as in standard functionality it is not available.

Regards,

Madhu.

[Former Member]

Thanks Alessandro, Madhu.

So Madhu you confirm this is not feasible into the standard functionality right?

Some other questions:

• Can this be restricted on a more technical level? There is an specific timeout parameter after 5min attaching/uploading a file?
• Can i restrict this type file for only some specific Access Request based on some criteria? The point is at this moment many users are using GRC and they are attaching any type of file (PDF, emails, etc...) So, If i indicate only PDF files are available into parameter 2401 that has impact over all the GRC Access Request right?

Kind regards and thank you.

Sara.

[madhusap]

Hi Sara,

Basically our client environment is very secured and we don't want GRC accepting .exe attachments in access requests. Since this functionality to restrict attachments based on extensions is available in 5.3, we were able to convince and get the same delivered in GRC 10.0 and 10.1

1. Basically BADI has the logic to control the type of attachments that can be used in access request which validates based on values maintained in 2401 parameter. Currently we allow Docx, pdf, xlsx,msg files. This BADI is applicable for all request types in GRC and if your requirement is to restrict based on Request Type or any other parameter then you need to enhance the BADI as per your requirement and you can discuss with ABAPer and can check the feasibility of your requirement.

2. I don't think there is separate timeout parameter for attachments, You can work with the Basis/Network team to have a look at the HTTP timeout parameter which can be helpful.

Regards,

Madhu.

[alessandr0]

Dear Sara,

I am unsure if this is customizable. With parameter 2401 you can allow extensions for attachments. Maybe this helps.

Regards,

Alessandro