How to maintain managers in GRC without any HR org structure in ECC?

[pranay_aitha2]

Hi,

We are planning to use SAP Access management in GRC 10, we would like to have manager approval in the access provisioning workflow.

As we do not have Manager's maintained in the ECC/GRC, we would like to maintain a custom table in the GRC which has the manager mapping and use that table for the population the manager field in GRC application.

Also as part of this, we are trying to figure out, where is the manager stored for a user in GRC?

thank you in advance.

Pranay

[madhusap]

Hi Pranay,

Do you have LDAP active directory where all user details are maintained?

Regards,

Madhu.

[pranay_aitha2]

Thank you for the reply Madhu,

We do not have those details on the LDAP

Regards,

Pranay

[madhusap]

Hi Pranay,

We also had similar situation in one of our projects, but we had LDAP but no manager maintained in LDAP so used some fields from LDAP and developed some custom tables and logic to determine Supervsiors as we don't want to maintain some dummy table with User vs Manager and update it regularly

1. Each user had certain Organization Units and Sub Units assigned to them in LDAP

2. We have developed a Supervisor mapping table based on these fields.

Eg: OU + SUB OU 1 will be mapped to a PFCG role in our custom table and the Supervisors are assigned to that role.

Our custom agent rule is a function module which returns users assigned to the PFCG role based on OU and Sub OU

Initally this will take sometime to setup all different OU and Sub OU combinations, but once stabilized this table will have no more changes and Supervisors for any particular combination request for that combination role and once assigned they become supervsiors(in fact approvers) for that combination

Only downside is we need to maintain lot of dummy PFCG roles based on combinations but since our environment had some combinations sharing same dummy PFCG roles so setup went good and is working fine.

We gave access to support team to maintain this table as part of O&S activities for future updates

P.S: This may not be solution for your case but can give you a thought to proceed with logic

Regards,

Madhu.

[pranay_aitha2]

Thank you for sharing the info Madhu,

As per our process, the user should be able to specify his manager. so I was thinking to build a custom application which would enable the user to maintain his manager.

on the backend, we will store this information in table, the issue I have is that. I am not sure, how to assign this manager in the user access workflow.

Regards,

Pranay

[former_member220726]

Hi ,

If the user ( Requester ) should be able to specify his manager , why cann't user directly go to the manager field in user access form and mention his manager name(User ID)  there ,  so that system dont check anything and it will take to the manager ID mentioned in that field.

Does this address your requirement .

Uma Shankar

[pranay_aitha2]

Hi Uma,

This method works when we use the SAPUI5 access request app or nwbc app.

We are planning to migrate to Fiori application, that app doesn't have an option to specify the manager.

thank you.

[jonathan_yim]

Hi,

I am not sure if your issue is resolved since it is in 2015. We have also implemented Fiori and if I am correct, Fiori gets the roles and then call the ARM in GRC.
That in turn should trigger the ARM configuration and etc.

Since you are maintaining a separate custom table for managers, then I think you need to an enhancement in the Webdynpro for the Manager ID field.

Your developer should be able to figure out the place to do the enhancement and SAP does provide an avenue for it -> SE80.

To figure out the place for the logic, in the ARM page, click to the User Details tab. Then right click somewhere near the manager ID field and usually a pop up screen shows the details for the webdynpro. Your developer can then check for the class and method, do some debugging and then from there, they can put some custom code. Hope this helps.