Abap/Security: Mass update via pfcg or function call, delimit role assignment

[timo_ehl3]

Hi out there,

i recorded transaction pfcg to delete user assignment of a role.

It works perfect, but now i need to know how to delimit the role assignment. -> How to change the end date of assignment to a user.

Is there any function call like this.

input: rolename, enddate

output: All Useres assigned to this role where delimitted to this role to enddate.

Thank you.

[Former Member]

I know that removing a role from a list of users in SU10 will end-date it, but I haven't tested setting it for a future end-date.

[Former Member]

Hi Timo,

Transaction SU10 will allow you to remove a role from a list of users with a specific start and end date.

Enter a list of users that have the role in SU10, then click on the edit button, then the "Roles" tab.  At the top you'll see radio buttons for "Add" and "Remove".  Pick the latter to remove roles and then enter the role you want to remove with a start and end date of the removal.  If you simply want to delimit a currently assigned role, then remove it from the current date till 31.12.9999.  That will result in the delimitation date being the current date - 1 day.

If the start date is today or in the past, you also have to click on the "Profiles" tab and pick "Remove" there before clicking on the save button.

Let's say you have a role currently assigned to a user from 01.01.2000 to 31.12.9999 and you remove it from 01.01.2015 to 31.12.2015, you will end up with two assignments:

01.01.2000 to 31.12.2014 and

01.01.2016 to 31.12.9999.

However, if the end date of the role removal is greater or equal to the role assignment end-date, then it will simply delimit the current role assignment.  Using the above example, if you instead removed it from 01.01.2015 to 31.12.9999, then the resulting user-role assignment would have been:

01.01.2000 to 31.12.2014 only.

If you wish to find the list of users assigned to a specific role, table AGR_USERS would be of help to you.

Alternatively, function BAPI_USER_ACTGROUPS_ASSIGN would allow you to do this programatically.

Kind regards,

Niel