SAP GRC - Field of Manager and the behavior of HR (PPOME/PA30)

[Former Member]

Hello,

We are implementing SAP GRC 10.1, and we made some tests and we checked the followings situations:

First situation:

1 - In PPOME we have a user with manager associated.

2 - In PA30 we have the same user but in info-type 0001, he don't have any manager associated. This user have the info-type 0105 assigned.

3 - Table GRACUSER don't identify the manager, the field appears empty

Second Situation:

1 - In PPOME we have a user with manager associated.

2 - In PA30 we have the manager associated to this user in info-type 0001. This user have the info-type 0105 assigned.

3 - Table GRACUSER don't identify the manager, the field appears empty

This missing some setting? Because when we make an access request for the first situation, the field of manager appears filled. But for the second the field of manager is empty.

Could you help us?

Thank you very much

Inês

[Former Member · Accepted solution]

Hello,

Thank you both for your reply.

The user and the respective manager that we using,have the infotype 0105 and the subtype 0001 maintained.

And Alessandro we change the path ID to B012, but unfortunately we don't have any results.

However in process access request we have another problem with manager, when we make a request with the user, the respective manager is picked up and we can send the request, and the notification appears in the manger's inbox . But when the manager have to approve, appears a error message : the inserted manager is wrong.

Why when the user sends a request everything is ok, but when is the manager to approve is incorrect?

Regards,

Inês

[former_member193066 · Accepted solution]

Hello ,

Please remove parameter for manager validation.

Access request validations

5021

YES

Check manager value against the userid in current system

[Former Member · Accepted solution]

For this problem, we found that are related with the following situation:

Example in table GRACUSER: Employee 40000

                                               Manager ACRXXX

In ERP System t-code PA30, the manager matches with data in infotype 0001 of the employee 40000.

However in ERP System, the user ID of manager in PA30 (infotype 0105, sub 0001) doesn't exist in the SU01.

So we have an inconsistency in some of data. But the problem was solved, we find some employees that have the correct data. And we know that data in PRD are correct

Regards

Inês

[former_member193066 · Accepted solution]

How it works is..

if you user details data source is HR system..

GRC system send information to you HR system.

it send only User id.

the user id is matched against infotype 0105 subtype 0001.

then it fetches employee number for the user.

then looks for manager, depending on relationship.

and find manager employee number then its managers user id which is maintained in 0105 subtype 0001.

Thanks

Prasant

[former_member193066]

Hello Ines ,

How manager is retrieved in GRC i if you are Using HR as data source.

The user should have Infotype 0105 and  subtype 0001 user id has to be maintained.

It look for relation either B012 or A002 to retrieve the details

Then check for users Manager and Manager should have user id Maintained in infotype 0105 and subtype 0001.

Function Module /GRCPI/GRIA_USR_GET_DETAILS  is used to fetch manager for the User's  in target system.

The remote function group /GRCPI/GRIA_USR has method to call /GRCPI/GRIA_USR_GET_MANAGER function module.

here you can see IV_USER is my ID passed and this ID has to be matched in the ID stored in infotype 0105 and subtype 0001.

and PATH ID is either A002 or B012

and it will fetch the manager ID which is stored in Managers infotype 0105 and subtype 0001.

if you maintain HR as details data source his SAP ID has to be maintained.

Regards,

Prasant

[alessandr0]

Dear Inés,

you need to make sure that both users, the user and the manager, have maintained infotype 0105 so that the system can identify the sap account (subtype 0001).

If a user does not have a direct manager, then the system should automatically read the next higher manager. This only works if HR is set up correctly and the master data are maintained accordingly. If a manager is set in org management but does not have a 0105/0001 assignment, then the manager field remains empty.

Based on the configuration from your detail data source (either A012 or B012) it reads the data from the org management. The system can only display what is correctly maintained.

Hope this helps.

Regards,

Alessandro

[Former Member]

Thank you Alessandro,

However, user and manager have maintain the infotype 0105, so it's weird, why the field on table GRACUSER is empty in both cases and in access request for one comes filled and for the other comes empty.

In configuration from detail data source was filled with A012.

Inês

[alessandr0]

Dear Inés,

A012 represents an active relationship that means an object manages another. However, B012 is the passive relationships which says that an object is managed by someone. I would recommend to set to B012 so that you can see from whom the object is managed (passive relationship).

In the access requests the details are read from the data source - so it seems that the relationship from the user to the manager is not set properly.

Check that all info types are updated accordingly and that the validity dates are set. Also check the org management (tcode PPOME) if user's manager is properly defined as manager of the org unit.

Regards,

Alessandro