Solved: CUA to Child users

Former Member · ‎03-08-2016

We just had a QA system refreshed after the refresh we have a list of about 20 to 30 users who were lost. They simply do not exist now.

However they are still in the CUA system fully intact.

This should be a fairly straight forward question, With all the multiple ways to do things in SAP there simply has to be a way to push or pull the users back to the child system from CUA without MANUAL intervention 1 by 1 copying them.

help is appreciated. Thanks in advance.

Private_Member_69416 · ‎03-08-2016

Pushing users to child system:

Sending User Master Data to a Child System - Identity Management - SAP Library

by user name, group or all assigned

Check SCUL for possible problems - e.g. missing roles

Former Member · ‎03-08-2016

By "refresh" you mean that you detached the child from the CUA, then did some system or client copy, then attached it to the CUA again and ran SCUG - which is then also likely to show you some differences?

Or did you extract a partial client copy (users and auths) before the "refresh" and then import it again afterwards, and then there was a difference in SCUG?

Cheers,

Julius

Former Member · ‎03-08-2016

This is helpful however. I was able to resolve the users not being in the child system by simply adding a generic role ( something that is only display and redundant to current access) to them using SU10 and end dating it the same day. To do this I made the assignment through CUA for the child system. Then CUA pushes the user back out to the child system as a NEW creation. even though I had them there previously that no longer matter as the refresh wiped them out.

P.S. the Generic role that was assigned will in turn Then be removed by script during the next invalid role assignment run.

P.S.S.I have a unique situation where I still have to go and use PA30 to change the 105 record for each. This however is not related to the above as this 1 off situation happens to be derived from the fact these are test users modeled after real profiles. I mention this only because it may help someone else later with a similar issue.

Former Member · ‎03-09-2016

I still faintly suspect that your approach can be optimized. Is it possible that you are not detaching the CUA child system from the master during this "refresh" and you are not running SCUG at all?

That will leave differences between the old and the new users and CUA master just thinks the system was unavailable for a while.

The safest way to do it is to detach it locally in the child system and then attach and run SCUG. The other way around runs the risk that the users are first all deleted and then recreated, much like you have done manually for these 30 users except with a much bigger bang.

Recreating IT0105 after the refresh will be unlikely to have much effect (just a guess) because the source system of the refresh did not have the UIDs so most likely did not have the PERNR either. So there might not be a link to anything for them? There are BAPIs for IT0105 to sync it from a master system, but as that is highly likely to be an HR system and not CUA there is little the CUA can do for you normally from a distribution perspective.