SAP CUA clean up

[Former Member]

Dear Members,

P.S: I am a Basis consultant. Knowledge on security topics are limited. So, sorry for being naïve.

I was asked to configure CUA for 3 different business entities. So, in total 9 systems were included in CUA. Solution manager being the CUA master.

The configuration went fine and our user administrator was able to perform the requests.

• However, to our surprise, CUA configuration has changed the user master of almost every user (70% of users were impacted). The impact is missing email addresses, fax numbers, change in the account numbers,....

               --> We had to build the user master from scratch. It was painful. One of the possible reason could be different user information across the systems. What other reasons can create this?

Requirement 1:

     1. Remove the connected systems (6 out of 9) from CUA master completely. They are not going to be included in future. How to safely remove these systems from CUA with out impacting the user master of already connected systems and CORRECTED USER MASTER MANUALLY SYSTEM?

          --> I have deactivated CUA using the transaction SCUA in the child system.

     2. How to clean up the central system which was already populated with child systems information (for example, User info,....)?

     3. What are the pre and post steps for a client copy performed on child systems?

I have referred the OSS notes, 191449, 182341, 197728. To be honest, I am more confused with the readings. Some suggest to manually delete the logical system creations, break RFCS,... . Note 191449 points to executing the report RSDELCUA on the CUA master.

Thanks a bunch,

Thanks & regards,

Sreeharsha Kaligiri

[Private_Member_69416]

Hi

Your situation was caused by starting the CUA configuration from systems where user master data were almost empty. DEV/QAS

Then you added systems with users already in CUA and you synchronized(replaced) the users with data from CUA. Last system you add was productive and your pain started.

I'm not sure how you did "manual" corrections but it sounds like you changed some fields from global to local and corrected the most valuable systems. If yes CUA isn't so central.

In this situation the best way is to break RFC connections, remove CUA, clan BD64 and start again (first system with the best user master data)

Regards

Przemek

[Former Member]

Hello Mr. Gapinski,

Perhaps, the user master itself is inconsistent before CUA configuration.

I have temporarily deactivated the CUA using the transaction SCUA in the child system.

Coming to the point manual corrections, the missing email, fax, phone numbers, and other information was collected from office outlook and used a batch script to update the information in SU01.

I cannot agree more in breaking the RFC connections, clan BD64. But the confusion starts with the sentence "remove CUA". What we need is to remove child systems permanently from CUA master.

Breaking the RFC connections does not clean the information in CUA master. for example deleting all information pertaining to the child system of interest.

Thanks in-advance.

Thanks & regards,

Sreeharsha Kaligiri

[Private_Member_69416]

where did you executed the batch script: CUA or child

[Former Member]

Soon after I deactivated the CUA from child system.

I collected all the change logs from SUIM -> Change documents.

Created an excel with all the missing information.

Executed the batch script on child system to correct the User master.

[Colleen]

prior to commencing this activity, what research did you actually do?

Delete the CUA and data (you can Google for this) to start again

Prior to starting you need to:

1. Decide on your SCUM settings - and make sure you understand the difference between global, local, proposal and re-distribute
2. Choose the first system/client to sync in
3. Consider revoking SU3 from end users whilst this activity is ongoing (if you make address tab data global then users will be able to make change in SU3 whilst you are still connecting the systems and synching the data - once you connect and data matches, the users cannot update global fields locally)
4. Consider fixing up each child system address data, user groups, etc before importing the system. If you do this, when you use SCUG to import users you will have them appearing at identical
5. Looking into the PRGN_CUST parameters relating to CUA (and also the password ones why you are at it)
6. Read up and research whether it's a good idea making Solution Manager your CUA master

CUA is very old - you should be able to find a lot of material (including a recent SAP wiki troubleshooting guide which has been updated)

Regards

Colleen

[Former Member]

The research:

1. The points mentioned were discussed in detailed with in the teams prior to implementation of CUA.

2. To our notice that the corruption happened because of inconsistencies with user master across 9 systems plus different release versions.

3. Global, local, proposal and redistribute settings -> we have decided prior to the start of CUA implementation.

So, coming back the problems and questions:-

1. How to safely remove child system? should I run rsdelcua on child? master? or on both?

any other methods?.

[Colleen]

Hi

If the points were properly discussed you would not have found yourself in this situation. I only asked these questions as I assume you will have a second attempt at reconnecting these and don't want you to have a repeat

Refer to SAP CUA Cookbook fro context:

Also, other references to help you in future

Central User Administration(CUA) configuration - Basis Corner - SCN Wiki

Best practice - How to perform a client copy when CUA is active - Security and Identity Management -...

Have a look in Wiki in general for other CUA information

I understand you are not strong on security and this is a first time. However, if you are still unsure how best to proceed and cannot search for this information, then I recommend you ask your manager for assistance

Regards

Colleen