Agent 'GRAC_SPM_OWNER' returned empty User ID

[Former Member]

Hi GRC Experts,

I am trying to configure EAM workflow to provision firefighter ID for a firefighter in GRC 10.1 SP11. We are implementing de-centralised firefighter concept here.

Access request of superuser access request type is raised and submitted successfully. Next stage is to route request to firefighter ID owner for approval. Agent ID 'GRAC_SPM_OWNER' is used. But, no notification is routed to the respective FFID owner.

When checked in MSMP debug log, this is the debug message recorded:

APPL_DEBUG:184:GRFNMW:MSMP agent rule GRAC_MSMP_SPM_OWNER_AGENT returned 1 approvers

APPL_DEBUG:225:GRFNMW:Agent 'GRAC_SPM_OWNER' returned empty User ID (for Line Item '0001')

The access request form contains approver name on line item 001. The approver name and ID exists in both the GRC and target systems. The approver ID have been assigned with roles: SAP_GRAC_SUPER_USER_MGMT_OWNER and SAP_GRAC_ACCESS_APPROVER in the GRC system.

Any idea what could be the problem here?

Regards,

Debbie

[Former Member]

Hi Debbie

Could you provide a screenshot of the Audit Log in NWBC > Access Management > Search Request? This is sometimes helpful. I had a similar issue, but it was a while ago.

Maybe I can try to assist you

Regards

Gerrit

[Former Member]

Hi Gerrit,

I tried to search request, but getting 500 SAP Internal server error. I have raised a SAP OSS and awaiting reply on resolution.

Will a screenshot of the access request submitted help?

Regards,

Debbie

[Former Member]

Hi Debbie

Send it, let's have a look

Thanks

[Former Member]

Hi Gerrit,

Here you go. This is the submitted request:

Here's the screenshot of the user ID of the assignment approver in the request:

Rgds,

Debbie

[Former Member]

Hi Debbie.

Ok so your request is submitted. That looks ok.

But I think the Audit Log will provide more information.
In the Audit log it will show with which approver the request is currently or show you the errors that might have occurred.

It's a long shot, but normally, I get the 500 SAP Internal Server Error when I am logged into NWBC, but haven't used it for a while. Could you see if you can access the Audit Log again?

Also, does SLG1 give you any information?

Thanks

Gerrit

[Former Member]

Hi Debbie

Another thing that might be helpful is to have a look in table GRFNMWRTAPPR to find the open / pending approval requests. This table shows all open Access Request that have not been approved and will show the Approver who the request is sitting with.

it might not solve your issue, but at least you will be able to get some information from here. I am not sure if in your case, if the Approver User field in this table will be blank because you get the error.

Maybe it helps.

All the best

Gerrit

[former_member191076]

Hi Debbie,

If the issue is resolved please share the resolution steps so that it is useful to others.