How to use GRC10.0 HR trigger to delimit user ID dates and roles

[jonathan_yim]

Hi GRC gurus,

I am trying to set up the HR trigger GRC 10.0 SP 22 in the company and below are my requirements. I have google around and found the HR trigger step by step guide and the SNOTE. However I got a couple of questions due to my limited knowledge of BRFPLUS.

Requirements:

1. When employee (EE) is termed, take the End Date from PA0000-ENDDA to delimit the validity date in SU01 and all the roles and PA0105-ENDDA for subtype 0001.

2. Basically I want to take the ENDDA of PA0000 or PA0001 and make the validity end date of SU01 and its roles and PA0105 subtype 0001 to be the same.

Questions:

Q1. I followed the step to copy the BRFPLUS delivered ID but when I tried to find the object, it gave an error message stating the Function ID does  not exist. Did the pre-delivered BRFPLUS Function ID for HR trigger changed? The closest I can find is Function 80E0ED08B0561DDF9FA60CB691494295 which also comes with pre-deliver Ruleset. Is this the new one I should use?

Q2. In the sample step by step guide, I found that the developer put a loop. Is there a need to put a loop? I do not understand the rational for the loop. The only explanation I can think of is whenever we make an entry in the infotypes via PA30/PA40, SAP actually deletes the relevant  earlier record and insert new records with the new BEGDA and ENDDA. Could this be the reason to loop so that it will capture the latest infotype information?

Q3. How can I delimit the validity dates in the SU01 and the PA0105 0001 with HR trigger after the BRFPLUS is configured? The guide did the BRF+ config to create the GRC Access Request. I do not see any configuration to have the new validity date updated. I have difficultly controlling the validity date in the AC using BRFPLUS before.

Appreciate if someone can provide some guide esp step by step.

I cannot seem to find the so call 'Configuration Tab' for the CUP as I seem to find some posts suggested. Is there a role or what is the node name to be added to the menu of the security role?

[jonathan_yim · Accepted solution]

Log a ticket to SAP and their reply is to create a custom one from scratch.

it is working for me.

[alessandr0]

Hello,

straight to your questions.

Q1: you need to copy the function from client 000 to your produxtive client. Either down/upload or transport. Notes are available accordingly.

Q2: not sure to which guide you are reffering to - but loops are used if you have more than one input line and the programs has to calculated each line seperately.

Q3: should be set automatically by the system if you follow the SAP guides. The HR trigger starts a request and the validity date of the system you have configured will be set automatically.

Please be aware that the user validity gets changed, not the validity of the roles. This due to the fact that the change user action type changes the system. To achieve the same for roles assigned I recommend to develop a program that runs periodically in the CUA or backend system and terminates roles of expired users.

Hope this helps.

REgards,

Alessandro

[Former Member]

Hi,

For Q1, I will check in 000 if there is such a version. For your information, when I look under the HR Trigger Application, I see that there are already pre-delivered function, ruleset and rules. So I wonder if there is still a need to copy the default one.

As for Q3, how can I add infotype 105 to be delimited? Is it not part of the HR Trigger functionality to delimit HR Infotype?

[Former Member]

Hi,

You are right about Q1. There should be a pre-delivered function ID. It can be found in my sandbox and prod. Someone might have play around in BRF+ and accidentally deleted or something.