GRC - Password self service - S_USER_GRP requirement

[Former Member]

Good Day All.

I am implementing PSS in GRC system for all users.  We have GRC 10.1 (SP12)

But I found the user needs below authorization in connected system to reset password.

1. S_RFC & S_RFCACL  (As we have trusted RFC So this is fine)

2. S_USER_GRP  - ACTVT -  02  -  (Issue). We can't give this access to non security user.

So do we have a way to implement PSS without providing S_USER_GRP to users in connected system ?

Also advice If we can use PSS to reset password for GRC system itself ?

Thanks in advance !!!

[former_member335915]

Hi Rajesh,

You do not give the access to the users in  connected system. The user id which is used in the RFC is given access. It is fine to give access to this id as this is a system user.

I guess you can connect to the GRC system as well. Just maintain the required RFC and select the check box which corresponds to PSS.

Please use the link mentioned below which has the steps to configure PSS.

http://scn.sap.com/docs/DOC-58058

Let me know if this helps.

Thank you,

Regards,

Praman

[Former Member]

Hi Praman  , Thanks for your response.

We have trusted RFC which is connected to satellite system e.g to connect ECC the current user access is checked in GRC and ECC system.

These connector are maintained in GRC connector settings.

Or do I need to maintain the user in service - GRAC_UIBB_END_USER_LOGIN.

I checked with updating user logon data but its not solving our issue.

It seems its only for using "End user login" page which anyway we are not using.

Any other purpose of user ID maintained here ?

Any advice ?

[Former Member]

Hi Rajesh,

As you are not using the end user logon there is no need to maintain the guest user in the logon tab for any of the end user logon services in SICF.

Assign the authorization S_USER_GRP to the RFC user and check if it helps.

PSS functionality can be enabled for GRC connector as well.

Regards,

Manju

[former_member335915]

Hi Rajesh,

These services are only for the End User Logon. The connectors maintained in the connector settings should suffice. Just be sure to select the PSS check box which allows a system to be used for PSS.

Thank you,

Regards,

Praman

[Former Member]

From your comment , it seems I need create a non trusted RFC with user ID with access for S_USER_GRP.

Trusted connection is causing the issue because it check the current user authorization.

[Former Member]

Hi Rajesh,

For S_RFCACL object can you maintain * value for the field RFC_USER and check if it works.

Regards,

Manju

[former_member185447]

Hello Rajesh Sah,

Did you happen to go through this article by Colleen

http://scn.sap.com/docs/DOC-58651

In this document, if you go through the section reset password, check point no.3 which might be some interest to you provided you are sure that you have PSS configuration done perfectly.

Regards,

Rakesh Ram M