Mass assignment of different roles to different users

[PKing]

Hello all,

my requirements are the following:

We are migrating to BI 7.0 AND establish a new role concept. So I have created lots of new roles and each of them has to substitute an old, obsolete one actually assinged only as single roles to the users. The user assignments have to be changed and I will have to assign about 50 composite roles and 200 single roles to the existing 2500 users and to remove the old ones.

SU10 is not sufficient for me because I have to either group users and assign & remove the roles (grouping of users is not done yet and everyone is unique/different) or to group by roles and assign and remove the roles. This is a lot of efford and in case of error recovery I cannot react as fast as necessary.

Is there an option to perform this? I am thinking about a report reading my already existing master file (*.csv) and assigning the defined roles to the users and to remove the defined old one from the users.

Does anyone have alternate suggestions?

Regards,

Petra

[Former Member]

Hello Perta,

I would say in such a scenario this is the best approach. As a matter of fact we use a similar program in our normal production environment. We use a file to upload roles for the users. The file deletes existing role assignments and then inserts the ones present in the file.

Regards.

Ruchit.

[PKing]

Hello Ruchit,

thanks for the quick reply! Do you mind sharing the code. It would help us a lot!!

email: petra.king@t-online.de

Thanks in advance,

Petra

[Former Member]

Hello Petra,

I am rally sorry but I cannot share the code as this is a client confidential information. I hope you will understand that. What I can tell you however is that it is modelled on SU01 transaction ( role assignment function modules) along with standard SAP upload function modules.Check SUSR* function modules in general.

Also ECATT is not a very viable option in this case since we are talking about dynamic role assignments here.

Regards.

Ruchit.

[Former Member]

Dynamic role assignments can be handled by catt/ecatt however you must use transaction SU10 for recording instead of SU01.

Cheers,

Ben

[PKing]

Hello Ben,

I was talking about SU10 but as Ruchit already told: we will have to assign the roles dynamically so eCATT might not help especially for recovery issues. Do you use eCATT for this purpose?

Bye,

Petra

[PKing]

Hello Ruchit,

OK - I understand this. So you agree to use the BAPIs of the SUSR-group.

Bye,

Petra

[Former Member]

Petra,

Technically SU10 works even if there are many different users with dynamically different roles.

However I would only recommend this for relatively small groups of changes. In addition instead of removing the roles it date delimits them (a function of SU10).

In the long run it's best to have a good set of custom tools/ABAP to assist.

Cheers,

Ben

[Former Member]

Hello Petra,

I would say I would certainly agree as we do it lot of times. I rememeber once after a system copy we lost role assignments due to some error.Our installation is spread across Europe and for each country we have seperate roles. We had the reference data and using that we built up the files and did the role assignment which I would term to be highly dynamical since not only roles were seperated on basis of countries but also different users for the same coutry had to be assigned seperate set of roles depending on their separtment. In that case the report worked fantasically for us.

Regards.

Ruchit.

[PKing]

Hello Ben, hello Ruchit,

thanks for your inputs.

I think the best solution is to create a program for the whole sczenario as I am VERY familiar with all the possibilities in SU10 and its restrictions (regarding removing roles and profiles). As you told we will need a recovery procedure for our users and roles and I am not talking about some small end strict defined user groups with some roles assigned but of at least 30.000 entries in table agr_users.

Bye,

Petra

[Former Member]

Petra,

Your options are custom programming as stated above or ECATT/CATT scripts.

Search eCATT for details. For CATT there is a work around on newer versions using transaction SCEM.

Cheers,

Ben

[PKing]

Hello Benjamin,

forgot to tell that I was also thinking of eCATT but of course this is not feasible. Most of all because of the recovery case.

Bye,

Petra