ABAP prog with Call Transaction to SU01 will not add roles in a CUA client

[Former Member]

I am modifying a current ABAP program that works in a non-CUA client to hopefully execute in a CUA client. This program performs a Call Transaction to tcode SU01 and adds roles to an existing user. I used tcode SHDB to identify the new BDC commands needed for CUA when using tcode SU01. When executing the program in the CUA client it does not save the roles to the user. There is no error message or abnormal termination.

When I assign the role to the same user that's referenced in my program directly with tcode SU01 it works fine. Its just when I run the ABAP program the role assigment is not retained. I opened a Customer Message with SAP and they referenced OSS Note 93802 and said this was a consulting question. My program is not abending as referenced in Note 93802, it just does not add the role.

Has anyone been able to get this to work in a CUA client?

[Former Member]

Hi,

are you by CUA client meaning the CUA MMS (master) system itself, or any of the child systems in the CUA landscape? Roles can only be assigned on the master (MMS) system. Also, with CUA, you need to specify the system AND role name, unlike stand-alone systems where only the role name is needed. If you elaborate, I may be able to help further.

By the way, a better way to assign roles in CUA landscapes would be to use the BAPI_USER_LOCACTGROUPS_ASSIGN, if you insist on doing it programmatically.

Regards,

Trond

[Former Member]

Hi Trond,

Thank you for your response. Yes, I am trying to add roles in the CUA master sytem to distribute to a child system. I need to do it programmatically because we will use this to do a mass load of 1500 users for our Go-Live.

Do you have an example program I can look at that uses BAPI_USER_LOCACTGROUPS_ASSIGN. Maybe I can modify my current ABAP code to use that BAPI?

[Former Member]

Hi,

it should be fairly simple to create a new ABAP using the BAPI's related to business object USER. Call BAPI_USER_CREATE1 to create the users, and BAPI_USER_LOCACTGROUPS_ASSIGN to assign roles in a CUA environment. It should go something like this:

[read file with user data into internal table wt_users]

[read file with role assignments into internal table wt_roles]

Loop at wt_users into wa_user.

[create LOGINDATA, ADDRESS and other structures for user in BAPI below, based on the data in wa_user]

call 'BAPI_USER_CREATE1'

exporting

username = [the user name from input file]

• NAME_IN =

logondata = [structure for logondata]

password = [initial password value]

• DEFAULTS =

address = [address structure created above]

[etc.]

if sy-subrc eq 0.

• Assign roles for the user

clear wt_activitygroups. refresh wt_activitygroups.

loop at wt_roles into wa_roles where username = wa_user-username.

[build an internal table, wt_activitygroups, for system/role assignments for the user]

endloop.

call BAPI_USER_LOCACTGROUPS_ASSIGN

exporting

username = [the users name]

tables

activitygroups = wt_activitygroups

return = wt_return.

Endloop.

Ideally, you would have two input files: one with the user data (one record per user), and another one containing the data for the BAPI_USER_LOCACTGROUPS_ASSIGN (on the format USERNAME, SYSTEM, ROLENAME); one entry per line. You'd loop at the first table, containing the user data, then create the user, then loop at all entries in the system/role assignment file for the same username, building an internal table of role assignemnts; then call the second BAPI (provided there were any role assignments to assign for that user!)

Hope this makes sense. It's not rocket science really; you can omit most of the parameters of BAPI_USER_CREATE1, and the second BAPI is even simpler. You could consider validating the input data by checking entries in table USRSYSACT, which contains all valid system/role assignments as seen from the CUA system (this table gets updated every time you do a "text compare" from within SU01.

Regards,

Trond

[Former Member]

Hi Trond,

I modified my ABAP code to use BAPI_USER_LOCACTGROUPS_ASSIGN to add roles to a user in the CUA client and that worked beautifully!!!

I appreciate you taking the time to go into such detail and providing a very concise, easy to follow answer.

This was a tremendous help!!

Thanks much,

Phil