Users & Role Assignment Report

[Former Member]

Hello, Here is the scenario:

User A, User C have following roles:

Role1

Role2

Role3

User B, User D have following roles:

Role2

Role3

Role4

If I run a SUIM Report for all the users assigned with Role1,Role2,Role3 I'd get Users A, B, C & D coz SUIM will default an OR operator (i.e., we'd get users assigned to Role1 OR Role2 OR Role3)

I need to know which users are assigned to Role1 AND Role2 AND Role3 (i.e., User A & User C)

Is there a way to do it in SAP ?

Thanks

[Former Member]

Use S_BCE_68001399

Enter one role at a time, producing a list of users for each role.

[Former Member]

I think we dont have any option like this .Only thing i can think of is to dump the agr_users table in a database and put a required query .

Or probably if you need it on regular basis then write a customized program or a query for it .

[Former Member]

Hi Prashanth,

Normally the scenarios will be,

-> a. How many users are assigned/ have access to a particular role

or

b. how many roles are assigned to a particular user.

these scenarios will be used for reporting/ audit.

in your scenario, you have assigned roles to different users. And when you run the report, it will show the assigned user accounts. but you want few of them should be in the list.

(as you said -> I need to know which users are assigned to Role1 AND Role2 AND Role3 (i.e., User A & User C))

as per my knowledge it won't possible. you have to import the data from table agr_users, and remove what ever you don't want.

[Former Member]

Hi Prashant,

i dont think we have an option for that

for single role it is not possible to find but you can try with composite role

below 3 can be added to a composite role and assign to A & C

Role1

Role2

Role3

Thanks and Regards,

kishore

[Bernhard_SAP]

Hi,

unfortunately the multiple selection on rolenames is really treated as 'OR'-operand. If you have to check only the assignement of 3 roles (=the maximum number for my workaround), I suggest to

1. identify, which profiles are connected to that 3 roles.

2. With that 3 profilenames start S_BCE_68001395 (users by profiles)

3. enter the 3 profilenames in the selectionscreen (they are treated then with 'AND' operand. I hope this workaround helps. b.rgds, Bernhard

[Former Member]

I do have another workaround that I'm using myself when running into similar problems.

Search for users that have role1 assigned. Copy all user IDs from the output and use them as input criteria for your search on role2. As you are only interested in those user who have role1 & role2 you can limit your selection for role2 to those users already having role1 assigned.

In your example if you start with "who has role2 assigned" your result would be userA, userB, userC and userD. Call S_BCE_68001400 (i.e. RSUSR002 will full selection screen) and enter userA, userB, userC and userD in the USER field. Enter role1 in the ROLE field. As a result you will now see userA and userC only.

This can of course also become a bit tedious with a large number of users but it should work fine up to at least 1000 users in you first result list. Not sure about the exact limit when you upload selection criteria from the clipboard. It also depends on the built SQL statement I think.

Hope this helps.

[Former Member]

I use an Excel Add In called "The Duplicate Master" I found for free (Google)

Use S_BCE_68001399

Enter one role at a time, producing a list of users for each role, enter each list into a worksheet and then use the Duplicate Master to compare the lists. It will highlight those users who have all three.

[Former Member]

Thanks everyone for your suggestions.

Yeah the Composite roles would've definitely solved the problem however we are using single role assignments referencing a 'Master Jobs - Security Roles' sheet.

We have 120 jobs(avg 7 roles each) so the manual filtering approach would take forever.

I am playing with MS access for now ... I'll keep you posted. Do let me know if any of you got a ABAP report developed with an AND operand (Users for Role1 AND Role2 AND Role3)

Thanks Again