Transporting role with user assignments

[Former Member]

Hi Guru's,

When we transport a role with user assignments then in the target system, the role will wipe out all the existing assignment and show the the users in the original released request.

eg. D->Q

In dev:

role-A has userA, userB

In Qas;

Role-A has UserA and userC

......after import of request:

the roleA will have userA and userB

What I have noticed is even if userB does not exist in Qas, the assignment will be reflected in AGR_USERS. A PFUD or user compare in a role does not remove the ghost entries. Is there any way to remove these inconsistencies ?

I saw note 534010, which is applicable for UST04.

Thank you

Abhishek

[Matt_Fraser]

Abhishek,

Do you have a specific reason for transporting the user assignments? This is not common practice, in my experience. Usually you just transport the role and associated profiles, but not the user assignments. You make the user assignments independently in each system instead.

--Matt

[Former Member]

Hi Matt,

Yes, I do agree this is not a best practice. However, for a particular requirement, we thought this was the best way to solve the problem. Infact, this was the first time I ever did this

We have a role that needs to ONLY be assigned to every person in a particular team. With more than 30 systems present( out of the production landscape, just the testing systems), we thought this would be the only fast way out than going in each system and assigning this role. This would also ensure unassignment of this role to any other person too

Any other alternative?

Thank you

Abhishek

[Matt_Fraser]

Ah, I see what you're trying to achieve. This could work if you were able to ensure that all the users on the team exist in each of the systems, but most especially they need to exist in the DEV system where you are originating the role.

If you have CUA implemented, could you not use that to assign the role in such a cross-system manner?

Another possibility -- are you using HR? If so, and if there is an org unit representing the team, you could assign the role to the org unit and let it be automatically assigned to each member of that org unit as a result.

All of these ideas require initial setup, of course, that is probably just as onerous as going to each of those 30 systems. However, you might only have to do it once.

[Former Member]

Hi Matt,

Had i had CUA, that would have been the end of the problem

No HR

I actually achieved what I wanted to, however the next part of the problem is how do i get these ghost entries outta AGR_USERS?

Thanks

Abhishek

[Former Member]

Got it!

PFUD with option 'Cleanups' enabled does the trick!