Derived Roles

[Former Member]

Hi experts,

Can anyone please answer this question for me? I have this big issue to resolve. I transported more then 100 Derived roles through the landscape; it automatically grabbed master for the derived roles.

But I guessed there were some more derived roles that link same Master roles, but I didnu2019t transport those derived roles that I didnu2019t need it to move to production.

The issue is that they are telling me that the other derived roles that were link to the same master role but I didnu2019t transport them so they were became ungenerated, they were already in production

I didnu2019t change anything in Master role. I only transported them.

My question is ; Is it possible if you transport one derived role but other derived role become ungenerated if you didn't tranport them. I didnu2019t transported so they can be ungenerated in production

I donu2019t understand that can be possible. Can anyone please answer this question for

Thanks

Syed

[Former Member]

Hi,

When a derrived role is transported the related master role gets transported to the production with profile status ungenerated.

Therefore some derrived roles are in development with same master role and some derrived role are in production with same master role..

Hence master role status gets changed, You need to generate the profile for the master role both in production and the development system.

[Former Member]

Thanks Rakesh,

But I still didn't get it, When I tranport derived (A) role related master role also transported, that;s ok I know that.

but there are some other derived roles (B, C, and D) already exist in production which was related to the same master role that was pulled when I transported derived (A) role.

I didn't transport (B, C, and D) derived role to the production but they become ungenerated when my Derived (A) role hit the production.

Is that possible

Please answer me in detail.

Thanks a lot

Syed

[Former Member]

Hi,

1.Once you transport the derived roles into Production system, they will carry the Master roles automatically.

2.After the transport is successful, you need to generate the Master role and also generate the child roles via the Master role itself.

3. DONOT GENERATE THE CHILD ROLES by themselves.

4. Now if you have not transported some of the other derived roles that link with the same Master role, then you need to transport them back from Dev to Production and once you make sure that all the derived roles linked to the Master role are in place then generate the Master role and press the generate derived role button finally one last time and all the derived roles will be generated.

Hope this helps.

Kiran Kandepalli.

[Former Member]

Thanks,

But as far as I know you can't generat role in production, there is no changes you can make in production.. Another point is when we usually transport roles its give you a option in PFCG that you want to transport this role with generated profile, if check mark in the option box it should transport with the generated profile

Can you please explain that

Thanks

Syed

[Former Member]

As the other derrived roles B,C,D were already in production and when derrived role A was pulled into production hence all roles will get affected as the main source the master role(for A,B,C,D) status gets changed.

(master role is transported again, even its not transported the status will change as new derrived role is added to its list)

Even you tick mark the option you need to generate the profile in production as the naming conventions(for profile generation) may differ between systems.

Guess you got it!!

Generate the master role in the production

Rakesh

[Former Member]

Thank you so much,

But you can't generate role profile in production, I tried it I don't have authorization to generate profile. I know usually in production you can't make any changes.

I didn't change anything in master role I have just transported Derived (A ) role but derived (B, C,. and D ) was become ungenerated in production for same master role.

I understand if I made any changes in master then it would have been effected but since I haven't touched master or derived roles jsut transport them in production but (B, C, and D) existing derived role are in production become ungenerated.

Well I really appreciated your feedback

Thanks

Syed

[Former Member]

Derived child roles are actually separate roles themselves and would not be affected by the transport of their master role.

If the dervied roles got ungenerated, then it may be that someone has transported ungenerated roles into PRD or modified them in PRD.

As a rule of thumb, I generate the master roles as well and do not leave them in a ungenerated state. As well I do this in DEV and then only transport generated roles.

[Former Member]

Do your company have multiple role administrators?

this happens occasionally when you have multiple role administrators.

I am pretty sure unknowingly you moved a master role which was changed without pulling all derived roles into the transport.check with your change documents on master role if you need to know how and by whom this change was done.

You can hit the 'generate derived roles' button directly in production since they use the existing profile name but not recommended.

retransport all derived roles for the master roles.

The red colour might be scaring you but really It won't affect ur users because these profiles will be in'to be compared' state.