How can I resolve a string to a Role in IS?

[Former Member]

We have the following use case:

We are loading employee data from a flat file generated from SAP HR.

We want to take three fields from this file and use them to build a string - we put this in a custom attribute called 'JOP'

So for example, a user might have the following Job = Developer, Org_Key = Southeast, Position = Senior

We run the two pass with a new attribute that looks like this:

Attribute = JOP

Value = %JOB%\%Org_Key%\%Position%

So when it gets to the identity store it looks like this: Developer\Southeast\Senior

Meanwhile, we will create Business Roles by the same name as the JOP.

So, I was told by a consultant that we set up the To IS Pass like this:

Attribute = MXREF_MX_ROLE

Value = <%JOP%>

He said that it would force the system look for the role as the same name as the string and return the mskeyvalue. However, it just returns an error:

putNextEntry failed storingE50436

Exception from Add operation:java.lang.IllegalArgumentException: Entry already exists - entry: E50436

Exception from Modify operation:java.lang.IllegalArgumentException: Entry reference value is not numeric:Attribute: MXREF_MX_ROLE - entry: E50436 : MXREF_MX_ROLE=<>

Has anyone been able to resolve a string to a role value? If so - can you help me please?

[Former Member · Accepted solution]

Hi Geoff,

the references between person and role is a numeric key, but the IC can also do this for you and assign each other with the name (MSKEYVALUE) in <...>, if they exist. That means that you need to create the role before you reference it. I tried it once and it worked fine for me the other way round with MXMEMBER_MX_PERSON from the Role.

Perhaps you get some problems with "\" in the name you want to use and in the references, but I'm not sure about that.

Instead of using <...>, you can also use the numeric key (MSKEY) of the role for the MXREF_MX_ROLE attribute in your to IS pass. You have also a better result handling in a script, which can be called from there. You can find out the corresponending role with an SQL statement in a database view (MXIV_SENTRIES).

E.g. in a script, you can execute the following statement with your rolename (search for "uSelect" in the IC help) : SELECT DISTINCT MSKEY FROM MXIV_SENTRIES WHERE ATTRNAME = 'MSKEYVALUE' AND AVALUE = 'My Rolename'

Best regards,

Nils

[Former Member · Accepted solution]

Nils,

Thanks for your reply.

It's interesting to me that you say this worked for you.

I tried using:

MXREF_MX_ROLE = <test> with a role created called test and got the same error that I must use a numeric value.

Are you using SP2?

[Former Member · Accepted solution]

Hi Geoff,

I'm using SP1 Patch1 and just assigned a role to a user with this method. Just have a look at my business card and write me an email. I'll send you an export of a sample job.

Best regards,

Nils

[Former Member · Accepted solution]

Sorry for my delay in replying to this issue, especially after you've taken the time to help me.

We still have not solved the original use case, but we are going to put into use your idea for a sql lookup function, it actually will work better and easier.

As far as trying to pass another attribute as a value for mxref_mx_role - we have never gotten this to work, I don't know if it's supposed to or not.

If anyone cares - this might help someone else in the future - this is the situation we ended up with:

Initially we tried to build the three field values into a new attribute, like this:

JOP = %dept_text%\%org_key%\%personnel_area_text%

Then we tried to reference this new attribute in MXREF_MX_ROLE like this:

MXREF_MX_ROLE = <JOP>

we also tried it like this:

MXREF_MX_ROLE = <%JOP%>

and this:

MXREF_MX_ROLE = <%JOP%> None of these worked. We had tried previously to build the string directly in the MXREF_MX_ROLE attribute, but it hadn't worked. Then we had the idea to add the and see if it would work. It shouldn't make a difference per SAP training materials, which state that the for add is assumed if the access doesn't currently exist, but nonetheless we tried it. So now our To-Pass looked like this: MXREF_MX_ROLE = <%dept_text%\%org_key%\%personnel_area_text%>

This worked. If you take out the it doesn't work, if you have the it does work. I suspect this is a defect - it shouldn't need the based on what we know.

Nonetheless, we now are using a different design.

We will import the employee data and build the JOP field from the other values. We will seperately have a table that links business role names to each unique JOP, and we will do a lookup as Nils suggested. This should work fine - we haven't gotten that far yet but I'll report in when we do.

Thanks again Nils!

[Former Member · Accepted solution]

Hallo,

irrespective of the Role creation, I have the not numeric-problem at the initial load.

SP2

-

---

putNextEntry failed storingXXXXXXX

Exception from Modify operation:java.lang.IllegalArgumentException: Entry reference value is not numeric:Attribute: MXREF_MX_PRIVILEGE - entry: XXXXXXX : MXREF_MX_PRIVILEGE={ValidFrom=2007-07-26!!ValidTo=2008-02-28}<PRIV:ROLE:XXX:T_XXXXXXX-XXXXXXX>

-

---

SP1

putNextEntry failed storingXXXXXX

Exception from Modify operation:java.lang.IllegalArgumentException: Entry reference value is not numeric:Attribute: MXREF_MX_PRIVILEGE - entry: XXXXXX : MXREF_MX_PRIVILEGE=<PRIV:ROLE:XXX:XXXXXXX-XXXXXXX>

-

---

I have the problem using the "SP1-P3-Initial-Load-ABAP-Job" and "SP2-Initial-Load-ABAPJob". So it is not a problem of the Time-limited attribute.

BR

manajah

Edited by: manajah on Jun 13, 2008 2:22 PM