GRC Role Expert - How it works

[Former Member]

I am researching to see if the task I have been given can be done. The idea is to find a way to automate PFCG so an associate can enter a master composite role in a screen and then the program would do PFCG in the background to generate the derived roles. I am on an SAP R/3 system. In my research I am finding that PFCG has issues with being run in the background but I have heard an RFC may be a possibility. Also I wanted to find out how the GRC Role Expert creates roles in SAP so maybe I can use the same idea. I have done several searches but can not find exactly what happens behind the scenes between GRC and SAP. I am assuming it does an RFC but beyond that I do not know. I am fairly new to this to thanks for bearing with me. Any help would be greatly appreciated!

[Former Member]

Yes, Role Expert communicates via RFC. You install a Real Time Agent (RTA, some programs and BAPIs) in each target R/3 system, the role creation will then be executed by calling a BAPI via RFC.

Up to version 5.2, the role creation process (maintaining authorization values) was a little "unhandy" in Role Expert, but from 5.3 you have a direct jump to PFCG for maintaining authorization objects and values.

SAP also always stresses that Role Expert is not supposed to be a PFCG replacement.

The main pro's of Role Expert are Risk Analysis prior creating the role, having role change reporting and if wanted, an approval workflow using Access Enforcer integration.

Regards,

Daniela

[Former Member]

Thank you for your help! You wouldn't happen to know what the name of the BAPI is, would you? I am finding BAPI_USER_PROFILES_ASSIGN but I'm not sure if that is the right one.