Question Re: GRACUSER is showing incorrect data in Additional Q&A

GRACUSER is showing incorrect data

Former Member — Wed, 21 May 2014 14:36:45 GMT

Hello,

We have 2 data sources connected to GRC system suppose say as SOURCE1 and SOURCE2.

User details along with personal number present in both the source systems. We have configugred first source system is SOURCE1 and second is SOURCE2.

But after the synchronization, in the table GRACUSER is showing connector as SOURCE2 for some users instead details are present in SOURCE1.

Why the system has skipped the details in SOURCE1 and updated GRACUSER as SOURCE2.

Please advise ?

Re: GRACUSER is showing incorrect data

Former Member — Wed, 21 May 2014 14:41:00 GMT

Have you set sequence for respective systems as per requirement? sequence will decide which system will be used as primary system for user data.

Please mention if you have same users available in both the systems, if this is the GRACUSER stores the data with the source system which has complete data with max details. GRACUSERCONN store all the entries/multiple entries in reference to connector.

Re: GRACUSER is showing incorrect data

Colleen — Wed, 21 May 2014 22:58:30 GMT

Hi Abhi

Extending on Mangesh's comment, I tested the sync jobs a while back (came up on a discussion in SCN) and I got the impression GRACUSER will store the user information for the last system the job ran for.

Every unique user across your connectors will appear once in the GRACUSER table. All subsequent accounts for the user will then appear in the GRACUSERCONN table.

You can confirm this by locating a user with both SOURCE1 and SOURCE2 accounts then run the sync on the two systems and check in between each run to see what happens the entries for that user in the tables.

Regards

Colleen

Re: GRACUSER is showing incorrect data

Former Member — Thu, 22 May 2014 05:19:01 GMT

Hi Abhi,

You should use DB table GRACUSERCONN(Table to store connector specific user) which stores multiple entries of user id and RFC destination instead of GRACUSER(User Table) which stores only single entry.

Thanks

Re: GRACUSER is showing incorrect data

former_member136769 — Mon, 26 May 2014 22:40:57 GMT

Hi Abhi,

I ran the sync job for and the behaviour is as per the explanation below:

GRACUSER is a master table for user data. There is a setting in SPRO->Governance, Risk and Compliance->Access Control->Maintain Data Sources Configuration->User Search Data Source.

You can list the connectors here for which you want the master data to be updated from. Whenever a repository sync job is run for a connector, if the connector is present in the data source list, all

the users which are there in that system will be have a new entry for this connector (overwriting the previous entry for any user which existed in the table).

Table GRACUSERCONN will contain the connector specific entries i.e. if a user exists in two system there will be two entries in GRACUSERCONN. While GRACUSER will have only one entry for a user for which the sync was last run(provided the connector was in the search data source list).

Let me know if you need further help!

Luciana

Re: GRACUSER is showing incorrect data

Colleen — Mon, 26 May 2014 23:24:38 GMT

Hey Luciana

This is great you confirmed the program and use of the Data Source.

Are you able to (pretty please) convert this into a SAP KB article in marketplace? This topic has come up a few times and would probably help everyone with SAP providing a clear explanation for user syncs

Regards

Colleen

Re: GRACUSER is showing incorrect data

former_member136769 — Mon, 26 May 2014 23:40:56 GMT

Hi Colleen,

I will do, sure, thanks for the heads up! so much information that can be put on WIKIs but problem is timeeeee! 🙂

Speak later,

Re: GRACUSER is showing incorrect data

Colleen — Mon, 26 May 2014 23:45:06 GMT

For sure - happy to contribute to the Wiki. I tried a while back but was not authorised to create pages, etc. I'm finding quite a few documents in SCN community probably belong more in the Wiki space.

If SAP and/or Moderators have ideas for Wiki improvements, possible we could identify people in the community to contribute and focus on building it?

Regards

Colleen

Re: GRACUSER is showing incorrect data

Former Member — Tue, 27 May 2014 10:37:49 GMT

Hello Luciana,

Yes, you are right and thanks a lot...!

Re: GRACUSER is showing incorrect data

former_member136769 — Tue, 27 May 2014 21:12:16 GMT

KBA and WIKI are underway.. soon will be available! Thanks for moderating helpful answers!

Re: GRACUSER is showing incorrect data

Former Member — Wed, 28 May 2014 15:07:01 GMT

Hello Colleen,

In continuation to this as you said Sync Job updates the details from the last sync connector.

Suppose in this case SOURCE 1 has complete user details but SOURCE 2 has very limited details.

Last sync was done on SOURCE 2 and it updates the same in GRACUSER table. But we need to have this table update based on the complete data.

Please advise on this is it possible.

Thanks in advance.

Re: GRACUSER is showing incorrect data

Former Member — Mon, 02 Jun 2014 10:44:29 GMT

Hello Luciana,

In continuation to this as you said Sync Job updates the details from the last sync connector.

Suppose in this case SOURCE 1 has complete user details but SOURCE 2 has very limited details.

Last sync was done on SOURCE 2 and it updates the same in GRACUSER table. But we need to have this table update based on the complete data.

Please advise on this is it possible.

Thanks in advance.

Re: GRACUSER is showing incorrect data

Former Member — Mon, 02 Jun 2014 10:44:43 GMT

Hello ,

In continuation to this as you said Sync Job updates the details from the last sync connector.

Suppose in this case SOURCE 1 has complete user details but SOURCE 2 has very limited details.

Last sync was done on SOURCE 2 and it updates the same in GRACUSER table. But we need to have this table update based on the complete data.

Please advise on this is it possible.

Thanks in advance.

Re: GRACUSER is showing incorrect data

former_member136769 — Tue, 03 Jun 2014 22:41:30 GMT

Let me check this scenario

Re: GRACUSER is showing incorrect data

former_member136769 — Tue, 03 Jun 2014 23:00:43 GMT

Here we go, will explain again, i think now it will be clearer to everyone:

How entries are being added in the GRACUSER and GRACUSERCONN:

The table GRACUSERCONN will have one entry for each combination of
user vs. connector.

Example: User A exists in connectors A11 and A12. Then GRACUSERCONN table
will have two entries:

User A for A11
User A for A12

But in case of GRACUSER table, this table contains one entry per user.

So with reference to the above example, if you execute sync for connector
A11, then you will have one entry in GRACUSER for user A and A11.

If you execute a subsequent sync job, now for connector A12, then the
existing entry for user A will be overwritten with user details from
connector A12.

So it means you will have only one entry in GRACUSER at a
time, that will reflect the last connector you have run the sync for.

Now it comes the role of the master user search source.

If you do not maintain anything in SPRO (.."Maintain data source
configuration") then it will work as above mentioned. The user A entry
will always be overwritten every time you run the sync for a different
connector/last connector.

But if you have maintained any of the connector like A11 or A12 in the
SPRO data source configuration, then the priority will be given based
on that. Note that there are sequences, so you may have one or more
data source connectors, and they will have priority among themselves
based on the sequence number they are assigned to.

Example: you have maintained A11 in SPRO then even if you will execute
sync job for A12, user A entry will not be overwritten. This is because
A12 does not have the priority.

The same applies if you have maintained A11 and A12 in data source
configuration. A11 with sequence 1, and A12 with sequence 2.

If you will execute sync job for A12, user A entry will not be
overwritten, because A11 has higher sequence priority.

How is that guys? better?

Thanks!

Re: GRACUSER is showing incorrect data

Colleen — Tue, 03 Jun 2014 23:31:08 GMT

Hi Luciana

I think the key bit here is the assumption that you consistently manage the identity for your users and ensure their address data is current in all connected systems

If not, as you said, choose your primary data source and go from there.

Cheers

Colleen

Re: GRACUSER is showing incorrect data

former_member136769 — Tue, 03 Jun 2014 23:41:23 GMT

You rock!

Re: GRACUSER is showing incorrect data

Former Member — Wed, 04 Jun 2014 14:48:47 GMT

Hello Luciana,

Its very clear now thanks a lot for the clear explanation.

Re: GRACUSER is showing incorrect data

Former Member — Thu, 05 Jun 2014 10:02:26 GMT

Hello Luciana

When we are trying to create Access request in GRC 10.0 for an user it results as user details not found.

Under SPRO - Maintain data source configuration we have configured 2 HR systems HR1 and HR2.

But the User details exits in HR1 system and lies in validity also. We have tried to run the Repository Object Sync also still unable to search the details.

But we observed even after the Sync job User details are not created in table GRACUSER and GRACUSERCONN. Is this could be the problem. Why its not updating even after the Sync job many times almost 10 times.

We have also configured parameter 5023 to YES.Please advise.

Thanks in advance

Re: GRACUSER is showing incorrect data

former_member136769 — Thu, 05 Jun 2014 16:28:02 GMT

Hi Adbi,

Is this question answered? if not, let me know,

With parameter 5023 to yes, it should go around first connector HR1, and for missing details it would go around for HR2.

I assume HR1 is the "master connector" for user details, if details are not in HR1 and are ion HR2, those should be collected. let me know what is your scenario, with examples of user details not coming.

What is the SP level of your GRCFND_A and GRCPINW and GRCPIERP?

Thanks

Luciana