Question Re: Error provisioning to GRC system - WF-Batch locking user in Additional Q&A

Error provisioning to GRC system - WF-Batch locking user

Former Member — Thu, 30 Oct 2014 06:16:20 GMT

We are having an issue when provisioning New Access requests to the GRC system itself (also a plugin system).

After 1st stage approver confirms approval in work inbox, only the user is being created, but the role assignment is not being added.

Upon review of SLG1 log and the Access request audit log, the following error message displays.

Maintenance of user xxxx locked by WF-BATCH

Then the request will instead take the escape path instead of ending due. The user created and the role not assigned.

We are using GRC AC 10 SP13. Can anyone assist.

Following version of GRC plugins installed on GRC system

GRCFND_A V1000 0013 SAPK-V1013INGRCFNDA GRC Foundation ABAP

GRCPINW V1000_731 0004 SAPK-10504INGRCPINW SAP GRC NW Plug-in

Re: Error provisioning to GRC system - WF-Batch locking user

alessandr0 — Thu, 30 Oct 2014 08:47:25 GMT

Hi Don,

did that happen once? Or several times? Or always?

I am also using SP13 and had that a couple of times (5 times out of 3000 requests). As it occurs seldomly I accept that and re-submit the request within the escape path.

Regards,

Alessandro

Re: Error provisioning to GRC system - WF-Batch locking user

Former Member — Thu, 30 Oct 2014 11:16:53 GMT

Hi Alessandro

It is happening a fairly often, but not all the time. I would estimate about 30% of the time.

I can handle by the exception path, but due to the frequency, I don't that would be best solution. Could this be related to system performance maybe? It is occurring in the GRC development system.

Don

Re: Error provisioning to GRC system - WF-Batch locking user

Colleen — Thu, 30 Oct 2014 16:03:19 GMT

Just wondering if it's intermittent... could Basis team have a look at system performance and see if there is any "tuning" that can be done to prevent the enqueue locks from releasing prior to the next step?

I assume creating a new user would call the BAPI to create. It should then release the lock before calling BAPI to assign access (my guess here).

Re: Error provisioning to GRC system - WF-Batch locking user

Former Member — Sun, 02 Nov 2014 16:06:40 GMT

Hi Colleen

Any suggestions about what I should Basis to look for regarding "tuning".

Application or database level? Which transactions?

Thanks

Don

Re: Error provisioning to GRC system - WF-Batch locking user

Colleen — Mon, 03 Nov 2014 00:56:39 GMT

Hi Don

My comment was a thinking out-a-loud moment. If your issue is intermittant then perhaps Basis can try to run some traces and have a look at the enqueue lock, etc on their side. In relation to transactions to look at, it starts getting past my expertise.

If the entire issue is caused by the GRC calls to ERP for provisioning, then SAP will probably need to release a note (if they have not already) as it could be a programming error.

Regards

Colleen

Re: Error provisioning to GRC system - WF-Batch locking user

Former Member — Thu, 06 Nov 2014 09:00:39 GMT

Hi Don,

we had the same error this week the first time.

In our case the server was offline for a short time.

Parallel a new virus scanner was implemented, we think this could have an effect on the server.

The problem was solved by execution of a new start of the server.

Hope this info will help.

Melanie

Re: Error provisioning to GRC system - WF-Batch locking user

Former Member — Tue, 22 Mar 2016 02:17:33 GMT

Hi Colleen,

I am facing this exact issue where id is locked by BAPI and in meawhile GRC tries to map the role to the user and then it throws the error.

Our plugin system is on CUA. Anyassistance will be appreciated.

Thanks