Question Re: User group provision in Additional Q&A

User group provision

Former Member — Thu, 06 Aug 2015 04:01:34 GMT

Hi Experts,

We have different user groups created in prod systems and we want to tag them to users as needed/fit when creating users through GRC.

is it possible?

Re: User group provision

Former Member — Thu, 06 Aug 2015 06:35:10 GMT

Hi Somik,

you can use User defaults, for assigning user group. But you can also create custom field, in GRC Box. Add all user group values to this field. Then map this field to CLASS, in SPRO->-->Maintain mapping for Action and Connector groups. A simple search will give results, on this

Regards

Plaban

Re: User group provision

Former Member — Thu, 06 Aug 2015 07:05:40 GMT

hello,

check your EUP setting and enable user group visible and editable,

you can fill user group while submitting request.

Regards,

Prasant

Re: User group provision

Former Member — Thu, 06 Aug 2015 07:09:44 GMT

Hi Plaban,

I have a lot of respect for all the knowledge and kindness of this community.

I am a new learner and I know that all the things are that not that easy to me as it may be to wise people like you

Our system has different user groups based on countries and functional team.

Can you kindly guide or refer to some blog/content?

Thanks as always!

Re: User group provision

Former Member — Thu, 06 Aug 2015 07:22:24 GMT

Thanks Prasant!

Do I need to run any sync to see the groups available on the connector? or should we put the group manually?

Re: User group provision

Former Member — Thu, 06 Aug 2015 10:02:54 GMT

Hi Somik,

Could you explain how the answer is correct , when GRC system does not have user group values of connectors.

Sync will not pull user group values. Also, adding all user group values(of all connectors) into GRC Systems' s Own User group list , will ruin GRC system's data, because GRC itself is a connector,like any other. Eg. do you add all user groups of BI into ECC?

When your system has diff. user groups for Countries, why don't you use User defaults. It can assign user group values based on country. but , you would have to pull country from the request raised.

everyone has taken the long road, when they started as a beginner. So, it was never easy for anyone.

Regards

plaban

Re: User group provision

Former Member — Thu, 06 Aug 2015 10:15:24 GMT

Hi Plaban,

Absolutely! I completely agree with you and has full respect about the journey you had to come here.

It's always an inspiration while starting as a learner.

Can you please provide some more details on the below

When your system has diff. user groups for Countries, why don't you use User defaults. It can assign user group values based on country. but , you would have to pull country from the request raised.

How can we map user group to countries in user default?

Re: User group provision

Former Member — Thu, 06 Aug 2015 10:25:03 GMT

Hello Somik,

i just replied based on my little knowledge in GRC.

I am very beginner with less experience,Unlike Plaban who is great experienced person.

would request you to remove this as answered and change it to plaban who gave you nice answer, as per my knowledge goes we could have kept it simple by keeping user group editable and can be filled manually as well,

i think for existing user user group can be populated automatically, just based on my little experience,you can seek help of other .

thanks ..

Prasant K Paichha

Re: User group provision

Former Member — Thu, 06 Aug 2015 10:31:02 GMT

Hi Prasant,

i admire you a lot, and you have been posting much before than i have. So, i am lesser experienced than you, in GRC.

Yes, existing user group of a user will be pulled automatically, and can be changed when set as editable and therefore can be filled manually.

Regards

Plaban

Re: User group provision

Former Member — Thu, 06 Aug 2015 10:33:26 GMT

Hi Both,

I admire you all the time and you all inspire me all the time.

But when I see in the GRC request the existing groups are not getting populated

Did i miss something here?

Re: User group provision

Former Member — Thu, 06 Aug 2015 10:39:40 GMT

Hi Somik,

Can you check, If you have any user group values in GRC system. If not, as a best practice you cam create custom field, and proceed, as posted earlier by me.

Regards

Plaban

Re: User group provision

Former Member — Thu, 06 Aug 2015 10:42:00 GMT

well i think , you need little tweak , to achieve what you need.

check you user detail data source .

. im not sure about your design and your requirement completely, you just wanted to know whether you can keep user group in access request, which have been answered,

we cannot help unless you provide complete details of you requirement .

may be once we have fair idea we can help you setting your requirement.

regards,

prasant

Re: User group provision

Former Member — Thu, 06 Aug 2015 10:55:21 GMT

Hi Prashant,

The requirement is hat twe have to assign user groups based on the country and functional team.

Example: If an user is from UK and from FI team,we have have to assign UK_FI and so on.

Re: User group provision

Former Member — Thu, 06 Aug 2015 11:37:16 GMT

hi Somik,

Does your request capture Country and Team? If so, you can use these fields in Decision table of User default, and then assign user group to User default, in SPRO->..-> Maintain user defaults-> set user group.

This will be an easy and one-time set up, so that you do not have to fill up user group manually for a new user. Also, this eliminates the manual error factor, of incorrect user group fill.

Regards

Plaban

Re: User group provision

Former Member — Thu, 06 Aug 2015 13:06:36 GMT

Thanks Plaban.

I will try and come back to you.

thanks to both of you for spending your time.

Re: User group provision

Former Member — Thu, 06 Aug 2015 13:38:32 GMT

Hello,

first you need to check whether u can populate these 2 things in access request.

location can be used to populate country from LDAP by mapping to an LDAP attribute to location field.

not sure how you want to use Team, may be you can use function area, if that can also be mapped with some attribute in LDAP then that would be nice, after that you can follow whats plaban say or.

you can customize and make your own development either in screen or methods to achieve this.

to help you further lets us know where those data are maintained , to which country they belong and which team they belong.

REgards,

Prasant

Re: User group provision

Former Member — Thu, 06 Aug 2015 14:20:25 GMT

I am finding the user default one a bit complicated

Re: User group provision

Former Member — Thu, 06 Aug 2015 14:42:34 GMT

lets start from beginning.

from where you want to populate country?

from where you want to populate team.

does the user knows their user group?

can user select manually?

Approvers know their user group?

then we can find a way to achive

Regards,

Prasant

Re: User group provision

Former Member — Thu, 06 Aug 2015 14:52:20 GMT

Thanks.

Here the S&A team submits the access request.

We understand the country of the user by the last two characters of the user Id.

Team we can populate depending on the JOB/Business role they request in the incident.

Re: User group provision

Former Member — Thu, 06 Aug 2015 15:38:48 GMT

ok, cool, means this can be updated manually by S&A team while submission.

in EUP setting make user group mandatory and keep it editable.

before submitting the request in GRC update user group manually.

Regards,

Prasant