Question Re: Access Control 10.1 approval workflow query in Additional Q&A

Access Control 10.1 approval workflow query

Former Member — Tue, 11 Aug 2015 08:16:53 GMT

Hi all

I'm hoping that you can assist with a query i have on the AC 10.1 ARM approval workflow process. I'm fairly new to this so please bare with me.

We are currently implementing the ARM module at a client, who has the following workflow request for new/change/unlock user account:

- User submits access request in GRC AC

- First level approver - Line Manager (risk analysis not mandatory)

- Second level approver - Business Process Owner (risk analysis mandatory)

- Third level approver - Authorizations/Security

The request is successfully submitted and is directed to the LM as 1st level approver. The LM approves the request and it's supposed to then be directed to the BPO for the 2nd level of approval, but it does not reach the BPO.

I’ve created a decision table in BRF+ to say if “Basis” is selected as the Business Process on an access request, it must go to the Basis BPO for approval. I've run a simulation on this table and the output results are correct. The table was checked, saved and activated.

I then used this tables Function ID to create a new Agents rule in MSMP (step 2 maintain rules) for the SAP_GRAC_ACCESS_REQUEST workflow process.

In step 3 maintain agents, I've created a new Agent ID called Z_BPO, as an approval purpose and GRC API type, and assigned the Agent Rule ID from step 2.

In step 5 maintain paths, I've created a "New User Account" path with 3 stages of approval - Z_BPO being the second level of approval.

When i try to Save/Simulate in step 7, a version cannot be generated as the IMG Configuration Tables contains errors. When the workflow starts checking the definition of Agent "Z_BPO", the following error is outlined: ABAP dictionary data object binding is out of synchronization.

I've checked the internet for assistance on this error to no avail. I think that i'm not defining the BRF+ decision table correctly within MSMP.

I've followed the documents on the below link that relate to BRF+ and MSMP extensively but i am still stuck.

Your urgent assistance and guidance on this is greatly appreciated.

Kind regards,

Neresha

Re: Access Control 10.1 approval workflow query

Former Member — Tue, 11 Aug 2015 09:13:37 GMT

Hi Neresha,

Have you checked, saved and activated the Function in BRF+ Agent Rule Application? I guess you have only activated the Decision Table. Please check, save and activate the function too.

Let me know if it works.

Regards,

Fazil

Re: Access Control 10.1 approval workflow query

Former Member — Tue, 11 Aug 2015 10:03:59 GMT

Hi Fazil

Thank you for your reply.

The BRF+ decision table, function and application are all saved, checked and activated with no errors (all 3 have green dots to indicate that they are active).

Was i correct in creating a new Agents rule in MSMP with the Function ID from BRF+?

Kind regards,

Neresha

Re: Access Control 10.1 approval workflow query

Former Member — Tue, 11 Aug 2015 10:24:53 GMT

Using the Function ID is correct.

Have you selected the correct "Business Process" field? There are 2 available, one is at header level, and the other is at line item level, i.e. the Business Process assigned to the role.

Also, have you created the agent rule as a "line item by line item" BRF+ rule?

Re: Access Control 10.1 approval workflow query

Former Member — Tue, 11 Aug 2015 11:09:21 GMT

hi Neresha,

can you show screenshot of the BRF+ function/decision table. Data dictionary binding is related, to BRF+, and not error in MSMP.

regards

Plaban

Re: Access Control 10.1 approval workflow query

Former Member — Tue, 11 Aug 2015 11:25:25 GMT

Hi Harinam

Thank you for your reply.

I have selected the Access Request Line Item business process. I tried testing with the Header business process but no change.

I have also created the Agents rule as a BRFplus Flat Rule (LineItem by LineItem). Is the below correct?

Kind regards,

Neresha

Re: Access Control 10.1 approval workflow query

Former Member — Tue, 11 Aug 2015 11:36:11 GMT

Hi Plaban

Thank you for your reply.

Please see below screenshots:

1. BRF+ Decision Table:

2. BRF+ Decision Table settings:

3. BRF+ Function:

Is this what you are looking for?

Kind regards,

Neresha

Re: Access Control 10.1 approval workflow query

Former Member — Tue, 11 Aug 2015 11:54:05 GMT

Hi,

I think you need to change Result data object as -- GRFN_MW_T_AGENT_ID

Remove user id and add this object.

Let me know the result.

Thanks

Mohan

Re: Access Control 10.1 approval workflow query

Former Member — Tue, 11 Aug 2015 13:46:09 GMT

Hi Mohan

Thank you so much for your suggestion - i can now successfully generate an MSMP version with no errors after adding GRFN_MW_T_AGENT_ID as my Result Data Object on my function. In BRF+ I've activated the decision table, function and application successfully.

However, on my access request, when it's supposed to be directed to the BPO for 2nd level approval, it takes an escape path to the authorizations team because it cannot find the approver.

My decision table now contains the following details, with NOTIFY_EXT_WHO_TYPE and NOTIFY_EXT_WHO_ID not mandatory. Is this correct?

I've set up step 5 maintain paths in MSMP as follows, which is pointing to the Z_BPO Agent ID. Is this correct?

Kind regards,

Neresha

Re: Access Control 10.1 approval workflow query

Former Member — Wed, 12 Aug 2015 00:39:37 GMT

hi ,

could you show your Modify and Modify Task settings, screenshot. check whether your Agent id is the same as rule id created, in both the above settings

regards

plaban

Re: Access Control 10.1 approval workflow query

Former Member — Wed, 12 Aug 2015 06:26:22 GMT

Hi Neresha,

Can you please attach Screen shot of the function?

Regards,

Fazil

Re: Access Control 10.1 approval workflow query

Former Member — Wed, 12 Aug 2015 07:27:03 GMT

Hi Plaban

Please see screenshots below:

1. Modify

2. Modify Task Settings

The Agent ID Z_BPO is linked (in step 3 maintain agents) to the Rule ID created in step 2 maintain rules. Is this correct?

Kind regards,

Neresha

Re: Access Control 10.1 approval workflow query

Former Member — Wed, 12 Aug 2015 08:47:06 GMT

Hi Naresha,

Please try with another function id:

Please check the transaction, Process ids. Agent type : GRFNMW_CONFIGURE.

As per your requirement above mentioned, you create detour rule not an initiator rule for risk violations.

Regards,

Reddy

Re: Access Control 10.1 approval workflow query

Former Member — Wed, 12 Aug 2015 09:00:40 GMT

Hi Naresha,

1.Remove Itemnum in line item key

2.Remove user ids in Notify Ext who id.

3.Do not maintain who type

once this done, test in simulation mode and let me know result.

Thanks

Mohan

Re: Access Control 10.1 approval workflow query

Former Member — Wed, 12 Aug 2015 09:22:31 GMT

Hi Mohan

I have removed the cell values as requested:

I've also successfully tested in simulation mode, where it brings up the correct user ID per process:

Kind regards,

Neresha

Re: Access Control 10.1 approval workflow query

Former Member — Wed, 12 Aug 2015 09:27:27 GMT

Hi Neresha,

As Mohana said, you can try keeping Line item as blank. So " ", should appear. and USER_ID is not required.

'Who type' can be kept.

Regards

Plaban

Re: Access Control 10.1 approval workflow query

Former Member — Wed, 12 Aug 2015 09:46:20 GMT

HI ,

please remove column User ID, and give blank in Line item, i.e the same as ..WHO_TYPE

regards

Plaban

Re: Access Control 10.1 approval workflow query

Former Member — Wed, 12 Aug 2015 13:11:56 GMT

Hi Plaban

I've left all columns blank except for the BPROC column. I could not remove the USERID column completely as it gave me an inconsistency error when i tried to Check the BRF+ decision table.

I created a new access request to test, but after 1st level approval the request is sent to the escape path as it still cannot find the BPO level of approval.

In your suggestion to remove the USERID column from the decision table as it is not required, how does the system know who to send the request to for approval, if "Basis" is selected as the business process, if the user ID is not specified anywhere in the system?

Kind regards,

Neresha

Re: Access Control 10.1 approval workflow query

Former Member — Wed, 12 Aug 2015 13:14:51 GMT

Hi ,

It seems to be BRF+ is fine.

1)Can you check all paths where Z_BPO agent is mapped and check stage settings as well.

if you find different agent maintained in stage settings, change it to Z_BPO.

Activate MSMP and test again.

2)If it still have issues, run transaction code -- GRFNMW_DBGMONITOR_WD to view message log,to view configuration ,etc.

Thanks

Mohan

Re: Access Control 10.1 approval workflow query

Former Member — Wed, 12 Aug 2015 13:14:56 GMT

Hi Fazil

Please find updated screenshot of the Function details:

Kind regards,

Neresha