topic Re: Evaluation path PROFL0 in Application Development and Automation Discussions

Evaluation path PROFL0

Former Member — Fri, 20 Mar 2009 20:48:49 GMT

Hi,

Anyone has any idea on an alternate to evaluation path PROFL0 so that a role when assigned to a ORG, drills down to all ORGS and positions below it when executing RHPROFL0?

Did you have to create a new relationship in PROFL0?

Any help in this direction would be appreciated

Thanks

Abhishek

Re: Evaluation path PROFL0

jurjen_heeck — Fri, 20 Mar 2009 21:03:59 GMT

> Any help in this direction would be appreciated

Have you considered posting in an HR forum? I think they're the experts on evaluation paths.

Re: Evaluation path PROFL0

Former Member — Fri, 20 Mar 2009 21:07:42 GMT

I have never tried, but "evaluation path" with the default value "PROFL0" is a parameter on the selection screen of RHPROFL0... and you can create variants for it... so this would indicate that there is something configurable behind it...

Try F1

Cheers,

Julius

ps: Let me know if you would like to have this thread moved to the HCM forum if you don't find an answer after a while. Please do not cross-post.

Re: Evaluation path PROFL0

Former Member — Fri, 20 Mar 2009 21:09:40 GMT

Hmm... sure, will do that, thanks Jurjen.

For the security part of the question, anyone faced problems in role assigned to the root Org and that role not getting assigned to all child Orgs when RHPROFL0 or PFUD is executed?

Re: Evaluation path PROFL0

Former Member — Fri, 20 Mar 2009 21:17:55 GMT

Hello Abhishek,

What i understood from your problem is you Assigned the role to root org and it is not getting assigned to all child orgs. .. please correct me i am wrong.

in Evaluation path of PD Profile " Leave Empty " and all Child orgs will get that role.

after you Assigning PD Profile to user I am sure you might be running RHPROFL0 to make Adjustment to all users who got this profile.

Another Alternative way is you Assign the PD Profile directly to user by using T-code " OOSB" in that way you no need run RHPROFL0.

Riyazuddin Mohammed.

Re: Evaluation path PROFL0

Former Member — Fri, 20 Mar 2009 21:26:36 GMT

Hi Julius,

Yeah, we actually can create variants of the evaluation path, however, it only updates the role for that org only . and the exact relations are a little complex to understand.

I will not cross-post, maybe just wait a few days....

Thanks

Abhishek

Re: Evaluation path PROFL0

Former Member — Fri, 20 Mar 2009 21:50:05 GMT

> ...and the exact relations are a little complex to understand.

Design error...

Cheers,

Julius

Re: Evaluation path PROFL0

Former Member — Fri, 20 Mar 2009 22:19:03 GMT

Hi Riyazuddin,

Thanks for your reply... yes, thats our intent here. However, we are not assigning PD profiles, this is just for the standard role assignment. I understand what you mean, use OOSB to manually create entries in T77UA, as an alternate for RHPROFL0. Thats our next goal... to assign PD Profile at Root ORG. And if it does not work, we might use the steps you mentioned.

Right now, we want the role assignment to ripple down. I tried running RHPROFL0 for Standard Authorizations with Evaluation Path blank, I guess it didnt like it.

Did you ever use a custom evaluation path as a copy of PROFL0?

Thanks

Abhishek

Re: Evaluation path PROFL0

Former Member — Fri, 20 Mar 2009 22:20:58 GMT

LOL!

Re: Evaluation path PROFL0

Former Member — Fri, 20 Mar 2009 22:45:30 GMT


> LOL!

Yeah, yeah... he who laughs last...

I understand from previous discussions... that you are also a "basis admin" so in addition to the scalability and automation you are looking for, you might also be considering the performance impact of the authority-check and your app server sizing?

There is a feature available since release 46C called the "reference user concept".

If all users (or known UMR groups of them) in your system are assigned to org units, and you want to assign a "basic" authorization to them at the root node... then you can also do this via one reference user which is assigned to all.

It is not the same as structural authorizations, but will enable the user to pass an authority-check which is unique only to the reference user - because the "auth" will be unique as well.

Some tips:

- The reference user (actually, the auths available to it - it is like a role...) should not be able to do anything on it's own without the "real" user authenticating.

- You need to secure the user and role maintenace of the reference user and the reference role more than what you would normally do for end-users.

Much like trusted RFC for authentication / identification, it is easy to make mistakes here with authorization... but it does work.

Just some thoughts because it might be an option for you to mix with shop floor folks who are not naughty...

Cheers,

Julius

Re: Evaluation path PROFL0

Former Member — Sat, 21 Mar 2009 00:34:49 GMT

Right now i am laughing at myself for the amount of work I am in

Just one of those days for me where you really need a drink!!

I used to work in Basis, don't mind working some Basis work occasionally now 😛

How would this affect the performance? The Org reconciliation will run at night, and auth-check will not care if the role comes from org or is a direct assignment in the UMR. The user buffer will be loaded the same way.

The idea of reference users is actually very interesting. I will definitely pursue it as an approach. In this case, if we where we have to assign the role to all, we can do a SU10 or go with the reference user approach.

The reason we are maintaining this at the ORG is, any employee who joins in, will be part of the ORG and will automatically get this access. Contractors will not be part of the ORG, and they will get it on explicit requirement only. Based on the requirement, we thought this is the best approach.

Now if the HR ORG assignment does not drill down to child ORGs, then we will have to analyze the whole design.

For structural to work, we will anyway have to maintain the relationships and roles at the positions.....

bah!! I am talking to myself... am heading to a bar..join me if anyone is interested, its on me!

Abhishek

Re: Evaluation path PROFL0

Former Member — Sat, 21 Mar 2009 08:00:29 GMT

Reference users are an indirect assignment, but to the UMR. The user buffer is loaded for the reference user (once only!) and all users who are assigned this reference user for additional authorizations, will pass the authority-check if either their own UMR or that of the reference user can satisfy the object field and value in the check.

So it is not an evaluation path, but rather a super-set of common authorizations which are already loaded for all assigned users if one of them has logged on since the buffers rolled.

It is like a buddy-concept

Cheers,

Julius

Re: Evaluation path PROFL0

Former Member — Mon, 23 Mar 2009 02:53:01 GMT

Hi Abhishek,

You are talking about roles, ie generated profiles.

And I think, when we consider allocation of profiles, RHprofl0 looks for only IT1016, ie manually created profiles.

Regards,

Sachhidanand Rankhambe

Re: Evaluation path PROFL0

Former Member — Mon, 23 Mar 2009 18:05:53 GMT


> Hello Abhishek,
> 
> What i understood from your problem is you Assigned the role to root org and it is not getting assigned to all child orgs.  .. please correct me i am wrong.
> 
> in Evaluation path  of PD Profile " Leave Empty " and all Child orgs will get that role.
> 
> after you Assigning PD Profile to user  I am sure you might be running RHPROFL0 to make Adjustment to all users who got this profile.
> 
> Another Alternative way is you Assign the PD Profile directly to user by using T-code " OOSB" in that way you no need run RHPROFL0.
> 
> Riyazuddin Mohammed.

Perhaps it is a design error per Julius, if you want the role assigned to the child orgs per Riyazuddin which you agreed with. I'm assuming the goal is you want to assign a role to an org unit and all the users in the org unit and under will get the role assigment. If have tested this successfully in ECC 6.0 awhile back in RHOPROFL0 with Object type "O" and Evaluation Path "PROFL0". The role will be assigned to all users in the org. Our sandbox is down now for upgrades so I can't test.

Good Luck!

Re: Evaluation path PROFL0

Former Member — Tue, 24 Mar 2009 16:18:38 GMT

> It is like a buddy-concept

Like partners in crime :-P.

For this scenario, then it will become difficult to meet a requirement of a manager needs to maintain another ORG. Dont know..... will have to brainstrorm this a little more..

Thanks for this direction... really is helpful.

Re: Evaluation path PROFL0

Former Member — Tue, 24 Mar 2009 16:23:27 GMT

Hi Sachhidanand ,

I think you meant IT1017

Actually, along with the option of PD profiles, RHPROFL0 also reconciles standard authorizations. You can test it, it works. There is an option for standard profiles in the program.

Let me know if you know any findings...or I have misinterpreted anything

Thanks

Abhishek

Re: Evaluation path PROFL0

Former Member — Tue, 24 Mar 2009 16:36:32 GMT

Hi John,

You got my intent!

I tried running RHPROFL0 , with the standard evaluation path PROFL0, and object type O. However, this is not getting assigned to all child ORGs. This is just reflecting at all those positions attached to that ORGs.

We are on ECC 6.0

Guess, if this not how how the ORG assignment works (that is O-O) , then an alternate way would be to update the role at all ORGs. That way any new position will inherit this relationship using standard (O-S-P).

Am open for any other alternatives....

Thanks all for all your thoughts....

Abhishek

Re: Evaluation path PROFL0

Former Member — Wed, 25 Mar 2009 05:57:13 GMT

Hi Abhishek,

I was talking about the IT1016, ie Standard Profiles only.

You are right, RHprofl0 supports standard authorizations, as well as PD profiles.

But you are considering manually created profiles+generated profiles under standard authorizations option, rather its working in your case. For me,

1) I assigned a composite role to a position & executed RHprofl0, but the user didn't get the role.

2) I ran PFUD with HR Organizational Management Reconciliation & the user got the role.

3) I assigned SAP_all to an org unit & executed RHprofl0, and the users got SAP_all.

Hence I am considering only manually created profiles under standard authorizations option.

I am not sure, why we are getting different outputs. If I am not wrong, then there is no setting controlling this behavior. And I am on 620.

Ultimately I want to say, I doubt, what you are looking is possible using RHprofl0, or not.

Please correct me if you find I am wrong.

Thanks.:-)

Regads,

Sachhidanand Rankhambe

Re: Evaluation path PROFL0

Former Member — Thu, 26 Mar 2009 19:57:22 GMT

Hi Sachhidanand ,

Thanks for this info..this is really useful...there is no wrong... only learning!

My bad, I got confused.... I got you meant IT1016 (Standard profiles)...my question was in reference to roles, and I was thinking that and PD profiles 😛

I checked RHPROFL0 for standard profiles, RHPROFL0 updates the profiles: Standard ones. (Assuming Manual profiles are out now ) I tried putting in a generated profile and RHPROFL0 didn't assign that. ( phew! ..or else I would go nuts! )

Coming back to RHPROFL0 for roles, I am myself a bit puzzled at its behavior. If I assign a role to a position, both PFUD and RHPROFL0 (with standard profile checked) will update this in the UMR. However, RHPROFL0 will re-assign all roles for that position on any change to B|007 relationship, the result, all roles will have a start date of the day the position changed.

I think the way out for this model would be to assign role at all the ORG's. This way, any new position will inherit the relationship when attached to any ORG. The frequency of new ORG's is less, so hopefully there will not be too many updates.

Thanks all for your answers....

Abhishek

Re: Evaluation path PROFL0

Former Member — Thu, 26 Mar 2009 22:59:40 GMT

Hi Abhishek,

Your observation has increased my confusion.:-(

But definitely a valuable addition to my knowledge. Thanks a lot for that.:-)

Atleast I'll be more careful with RHprofl0.

Aso, navvarshachya hardik shubhechchha.:-)

Regards,

Sachhidanand Rankhambe