topic Re: Error : User master comparison incomplete in Application Development and Automation Discussions

Error : User master comparison incomplete

Former Member — Thu, 24 Jun 2010 06:25:26 GMT

Dear All,

I am working on a CUA system. I have modified an existing role(it was a requirement to change Material Mvt typ) and transported to QA system. then run PFCG_TIME_DEPENDENCY.

But when I check user -> and roles using SU01, I see the role I transported is in RED color. but then when I try to do a user comparison I got new error user "Maximum profile exceeded for user ABCXX" , because of this error I cannot complete user comparison.

I also tried PFUD -> Cleanups first, then Profile matching unfortunately it still gives User master comparison incomplete.

Is there a alternative way to compare users except "ABCXX" which has "Maximum profile exceeded for user" or how do I skip this message and complete user comparison ?

Re: Error : User master comparison incomplete

mvoros — Thu, 24 Jun 2010 06:40:54 GMT

Hi,

you are hitting the limit for number of profiles assigned to one user. It's 312 profiles. You can try to use reference user or create a new specific role with all required authorization as a replacement for all roles assigned to this user.

I forgot to mention that this problem has been already discussed on this forum. Please use search functionality before posting.

Cheers

Edited by: Martin Voros on Jun 24, 2010 8:41 AM

Re: Error : User master comparison incomplete

Former Member — Thu, 24 Jun 2010 06:58:19 GMT

Hi Souyee,

A user's profiles (i.e., the objects generated by the profile generator) are all stored in one long field in table USR04. Once that field is filled up a user can have no more roles.

It seems that you are working with a poor security design that should require so many roles. Ideally users shouldn't need more than three or four roles.

So best solution is remove unwanted tcodes from the user menu and then re- generate / do user comparssion.

Useful links:

http://www.basis2048.com/maximum-number-of-profiles-for-each-user-62.htm

Thanks,

Sri

Re: Error : User master comparison incomplete

Former Member — Thu, 24 Jun 2010 07:13:51 GMT

Hi All,

Thank you for your time.

I understand the problem with Max profiles, but now my question is will the User comparison not complete if one user profile is exceeded ?

How do I skip this user and generate Profile matching so that other users can have access ?

Re: Error : User master comparison incomplete

Former Member — Thu, 24 Jun 2010 07:48:45 GMT

Souyee,

If user needs access,then remove unimportant tcodes from the user menu.

If you have similar user id , without profile issues,then you can copy that id .(i.e if it is happening for only one user id)

NOTE:

even if you are able to do the user comparsion,Some of our users are not able to execute some transaction codes, even though the required roles are granted. these type of problems will occur.

Other option is:

you need to identify the profiles assigned and ensure that they are below 312, as you canu2019t assign more than 312 profiles to a SAP User ID.

If the issue happens even with very few profiles, verify the Number of authorizations in User Buffers value in the Instance profile. The value for Auth/authnum ber_in_userbuffer parameter can be increased_. The size of the buffer must always exceed the maximum number of authorizations as authorization checks are made only against those in the buffer. The default value is 800, but this can be set to a value which is between 1u20132000.

Note: Take the help of basis guys,if at all you need to change the Instance value.

Thanks,

Sri

Re: Error : User master comparison incomplete

Bernhard_SAP — Thu, 24 Jun 2010 08:29:13 GMT

> If the issue happens even with very few profiles, verify the Number of authorizations in User Buffers value in the Instance profile. The value for Auth/authnum ber_in_userbuffer parameter can be increased_. The size of the buffer must always exceed the maximum number of authorizations as authorization checks are made only against those in the buffer. The default value is 800, but this can be set to a value which is between 1u20132000.

Hello Sri,

just to avoid any further misunderstanding or false information:

auth/auth_number_in_userbuffer is obsolete since a long time already.

It is only used, if someone sets auth/new_buffering to 1 or 0. There must be serious issues to choose those values.....

Please refer to sap note 209899

b.rgds, Bernhard

Re: Error : User master comparison incomplete

Former Member — Thu, 24 Jun 2010 09:03:42 GMT

Hi,

The obvious answer is staring you in the face - fix the user that has incorrectly assigned roles. This way you treat the cause rather than work around the symptoms.

When the incorrectly defined user has correct role assignments then you will not get any reconciliation problems when you run a user compare for any of the roles in their UMR or any users that have those roles assigned.

Re: Error : User master comparison incomplete

Former Member — Thu, 24 Jun 2010 09:18:31 GMT

Hi,

Ben : Thanks for the correction.

Soyunee :

As ben said , auth/auth_number_in_userbuffer is obsolete since a long time already.

So pls refer to the these NOTES:

410993 - Maximum number for profiles and authorizations.

826908 - PFCG: Profile generation fails for large roles

it says that When you use roles exclusively, the number of profiles per user can only be doubled by assigning a reference user.

If you also use manual profiles, you can combine these to form collective profiles.

or,

Try to re create the role,once again and assign it to the user

or Follow Alex method.

Thanks,

Sri