topic Re: COMPOSITE ROLE USER ASSIGNMENT in Application Development and Automation Discussions

COMPOSITE ROLE USER ASSIGNMENT

Former Member — Mon, 10 Aug 2015 20:49:58 GMT

Hello there,

I have got a quick question:

I created a Comp.Role with all the Single Roles attached to it and then assigned to all the required users in PRD. Then, the requirement came back saying that we need to remove one of the single roles from the Comp.Role which I have done in DEV by using PFCG and created a TR and moved to the PRD but the Users still have THAT 'Single Role' in their Usr Master Data. Do I need to remove manually from each users? OR what?

Re: COMPOSITE ROLE USER ASSIGNMENT

Colleen — Tue, 11 Aug 2015 00:32:09 GMT

Hi Rehan

Please try to go into SU01 and see if you can remove the single role yourself. You will notice that it is in blue as it's indirectly assigned due to the composite role. Try to delete it and see what result you get.

Next up, what sort of cleanups in PFCG and PFUD can you see that might assist you?

I recommend you brush you up on your basis security transactions

Regards

Colleen

Re: COMPOSITE ROLE USER ASSIGNMENT

Former Member — Tue, 11 Aug 2015 01:39:10 GMT

Thanks Colleen for the reply.

It's not a "Direct Assignment" or else it would have a equal (=) sign. It shows a Composite sign in the User Maintenance Record and that is coming from the Composite Role but the role doesn't have THAT "Single Role". Are you suggesting me to run PFUD with that specific Comp.role?

Re: COMPOSITE ROLE USER ASSIGNMENT

Colleen — Tue, 11 Aug 2015 01:43:38 GMT

Hi Rehan

Go to PFUD and click on the information button and read up on the composite role scenario. It might sound familiar to your question

Instead of pressing the alert moderator for a basic question and training issue, I'm trying to help you learn to troubleshoot and decide on the course of action so you can make the decision yourself.

In short: yes.

Regards

Colleen

Re: COMPOSITE ROLE USER ASSIGNMENT

radhakrishnan_r — Tue, 11 Aug 2015 11:14:03 GMT

Rehan,

Perform below steps

Remove the specific role from the composite role in development system and capture in a transport request and move it to prd system
Once the TR is imported in prd system relationship bw composite role and single role will no longer available
Then run report PFCG_TIME_DEPENDENCY so it will reconcile the all the users and single role will be removed from all users profile not from system.

Regards,

Re: COMPOSITE ROLE USER ASSIGNMENT

Bernhard_SAP — Tue, 11 Aug 2015 13:00:26 GMT

Some years ago there was a bug, which was corrected with note 1816508.... Please check , if it is relevant for your correciton level...

b.rgds, Bernhard

Re: COMPOSITE ROLE USER ASSIGNMENT

Former Member — Wed, 19 Aug 2015 11:54:21 GMT

Hi Rehan

Also look into scheduling a job to run PFCG_TIME_DEPENDENCY before the start of each business day.

Regards

Akhil

Re: COMPOSITE ROLE USER ASSIGNMENT

radhakrishnan_r — Fri, 21 Aug 2015 09:17:50 GMT

Rehan,

Like Bernhard said check below SAP Notes which will help you to fix indirect role assignment and removal issue further.

1816508 - PFCG/PFUD: Deletion of indirect role assignments fails

1673833 - PFCG: Error in user copmparison of a composite role

1416149 - Role lock when changing user assignments

Regards,