topic Re: Users & Role Assignment Report in Application Development and Automation Discussions

Users & Role Assignment Report

Former Member — Tue, 26 Feb 2008 17:12:10 GMT

Hello, Here is the scenario:

User A, User C have following roles:

Role1

Role2

Role3

User B, User D have following roles:

Role2

Role3

Role4

If I run a SUIM Report for all the users assigned with Role1,Role2,Role3 I'd get Users A, B, C & D coz SUIM will default an OR operator (i.e., we'd get users assigned to Role1 OR Role2 OR Role3)

I need to know which users are assigned to Role1 AND Role2 AND Role3 (i.e., User A & User C)

Is there a way to do it in SAP ?

Thanks

Re: Users & Role Assignment Report

Former Member — Tue, 26 Feb 2008 17:27:15 GMT

Use S_BCE_68001399

Enter one role at a time, producing a list of users for each role.

Re: Users & Role Assignment Report

Former Member — Tue, 26 Feb 2008 17:30:09 GMT

I think we dont have any option like this .Only thing i can think of is to dump the agr_users table in a database and put a required query .

Or probably if you need it on regular basis then write a customized program or a query for it .

Re: Users & Role Assignment Report

Former Member — Wed, 27 Feb 2008 07:15:28 GMT

Hi Prashanth,

Normally the scenarios will be,

-> a. How many users are assigned/ have access to a particular role

b. how many roles are assigned to a particular user.

these scenarios will be used for reporting/ audit.

in your scenario, you have assigned roles to different users. And when you run the report, it will show the assigned user accounts. but you want few of them should be in the list.

(as you said -> I need to know which users are assigned to Role1 AND Role2 AND Role3 (i.e., User A & User C))

as per my knowledge it won't possible. you have to import the data from table agr_users, and remove what ever you don't want.

Re: Users & Role Assignment Report

Former Member — Wed, 27 Feb 2008 08:07:41 GMT

Hi Prashant,

i dont think we have an option for that

for single role it is not possible to find but you can try with composite role

below 3 can be added to a composite role and assign to A & C

Role1

Role2

Role3

Thanks and Regards,

kishore

Re: Users & Role Assignment Report

Bernhard_SAP — Wed, 27 Feb 2008 08:12:48 GMT

Hi,

unfortunately the multiple selection on rolenames is really treated as 'OR'-operand. If you have to check only the assignement of 3 roles (=the maximum number for my workaround), I suggest to

1. identify, which profiles are connected to that 3 roles.

2. With that 3 profilenames start S_BCE_68001395 (users by profiles)

3. enter the 3 profilenames in the selectionscreen (they are treated then with 'AND' operand. I hope this workaround helps. b.rgds, Bernhard

Re: Users & Role Assignment Report

Former Member — Wed, 27 Feb 2008 18:12:43 GMT

I do have another workaround that I'm using myself when running into similar problems.

Search for users that have role1 assigned. Copy all user IDs from the output and use them as input criteria for your search on role2. As you are only interested in those user who have role1 & role2 you can limit your selection for role2 to those users already having role1 assigned.

In your example if you start with "who has role2 assigned" your result would be userA, userB, userC and userD. Call S_BCE_68001400 (i.e. RSUSR002 will full selection screen) and enter userA, userB, userC and userD in the USER field. Enter role1 in the ROLE field. As a result you will now see userA and userC only.

This can of course also become a bit tedious with a large number of users but it should work fine up to at least 1000 users in you first result list. Not sure about the exact limit when you upload selection criteria from the clipboard. It also depends on the built SQL statement I think.

Hope this helps.

Re: Users & Role Assignment Report

Former Member — Wed, 27 Feb 2008 19:00:13 GMT

I use an Excel Add In called "The Duplicate Master" I found for free (Google)

Use S_BCE_68001399

Enter one role at a time, producing a list of users for each role, enter each list into a worksheet and then use the Duplicate Master to compare the lists. It will highlight those users who have all three.

Re: Users & Role Assignment Report

Former Member — Wed, 27 Feb 2008 19:37:42 GMT

Thanks everyone for your suggestions.

Yeah the Composite roles would've definitely solved the problem however we are using single role assignments referencing a 'Master Jobs - Security Roles' sheet.

We have 120 jobs(avg 7 roles each) so the manual filtering approach would take forever.

I am playing with MS access for now ... I'll keep you posted. Do let me know if any of you got a ABAP report developed with an AND operand (Users for Role1 AND Role2 AND Role3)

Thanks Again