Remove invalid entries from GRACUSER

[#1]

Dear Colleagues

I'm trying to remove user data for invalid connectors from the tables GRACUSER, GRACUSERCONN, GRACUSERROLE. To populate these tables is very easy, but to remove invalid entries is somehow mission impossible. Sorry for the impressive terms.

The names of the connectors have changed many times in the past. Now we have some invalid entries, which have impact on other processes (SOD, extension and termination).

My idea was to activate an old connector and change the target host to any SAP system with fewer users, the 000 client is good example. Nothing happened, the sync didn't work.

I tried to create new user in this system and the user was added in the GRACGRACUSER* tables.

After I have deleted this user again form the backend the user is still in the sync-tables.

::sync log::

Sync successful for connector P01_020 and total count: 24

Sync completed for connector P01_020

User sync successfully executed

Sync successful for connector P01_020

Repository Object sync job successful

::sync log::

I have still over 800 users for the connector P01_020 in the table GRACUSERCONN.

Thank you for any suggestions.

Daniel

[Former Member]

Thanks both for the quick answer.

The syncjobs was run in the full sync for the connector.

We are on support pack 11:

SAPK-V1011INGRCFNDA

SAPK-10311INGRCPINW  

There also the last implemented notes:

0001785439 Performance improvement of User Sync

0001864423 Repository sync is not updating the GRACUSER table properly

0001873361 Performance issue with GRAC_REPOSITORY_OBJECT_SYNC

When I've run the SOD last time (include deactivated and locked users). I saw some users without any status, they never didn’t exist in this connector. I’ve checked some users with ‘no violation’. There is no history for 19 from 272 users (statistically sample) in the backend (they didn’t exist).

[Former Member]

Hi Daniel

Have a look at the following SAP Notes 1676255, 1819493, 1803158.

They have to do with deleting data for a specific connector, or all connectors.

Regards

Ferdie

[dyaryura]

Hello Daniel,

Have you configured data sources? 1960721 - Search Data Sources in GRC

We have a similar issue but with Legacy Connectors, in such case there's a special procedure to delete users. Even you perform a full synch the users are not deleted.

If you are in a DEV/TEST system you might try cleaning up the tables using SE14 for example. I tried such option once after deleting the SoD rules in a DEV system and we still had an entry in one of the tables that was impossible to delete via the programs.

Definitely that's not a recommended procedure, but for tests systems where  you've tried and tested many things sometimes is the only way to fully clean the tables. For a production system is not an option at least if you don't have a SAP recommendation to do that...

Cheers,

Diego.