COMPOSITE ROLE USER ASSIGNMENT

[Former Member]

Hello there,

I have got a quick question:

I created a Comp.Role with all the Single Roles attached to it and then assigned to all the required users in PRD. Then, the requirement came back saying that we need to remove one of the single roles from the Comp.Role which I have done in DEV by using PFCG and created a TR and moved to the PRD but the Users still have THAT 'Single Role' in their Usr Master Data. Do I need to remove manually from each users? OR what?

[Colleen]

Hi Rehan

Please try to go into SU01 and see if you can remove the single role yourself. You will notice that it is in blue as it's indirectly assigned due to the composite role. Try to delete it and see what result you get.

Next up, what sort of cleanups in PFCG and PFUD can you see that might assist you?

I recommend you brush you up on your basis security transactions

Regards

Colleen

[Former Member]

Thanks Colleen for the reply.

It's not a "Direct Assignment" or  else it would have a equal (=) sign. It shows a Composite sign in the User Maintenance Record and that is coming from the Composite Role but the role doesn't have THAT "Single Role". Are you suggesting me to run PFUD with that specific Comp.role?

[Colleen]

Hi Rehan

Go to PFUD and click on the information button and read up on the composite role scenario. It might sound familiar to your question

Instead of pressing the alert moderator for a basic question and training issue, I'm trying to help you learn to troubleshoot and decide on the course of action so you can make the decision yourself.

In short: yes.

Regards

Colleen

[radhakrishnan_r]

Rehan,

Perform below steps

1. Remove the specific role from the composite role in development system and capture in a transport request and move it to prd system
2. Once the TR is imported in prd system relationship bw composite role and single role will no longer available
3. Then run report PFCG_TIME_DEPENDENCY so it will reconcile the all the users and single role will be removed from all users profile not from system.

Regards,

RK

[Bernhard_SAP]

Some years ago there was a bug, which was corrected with note 1816508.... Please check , if it is relevant for your correciton level...

b.rgds, Bernhard

[Former Member]

Hi Rehan

Also look into scheduling a job to run PFCG_TIME_DEPENDENCY before the start of each business day.

Regards

Akhil

[radhakrishnan_r]

Rehan,

Like Bernhard said check below SAP Notes which will help you to fix indirect role assignment and removal issue further.

1816508 - PFCG/PFUD: Deletion of indirect role assignments fails

1673833 - PFCG: Error in user copmparison of a composite role

1416149 - Role lock when changing user assignments

Regards,

RK