CUA - Programs adding and deleting User Rolls

[Former Member]

Good Day;

We are currently bring CUA up and using a sandbox as a test child system. Once fully deployed, we will have CUA controling all systems (Sandboxes, Dev, Quality), except production.

Issue - We currently have an application that allows for the adding or deleting of Rolls through the portal. When this was testing, the program failed.

We need to be able to test in both the development and quality systems.

Question. Is there a way (config maybe) that a program would be able to add and delete Rolls as well as have CUA active.

Regards

[Bernhard_SAP]

Hi Don,

your program should call the bapi_locactgroups_assign(and *_delete). Documentation about this FMs can be found in TX BAPI->Basis Components->Security->USER.

I hope, this information is helpful. b.rgds, Bernhard

[Former Member]

Thanks Bernhard

We are currently testing this out. I will let you know how it goes

Thanks Again

Regards

Don

[Former Member]

I'm not a big fan of your design. Do not mix DEV, QA & PROD on the same CUA.

The best design is try to have a CUA in each landscape [DEV, QA & PROD].

Let's say I have 2 major modules, ECC & SRM. I will have 3 CUAs.

I will have one CUA in DEV

-ECC as the Master

-SRM as child

I will have one CUA in QA

-ECC as the Master

-SRM as child

I will have one CUA in PROD

-ECC as the Master

-SRM as child

Why? If all the CUA are the same, you know if it works in PROD, it also works in DEV & QA, or at least can be tested with the same exact environment.

[Former Member]

Thanks John.

I am trying to find some documentation on the CUA set up you are outlining. Would you be able to point me in the right direction.

Thanks again John..

Regards

Don

[Former Member]

Don,

Thanks and I wish you luck on your adventure to CUA.

I think the documentation you will find will not cover CUA landscape design. It will only cover technical configuration.

I based my design on functionality and some common sense. I'll give you the reasonging for our design due to our project scenario.

Production:

We are using HR position base security and CUA. The master is the ECC 6.0 system. We have about 37,000 user IDs and IT 105s (HR info type for communition which is the user ID).

Do I really want to mix my live users with DEV or QA? The answer is NO.

Our production portal UME points to ECC 6.0 and the iViews will point to other system such as SRM or BI.

QA:

QA CUA will have the same configuration as Production. Why? When you run "Integration Testing" - PROD is similar to QA - there will be no surprises on your testing after you move it to production.

DEV:

This will also be the same setup was QA & PROD. DEV will have less users not 37,000 only a couple of hundred for test users and Project Team Members.

Something to think about. Lets say DEV, QA & PROD are in the same CUA and you have to run major service pack testing. This will impact CUA and users that you need to SCUG back after. Let's say the master CUA goes down, you will affect DEV, QA & PROD administration until that system goes up. Just very messy.

There are lot of ways to design CUA, choose one that will work for your current situation.

Good Luck!

Edited by: John Navarro on Feb 25, 2008 7:52 PM

[Former Member]

Good Day John;

I agree, we would not want to mix our development users with our production users. At this time we will only be implementing CUA in our development and test systems. The issue this brings up (for us) are the applications that generate authorizations.

Thanks again

Regards

Don Newton

[Former Member]

Don,

I am not clear when you wrote "The issue this brings up (for us) are the applications that generate authorizations." Are you talking about custom transaction or SAP deliver transactions or both or something else. Give me an example of this application.

[Former Member]

Good Day;

This is using delivered SAP code. The transaction that comes to mind is Section_34.

A batch job runs at night and can either assign or remove authorization

Regards

Don

[Former Member]

I haven't heard or seen tcode "Section_34". Sorry, I have to differ to the other expert on this forum.

====================================

Good Day;

This is using delivered SAP code. The transaction that comes to mind is Section_34.

A batch job runs at night and can either assign or remove authorization

Regards

Don