Recreating SUIM Query

[Former Member]

I need to recreate the SUIM query of Users w/specific authorization objects in a recurring program. Can somebody help me see where I'm off? I follow the below logic. Often, my query returns way more users than the SAP's SUIM query.

First, I make sure I have the child roles included using the AGR_AGRS table.

Then, I query AGR_1251 table for the auth object I am looking for.

Next, I join the results of AGR_1251 with the results of the 1st query to find all of the roles w/the auth object.

Last, I join these results with the AGR_USERS table on the role name (AGR_NAME). This brings all the users assigned roles with the auth object.

Boy, I could really use help on this. Thanks!

[Former Member]

I need to recreate the SUIM query of Users w/specific authorization objects in a recurring program. Can somebody help me see where I'm off? I follow the below logic. Often, my query returns way more users than the SAP's SUIM query.

First, I make sure I have the child roles included using the AGR_AGRS table.

Then, I query AGR_1251 table for the auth object I am looking for.

Next, I join the results of AGR_1251 with the results of the 1st query to find all of the roles w/the auth object.

Last, I join these results with the AGR_USERS table on the role name (AGR_NAME). This brings all the users assigned roles with the auth object.

Boy, I could really use help on this. Thanks!

[jerryjanda]

Hi, Eric:

Thank you for visiting SAP Community to get answers to your questions. Since you're asking a question here for the first time, I recommend that you familiarize yourself with https://community.sap.com/resources/questions-and-answers (if you haven't already), as it provides tips for preparing questions that draw responses from our members.

Should you wish, you can revise your question by selecting Actions, then Edit (although once someone answers your question, you'll lose the ability to edit the question -- but if that happens, you can leave more details in a comment).

Finally, if you're hoping to connect with readers, please consider adding a picture to your profile. Here's how you do it: https://www.youtube.com/watch?v=F5JdUbyjfMA&list=PLpQebylHrdh5s3gwy-h6RtymfDpoz3vDS. By personalizing your profile with a photo of you, you encourage readers to respond.

Kind regards,

--Jerry

[jbm-sceis]

Why don't you just schedule program RSUSR002 with your own specific variant? If you are just looking for a report, then that might help. If you have to do something else with the data returned, then I guess you have to write some code...

[Former Member]

It's part of a bigger monitoring program. There's really no way anything can work except querying the tables. I wonder why this would be uncommon.

[jbm-sceis]

It's not uncommon, I just am not the right person to help you with this. Good Luck!

[jurjen_heeck]

If your query returns more rows than the SUIM report please consider filtering AGR_USERS on the validity dates and AGR_1251-DELETED <> 'X' to skip alle deactivated instances of the object.