GRC HR Trigger - New Account Provisioning

[SubbuIyer]

Hello Everyone,

We are implementing new account user request creation in access control 12.0 on SAP S/4 HANA embedded 1909 FPS02 using the standard HR triggers configuration based on IT0105 subtype 0001. We have configured Hr trigger (BRF+) by using below Wiki. https://wiki.scn.sap.com/wiki/display/GRC/GRC+10.0+-+HR+Trigger+configuration and referred KBA note https://launchpad.support.sap.com/#/notes/2182535 and checked all instructions. The BRF+ simulation is working perfectly fine.

The problem we are facing is that when we actually update a new value for the IT0105, the system does not recognize the change and throws a message that "Rules are not satisfied for Employee id". But, when we make a change and save it, the program is able to catch this change and the request gets created.

The question is why the program is unable to read the initial entry to the IT0105 in PA30?

Decision table

PA30

The SLG1 logs are as follows:

Info Type Field New Value Old Value

0105 AEDTM 20210219

0105 BEGDA 20210218

0105 ENDDA 99991231

0105 FLAG1

0105 FLAG2

0105 FLAG3

0105 FLAG4

0105 GRPVL

0105 HISTO

0105 INFTY 0105

0105 ITBLD

0105 ITXEX

0105 OBJPS

0105 ORDEX

0105 PERNR 10050059

0105 PREAS

0105 REFEX

0105 RESE1

0105 RESE2

0105 SPRPS

0105 SUBTY 0001

0105 UNAME T-SNIYER

0105 USRID GRCTEST7

0105 USRID_LONG

0105 USRTY 0001

Rules are not satisfied for Employee ID 10050059”.

[SubbuIyer]

We finally got this resolved with help from SAP. The issue was with one of the RULE, the operation was modified to INSERT instead of CHANGE. Please see attachments.screen-shot-2021-03-19-at-125228-pm.png

[SubbuIyer]

Hi Ramesh,

I am glad to hear from you. 🙂

There is no SF here. There is mini HR which is being used as a source for user data. We have managed to get it working for now by slightly tweaking the decision table. We have a message open with SAP to validate the solution. If this is found ok, I will post the solution here for the community.

Regards,

Subbu Iyer

[RameshVithanala]

Hi Subbu,

Do you have SF Employee Central, if so leverage SFEC HR Trigger instead of traditional HR Triggers,then you can automate the Business Role assignmnet.

Thanks

Ramesh

[SubbuIyer]

Thanks Mahendra. We validated the points you mentioned. I would just like mention again that the trigger is not working only when the 0105 is initial, but once it is changed the trigger works and the request is created. I have not seen this being reported anywhere in SAP community so it appears there is some configuration that we are missing that is not triggering the request creation when IT0105 is initial value.

I have attached the screenshots for the configuration as requested. I do highly appreciate your help in this regard.hrt-action-to-request-type-config.pnghrt-decision-table.pnghrt-request-to-action.pnghrt-request-type.png

[former_member692917]

Subbu,

I believe below points would be causes.

1. BRF+ decision table condition is not matching with changes that happens in PA tables.

2. Whether correct request type is maintained in Decision table.

3. Correct action types maintained in request type under user provisioning.

4. Also Maintain HR Trigger Actions maintained with proper request type number.

5. Also check on Initiator rule configuration in MSMP.

Validate one by one and yourself can identify the problem. If not pls share some images of configurations, will try to sort out.

Regards,

Mahendran R