SAP GRC Access Control 12.0 upgrade - tables clean up

[olgavlachova]

Hello all,

we are running upgrade from GRC AC 10.0 to 12.0 and I would like to clean up some data during upgrade.

We will remain existing GRC Production as a read only standalone system for access to old data. That's why I want to delete obsolete synced content (done by Repository Synchronization, Action Usage Sync, Role Usage Sync, PFCG Sync) and roles in Business Role Management.

What tables should be cleaned up?

GRACUSER
GRACUSERCONN
GRACACTION
GRACACTIONSYST
GRACACTIONT
GRACACTPERM
GRACACTPERMSYS
GRACPROFILE
GRACPROFILET
GRACRLCONN
GRACRLCONNT
GRACRLCONNTXT
GRACRLCONNVAL
GRACROLEACT
GRACROLEACT_STG
  
GRACACTUSAGE
GRACROLEUSAGE
  
GRACROLE
GRACROLEAPPRVR
GRACROLEARC
GRACROLEAUTHCNT
GRACROLECRPVL
GRACROLEDEF_STG

What about logs like GRACCHANGELOG?

Thank you very much for ideas and help!

[bassuino]

Hello Olga,

Thanks for the details.

The synched data is gonna be deleted by the job mentioned above:

Authorization: GRACACTIONSYST, GRACACTPERMSYS, GRACAUTHPMSYST, GRACCLASSSYST, GRACFLDSYS, GRACFLDSYST, GRACFLDVALSYS, GRACOBJECTAUTH, GRACPERMCLSSYS, GRACPERMFLDSYS, GRACPERMFLDVAL

Repository: GRACRLCONN, GRACROLEORG, GRACUSER, GRACUSERCONN, GRACUSERMAP, GRACUSERORG, GRACUSERPROFILE, GRACUSERROLE, GRACUSRPDPROFILE, GRACPROFILE, GRACPDPROFILES, GRACPROFILET

Action Usage: GRACACTUSAGE, GRACMGMTACTUSAGE

Role Usage: GRACROLEUSAGE

Other: GRACTASKEXECSTMP

However, there`s other data connected to table GRACROLE such as workflows. Are you also planning to delete workflows and all master data involved in that?

Cheers,

Fernando

[shivam_agarwal1]

Hi Olga

As Fernando mentioned, you can review KBA - 2268795 GRAC_DELETE_ACCESS_RULES explained

for all related tables which you want to delete.

In order to maintain consistency, please delete data along categories as mentioned in above KBA.

Thanks

Shivam

[olgavlachova]

Hi Shivam,

thank you for the feedback.

See my answer to Fernando:

https://answers.sap.com/comments/13862776/view.html

[bassuino]

Hello Olga,

I would consider deleting what`s in report GRAC_DELETE_ACCESS_RULES. You have a selection screen where you can select connectors and other criteria. The following KBA explains all the data delete from tables if you`re not familiar with ABAP:

2268795 - GRAC_DELETE_ACCESS_RULES explained

Cheers,

Fernando

[olgavlachova]

Hello Fernando,

thank you for answer.

I tried mentioned report, unfortunately it's not suitable.

I runned it for all systems & connectors but content of tables remains.

We are able to delete tables on DB level during upgrade but I need to know whole list of tables related to synced content (done by Repository Synchronization, Action Usage Sync, Role Usage Sync, PFCG Sync) and roles in Business Role Management.

Any idea if all related tables are in my list?

Thank you and have a nice day.

Olga