Stop requesting same role multiple times in GRC ARM

[ae55hs]

User may have multiple roles already assigned via GRC. However, user may still use Request Type "Change Account" and request assignment of same roles again.

Eg: User A has role XYZ assigned via GRC (in existing assignment you can see role XYZ assigned to user with Start date 01.01.2017 to end date 31.12.9999).

The user may go to GRC and request access for the same role XYZ, now with start date 01.09.2017 to 31.12.9999. In the process, the user gets the same role assigned twice with different start and end date in the managed system.

Is there a way to stop users requesting access to the same role, already assigned and if within the same validity range? Isn't it logical that if an user already has the role assigned, he shouldn't able to request for it again.

P.S: I know that PRGN_COMPRESS_TIMES will resolve the issue of redundant role assignment in the managed system. But that's not the solution.

[alessandr0 · Accepted solution]

Hi Majumdar,

the only way to suppress is with custom modifications. For example, you can enhance the access request submission or even the web dynpro that it performs a cross-check. In case the role is already assigned, show a warning or stop the user from continuing.

Alternatively, you can add a cross-check in the initiator rule in BRFPlus. In case the role is already assigned, automatically approve the role (route it through an automated approval process). With that, you at least avoid any overhead in approving the request.

Regards, Alessandro

[ae55hs]

Thank you all for your responses. We will go for a custom enhancement in the webdynpro to inhibit access request for a role that is already assigned.

[former_member339032]

Hello D. Majumdar,

We are also having the same issue. Please share the method with which you made the customization in webdynpro.

[former_member226273]

Hello D. Majumdar,

As commented by Ramesh, we cannot restrict users from request same role again.

If you are not using business roles, the duplication of role assignments can be taken care by time dependency job. But only if you are not using Business roles.

Kind regards,

Yashasvi

[ae55hs]

We are using Business Roles. I think you meant program PRGN_COMPRESS_TIMES, not time dependency job.

[ae55hs]

Thanks for your response. I don't feel it's a training issue, it's more about controls.

We don't use BRM.

[Former Member]

Hi Majumdar,

We cannot stop user from requesting same TR again and again, the question I have here is why user is requesting same access and to me its a training issue.

Do you use SAP GRC AC BRM?

Thanks

Ramesh