Application Development Discussions
Join the discussions or start your own on all things application development, including tools and APIs, programming models, and keeping your skills sharp.
cancel
Showing results for 
Search instead for 
Did you mean: 

Cannot specify an imparting role

Former Member
0 Kudos

Dear Expert

I have some derived role. I have deleted transaction inheritance relation with some roles and want to define again

The derive from role is greyed out cannot be allow to select or enter the master role again.

Please advise how to do that ?

Regards

1 ACCEPTED SOLUTION

Colleen
Advisor
Advisor
0 Kudos

Hi Anwer

Wouldn't it be quicker to delete the derived role and recreate (if necessary, take note of the profile Id for the role and re-use it)

Haven't tested this recently, but I think you'll need to remove all role menu of the derived role to reconnect it as the derived role is meant to inherit menu from the imparting.

Regards

Colleen

12 REPLIES 12

Colleen
Advisor
Advisor
0 Kudos

Hi Anwer

Wouldn't it be quicker to delete the derived role and recreate (if necessary, take note of the profile Id for the role and re-use it)

Haven't tested this recently, but I think you'll need to remove all role menu of the derived role to reconnect it as the derived role is meant to inherit menu from the imparting.

Regards

Colleen

Former Member
0 Kudos

Dear Colleen

Thanks for reply!

I am working on project.

There are 2000+ roles are exist with 1 company and 14 branches.  we are working for the another company and don't want to develop the role from the beginning.

I have taken the following strategy for the another company roles and authorization

     1) Copied existing roles with derive roles.
     2) Delete inheritance roles of company 1.

     3) Define another master role into derive role of company2.

     4) Maintain organization data and authorization data of company 2

But, I am stuck on # 3 cannot define the another master role of company 2.

Please advise and correct am about the strategy !

Regards

Former Member
0 Kudos

When you remove the inheritance, SAP forgets about the master role and greys the input field to indicate that the child is now master of it's own menu.

As SAP does not care which master role you might want to reattach an inheritance from, it only has one prerequisite -> the menu must be empty.

So delete the whole menu and hit enter. Field is available again for reassignment to a new master. Org levels and manual and changed authorizations remain unaffected. Menu objects and their proposals will be adjusted.

Cheers,

Julius

0 Kudos

Hi Anwer

When you mention two companies - are they two companies on the same system (i.e. different company code) or do you have two customers and you are copying the roles to another system?

My reason for asking this, if this is a "template" solution and you are incorporating a new company into the solution, why do you need to break the inheritance of the parent/imparting role after the copy? Instead, shouldn't it just be a case of changing the derived role values?

Continuing this, if both companies always need the same transaction and authorisations then you want them to have the same imparting roles. Otherwise, if you need to update a role you will need to perform the change twice

On the other hand, if you are copying the roles to a different system are you assuming that the processes are the same as well as underlying SU24 and support packs, etc? If it is a different customer, then you should really go through a proper role design process and put the effort into build. If it is a different system with different technical baseline, your roles will need adjusting and clean up effort anyway.

I get that you are trying to reduce build effort but what is this going to do to your ongoing administration effort?

Regards

Colleen

Former Member
0 Kudos

Dear All

Thanks for participating and help me decide the strategy for the another company roles.

Yes. This is same system for company 2 and they have same transaction for the roles.

There is no much big change except the organizational data. that's why, I want to copy the existing role then change the organization data with company code, business area, controlling area and plants.

I have learned with all of  your experience and strategy of Julius to re-attach to another master roles to continue the adjust role for company 2.

Thanks for all of you to help me.

Regards

0 Kudos

Hi Anwer

You do not need to reattach to a different parent role. Copy the derived role, change the organisational values and generate the new profile. It becomes a tedious data entry activity unless you have some custom tools to automate this.

If you break the inheritance and then add a new role you will then need to dual maintain two parent roles every time you want to make a change.

Regards

Colleen

Former Member
0 Kudos

The major downside of derived roles is that the will all be exactly the same, except for technically defined org level fields.

My understanding is that Anwer wants them to be almost the same and not exactly the same. So sending a set of different non-org fields to the one company without being forced to upgrade the field makes sense. Using one company as a pilot for new transactions might make sense as well. Eventually one comes to the conclusion that derived roles are actually a pest.

I dont use them.

Cheers,

Julius

0 Kudos

Hi Julius


The major downside of derived roles is that the will all be exactly the same, except for technically defined org level fields.

Quite amusing - as I would normally say the "The major positive of derived roles....)

It comes back to the client requirements and understanding the design. I did interpret Anwer's need as just changing org values (but it is not 100% clear even in his last comment to me)

I like your idea of pilot go lives and needing to make changes. Then, there is always the situations of regional access (SAP standard for specific countries) and custom transactions for specific companies only that is a challenge. In the sites I've been on, they have built an additional role. The trade off was to protect imparting/derived at a cost to additional role assignments. Part of this decision is whether the business process owners and functional consultants are enforcing standardised processes across all companies.



Eventually one comes to the conclusion that derived roles are actually a pest.

In your approach, are you then having to use your own custom tools to manage mass updates to roles? If you are on a site that has 50+ plants and you need to build access by plant, wouldn't that mean 50 role updates for you if you needed to grant them a new permission?

Regards

Colleen

Former Member
0 Kudos

You can provision a role with anything via SU24 and then do a merge to all roles who are affected. That can be automated to a one-click per role level.

Yes, we have our own tools to sync the menus and distribute sets of org. levels to sets of target roles.

I hope that by early next year there will also be API's to provision non-org values automatically to open fields in roles or append values in special cases where they should differ from role to role, like movement types and approval keys. I will post the SAP note number when I have it. Then derived roles will not be attractive at all anymore.

But I do also know customers who can live with derived roles and the business processes are harmonized enough that the number of bolted on localizations could be kept to a reasonable number.

Cheers,

Julius

0 Kudos

Thanks Julius. I'll key an eye out for the APIs and SAP Note

Agree, the benefits of derived roles may not longer be there. Though I do wonder how many people out there adopt the improvements and reconsider their approach. After all, still seeing split roles/org value only roles around the place.

Regards

Colleen

Former Member
0 Kudos

Dear Colleen and Julius

I don't have my own tool which will make the life easier to develop or maintain the roles. The business logic as same as company 1, vendor group/account group except the organizational level change, business area, personnel area,  plant, division and distributional channel.

I keep 1 master role then copied the existing 14 branches role to new company role to modify the organizational level data.

The development is going on. The Go-Live is on 1st January 2015 and client don't have much time to discover tools to automate.

I will be very thankful to all of you to update me about the APIs and SAP Note.

Regards

Anwer Waseem

Former Member
0 Kudos

Hi Julius

I didn't know about the option to delete the menu to allow the role to become derived again but I still hate derived roles 🙂

Merry Christmas

(Except to Composites and derived roles)

David