SAP_ALL and SAP_NEW not assigned to created user in SU01 CUA system

[Former Member]

Hi Experts,

I am trying to add the profiles SAP_ALL and SAP_NEW while creating a user in SU01 in CUA system (Solution Manager). Actually, these profiles has to be assigned automatically if the systems (in our case, D02 and D03) are configured to CUA system. When I tried manually to add these profiles, I am getting error "Profile SAP_NEW does not exist". (see in attached screenshot).

Any ideas, please?

Thanks & best regards,

Srinu

[Former Member]

This is correct. SAP_NEW is obsolete as profile and is replaced by a role with the same name (SAP_APP as well).

You must use roles. Profiles might be completely obsolete some day soonish.

Cheers,

Julius

[Former Member]

Hi Julius,

I think, you haven't understood my query. In CUA (central system), in SU01, in profiles tab, the SAP_ALL and SAP_NEW are maintained automatically and not in Roles tab. I want to have the systems (D02CLNT710, D02CLNT720, D02CLNT730, D03CLNT100, D03CLNT700, D03CLNT710, D03CLNT720, D03CLNT730) with profiles (SAP_ALL and SAP_NEW) like other systems(D02CLNT100, D02CLNT200). See the attached screenshot.

Thank you,

Srinu

[Former Member]

Well, SAP_NEW is a role now and the profile is obsolete. But I agree that your system still has it.

Hmmm....  I wonder whether there is a button you could click to compare the texts of data in child systems with the master system? Otherwise just wait until tomorrow - it's christmas and you might be lucky..  😉

[Former Member]

Hi Julius,

But, I don't understand one thing from the previous screenshot which I send you. I don't find these roles in both systems (child and central). Then, from where they are generating for some systems and why they're not generating for another systems?

Any ideas, please?

Thank you in advance!

Best regards,

Srinu

[Former Member]

Can you take a new screenshot of the search help for SAP_NEW today?

Santa will have been there in the night and hopefully in one of the packets there was a big button with the "text comparison from child systems" in it.

Cheers and merry christmas,

Julius

[Colleen]

that's assuming the elves did their job each night so santa doesn't need to press the text comparison button

[Former Member]

Hi Julius,

No need to make fun of my question comparing it with Santa.

If you have any other ideas, please let me know. Otherwise, it is not required to support me.

Thank you,

Srinu

[Former Member]

Hi Lee,

Any ideas, please?

Thank you in advance,

Srinu

[Former Member]

Does that mean it did not work either with the text comparison? And the RFC user in the child system is authorized to run it?

Cheers,

Julius

[Former Member]

Well, are you going to provide more information than just "it does not work", or can we go back to the support level of at least having some fun again while we wait?

Cheers,

Julius

[Former Member]

Hi Julius,

Yeah, it does not work also with text comparison button. But, I noticed an issue "You cannot log on (CUA system assignment missing)" for the dialog user that I created using SU01 in CUA central system (SolMan). I am getting this error when I try to logon to SolMan system using this user. I don't think that this has to do something with Roles.

Any ideas?

Thanks & best regards,

Srinu

[Former Member]

The error message is clear to me. You cannot logon to a system if the user is not assigned to that system. The master is also just a child of itself.

But that is a different problem to the one you have been describing previously.

Cheers,

Julius

[Former Member]

Hi Julius,

I don't think that the master system is also acting as the child system for the User because when I create the user in master system I can see the same user is created automatically also in child system. So, I would say, that is the functionality of CUA through which we manage the child systems via master system.

Any other ideas?

Thank you in advance,

Srinu

[Former Member]

I think only as mentioned before, so I would say no more ideas from my side.

Former Member mentioned once before that there is a cooling off period integrated into the CUA. Perhaps this is what he meant? Lets ask him.

Cheers and good luck!

Julius

[Former Member]

Hi Julius,

Thank you for your time and patience.

I will wait till you get some idea from Will.

Best regards,

Srinu

[Former Member]

Hmm - if I remember correctly, the cooling off period became obsolete in 6.0 because impatient people found a way of circumventing it by using the "Text Comparison with Child System" button.

Which is a pity. I used to find lots of interesting things to do while I waited. Sometimes I would use the time to take a look at the CUA RFC user in the child system and see if he was correctly authorised for his job. But other times I would just watch the clouds and look for interesting shapes in them.

[Colleen]

Hi Srinu

Did you manage to figure this out yourself? If you search you will find CUA cookbooks and other material that explains the CUA setup

In relation to the "Profile does not exist" (and useful hints masquerading as hints), you need to run the user compare job (button links of SU01 roles or profiles tab as well as SCUA transaction) to update the tables in CUA that hold the references of roles and profiles that exist for each child system.

If you cannot run this job or attempt to use transactions SCUA or SCUG for the child system and receive a connection error then you need to work with Basis to check the CUA setup. If you happen to be the Basis Administrator then you need to go back to basic training and read up on ALE, RFC and CUA setups to see where it failed (most times it's either trusted RFC or system user in RFC connection being locked or not existing or authorisation error)

In relation to your comment below about "you cannot logon to system" for your test user - again this is the fundamentals of CUA and some slight differences to standalone. You need to assign the CUA system to the system tab of the test user. Logon checks will look at USR02 on a standalone to make sure users is not locked, in validity, etc but with CUA it also checks out the system tab assignment to make sure the user does not exist for CUA purposes only (differentiates between the user being a CUA account or an actual Solman account).

In short, go back to your basics on CUA. It's been around 10+ years so you'll find your answers out there

Regards

Colleen

[Former Member]

Hi Lee,

I already performed the steps according to the information that you mentioned above.

If you have any other ideas, please let me know!

Thanks & best regards,
Srinu

[Former Member]

I noticed that was around earlier today. He specializes in using pixie dust to forensic mystic problems - perhaps he has an idea?

Otherwise I would simply sit back and wait. Something is bound to happen sooner or later..

Cheers,

Julius

[Colleen]

Hi Srinu

1. In CUA have a look in table USRSYSPRF to see if you can find an entry for the child system and SAP_NEW (really this what the match code search in SU01 profiles tab would do)
2. In child system, check to see if SAP_NEW profile actually exists (like Julius mentioned)

If you cannot find an entry in CUA table but can tell it exists in child system then you have a problem with running the text comparison job (which is on the roles and profiles as I mentioned)

If you claim you ran the job and the entry is still not there for you to select then you need to revisit your configuration to see what is failing.

Again, you should be able to search and find this information yourself. CUA has been around long enough for people to stop using it.

If you still cannot resolve this your might be at the stage of contacting SAP to investigate the pixies or gremlins in your system.

Regards

Colleen