Skip to Content
author's profile photo Former Member
Former Member

Roles turned RED after Upgrade

Hi Experts,

We have recently carried out upgrade in our ECC system. There are approximately 2K roles that have status as not generated. On further analysis (checking individually in PFCG for few roles), we couldnt find any auth objects in yellow or red. Everything is green and intact, but the roles are turned RED. Is there any insight on why these might have turned RED? This is difficult to explain to the client so as to there are no changes to be made to the role but still we have to generate them so that they turn green.

Add a comment
10|10000 characters needed characters exceeded

Related questions

2 Answers

  • Posted on Aug 23, 2017 at 05:48 PM

    Dear Vaishali,

    seems like someone executed steps 2A to 2D in SU25. Can you check if these roles showing up in SU25 got new auth objects? Any upgrade brings some new authorization objects through SU24 that need to be manually updated in the roles. How did you open the authorization in the roles? Did you read the old status or did you merge with SU24 values? In order to get the new authorization objects you have to merge with SU24. Please note that this task can be very time consuming.

    Hope this helps.

    Regards, Alessandro

    Add a comment
    10|10000 characters needed characters exceeded

  • Posted on Sep 08, 2017 at 07:49 PM

    SU25 can also be performed very fast (less than one day) if you understand it well and have confidence in your SU24 which you already did maintain (because you use it). Upgrade efforts are not a reason not to maintain SU24. Fear is the only reason.

    But I suspect here that someone in the last step of the expert mode did not set the status. That means that a merge of the role would have adjusted something (sometimes due to the upgrade, but mostly the roles were due for a merge anyway) and they ignored processing it.

    The trick with SU25 is to understand it.

    - You must read the SAP note about dependences, particularly the initialization of the timestamps and repair tools.

    - You must verify that your roles are merged BEFORE you add the new SU24 so that you can distinguish between old bad housekeeping and new impacts.

    - Step 2A can be split into applications but normally you can just go for it.

    - Step 2B is most important NOT to choose the SAP options for that which you have maintained yourself.

    - Step 2C depends on how many single roles you have and how confident you are in your SU24. The more elegant your concept, the less you will have and you can sail through it in about an hour.

    If you made a stupid concept, neglected housekeeping and took shortcuts in the past, then you will have created such a mess. Unfortunately some consultants leave such things behind for others to fix later on and no one notices until the next release upgrade... :-(



    Add a comment
    10|10000 characters needed characters exceeded

Before answering

You should only submit an answer when you are proposing a solution to the poster's problem. If you want the poster to clarify the question or provide more information, please leave a comment instead, requesting additional details. When answering, please include specifics, such as step-by-step instructions, context for the solution, and links to useful resources. Also, please make sure that you answer complies with our Rules of Engagement.
You must be Logged in to submit an answer.

Up to 10 attachments (including images) can be used with a maximum of 1.0 MB each and 10.5 MB total.