Skip to Content
0

GRC ARM - Business Roles not being provisioned

Feb 19, 2017 at 05:20 AM

728

avatar image

Hello Experts,

We are using Business Roles in order to provision a Production request in both Production and QA environments. We are currently in UAT and the Business Roles should be provisioned similarly in a QA client and in a DEV client.

However, at the end of the request, the provisioning doesn't happen, Audit Log says "no assignments available for provisioning" and the Provisioning Log is empty.

This was tested successfully using 2 DEV clients and, in QA, the request to assign the technical roles directly also works.

In NWBC > Access Management > Role Maintenance, we can see that the Business Role is correct, the technical role assigned to it is also correct and the technical role is linked to the right technical group, which contains the 2 connectors (QA and DEV).

Any suggestions on what to check would be truly appreciated.

Thank you.

10 |10000 characters needed characters left characters exceeded
* Please Login or Register to Answer, Follow or Comment.

4 Answers

Alessandro Banzer Feb 23, 2017 at 08:09 PM
1

Gustavo,

did you check if the provisioning environment is correctly maintained? Also the roles must exist in the target system and synced properly into GRC. Both status "Role Exists" and "Allow Provisioning" must be set to yes, otherwise the provisioning won't happen.

Regards, Alessandro

Show 2 Share
10 |10000 characters needed characters left characters exceeded

Hello Alessandro,

Really appreciate your answer. Yes, the roles show as Exist = Yes for both backend systems. (In some cases it doesn't, even after another Full Sync, but we selected roles that show exist in order to isolate the issues).

When you say "environment is correctly maintained", can you help me identify where to check, please? We've checked connectors and connector groups, as well as the activation of all relevant BCs.

Thanks and have a good week,
Gustavo

0

Hello Gustavo.

I believe what Alessandro asked you to check about "provisioning environment" is if your backend system is linked to the PROV integration scenario at SPRO > GRC > Common Component Settings > Integration Framework > Maintain Connection Settings.

Regards,

Marcelo

0
avatar image
Former Member Feb 24, 2017 at 06:38 PM
0

We are having the same issue in our GRC QA environment, Business role provisioning works just fine in Dev, also provisioning of technical roles work, however business role provisioing fails with "No Assignments Available for provisioning"

Show 2 Share
10 |10000 characters needed characters left characters exceeded

Hi Chris,

We tried to replicate the same configuration from QA to DEV, same connectors, and the results are even worse: even though we select the Landscape for QA backend, it provisions in DEV backend.

Have you tried the same? What were your results?

Thank you for sharing.

Regards,
Gustavo

0

Hi Chris,

Please see the answer for SAP below. So, for us, it was 'working' in DEV because we had only one landscape. Once we moved to QA, we started testing the real scenario and things fell apart.

Hope this helps you. If it doesn't, the best is to get SAP to connect to your system and have a live screensharing with them.

Cheers,
Gustavo

0
Plaban Sahoo Feb 19, 2017 at 10:59 AM
0

Hi,

it seems there is missing inf. in import of the 2 technical roles. Could you ensure that, these technical roles have 'Allow auto-provisioning' as 'Yes'

Regards

Plaban

Show 1 Share
10 |10000 characters needed characters left characters exceeded

Hello Plaban, thanks for your answer.

However, that was already set. See the import template attached bizroles-test.txt

Any other suggestions?

0
Gustavo Soares Mar 02, 2017 at 10:10 PM
0

Ok. We've got a reply from SAP:

Business Roles cannot have the same name for 2 different landspaces.

To fix the issue, we added the Production client number in the technical name (in the middle, because our naming convention sets the Org Level in the end and that's used for our search).

No impact on Composite Roles!

Unfortunately that's not documented anywhere we could find. SAP says it is very specific to our case (same role in different Production clients), so they won't release an information note - which would have saved us a week of pointless investigation :(

Thanks everyone for extending a helping hand anyway.

Cheers,
Gustavo

Share
10 |10000 characters needed characters left characters exceeded