GRC ARM - Business Roles not being provisioned

[gustavo_soares]

Hello Experts,

We are using Business Roles in order to provision a Production request in both Production and QA environments. We are currently in UAT and the Business Roles should be provisioned similarly in a QA client and in a DEV client.

However, at the end of the request, the provisioning doesn't happen, Audit Log says "no assignments available for provisioning" and the Provisioning Log is empty.

This was tested successfully using 2 DEV clients and, in QA, the request to assign the technical roles directly also works.

In NWBC > Access Management > Role Maintenance, we can see that the Business Role is correct, the technical role assigned to it is also correct and the technical role is linked to the right technical group, which contains the 2 connectors (QA and DEV).

Any suggestions on what to check would be truly appreciated.

Thank you.

[Private_Member_188120]

We are having the same issue in our GRC QA environment, Business role provisioning works just fine in Dev, also provisioning of technical roles work, however business role provisioing fails with "No Assignments Available for provisioning"

[gustavo_soares]

Hi Chris,

We tried to replicate the same configuration from QA to DEV, same connectors, and the results are even worse: even though we select the Landscape for QA backend, it provisions in DEV backend.

Have you tried the same? What were your results?

Thank you for sharing.

Regards,
Gustavo

[gustavo_soares]

Hi Chris,

Please see the answer for SAP below. So, for us, it was 'working' in DEV because we had only one landscape. Once we moved to QA, we started testing the real scenario and things fell apart.

Hope this helps you. If it doesn't, the best is to get SAP to connect to your system and have a live screensharing with them.

Cheers,
Gustavo

[alessandr0]

Gustavo,

did you check if the provisioning environment is correctly maintained? Also the roles must exist in the target system and synced properly into GRC. Both status "Role Exists" and "Allow Provisioning" must be set to yes, otherwise the provisioning won't happen.

Regards, Alessandro

[gustavo_soares]

Hello Alessandro,

Really appreciate your answer. Yes, the roles show as Exist = Yes for both backend systems. (In some cases it doesn't, even after another Full Sync, but we selected roles that show exist in order to isolate the issues).

When you say "environment is correctly maintained", can you help me identify where to check, please? We've checked connectors and connector groups, as well as the activation of all relevant BCs.

Thanks and have a good week,
Gustavo

[Monsores]

Hello Gustavo.

I believe what Alessandro asked you to check about "provisioning environment" is if your backend system is linked to the PROV integration scenario at SPRO > GRC > Common Component Settings > Integration Framework > Maintain Connection Settings.

Regards,

Marcelo

[gustavo_soares]

Ok. We've got a reply from SAP:

Business Roles cannot have the same name for 2 different landspaces.

To fix the issue, we added the Production client number in the technical name (in the middle, because our naming convention sets the Org Level in the end and that's used for our search).

No impact on Composite Roles!

Unfortunately that's not documented anywhere we could find. SAP says it is very specific to our case (same role in different Production clients), so they won't release an information note - which would have saved us a week of pointless investigation 😞

Thanks everyone for extending a helping hand anyway.

Cheers,
Gustavo

[former_member91276]

Hi,

it seems there is missing inf. in import of the 2 technical roles. Could you ensure that, these technical roles have 'Allow auto-provisioning' as 'Yes'

Regards

Plaban

[gustavo_soares]

Hello Plaban, thanks for your answer.

However, that was already set. See the import template attached bizroles-test.txt

Any other suggestions?