Skip to Content

Unable to change operator in Function [GRC ARA]

Hi guys,

Why won't GRC let us change the operator in the Function below from 'AND' to 'OR'.

We are on GRC 10.1 SP15.

Thank you.

Add comment
10|10000 characters needed characters exceeded

  • Follow
  • Get RSS Feed

2 Answers

  • 3 days ago

    Hi,

    2 diff. Fields of a single auth. Object, will require AND.

    Same field of a single auth object, will accommodate OR, beacuse I obvious logical reason

    Add comment
    10|10000 characters needed characters exceeded

  • 3 days ago

    Solution

    SAP GRC does not allow mix of AND and OR for the multiple values of same field within an authorization object group.

    If we set the values of an Authorization object like below,

    ACTVT 01 AND
    ACTVT 03 AND
    ACTVT 04 OR
    ACTVT 05 OR

    System will automatically replace AND with OR as below, once you save the Function.

    ACTVT 01 OR
    ACTVT 03 OR
    ACTVT 04 OR
    ACTVT 05 OR

    which is right and as per design.

    It is always recommended to use below approach while creating/changing the SOD rules for multiple values of same field within an object group.

    1. Only AND (in all multiple field values of an object).
    2. Only OR (in all multiple field values of an object).
    3. Only NOT (in all multiple field values of an object).

    Note: Ensure to use the same best practices while modifying the function permissions files and importing using import rule functionlity

    Thanks

    Ramesh

    Add comment
    10|10000 characters needed characters exceeded