Skip to Content

CUA - child system roles have a grey diamond "status of the user master record is unknown"

Hello World! I hope you are all doing well. We have recently replatformed our system and re-implemented CUA in a client in our GRC system. It is release 10.1. We have configured it and it seems to be working fine, however the status next to all child system roles is grey. The local roles are green as expected. All idocs are being processed and changes are successful in the chiled systems. Our security team find's this rather annoying as they don't have a way to validate without going to the child systems or check idoc logs. Any thoughts as to why the status indicator isn't turning green? I have followed note 1642106 completely and the USR_ATCR_IMP(timestamp) jobs are running in the central system.

Add comment
10|10000 characters needed characters exceeded

  • Hello William,

    I have re-tagged your question with "Access Control" in the hopes that fits better. I'm not completly sure though, maybe it should be "Security"?

    The "Identity Management" tag is for questions relating to that specific SAP product, not role and identity management in general. :)

    Regards,

    Steffi.

  • retagged to Security as it is not related to Access Control.

  • Get RSS Feed

3 Answers

  • Best Answer
    Oct 21, 2016 at 09:05 AM

    It is pretty straight forward. The central system does not and cannot know, what the status of the user comparison is in the child system. The comparison is performed there locally. NO status information of the comparison is sent back to the central system. So the status icon for the comparison will always be grey except for assignments for the central system itself.

    Use scul to monitor your assignments.

    b.rgds, Bernhard

    Add comment
    10|10000 characters needed characters exceeded

    • technically it is possible but you will have to write it yourself.

      This functionality was _never_ available! Franks Statement, that he had it before in

      SolMan 7.1 and earlier must be a mistake or misunderstanding. The Status field was not available at all in earlier versions (in SU01 in the CUA central System)....

      brgds, Bernhard
  • Aug 01, 2017 at 06:44 AM

    Hello Bernhard,

    thanks for your answer on that.
    Howerver, that´s causing big irritations to several customers and consultants as well, because it´s a big change to the situation we´ve had before (SolMan 7.1 and earlier). Furthermore, this change of the grey role status is not mentioned anywhere?! So, everybody is searching for "error solutions", what seems to be a waste of time (according to your answer)!? Why isn´t it possible to mention that clearly in a SAP note or the installation guides, or or...?
    Thanks you very much and kind regards
    Frank

    Add comment
    10|10000 characters needed characters exceeded

  • Oct 31, 2016 at 07:57 PM

    Thanks for your input. It is much appreciated!

    Add comment
    10|10000 characters needed characters exceeded