All roles suddently turned red!

[Former Member]

Hi there

Please tell me what goes wrong... Today we found out that all our roles have turned red. The authorisation and user tabs have red light in all roles, and they are not generated. Alot of new values (with status "new") have come in, e.g. more than 20 new entries found under PLOG, P_ORGIN was brough in although we should be using the context solution. This gotta be something to do with some activation in SU24. User comparison doesn't help in this case. Do we need to manually go through each role to make the fixing, or is there a better way? What is the reason causing this?

Not sure I should call this a lucky thing still, it happens only in our test client.

[jurjen_heeck]

Did you find anything in the change documents on the test client?

The closest thing I can think of is that you've transported the roles with user assignment and without generated profiles. That way (if there were no users assigned in dev) all userassignments would be gone, as well as the profiles. SU24 itself does not change existing roles/profiles.

Try SUPC for mass generation and have a look at the chnage documents for users to see which roles you have to re-assign.

[Former Member]

Juergen's respose looks more likely unless ofcourse an upgrade activity is done where in new objects gets added on the roles and hence get red !

Now if the user assignment is red --> users has been deleted.Since its a test box i guess these would not have been a transport coming in

1.Step -.please go intoSUIM and see the change log to the role ?

[Former Member]

You haven't applied any patches recently have you?

[Former Member]

This gotta be something to do with some activation in SU24. User comparison doesn't help in this case. Do we need to manually go through each role to make the fixing, or is there a better way?

If you updated something in SU24, I guess you added an object without default values. In that case you need to go through each role manually.

GP

[Former Member]

>

> Hi there
> 
> Please tell me what goes wrong... Today we found out that all our roles have turned red. The authorisation and user tabs have red light in all roles, and they are not generated. Alot of new values (with status "new") have come in, e.g. more than 20 new entries found under PLOG, P_ORGIN was brough in although we should be using the context solution. This gotta be something to do with some activation in SU24. User comparison doesn't help in this case. Do we need to manually go through each role to make the fixing, or is there a better way? What is the reason causing this?
> 
> Not sure I should call this a lucky thing still, it happens only in our test client.

User tab on red can be normal if there are no users assigned. The auth tab on red is definitely a bad thing. In the auth tab it should tell you who made the last update.

SU24 will not cause this problem. I update SU24 like white on rice but it will not make changes to any roles till I PFCG with expert gen.

Are your roles SAP delivered roles?

[Former Member]

Hi guys, thanks for all your replies!

Here are some more information to provide:

1) Only the authorisations are in red

2) Users assignments are still there, just that they are in yellow probably due to the reason in 1)

3) Our system was upgraded approx. a month ago

4) In SU25, I noticed that some admin has executed steps 2A to 2D under section "Post-processing the settings after upgrading to a higher release". But the transport request was not carried out, so I guess that doesn't create any impact on this since the transport request was not made?

5) The affected roles are customer-specific.

Do we need to manually generate each affected role?

[Former Member]

Hi Theoz,

The roles will need to be manually generated and then saved to a TR and moved across the landscape.But before you generate the roles, please ensure to add values to the auth. obj that have been newly pulled as

part of an upgrade as Avijit suggested.Otherwise, the profiles would be generated showing the authorization tab as green but would have some open authorizations within it.

Generating the profiles and moving the changes across the landscape should put the authorizations tab into green across ur landscape..

Thanks,

Saby..

[Former Member]

You write that your system was upgraded approx. one month ago. Also, someone ran su25 steps 2A to 2D. These steps give the list of roles that need to be changed after upgrade. So, did you modify your roles after the upgrade? Typically after upgrade, the roles become red, because the in the new version of SAP, many new authorization objects are pulled into the roles and/or some authorization objects will now have changed default values. You need to go into the roles, check these new auth objects, decide on what values to put, and then save and generate the roles. If you just generate the roles without checking the auth object values, then it is likely that some auth object values within the roles would be blank ( they will be yellow).

You can use su25 to get a list of roles that need to be modified. Then you can modify them and generate them. This is generally quite time-consuming affair, depending on the number of roles that need to be modified.

[Former Member]

Thanks guys for all your great help, this helps alot!