Move CUA master that uses composite roles

[Former Member]

Hello,

The last few days I have been trying to move a CUA master from an old 6.20 to a 7.01 system (both SM). It is a new system, not an upgrade.

Before touching the setup of the old CUA setup, I did a mass transport of all the composite roles, including generated profiles and user assignment.

I then set up the new master as a CUA master and connected the slave clients to the new master.

Imported the users from the clients.

And then I imported the transport with the composite roles.

It it almost perfect. The derived single role assignment from the old master was imported from the clients. Meaning that in function everything is as it was before. But the single roles are not assigned through the composite roles. If I check the user in the CUA master I cannot see the assignment of composite roles. But in PFCG the users are listed.

I have been testing and have discovered that if I removed the users from the composite role in PFCG and add them again, assigns the composite role to the user as it is supposed to be.

I have now found note 1385715 which states that transport of user assignments is not supported.

I cannot find a valid automated approach. In the productive setup there is 500+ composite roles, so a manual approach must be avoided.

What documentation have I missed?

BR,

Thomas

[Former Member]

Hi Thomas,

Please help me understand few things.

What was the need of transporting composite roles from old CUA to new CUA? As CUA only contains the mapping of child systems - users - roles. Unless CUA system is being used for any other purpose.

 But the single roles are not assigned through the composite roles. If I check the user in the CUA master I cannot see the assignment of composite roles. But in PFCG the users are listed.

Can you confirm in which system you are checking this?? Is it the child system??

[Former Member]

In the specific case the CUA has 500+ composite roles, residing on the CUA master. These composite roles contains single roles that points to some roles on the child systems. So by assigning a composite role on CUA an number of roles on different systems are assigned to the user as a consequence of this.

In the current setup it is not "allowed" by contract to assign a single role on a child system, all assignments must be done by composite roles. It works perfect, but I would regret to do a manual asignment of those composite roles on the new CUA.

I'm checking this in the CUA master - when I look at a user I can see the assigned composite roles and the corresponding singles roles having a different color than the directly assigned roles.

[Former Member]

Hi Thomas,

Can I confirm that you are using composite roles that are created in the master. These composite roles contain single roles for the child systems?

If this is the case then SAP is behaving as I would expect it. The single roles had their assignments imported into the master before the composite roles were there.

I don't have access to a CUA master to try this, but you could try running a use compare with option composite role comparison.

The only thing I am not sure about is if this would end up with duplicate assignments in the CUA master.

[Former Member]

Exactly. Composite roles are created in the master and single are in the child systems.

This composite compare does not change the fact that the composite role does not show up when looking at the user in SU01.

I think that I need to move back and find another way of "transporting" the user assignments when the target is a CUA master.

[Former Member]

Hi Thomas - apologies, I misread your post. I thought the composites had attached to users but the single roles were not inherited form the composite.

If the issue is that composites are not mapped then there is little that you can do about it other than a remapping.

Do you still have the composite role mapping in the 6.20 master?

If you do it would be a simple matter to download the mapping and then use something like an eCATT to reassign the composite roles. Something like following approach maybe:

Script 1. Use SU10 Remove single roles from user master (select all and then delete)

Script 2. Using SU10, use the mapping to add in the composite roles for the user.

Split into batches of 100, you would then be able to ensure everything is reprocessed in a timely manner.

[Former Member]

It might turn out as the solution. But I'll still be searching for a SAP solution. Am I the first ever to need to to this?

[Former Member]

I dare to say that you are not likely to be the first with this problem.

From experience 2 of the things that you are doing are not particularly common - 1. transporting role assignment 2. using cross system composites (in my opinion a good use for them).

It may be worth raising an OSS note, though this depends how quickly you want to get it done.

Good luck.

[Former Member]

I was not aware that this was even possible...

Try going into SU01 and just saving once. Try the same in PFCG (possibly adding a "dummy" user for good measure). Does that make a difference?

SU10 does not always work reliably in combination with CUA, and while setting up test users I have noticed similar behaviour sometimes so it might not have anything to do with the master composite role for local single roles technique you are using.

We are in the process of replacing the CUA with an IdM, so I just moved on.

I would open a support call with SAP and ask them to take a look.

Cheers,

Julius

[Former Member]

One thought I just had: You could do a client copy of users and roles from your old CUA master into your new one. I am not sure about the safety of doing that from an older system to a newer system though.

That would move all user details, role assignments, passwords, roles etc over. For 500 users it seems like a lot of risk compared to alternatives though.

[Bernhard_SAP]

Hi,

have you already tried:

SCUG->select a child system->press button 'User'(ShiftF1)->navigate to 'already central users'->mark some test user for trial->press 'role assignements' (CtrlF8). Does this bring back the single role assignements into the view of centrals SU01?

b.rgds,

Bernhard

[Former Member]

I solved the issue by adding the client systems to the CUA and then retrieving the users from the client systems. After that I remoce the CUA setup, imports the transport with the composite roles, setup CUA again and does a composite role comparison and then it is working!

[Former Member]

A few things to check and try...

1. In PFCG and SU01 run the user compare.

2. PFUD on the affected roles.

2. Run SE16->AGR_USERS on a few users to check. Sometimes SU01 in CUA does not show the true role assignment.

Good Luck!