GRC Access Control 5.3 - RAR Risk Analysis in offline mode

[Former Member]

Hi expert,

I'm trying to do RAR Risk Analysis in offline mode following this guide (https://www.sdn.sap.com//irj/sdn/go/portal/prtroot/docs/library/uuid/20a06e3f-24b6-2a10-dba0-e8174339c47c). But to generate User Action file the ABAP have a problem when try to get a COMPOSITE ROLE field for a Role that is asociate to many Composite role as the unique record consists of fields IDUSER, ROLE and ACTIONFROM . Someone know how we can solve this conflict?

Best Regards!

[Former Member]

Hi all,

I can let you know that we implemented offline risk analysis approach for a huge customer in Spain using this approach for both SAP systems and non SAP system in 2008. Around 16 systems in scope.

It was hard, very hard but the implementation was successfull and they are running it currently with success.

Kind regards,

Imanol

[Former Member]

I'm sorry, I think I haven't made myself clear enough. The thing is that the User Action File has a "Composite Role" field and we don't know how fill it when the Single Role belongs to multiple Composite Roles. This is because of the primary key, we can't make multiple records for each userid/role combination, each one with one different Composite Role, such as the following example:

USERIDX/ROLEX/ACTIONX/ACTIONX/PROFILEX/COMPOSITEROLE1

USERIDX/ROLEX/ACTIONX/ACTIONX/PROFILEX/COMPOSITEROLE2

.....

USERIDX/ROLEX/ACTIONX/ACTIONX/PROFILEX/COMPOSITEROLEN

Should we instead do only one record with all the composite roles? What character should we use to separate the composite role names? A ",", a ";"? For example:

USERIDX/ROLEX/ACTIONX/ACTIONX/PROFILEX/COMPOSITEROLE1_,_ COMPOSITEROLE2_,_ COMPOSITEROLE3

Hope I explained myself. Thanks for your help.

[Former Member]

".......we can't make multiple records for each userid/role combination,............."

Yes you CAN. this is what documentation is saying .

you can have multiple records for "user id & role " combination, however third one i.e. TCODE had to be different

if TCODE is again repeated then........ it is issue.......

please contact SAP, that will be best.

sorry ........

regards,

Surpreet

[Former Member]

can you please elaborate what is 'problem'?

regards,

Surpreet

[Former Member]

Hi Surpreet,

The Problem is: the join of IDUSER, ROLE, ACTIONFROM field must be unique. When a simple role have asociate to many composite roles, this key will be duplicated. For the moment, we're taking only first composite role asociate to this simple role, but the information is not complete.

How we can associate each simple role that belonging to many composite roles without having conflict to duplicate this join?

Best Regards!

[Former Member]

Arias,

you are first customer i know is using offline analysis ..........

well i think you missed below line

"u201CUSERIDu201D (User ID) and u201CROLESu201D (Role) fields can have multiple values but the combination of

USERID/ROLE/ACTIONFROM/ACTIONTO (UserID/Role/ActionFrom/ActionTo) fields should be unique."

which is among impotant points to be noted.

hope that helps.

regards,

Surpreet

[Former Member]

Hi Surpreet,

Right, I understand this part. But to simplify the question, do you can show me an example of how that file should be generated? because the problem is to get the ROLE COMPOSITE field, the primary key to be repeated when a SIMPLE ROLE belongs to many COMPOSITE ROLE.

Best Regards!

[Former Member]

hi,

per documentation profile or single role and composite role can be duplicate

they ARE NOT UNIQUE records.

UNIQUE record is COMBINATION of THREE field, so I expect ONE TCODE PER SINGLE ROLE........

hope you get my point.......

regards,

Surpreet