Moving roles with user assignment

[Former Member]

Hi There,

Need your help...

We have roles and users created in QA for training, now we want to move roles from QA to Production with user assignment.

Users that are created in QA for training have also been created in Production, is it possible to move the roles from QA to Production with the user assignment.

Thanks and Regards,

Azher.

[Former Member]

Hi,

When you create the transport from PFCG, there is a "Choose objects" pop-up. There is a check box for "User assignment" and "Personalization". There you can choose the user assigment checkbox to include user assigment in the transport which will move into the target system.

Prior to that check the Customizing table PRGN_CUST if any entry has been set as USER_REL_IMPORT with value NO, if it does then you need to remove that using transaction SM30 for transporting user assignment along with roles.

But make sure all users assigned to a role in your QA are present in Production also, any additional user in production having this role would lose the assigment once your transport moves in.

Thanks

Sandipan

[Former Member]

Hi Sandipan,

Table PRGN_CUST does'nt contain any entries, its an empy table in QA.

When I am creating a customizing TR for roles the TR is geting created in Local change request which cannot be moved to Production. I even tried manually copying the cofiles and datafile, but that didn't work.

Thanks and Regards,

Azher.

[arpan_paik]

 When I am creating a customizing TR for roles the TR is geting created in Local change request which cannot be moved to Production. I even tried manually copying the cofiles and datafile, but that didn't work. 

When you are creating a TR with role/s are you giving a target system? Ideally it should be your TEST system. For existing TR (which not been released) you can define a target system in SE11.

Regards,

Arpan Paik

[Former Member]

Table PRGN_CUST does'nt contain any entries, its an empy table in QA.

USER_REL_TRANSPORT entry with value NO locks system from TR imports with User assignment. So you have to ensure your target system-Production does not has that entry in PRGN_CUST.

TR is geting created in Local change request which cannot be moved to Production.

This TR request are created in Local Change request only when you do not specify a target system/group . All you need to do is specify the "Target" while creating the TR in PFCG (subsequent screen after you hit Create request) and release your TR via SE10. Once released, the TR would be added to the import queue of Production. You/your Basis team can import it manually via STMS_IMPORT (Extras>Other requests>Add TR and CTRL+F11 to import). If there are any errors please have Basis team to review the transport logs.

P.S: You can only transport direct user assignments of roles via PFCG transport option described in my post. In case of indirect user assignments that were created using Organizational Management (HR-Org), you will have to use transport functionality in Organizational management.

Thanks

Sandipan

[Former Member]

Dear Sandipan/ Arpan / Raghu,

Thank you very much for your replies, and I apologize for a big delay in my reply...

We uploaded and downloaded the roles from QA to Production and user assignment was done manually in Production system.

Regards,

Azher.

[Former Member]

We uploaded and downloaded the roles from QA to Production and user assignment was done manually in Production system.

You have to be carefull of this.... because of profile name collisions. Also if you have not always transported SU24 changes all the way through or someone maintained SU24 or Su22 in QAS or PROD (as they sometimes do when they have too much access and too little training...) then you can very easily create inconsistencies.

It is quite likely that when you transport the roles again, some suprises will happen...

You should avoid this - which is also why some companies restrict this access (upload in PROD) and have the basis folks control the transport system as a last resort.

If you now do a remote comparison between your DEV and PROD system for this role (see transaction SUIM --> comparisons --> roles) then you will see what might happen.

ps: Using "edit old status" is the ultimate "low-brainer"...

Cheers,

Julius

[Former Member]

Hi Azher,

How you are creating the transport request. Are you using the Mass Transport option. Your reply seems that you are following an alternative method, in which it is not possible to include user assignments for roles.

BTW, it is not a good practice though.

Regards,

Raghu