Skip to Content
avatar image
Former Member

Role update strategy in AC 10

Would like to know about the role management in 3 systems landscape.

We want to update the dev system from GRC production system with the role changes or role creation and than transport to QA and Production system. So in this case, GRC system will update development system in the background and than manually we have to move the changes via transport to QA and Production manually.

OR the GRC production system will update directly backend Production system and there is no use of manually transporting them.

Add comment
10|10000 characters needed characters exceeded

  • Get RSS Feed

2 Answers

  • avatar image
    Former Member
    Aug 07, 2011 at 05:48 PM

    Answer to this question lies outside GRC .

    It totally depends what is your role creation strategy . You can connect GRC to any backend system and ERM of GRC 10 will create role in that .By having GRC you can make sure that you have SOD free role and approval are in place for the role .

    But still my suggestion would be create role in Dev back end through GRC 10 (ERM) migrate to QA for testing and then migrate SOD free and fully tested role to Production

    Thanks & Regards

    Asheesh

    Add comment
    10|10000 characters needed characters exceeded

  • avatar image
    Former Member
    Aug 08, 2011 at 09:59 AM

    > We want to update the dev system from GRC production system with the role changes or role creation and than transport to QA and Production system. So in this case, GRC system will update development system in the background and than manually we have to move the changes via transport to QA and Production manually.

    >

    > OR the GRC production system will update directly backend Production system and there is no use of manually transporting them.

    Hi SD

    There is no provision to transport roles within GRC AC. You can provision roles in development system and transport to quality and production has to be done manually. It is never recommended to provision the roles directly in quality or production.

    Hope this answers your questions.

    Thanks.

    Anjan Pandey

    Add comment
    10|10000 characters needed characters exceeded

    • I agree with Anjan in this case.

      I would manage the automated approval of the role definition and then get GRC to auto populate into the Development system in the first place.

      You can then transport the roles through the landscape in the usual SAP code management manner.

      I suppose that now ERM uses the ABAP functionality, you could get creative and use something like Solution Manager's ChaRM alongside GRC's AC workflow and the one transport path to syncronise and automate the whole lot using rfc calls / destinations and workflow action triggers.

      Simon