CUA setup in GRC10

[Former Member]

Hello,

Can someone share CUA setup in GRC 10. in Access Control User provision i added RFC Name . Using CUP i can create user but assignment of role does not happen.

when selecting Model User i cannot choose from which user i can select to copy.

Regards,

Prasant K Paichha

[former_member182655]

Hello Prasant,

Have you resolved the problem? I have the same issue: user is created in a child system, but roles are not assigned.

Regards,

Artem

[Former Member]

Hi guys,

Please check your CUA settings in SCUM. It sounds like role provisioning may not be set correctly.

Also check your CUA settings in the GRC system under the AC>User Provisioning node.

My personal advise is to only use CUA if you are strictly going to provision roles and create users solely from GRC via CUA for all target/child systems. If you are hoping to have any flexibility with GRC10.0/CUA i.e. able to maintain some users or assign roles via the back end directly, it is not possible. You actually would have to decommission CUA from your landscape to retain/provide any flexibility.

I strongly feel if GRC 10.0 is utilised properly for Access Administration, then you will not miss CUA.

[former_member182655]

Hi Harinam,

Thank you for the advice! My CUA landscape allows to assign roles in the backend only (as well as emails, parameters and so on). Saying truly I assumed that it could be the problem, but I didn't find any restrictions for CUA in my case. Moreover, I haven't found any new note regarding restrictions for GRC 10 (only for 5.3). Do you have any document on GRC 10 regarding CUA restrictions?

Regards,

Artem

[Former Member]

Hi Artem,

Just like you, I was confused by how CUA worked with GRC 10.0 after moving from 5.3. There are a few SAP notes in regards to CUA and GRC 10.0, but i am not aware of any exclusive guide in regards to CUA + GRC 10.0:

1616121 - GRC 10.0 CUA Settings

1937796 - How provisioning works in the CUA child systems in AC10.0 when CUA settings are not maintained in the GRC

1859038 - UAM:CUA provisioning not working correctly in Access Request

However, I found the behaviour of CUA confusing and when I realised I was able to assign roles but not create users, we switched configuration over to the Model distribution and then found we could create users but not assign roles. We had to get SAP involved and they confirmed to us after some investigation from their support team that we can not use CUA partially with GRC (unlike in 5.X, where CUA was actually being ignored from what the support guy told me!).

In the end, we disconnected CUA from the landscape and set up GRC to cater for new joiners and leavers requests and set up Password Self Service etc.

Some may argue to go further and bring in IDM into the organisation, but not everyone has the budget and appetite for the overhaul.

[former_member182655]

Hello Harinam,

Thank you very much for detailed answer and that you have shared your project experience! I will try to open a message to get official SAP answer.

Regards,

Artem

[Former Member]

Not the advice you ideally wanted to hear, but felt the experience I had a while ago had to be shared. In summary, if you want to use CUA with GRC, wnsure all the child systems are fully taken care of via CUA only (i.e. no back end flexibility).

[former_member193066]

Hello,

Yeah long back.

SAP created note for us..

our issue was the functionality missng with SP05 for system like 4.6 version.

Regards,

Prasant