Table related to Role & Role Owner in GRC AC 10

Hi Expert,

I am looking for your advice.

In GRC AC 10 which table contain role & role owner name.

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Accepted Solutions (0)

Answers (2)

Hi sachin,

Following are the tables :

GRACROLE and GRACROLEAPPRVR

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Hi Amanjit,

Thanks for help.

Table GRACROLEAPPRVR is useful for me.

But i have one question in that table the Role Name is not exists it shows Role id like this 0050569000E11ED1A0CD88F5E8A84BAC but i am looking for name of role.

Please help.

Hi Sachin,

Role name is present in GRACROLE table , so using role name, first you will have to get role id from GRACROLE and then using ID, fetch approvers from GACROLEAPPRVR.

Hi Amanjit,

Thanks got it.

Need you advice on the scenario.

We have a set of roles & each role have their Approvers & alternate Approvers.

Now a request comes of a specific role so how i work around so that specific role request goes to their related Approvers.

If i used BRF+ then i have to maintain all role with Approvers in Decision Table.

If in a case a new role comes then i have to added in BRF+ table of if a Approvers changes then i have to change that Approver in Decision Table.

So is there is a way by which we change Approver in role & it reflected means other than BRF+.

Please help.

Hi Sachin,

You can update the Role Approvers under "Role maintenance" (in Access Management menu) rather than using the BRF+ Decision table.

There are 2 different types of Approvers :

1. Assignment Approver (for Approving the Access Request)

2. Role content Approver (for approving the Role creation / modification in BRM)

Please maintain your approvers in Assignment Approvers.

Further for your Access Request path in MSMP, please select the stage as GRAC_ROLEOWNER.

Regards,

Nikita Sharma

HI Nikita,

I already maintain approvers as Assignment Approvers.

but when SoD comes then After Approvers, the request moves to Other/Secondary/Local Approvers comes into the picture to approve the request these approvers[Other/Secondary/Local Approvers] are location based so how i maintain this.

Any advice on this.

Hi Sachin,

Please create a Agent Rule in BRF+ to maintain Location specific approvers.

Regards,

Nikita Sharma

Thanks Nikita,

I'll do that.

Hi Amanjit,

I want to prepare a report which gives the request number and approvers at different stages.

I found that information is available in below tables.

1. GRACREQ - With Request ID, Request number, Request Created Date

2. GRFNMWRTDATLG - with MSMP Instance ID, Stage Sequence Number, Stage Status,Approver User

3. GRFNMWRTINST - with MSMP Instance ID, External Key (ACCREQ/REQUESTID)

I am not able to connect GRFNMWR* tables with GRACREQ* tables as I couldn't find any mapping.

However in GRFNMWRTINST table, I could see there is a column called "EXTERNAL KEY"

for example with value as "ACCREQ/529CEC1BA0701A30E1008000C0A8141C".

In this second part of value corresponds to Request ID in GRACREQ* tables.

I am trying to create a table join using SQVI for above mentioned 3 tables but not able to connect

GRFNMWR* tables with GRACREQ* tables.

Can you please suggest how to join GRFNMWR* tables with GRACREQ* tables.

Thanks in advance.

Regards,

Sai.

Hi Sai,

Yes your observation is correct. The external_key field of GRFNMWRTINST table is the Concatenation of ACCREQ/ and Req ID from GRACREQ.

Also the external_key_dis field of GRFNMWRTINST is the REQNO of GRACREQ.

Please feel free to get back to me in case of more queries.

Regards,

Shweta

Hi Shweta,

Thanks for your reply.

In SQVI I am trying to join below 3 tables to get the details of request and approvers for that request at different stages.

GRACREQ

GRFNMWRTDATLG

GRFNMWRTINST

Mapping is as shown in the attached screenshot.

I am not getting any results by joining in this format. Am i missing anything? Also I could see External_Key and External_Key_Display columns of GRFNMW* table are not getting mapped to corresponding RequestNo in GACREQ* tables. Hence my output is empty.

Can you suggest if i am missing something?

Regards,

Sai.

Sachin,

I have a similar request from a customer (we refer to this as a "Regional Role Owner"). I am curious as to the fields you are going to use in decision table, and wonder if you could provide any more detailed information, either in this forum, or privately. My concern is to design Decision Table that requires NO MAINTENANCE after initial design and testing is complete. So, if Regional Role Owner changes, no maintenance of BRF+ Decision Table will be required. I believe only option is to create Z custom agents in MSMP workflow (approver and notification type agents). This way, when a Regioal Role Owner is added or removed, maintenance is done in MSMP workflow, and not in BRF+. I was curious as to which Role Attributes you were using for your BRF+ rule. Perhaps you would consider publishing a white paper on your solution / desgin?

Sincerely,

Patrick

Hi Patrick,

Please give me brief idea about your workflow.

After then i am able to help you.

Best Regards,

Sachin

Hi Sachin,

Instead of using Decision table, i would suggest you to use DBLookup who will go into the table mentioned in earlier reply and find out the approvers.

By doing so you dont need to maintain the mapping in BRF+.

There are some document available on BRF+ with DBlookup. Check that.

I hope it helps.

Regard,

Amit

Hi Sai

Did you come right with this?

I am facing the same issue.

Regards

Mustafa

Hi, Sachin.

I believe the experts helped with your doubt, right?

So to help others friends SCN, please

Regards,

Salomão Bruno

You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.

Comment

Ask a Question