Skip to Content
avatar image
Former Member

Automating Roles Copy and Configuration

Hi,

I need to copy a bunch of roles, rename the 3 digits suffix, and change the organisational values.

Can this be automated. I have 300 roles to copy and to adapt to new company.

Thanks for your reply.

Add comment
10|10000 characters needed characters exceeded

  • Get RSS Feed

3 Answers

  • avatar image
    Former Member
    Mar 28, 2013 at 09:30 AM

    Hi beejan,

       you can copy role.

    ifrole has assigned user(XXXX).Goto pfcg-->enter roles name--->selecte roles copy--->from and to role name .it  wil make copy and assigned authorization at authorization tab---> generate profile after assign autjhorization(there is one opption organization level,we can set company code)--->assign to user desire user Id.

    It will help you.

    Regards,

    Prabaharan B

    Add comment
    10|10000 characters needed characters exceeded

  • Mar 28, 2013 at 12:18 PM

    Sure it can be automated.  For 300 roles I wouldn't bother though.  I would create a script (eCATT/LSMW) to copy and rename the role and then manually update the org values.  That's about 2 days work.  You will spend much longer than that automating the org level change in a way that doesn't give the potential to cause some major issue.

    Add comment
    10|10000 characters needed characters exceeded

  • avatar image
    Former Member
    Mar 28, 2013 at 09:13 PM

    PFCG is a single mode transaction (bar derived roles non-org fields, but that brings more disadvantages withit than advantages.

    The bugger with eCatts and similar GUI scripting is release and SP dependencies. SAP changes things at various levels. With 7.31 there were several changes to PFCG but the core functions called are mostly quite stable.

    What I use on projects is a "migration toolkit". It becomes worth while once you have enough use for it. You develop on the lowest release and code upward compatibility to the highest release. You then end up with something that looks similar to this and works like a charm...  :-)

    If you are using GRC 10 and implement the ERM to manage your roles, then you can also create org sets as templates and assign them to functional roles, It should however not be mistaken for seperating org. fields from functional authorizations, as activity related fields assigned to the same objects as the org fields will hurt you.

    Perhaps oneday we will have field sets which have the object as the variable. Using a combination of SU24 and org. sets and considering these restraints in the role design also works fine for me, but is different from customer to customer.

    Carving the CO objects which use RESPAREA out of the rest of the concept helps a great deal to simplify the rest... then you end up with rob roles as robust single PFCG roles which are menu driven. I have not had any problems using this approach and when you need to change something you can do then very fast and see what the impact is from adding or removing ⚠️ proposals and org. values.

    But... you MUST first build the roles correctly. If you have a spagetti of small single roles clubbed together under composites with a myriad of single assignments with manual authorizations then there is no way out of it again except by starting over from scratch.

    Cheers,

    Julius

    Add comment
    10|10000 characters needed characters exceeded