SAP GRC v10.1 SP19 S_Service false violation

[Former Member]

Hi,

We are having the following issue during our upgrade:

S_Service role violations where the Ruleset does not even have it, but the role violating has S_Service with both fields as “ * “. That rule is not even in that risk or function.

Additionally, I have seen a lot of mentions of this phrase which is directly out of the SAP Note “adjust your Ruleset”. What is meant by that? Because our Ruleset does not contain one entry for S_Service either active or inactive.

Thanks in advance.

-John

[Former Member]

Hi John,

Which ruleset are you utilizing?

You need to check which Logical Groups your target system is assigned to within "Maintain Mapping for Actions and Connector Groups" in SPRO. Rulesets are uploaded, or activated, for specific systems or for Logical Groups, or both.

S_SERVICE could be in a ruleset that was uploaded to one of the Logical Groups that the system belongs to, and you may just not know it.

You should use program GRAC_DOWNLOAD_RULES and download each available "System" ruleset, including all Logical Connectors rulesets, and find which one contains the S_SERVICE rules in the Function-Permission file.

You could also check table GRACFUNCPRM to see if RESOURCEID=S_SERVICE returns any results. If so, there is a rule in one of the rulesets with this activated.

Let us know if any of this helps,

Ken