Blog for SAP technical guru's: SAP basis, SAP security and authorization, SAP ABAP, SAP Focused Run
To get the function for mass role deletion, you first need to apply OSS note 3360981 – PFCGMASSDELETE: Mass deletion of roles.
After the note is applied transaction code PFCGMASSDELETE can be started:
The I information button provides the description of the functions of the program:
The SCC4 functions are described in OSS note 1723881 – Application of client-specific customizing settings to role maintenance.
When you run a system for longer time, you might see that users have roles assigned that are obsolete (end validity date in the past), or having a role assigned multiple times.
With the role user assignment compression program you can clean up.
Questions that will be answered in this blog are:
Start program PRGN_COMPRESS_TIMES:
Select the Delete Expired Assignments to delete role assignments with validity date in the past as well.
If you want you can first run with the simulation option to see what the program will do, and run without the simulation option to perform the actual clean up.
For issues, do check notes:
If you run a CUA system, the compression program needs to run on the CUA system and not on the local system. See OSS note 1692243 – Report PRGN_COMPRESS_TIMES cannot be used in CUA.
When you have updated a role this update needs to be reconciled with the existing users assigned to the role. This blog will explain how to do this.
Questions that will be answered are:
User compare in role building is pretty easy. In PFCG when you get the yellow traffic light in the user tab the screen looks as follows:
Simply hit the User Comparison button and you are done:
With transaction PFUD you can do a mass user assignment comparison:
More information on PFUD can be found in OSS note 511200 – PFCG/PFUD/SU01/SU10: Role assignment and profile comparison.
Bug fix notes:
When you transport a role some changes might end up into the roles being updated, but the user comparison is not done. The end result is that the assigned authorization does not work, and you might get lots of complaints.
In oss note 571276 – PFCG: Transport of roles, SAP explains regarding the cleanup option: “If you schedule the user comparison in a way that means that there might be time overlaps with role imports, you should always deactivate the “Cleanups” option. Otherwise, imported profile data might be deleted.” and “The cleanup is not a security issue, so it does not have to be active for every comparison. Experience shows that it is sufficient to execute it once a week. However, it must be scheduled so that no role import is in progress at the same time.”.
That’s why it is wise to run the program behind PFUD, RHAUTUPD_NEW, in each system on daily or bi-daily basis without the cleanup option. And run it once per week in the weekend with the cleanup option enabled.
OSS note 2734455 – Optimized user comparison after role imports contains optimized way for the comparison in some cases when you transport roles. It also explains the new PFUD_AIMP transaction.
