BRM vs AGR_1251 Entries

[Former Member]

Hi Everyone,

Today our customer reported a Issue while they came across while using BRM.

Example Scenario:

I have created a role in backend directly. Added a Tcode which included objects with Org.Level fields and generated the role in backend. Below are my AGR_1251 table entries.

I have created a similar role from BRM. Added a Tcode which included objects with Org.Level fields and generated the role in BRM.Below are my AGR_1251 table entries.

Basically I wanted to understand why there is difference in AGR_1251 table entries depending on generation from backend or through BRM.

I have maintained $BUKRS value as 1000 in role.

Someone please share details if you know about this issue.

~ Madan

[former_member282031]

Hello Madan,

Did you already find a solution to this? Have you gotten an answer from SAP?

I'm facing the same issue.

As for now (as workaround) I'm generating profiles in the backend via SUPC.

[Former Member]

Hi Madan,

can you share a picture using PFCG change mode of the role created on BRM (with all the expert tools active)

It almost looks like when you updated the role on BRM it didn't use the org level for bukrs and updated the field directly instead.

Cheers,

NJ

[Colleen]

Hi Madan

I would check Marketplace if I was you on that one to see if there is a correction. If not, raise an Incident.

BRM is meant to call the BAPIs used for PFCG maintenance. The AGR_1251 entry for BUKRS = 1000 has S for Standard (implying org inheritance has not been broken). What has been stored in AGR_1252 for the role?

What does it look like in PFCG (curious here) and if there is a difference if you went into change mode - would you get the warning that you are breaking inheritance if you attempting to maintain BUKRS value direct?

BRM should update the AGR_125* tables as through you were maintaining PFCG as it's meant to facilitate and semi-automate role maintenance.

What release and SP are you on?

Regards

Colleen

[Former Member]

Hi Colleen,

Thanks for your response and sorry for delay in my reply.

We are on GRC 10.1 SP04.

I have searched for the corrections corresponding to our version and SP in market place and couldn't find any and also searched SCN for details as well. I have raised a OSS message also, but posted in SCN so that anyone who came across this issue could guide me as SAP taking long time

My Role is ZTEST_GRC. This is just a single role and we are not using Master-Derived Role concept, instead using Org Roles (created separately)

Role in Backend – Maintained with below values saved Authorizations and generated it and below are the details.

Role in BRM – Maintained authorization data through BRM by clicking Maintain Authorization Data button.

Maintained same authorizations in PFCG through BRM and then synched it in BRM and then generated from BRM.

After generation from BRM below are the table entries and role authorization data.

~ Madan

[sandeep_devaki]

Hi Madan,

I guess GRC has updated AGR_1251 for the ORG value . Actually it should update the table AGR_1252 only but in your case it has also updated AGR_1251 .

Can you share us the solution that SAP has suggested for this .

Regards

Sandeep Devaki

[Former Member]

Hi Sandeep,

I have raised this to SAP and they are currently doing analysis about this issue.

I will update the thread with the solution once SAP provides a fix.

~ Madan

[Former Member]

Hi Madan,

Can you please share us the solution that SAP has suggested for this?

We are currently experiencing same issue in our GRC 10  SP12 installation.

Kinde regards,

Markus