Analytic Settings Problem

[Former Member]

Dears

I'm new to Nakisa, configuring Org Chart Application version 4.1

I made Manager Role the default role

Un secured FTE analytic view from Manager Role

In Role Mapping, ROLE_MANAGER mapped to /NAKISA/MNGR_LINEMNGR_M

In SAP, there is a backend user called Nakisa has the role /NAKISA/MNGR_LINEMNGR_M

In user profile in backend, user has SAP_ALL (Just for testing)

Now, after publishing, when i'm using FTE view, it gives me n/a

can you help please.

[StephenBurr · Accepted solution]

Are you using Live or Staged analytics?

Which method of authentication are you using?

Have you specified the user & password in the SAPConnection data element? 

Have you confirmed that the role is being assigned correctly on login?

See: Debugging User and Session Information - ERP Human Capital Management - SCN Wiki

Have you run a RFC trace from the AdminConsole?

Stephen

[Former Member · Accepted solution]

Dear Stephen

I'm using Live analytic as i copied Live RFC Build and my configuration in Nakisa using Live analytic.

i'm using Logon screen method.

about user and password, it's defined in SAP connection and the connection is working well, is this the connection you mean or what?

when i went in debugging mode i found that user authentication is null, while i configured Nakisa Role_Manager as default role and in role mapping as i told you before, you can check the screen shots.

[StephenMillard · Accepted solution]

Have you confirmed the SAPDataConnection (above is RoleMappingConnection) and carried out an RFC trace as Stephen Burr suggested?

[Former Member]

Dear All

Thanks alot for you all, problem solved.

All i have done, is that i copied a new fresh build and made the configuration again and it worked

[StephenMillard]

Glad to hear you got it resolved.

Regards,

Stephen.

[Former Member]

I didn't change anything except that i un secured all secured items for all roles.

and about SSO, i used logon screen and there is no SSO at all, what are you see in the trace is the RFC call getting data as you told me before.

[StephenMillard]

The SSO reference earlier was specifically in response to this:

Now in debug mode i can see that User population data is coming out, but still User Authentication Row is Null.
Do you have any idea why?
I think that is the problem.

It was in no way intended to reference anything shown in the RFC trace - ref. the way the discussion is branched.

Changing items from secured to unsecured should have changed whether they appear in the app for users mapped to specific roles (i.e. employees everywhere and managers/assistants when outside of their structure branch).  I don't know of any way that it would affect the values being returned as these are interface/presentation controls not value/data retrieval controls.  So either it has worked around something other than the analytic values showing as n/a or you changed something else to affect this.

With regards to this having 'solved part of the problem', I'm not so sure.  Do you want everyone to be able to see the analytics data for everywhere in the organisation.  Also if you unsecured every item this would make the extended employee information on the position/employee details panels visible to everyone.  Is that acceptable and if so would you not look to have every user login using the HR role instead (though I do realise you said earlier it had no effect I suspect that my not always have been the case to this point).

I'm also still no clearer on what your issue with the other analytics actually looks like.  Is there any chance you could show us?

Regards,

Stephen.

[Former Member]

Dear Stephen

First of everything, i'd like to thank you very much for trying to help me as much as you can. And i'm really sorry for taking too much of your time.

With regards to this having 'solved part of the problem', I'm not so sure.  Do you want everyone to be able to see the analytics data for everywhere in the organisation.  Also if you unsecured every item this would make the extended employee information on the position/employee details panels visible to everyone.  Is that acceptable and if so would you not look to have every user login using the HR role instead (though I do realise you said earlier it had no effect I suspect that my not always have been the case to this point).

I'm also still no clearer on what your issue with the other analytics actually looks like.  Is there any chance you could show us?

As i'm still learning Nakisa (actually i'm in a very big project and so important), yes i want analytic data to be available for every one with all extended data of employee and position.

All i'm trying to do is to solve the problem of n/a analytic views, after this point i may be able to handle authorization issues.

So, yes again i want everything available for everyone with any role.

My problem in other analytic views is that it show n/a while i really don't know why. At the same time, there is only one view displaying data as i showed you before.

Regards;

Abdow

[Former Member]

Dears

I think part of the problem is solved as i can see data now in position analytics, but in other analytics still the same problem. can you help?

[StephenMillard]

Can you please provide details of what you have changed to get this part working and what the issue with the other analytics actually looks like?

Regards,

Stephen.

[StephenMillard]

Have you confirmed that there is actually data being held in SAP to be used for calculating the FTE?  It wasn't clear from your post whether it was showing previously.

Position FTE is based on HRP011-MOAVG and employee FTE is based on PA0008-BSGRD.  Not everyone maintains these so that could be an explanation as to why you might be seeing "n/a".

Regards,

Stephen.

[Former Member]

Dear Stephen Millard

Actually PA0008-BSGRD is maintained well on master data but i don't know what you mean with

HRP011-MOAVG.

Anyway, nothing i analytical data is working FTE, Nationality and also gender.

so i think it's not master data.

[Former Member]

Dear Abdelsalam,

Can you please assign the role /NAKISA/MNGR_LINEMNGR_M to the user with whom you are testing and see. I believe its an authorization issue.

Regards,

Venkat

[Former Member]

Dear Venkat

The role you are talking about is not standard in SAP and doesn't exist by default, so i have to create it and put my authorization in it.

So why i do so while i already did mine that i showed you in my screenshots.

[Former Member]

Dear Abdel,

You have to do it for the user with whom you are logging in., then the mapping is complete.  Seems you assigned it to the backend service user., not to the dialog user who is looking at Nakisa.

You did the mapping in NAKISA that's fine, same role you should assign to the user as well.

Try it and see.

Regards,

Venkat Duggirala

[Former Member]

Dear Venkat

As you can see in the screenshot, the same role in Nakisa is already assigned to dialog user in SAP back end.

But the question is, do actually i need the back end user to be dialog user? and why not to be SYSTEM user or anything else?

[StephenMillard]

Hi Abdelsalam.

The details for the FTE sources were taken from the OrgChart feature check list document provided by Nakisa that explains where the data comes from.  When FTE is returning n/a I have frequently found that it has been because there was no data to retrieve.  You hadn't mentioned that other analytics were being affected as well so it seemed to be a logical step to confirm the presence of the data.

Regards,

Stephen.

[StephenMillard]

In an attempt to clarify a few things ...

• The role assignment will determine what Nakisa role is assigned and whether the analytics should be visible to the user.
• If the SAPConnection data connection has a user name and password specified, that user account will be used to retrieve data from SAP and the authorisations on that account will determine if it has access to the data.
• If the user name and password are omitted from the SAPConnection, then it will use the logged in user's account for SAP access and the corresponding authorisations.
• Managers can only see analytics for their own org unit and below, so you must ensure that the employee the user account is associated with is in the chief position of the desired org unit.
  

From some additional points from earlier in the thread it sounds like FTE (is that both employee and position?) analytics are showing as n/a and that gender & nationality are also failing to display the expected values.

1. Does this mean that all of the other analytics are working fine?
2. Is this failure to display affecting all levels/org units within the structure?
3. Is there any change in behaviour if you set the default role mapping to be the Nakisa HR role?
4. What happens if you have the Nakisa system account configured in the SAPConnection (i.e. user name & password) and give the account SAP_All?  Any change?

Regards,

Stephen.

[Former Member]

Dear Stephen Millard

I activated RFC trace, but actually what exactly the part that i should look at, but i scrolled it all and it seems to me ok.

• The role assignment will determine what Nakisa role is assigned and whether the analytics should be visible to the user.
• No problem.
• If the SAPConnection data connection has a user name and password specified, that user account will be used to retrieve data from SAP and the authorizations on that account will determine if it has access to the data.
• No problem.
• If the user name and password are omitted from the SAPConnection, then it will use the logged in user's account for SAP access and the corresponding authorizations.
• which logged in user?!!, for example there are ten users connected to SAP and one user (Test-1) will connect to Nakisa: So, you mean in that case, Nakisa will search for user (Test-1) in logged in users on SAP back end and if found, it will use its authorization?
• Managers can only see analytics for their own org unit and below, so you must ensure that the employee the user account is associated with is in the chief position of the desired org unit.
  
• I think this is the case if i configured dynamic org chart, but actually my root org chart value source is OrgChartRoot

From some additional points from earlier in the thread it sounds like FTE (is that both employee and position?) analytics are showing as n/a and that gender & nationality are also failing to display the expected values.

1. Does this mean that all of the other analytics are working fine? No
2. Is this failure to display affecting all levels/org units within the structure? Yes
3. Is there any change in behaviour if you set the default role mapping to be the Nakisa HR role? No
4. What happens if you have the Nakisa system account configured in the SAPConnection (i.e. user name & password) and give the account SAP_All?  Any change? That is what i actually done

[StephenMillard]

If the user name and password are omitted from the SAPConnection, then it will use the logged in user's account for SAP access and the corresponding authorizations.

which logged in user?!!, for example there are ten users connected to SAP and one user (Test-1) will connect to Nakisa: So, you mean in that case, Nakisa will search for user (Test-1) in logged in users on SAP back end and if found, it will use its authorization?

If I login to OrgChart with user ID MANAGER1 and there are no user ID and password details in the SAPConnection data connection, OrgChart will request data from SAP as if MANAGER1 was directly requesting it (hence why the account would need permissions to run RFCs).  If I login as EMPLOYEE2, it would then request the data as EMPLOYEE2.

If the user ID and password are set in the SAPConnection data connection for a system user account called NAKISA0, regardless of whether I logged in as MANAGER1 or as EMPLOYEE2, data would be requested from SAP using the permissions associated with the NAKISA0 account.

Regardless of what is in the SAPConnection data connection in terms of credentials, if MANAGER1 has a SAP role associated with it that is mapped by OrgChart to the OrgChart Manager role and EMPLOYEE2 has a SAP role that is mapped to the OrgChart Employee role then the employee would not see the analytics sections and the manager would see the sections only when viewing their org unit or below (remember the MANAGER1 account must be associated with the manager of an org unit to provision this).

If the SAPConnection data connection has no credentials set in it and there are auths in effect that restrict data access for the account MANAGER1 then this could be a reason that when logged in as this user that the analytics could be seen, but the values are not populated.

Managers can only see analytics for their own org unit and below, so you must ensure that the employee the user account is associated with is in the chief position of the desired org unit.

I think this is the case if i configured dynamic org chart, but actually my root org chart value source is OrgChartRoot

This is the case regardless of how you set the default root.  The dynamic root only affects where the chart starts when the user opens the application.  This is a a case of permissions not default display.

I activated RFC trace, but actually what exactly the part that i should look at, but i scrolled it all and it seems to me ok.

So the traces would have shown no data being returned for the analytics when you drill into the calls ... which isn't what you want.  You could get the parameters from these and then look at running the same calls with the same user account in SAP to see why the data isn't being returned.

If you see the data is being returned by the function calls and that it is not being displayed in OrgChart then there would be a different avenue of investigation.

Does this mean that all of the other analytics are working fine?
No

Is this failure to display affecting all levels/org units within the structure?
Yes

Is there any change in behaviour if you set the default role mapping to be the Nakisa HR role?
No

What happens if you have the Nakisa system account configured in the SAPConnection (i.e. user name & password) and give the account SAP_All?  Any change?
That is what i actually done

So no analytics are displaying in the analytics sections anywhere for anyone at any time.  Are they all displaying as n/a, 0 or something else?

Switching the role to HR should have revealed analytics on some other branches of the organisation unless you set-up your manager role as the chief of the root org unit or your set-up had some other potential difference such that the HR role wasn't being mapped (having seen the earlier manager mapping in the debug output).

From the last statement it seems you have the SAPConnection set-up with a user account (presumably a system/non-GUI user ... Nakisa from the earlier screen shots(?)) that has been given SAP_All ... which means that this is the account that would be collecting the analytics data from SAP.

So does this account:

• Have any data restrictions applied to it that might restrict access to the analytics data items described in the OrgChart feature check list?
• Have all of the correct authorization associations as described in the "Authorization Objects" section of the OrgChart Admin guide?

Other things worth double checking failing anything coming to light from the above are that...

• No errors relating to the analytics are appearing in the cds.log.
• That the add-on and transport were correctly deployed.

Regards,

Stephen.

[Former Member]

Dear Stephen

I assigned the user to an employee, which is the cheif of the ORg Structure root.

Now in debug mode i can see that User population data is coming out, but still User Authentication Row is Null.

Do you have any idea why?

I think that is the problem.

[StephenMillard]

That's where the details of the SSO Ticket appears when you are using single sign on.  I'm not sure if I've seen it populated for login screen based logins (and I've no idea if it is for AD integrated logins).

Regards,

Stephen.