GRC Access Control Repository 10.1 /10

Purpose

This document explain the background jobs available in the context of the GRC Access Control 10.0 Repository, as well as the importance of those jobs in relation to other areas of the application. In addition, this document discusses the best practices for scheduling the jobs, and tips for performance.

Overview

In GRC Access Control 10.0, data from various client systems is stored in the Access Control Repository to improve the performance. This repository is a collection of tables within the GRC foundation server.

The Access Control Repository

There are various kinds of data which need to be synchronized from plugin systems into the GRC foundation system, using various transactions. The synch job reports can be run from IMG, navigating to Governance, Risk & Compliance>Access Control>Synchronization Jobs:

Authorization Synch
Synchronizes PFCG Authorization data

Repository Object Synch
Synchronizes Profiles, Roles, and Users master data

Action Usage Synch
Synchronizes action usage data

Role Usage Synch
Synchronize role usage data

These reports can also be maintained as scheduled background jobs.

The order in which these synchronization reports are completed is important. The jobs should be executed in the above order. 

Authorization Synch

The report GRAC_PFCG_AUTHORIZATION_SYNC synchronizes the PFCG master data from the backend system(s) specified in the connector input parameter. It is also possible to execute this report by running the transaction GRAC_AUTH_SYNC.

The objects are pulled from backend transaction SU24. This transaction holds the relationships between transactions and their respective authorization objects. This is relevant for roles creation in Business Role Management (BRM). Upon adding a transaction to a role, BRM will bring in all the synchronized authorization objects maintained for that transaction.

There are a few input parameters that need to be provided:

• Connector field: enter the connector ID defined in transaction SM59. It can be entered more than one Connector.
• Language: enter the language for which the roles are created in the system, it can be entered more than one language.
• Legacy systems: In case the synchronization is for a legacy system, check the "Legacy System" box and provide the connector ID for the Legacy system, also in transaction SM59 (under connection type "L").

 

Repository Object Synch

The Repository Object Synch synchronizes User, Role, and Profile objects to Access Control Repository. The main report is called GRAC_REP_OBJ_SYNC and can be run directly from transaction SE38 to update User, Role, and Profile objects all at the same time.

For each of the objects to be synchronized, a specific report is called within GRAC_REP_OBJ_SYNC. As a best practice recommendation, the synchronization of the objects should be run in a specified order for the program to function properly: Profiles first, then Roles, then Users. The Repository Sync job does this automatically for you, therefore it is recommended to run the Repository Object Synch from IMG, instead of each report separatelly. This explains why the report screen does not allow users to check only Users and Roles, for instance. In this case the Profiles checkbox is automatically selected.

To synchronize User master data, the report is called GRAC_ROLEREP_USER_SYNC.

To synchronize Role master data, the report is called GRAC_ROLEREP_ROLE_SYNC.

To synchronize Profile data, the report is called GRAC_ROLEREP_PROFILE_SYNC. 

There are a few input parameters that need to be provided:

• Connector field: enter the connector ID defined in transaction SM59. It can be entered more than one Connector.
• Language: enter the language for which the roles are created in the system, it can be entered more than one language.
• Legacy systems: In case the synchronization is for a legacy system, check the "Legacy System" box and provide the connector ID for the Legacy system, also in transaction SM59 (under connection type "L").
• Syncronization mode, explained as follows. 

Synchronizarion can be executed in two modes:

This report can be executed in two modes:

• Incremental Sync Mode - updates the PFCG authorization master data that has been maintained since the last execution
• Full Sync Mode - synchronizes data using a beginning date of 01/01/1970. The end date is always the current GRC server system date.

   
As a best practice approach, schedule periodic runs of the Repository object synchronization in Full mode once a week, and in Incremental mode every hour. 

   
IMPORTANT: After every Role Import, a Full Synch mode is required for the newly imported roles be captured by the report.

Action Usage Synch

The Action Usage Synchronization job retrieves the Transactions executed in specified plugin systems. Within this report, the execution count of the action usage, and the Alerts information is also updated.

The report is called GRAC_ACTION_USAGE and can be run directly from transaction SE38. For the specified connector, the report will loop through the list of application servers available and will read the action usage information from STAD.

    

 

There are a few input parameters that need to be provided:

• Connector field: enter the connector ID defined in transaction SM59. It can be entered more than one Connector.
• User field: enter the User ID for which to capture the action usage information. It can be entered more than one User.

Fore more information on the Action Usage Synchronization job, please visit the WIKI:
The Action Usage Sync job in technical details - GRC Access Control 10.0 

Role Usage Synch

The Role Usage Synchronization job retrieves the role usage information into the GRC repository. This job is important a pre-requisite for customers willing to use the User Access Review (UAR)workflow feature available in GRC V10 Access Request Management (ARQ). 

The report is called GRAC_ROLE_USAGE_SYNC and can be run directly from transaction SE38.

There are a few input parameters that need to be provided:

• Connector field: enter the connector ID defined in transaction SM59. It can be entered more than one Connector.
• Legacy systems: In case the synchronization is for a legacy system, check the "Legacy System" box and provide the connector ID for the Legacy system, also in transaction SM59 (under connection type "L")

MSMP Worflow - User Access Review (UAR) Configuration

User Access Review (UAR)  Workflow Configuration and Description 

Purpose

The purpose of this document is to explain the User Access Review Workflow in detail and the Configuration settings required to implement the same. 

Overview  

The User Access Review (UAR) feature provides a workflow-based review and approval process for user access requests. The periodic reviews of user access are performed by business managers or role owners, and the system automatically generates the requests based on the company’s internal control policy.  The review asses roles assigned to users and the frequency of use for that role by the user. 

Concept

                      

 Key Users for UAR

Administrator	This person has the Admin role assigned for Access Control.  They can perform UAR-specific administrator tasks, such as cancelling UAR requests and regenerating requests for rejected users. As well as Admin review before generating workflow for request.
Reviewer	This term refers to the approver at the Reviewer stage.  The Reviewer may be the user’s manager or the role owner.
User’s Manager	The direct manager of a user as defined in the User Details Data Source.
Role Owner	The role owner specified in CUP master data.
Coordinator	The Coordinator is assigned to Reviewer.  They monitor the UAR process and coordinate activities to ensure the process is completed in a timely manner.

 IMG Configurations for UAR

1. Log onto the backend system.
2. Enter transaction SPRO.
3. Click SAP Reference IMG button.
4. Navigate to Governance, Risk and Compliance ==> Access Control ==> Maintain Configuration Settings.
5. The following fields can be maintained there for UAR:

• The Request Type can be maintained in IMG under Governance, Risk and Compliance-> Access Control-> User Provisioning-> Define Request Type.
• The Priority can be maintained in IMG under Governance, Risk and Compliance-> Access Control-> User Provisioning-> Maintain Priority Configuration.
• The reviewers for the UAR can be either the Manager of the User or the Role owner for the Role.
• Admin review required can be

YES	The request will go to the Administrator before it is generated for the Manager or Role owner (based on previous selection) to review.
NO	The request will bypass Administrator review and be directly generated and go to the Reviewer

 NOTE:  If the User does not have a manager or, the role owner does not have an owner, selecting No on Admin review will not generate workflow for request . And the  role owner / manager must have a coordinator assigned to him. This mapping is defined in Manage Coordinator link under Access management tab.

Generate data for UAR

1. Log onto Access Control Application
2. Navigate to location( shown in below figure)

                                              
                                                                                                                    Figure 2
                 3. Click on Create button and enter the following data for the fields then, Click Next (Figure 3)| Schedule Name | Enter the name for the UAR job.                                          

                                         
                                                                                                 Figure 3 

               4. Define Variants/Filters for selection then, Click Next

                   As shown in Figure 4 below you may select any number of variants available via dropdown menu and entry fields to specify the size and target of your request. 

                                  
                                                                                                                                      Figure 4
                 5. Shows summary then, click Finish

                 6. Job is created and status is displayed as:

                                    Completed: The job is completed                                                                             

                                    Terminated: The job is terminated by the Administrator

                                     In Planning: The job is currently working on the Request or if it is a reoccurring job then it would remain in this status

Admin Review

If Admin review is selected to Yes in the section 4 of Configuration IMG for UAR then you may review the request here before it can be processed further to the reviewers. This also allows you to add reviewers and coordinators if not defined for role or user.

  To Access Admin Request:

               1. Navigate to (Figure 5):NWBC-> Access Management->Compliance Certification Reviews-> Request Review

                                                                       
                                                                                              Figure 5
                 2. Search for a job using criteria specified in the filters such as Process Type, User ID, Reviewer and Coordinator ID, Date, and Job ID (Figure 6).

                 3. Click Search

               This shows the Request Number, the Job ID, Type of request, the reviewer for the Request, the coordinator for the request and, the status for the request (Figure 6)

                 4.  Select the request you want to edit, then click Change Reviewers button to assign the reviewers and coordinator for the request or Cancel request button to cancel the request.

                                  

                                                                                                                                  Figure 6

                                                                                                                               
                   5. Select the Reviewer and Coordinator from the list or enter the ID the, Click OK.

                                        

                 6. Save your entries.

Manage Coordinators                                                                                   

Under this link you can manage the coordinators and reviewers for your requests. This lists coordinators for the reviewers as well as their ID, name, and email.

                1. Navigate to Access Management-> Compliance Certification Reviews
                2. You can select a Coordinator then, Click Open or Delete

                3. Click Create, to create a new coordinator

                4. Enter ID or select from menu.

                5. Save your work

                6. Now you need to run another background job ”Update UAR workflow” to generate UAR requests. This step is mandatory only if you are generating requests after admin review

UAR Workflow

Workflow settings for UAR

To manage the workflow for the request:

1. Navigate to Governance, Risk and Compliance ==> Access Control ==> Workflow for Access Control ==> Maintain MSMP Workflows.
2. Select the Process ID SAP_GRAC_USER_ACCESS_REVIEW.
3. Click on Display/Change button to toggle between edit modes

                             3.1.    You may define Global Escalation rules and Escape conditions here (Elective Step):
                                  
                                                                                                      Figure 8
4. Click Next
5. Enter the Maintain Rules: These can be Function Module/ BRF plus/ ABAP Class / BRF plus Flat rules. These can be an initiator, routing, agent, or notification   rule

                                               

                6. Click Next, Enter Maintain Agents
                    Here you may define Agents for the workflow stages. These agents can be for notification or approval purpose. Agent Type may be:
                          Directly Mapped Users: Approvers selected from the Approver definition.
                          PFCG Roles                 : Users with specific role will be selected
                          PFCG User Groups    : Approvers selected from PFCG User Groups assigned to users (SU01 Groups tab)
                          GRC API Rules            : Approvers selected from the associated function module (FM).

                                                      
                                                                                                        Figure 9: Maintain Agents
 

                                                                                         
                                                                     Figure 10: Add Users to Approver Groups
                 7.   Click Next, Enter Variables & Templates
                      Maintain Templates for notification and Approval
 
                                                  
                                                                                        Figure 11: Variables & Templates
                  
                 8. Click Next, Enter Maintain Paths 
                 9. Click Add then enter the fields for Path ID and Path Description
                 10. Select the Path, then click Modify or ADD to define path stages 
                 11. Click Next, Enter Maint Route Mapping
                      Used for mapping the Logical Path (Initiator) to an Actual Path

                 12. Click Next, Generate Version
                 13. Click:
                        Save: Saves changes to the database
                        Save/Simulate: Save changes to the database and run a simulation to check for errors.
                        Activate: Generate Active Versions

Update Workflow for UAR Request

              1. Log onto front end Access Control Application.

              2. Navigate to Access Management-> Background Jobs-> Background Scheduler

              3. Click on Create button and enter the following data for the fields:

                    Schedule Name: Enter the name for the UAR job.

                    Schedule Activity: Update Workflow for UAR request

                    Recurring Plan: Select the radio button. If Yes then, provide date range and time.

                    Start Immediately: If not a recurring job, select whether you want it to start immediately or provide a date and time for the job to start.

              4. Click Next then, Click Finish.

Reviewing UAR Requests

Once the Request Workflow has been updated the request follows its workflow path and gets to the right reviewer

Reviewers Inbox and Outbox

The request once generated is sent to reviewer’s inbox and outl

To work on the Request

              1. Navigate to: My Home-> My Profile-> Work Inbox

Searching for UAR Requests

The requests are sent to the Reviewers inbox and email (if the email address is configured into the system)

Working on the Request

              1. Click on the request you would like to work on

              2. Click Administration (Open will just let you view the request and not let you work on it)

              3. Select the Request you would like to work on and you may take the following actions

                     a. Approve: You approve the request and the Role is not removed

                     b. Remove Role: Role is removed from the user

                     c. Forward: The request can be forwarded to another reviewer with a Note.

                     d. Reject Role: You reject  to work on role for the user

                     e. Reason: Reason for rejection. Maintained in IMG under: T-Code: SPRO->  Governance, Risk, and Compliance-> User Provisioning-> Maintain Review Rejection Reasons

                     f. Add Comment: Click Add Comment to add comment with the review request

                     g. Cancel Rejection: You may cancel the rejected role/user prior submitting. *Only applicable in rejected roles/user view*

              4. Submit the Request

Related Notes

 SAP Note: 1732890 - GRC 10.0 - Update Workflow for UAR request job does not trigger the workflow

SAP Note: 1620493 : GRC 10.0 UAR Background Job stuck

SAP Note: 1620495 : GRC 10.0 UAR - Submission failure of request

GRC AC 10.1 /10 - Creation and Transport of Mitigating Controls

1. Before creating mitigating controls you need to create a Root Org entry, this replaces the Business Units in previous AC versions. Navigate to the IMG under Shared Master Data Settings and create a Root Org as shown below:

    2. You will need to:

• Create User in SU01 master in GRC.
• Run the user sync jobs in GRC.
• NWBC - Access Management - Access Control Owners - Create an entry and select owner type as Mitigation Monitor or Mitigation Approver

• NWBC- Master Data – Organization - Assign user in Owner tab. After assigning the user to the organization then user can be maintained as Mitigation Approver/Monitor during Mitigation Control creation workflow.

    

3. Now create mitigation control from NWBC -> Setup -> Mitigation Controls -> Create

In SP13, when we are adding actions in the reports tab, an error message pop-up as shown below.

Without the report the mitigation saves without issue. I am also adding the Action value by clicking F4, searching and then adding it. To resolve this implement SAP Note: 1902129 - Unable to save Mitigation control after adding AC Report

Mitigation Monitor: Mitigation monitor is the one who would be checking whether mitigation is being performed. This monitoring can be done either manually or alerts can be sent to the monitor. "Reports" which are maintained in reports tab of mitigating control, will trigger an e-mail to the Mitigation approver if control monitor does not run that report with in the frequency mentioned.

Alerts can be set through the program mentioned below by executing the Tcode GRAC_ALERT_GENERATE.

Mitigation Approver: Mitigation Approvers are assigned to controls and are responsible for approving changes to the control definition and assignments when workflow is enabled. In GRC 10.0 we have predefined workflow for this. We need to maintain the below configuration settings in SPRO.

Below mentioned standard workflows needs to be enabled.

Issues with Deletion of Mitigation Controls or MC assignments:

When deleting Mitigation Controls or Mitigation control assignments, we used to a get a message task executed but deletion was not happening. After implementing the steps mentioned below issue was resolved.

1.Run transaction SM30

2. Display the view GRFNPARENT in change mode

3. Add new line

4. Entity = SUBPROCESS

5. Parent = ORGUNIT

Mitigation Control Assignment Workflow

In GRC we have standard SAP provided workflow for Mitigation control assignment. I have come across few queries w.r.t this workflow as the mitigation assignment approver is not able to view the details as the "VIEW DETAILS" button is greyed out as shown in below screen.

SAP has confirmed that this is the standard functionality and has release a note to inform all the users. Please check the below note for the same.

1911146 - View Details is grey out in the Mitigation Control Assignment Approver screen

Mitigation Controls - Deleting Root org. Issues

When few users tried to delete the root organizations which were created as part of creating mitigation controls through Tcode PPOM, they were getting some error message as shown below.

Assignment to subordinate objects (Organizational unit ABCD, for example), not possible

Resolution:

Execute the report RHRHDL00 and from here try to delete the root. orgs and the issue will be fixed and they will be removed. But one thing to make sure is all the all the objects under the root org are deleted prior to this.

Transport Organizational Units & Mitigation Controls

There is no Transport Mechanism to move the Business Units/Organizational Units & Mitigation Controls
from one Landscape to another Landscape in GRC Suite, because it is Master Data.

There is no Download & Upload functionality available for these Controls to move from one Landscape
to another.  Organizational Units & Mitigation Controls are tied together as these are shared among
GRC Access Controls & Process Controls.

You need to recreate it in Destination Environment as Transport/Movement is not possible.

When you create the Organizational Unit with the Description in GRC, the System will generate a 
unique number for Organization Unit, which will be different for each system.  That was the
reason, we need to recreate Organizational Unit in each System.

But, Mitigating Control Assignments of User/Role/Profile/User Org/Role Org can downloaded from

one Landscape & can upload it to  another Landscape.

Most convenient way to change existing mitigations is to use standard ABAP program for download and upload.

Go to SA38 and use the following programs:

GRAC_UPLOAD_MIT_ASSIGNMENTS

GRAC_DOWNLOAD_MIT_ASSIGNMENTS

Once you have downloaded the full list into an Excel file you can do your adjustments and upload it again.