How to delete expired roles?

Here are 3 notes you may want to review to see if there is any helpful info, plus some documentation that may be helpful for others....we are going from 40B to 47 and have had a few issues with role deletion

Notes: 312943 504412 & 313587

Additional info

First, the report PFCG_TIME_DEPENDENCY is functioning as designed. It was not designed to remove activity groups.

Second, in transaction SU10 you must have the valid from and valid to fields filled in with the actual dates, 04/08/2002, in order to remove the invalid activity group. You need to be sure that the remove user radio button set in the role tab. But in the profile tab, the add user radio button is selected by default. What you have to do is go to profile tab and select the remove user radio button. You have to make sure both role and profile has the same radio button selected, i.e. remove from users. Only then when you click save, it will allow you to delete the role from user.

In transaction SU10, you need to complete the following steps:

1. Click on the Authorization data button.
2. Entry the users name, latimerc
3. Click on the execute button.
4. Put a check in front of the users name.
5. Click on the transfer button.
6. Now highlight the user.
7. Click on the pencil button.
8. Click on the Activity Groups tab.
9. Enter the profile name (PM_NOTIFICATION_PROCESSOR).
10. Enter the valid from and valid to dates (04/08/2002).
11. Change the radio buttons to remove user from both the Activity Group and Profile Tabs.
12. Click on the trash can.

Configuring Process Roles

Use

You may need to configure process roles whenever:

· You assign users to the role

· You add default user assignments at design time

This is not a required step in the process design. If you do not explicitly configure the process roles when designing the process, the user assignments for each available role are done when the process is being initiated. However, you can use this function to enable better control over the process initiation.

For each process, you can configure:

· The standard built-in roles – Administrator, Overseer, and Owner

· The custom user-defined roles

Prerequisites

You have the appropriate rights to work with Guided Procedures (GP) design time.

More information: Authorizations

Procedure

Configuring Standard and Custom Roles

...

1. Open the gallery, select a process template, and open its design time.

2. To switch to edit mode, choose (Edit).

3. Open the Roles tab page.

4. Select a role from the list and choose one of the following role types for it:

○ Initiation Defined – user assignments for the role are done at process initiation.

You can also configure the following options for the role:

■ Default Definition Required – with this option selected, you must also define a default user assignment for the role, as explained in section Defining Defaults.

■ Overwritable at Runtime – with this option selected, the defaults defined for the role can be overwritten when the process is being initiated.

■ Filled from Context Parameter – this option is configurable at block level, whenever input context parameters are available.

For example, you may want to assign users to particular tasks dynamically. For this purpose, you supply the user as an input parameter to the next process step. The processor of the role is automatically filled from this context parameter and the task is assigned to the specific user.

○ Initiator – the user who initiates the process is assigned to the role.

○ Runtime Defined – user assignments for the role are done during the process lifetime by the corresponding callable object (for example Assign Users to Process Roles).

You can consolidate the roles, if required, as described in Consolidating Roles.

Defining Defaults

If you have configured a role type to Initiation Defined, you can also assign a default user to the role. At runtime, this user processes the action or block unless the initiator modifies the assignment when the process is started.

You can assign defaults to both active and inactive processes.

...

1. Open the Default Roles tab page.

2. Add a user to the relevant roles.

3. Choose (Save).

Assigning defaults is required only if the option Default Definition Required is selected. Otherwise, you may skip this activity.

Assigning Default Roles

Use

The Assign Default Roles wizard allows you to define a default user to a role as long as the role type is Initiation Defined. At runtime, this user processes the action or block unless the initiator modifies the assignment when the process is started.

Only process roles of type Initiation Defined, are shown in the wizard.

More information: Configuring Process Roles

Procedure

1. Select an active process

...

Browse to select an existing process.

Only active processes are shown in the gallery. To assign default roles to inactive processes, see the Defining Defaults section in Configuring Process Roles.

2. Assign default roles

1. Select a role.

You can associate an existing user to each of the process roles. In addition to the roles that you have defined when you created the process template, you can also assign users to the built-in roles: Overseer, Owner, and Administrator.

2. In the Add Users section use the Find function to search for the required user.

3. To associate the user with the role, select it and choose Add.

4. To assign more default roles, repeat steps 2 to 4.

5. Choose Finish.

Role Administration Functions

Roles contain the following information:

● Name of the role

● Role description text

● Role menu structure

● Authorization profile data

● Users or organization plan elements to which the role is assigned

● MiniApps

● Personalization data

Functions in the Role Administration Initial Screen

Function	Notes
Change ()	Change and assign delivered roles or change customer roles
Display ()	Display single or composite roles
Create Roles ()	Creating Single Roles Creating Roles contains an overview of the procedure.
Create Composite Roles ()	Creating Composite Roles
Add to Favorites ()	The role is included in the tree display. The Favorites are displayed when you call the role administration transaction or choose Views. To delete a role from the Favorites, position the cursor on the role. Choose the right-hand mouse key and choose Delete from Favorites in the context menu.
Where-Used List ()	For single roles, specifies the composite roles in which the role currently entered in the Role field is used. For composite roles, specifies which single roles are contained in the role currently entered in the Role field.
Delete ()	If you want the deletion to be transported, place the role objects in a transport request before deleting. To delete the role in a system linked by RFC (like a component system in Workplace), choose Role ® Distribute deletion.
Copy ()	Predefined roles are delivered as templates. They begin with the prefix "SAP_". Copy a role to a name in the customer namespace. You can also copy the user assignment and personalization objects.
Transport ()	Transport and distribute roles
Transactions ()	Where-used list for transactions in roles
Views ()	Select views to display roles. You can choose from the following views: ● Favorites ● Single roles ● Composite roles ● Roles in composite roles ● Inheritance hierarchy ● Display roles for role owner ● Roles grouped by country ● Roles grouped by industry ● Roles grouped by target system Inheritance hierarchy displays all roles from which other roles have been derived. For more information, see Derive roles.
Display Documentation ()	Displays the documentation of delivered roles in the bottom right-hand part of the screen. You can link a role with a document in the Knowledge Warehouse by choosing Utilities ® Info Object ® Assign.
Set Filter () Undo Filter ()	You can further restrict the role display at the bottom of the screen with Set filter. The Roles in composite role view also displays the composite roles to which a single role with the filter search string is assigned. You can reset filter values with Reset filter.

Other Functions in the Role Menu

Function	Notes
Print	All role data (activity assignments, organizational levels, authorization data, user assignment, and so on) are printed.
Download/Upload	To avoid inconsistencies, all roles from which a role is derived are also downloaded. When you download composite roles, all the roles which they contain are also downloaded. When you upload a role, all role data, including authorization data is uploaded from a file into the SAP system. The user assignments for the role and the generated profiles for the role are exceptions in this case. You must therefore regenerate the authorization profiles after the upload.
Read from another system by RFC	... 1. On the Mass Import of Roles screen, choose the input help. 2. In the dialog box that appears, specify whether you want to use RFC destinations or a variable. 3. If you use RFC destinations, select the RFC destinations of the systems from which you want to import roles. The Select Roles (no composite roles) dialog box appears. The program imports the selected roles, together with its menu and description, into the current system using an RFC connection. The authorization data is not imported, however. You can also enter the RFC destination as a variable with transaction SM30_SSM_RFC.

Options under Goto ® Settings:

● Simple maintenance (editing the menu for the Workplace)

Choose this option to set up composite or single roles on the Workplace server.

● Basic maintenance (menus, profiles, other objects)

This option contains all functions for role administration. This is the default setting.

● Complete view (organizational management and workflow)

You can use this option to display and change Workflow tasks for a role on the Workflow tab page. The assignments are only relevant for Workflow, that is, the users directly or indirectly assigned to the role are potential Workflow task performers.

Utilities Menu Functions:

Function	Notes
Status overview	Displays a list of all or selected roles with user assignment, menu, authorization profile and user master record comparison status information. You can choose the following options to restrict the result list: ● Only Display Roles with Errors and Warnings: This option is activated by default and reduces the result list to roles for which the status checks do not return only green lights. There must therefore be at least one traffic light showing at least yellow for the role to be displayed. To display all entered roles in the result list, deselect this option. ● Check assignment of workflow tasks You can activate and deactivate the check for workflow assignments, depending on whether the function is used in your system. Otherwise, roles with missing workflow assignments but that display green traffic lights for all other properties, would also be displayed. This might not actually be what you want. If you are working with workflow assignments, it is useful to select the option (default setting: inactive) to identify roles with no assignments. Essentially, the option can only be selected if organizational management is active. If you use organization management, the statuses of the Workflow tasks and the indirect user assignments are also displayed.
Mass generation	Generates the profiles of several roles (Mass generation of profiles) at the same time
Mass comparison	User master comparison for several roles (Compare user master records)
Mass transport	You can select several roles to transport in a dialog box (Transporting and Distributing Roles).
Mass download	Save several roles on the PC. You can choose on the selection screen whether you: ● Also want to transport the single roles contained in the selected composite roles (Customizing switch ADD_COMPOSITE_ROLES in table SSM_CUST) ● Also want to transport the generated profiles for all single roles (PROFILE_TRANSPORT in table PRGN_CUST) You can define the default setting for both options using the value in the Customizing switch. If you explicitly set a switch to NO, the option in question on the selection screen is not active. Otherwise, it is active.
Role comparison tool	(Cross-system) role comparison (Compare roles).
Templates	Templates for roles
Customizing auth.	Assign projects or views of projects in the implementation guide (IMG) to a role. With this assignment, you can generate targeted authorizations for certain IMG activities and assign users. The authorization required to perform all activities in the assigned IMG projects/project views is generated in profile generation. A dialog window appears where you can make this assignment. Choose Information to display more information on using this option.

Environment Menu Functions

Function	Notes
User master	Call user administration (Create and edit user master records).
Text Comparison for CUA Central System	Send the current list of roles and profiles to the CUA central system.
Display Changes	Displaying Change Documents (For more information about the user interface of the evaluation report, see the Determining Documents for Roles and Role Assignments section.)
Installation/upgrade	Call the transaction which initially fills the role administration customer tables or updates them after an upgrade. The role administration customer tables contain a copy of the SAP field value and check indicator default values. (Reducing the Scope of Authorization Checks).
Check Indicators	Call the transaction for changing check indicators and field values.
Auth. Objects ® Display/Deactivate	Display authorization objects with documentation / Deactivate authorization checks

Roles with responsibilities

In Release SAP R/3 4.5A and higher, all Roles with responsibilities which were created in SAP R/3 4.0A and 4.0B, are migrated in separate roles. The result of the migration is roles that contain transactions, and a derived role that contains the authorization data and user assignments for each responsibility.