Question:
Hi
We are going to implement the HR Context solution, and we need to transfer all the data in all roles from P_ORGIN to P_ORGINCON.
Is it possible to do this automaticly or do you have to do it manually?
Best Regards
Jacob
Answer:
Jacob,
You could try exporting the roles, tweak the export file, which is fairly readable fixed-record-length ascii, and reimporting them. (look for lines starting with AGR_1251 and containing P_ORGIN) This could be done with some sort of scripting language but imho is only worth the effort if you have to change more than 50 roles.
One possible pitfall is that the exportfile has got sequential linenumbers per profile and the P_ORGINCON object has one more field (=line) than P_ORGIN. The linenumbers are just to the left of the object name.
Also you may want to leave all P_ORGIN objects in place so you can flick back the ORGIN/INCON-switches if tests go bad. This means you'll have to insert about 6(?) lines per profile in the export/importfile and adjust the linenumbers accordingly.
Otherwise I'd say you've got quite some clicking and typing to do. I would advise to leave the P_ORGIN objects in the roles for a while until you're shure all goes well.
hth,
Jurjen
Answer:
Hi Jurjen
Thank you very much for your response. I need to change approximately 1500 roles.
I will try your suggestion in a test environment.
Have you tried to edit roles in an exported file before?
Thanks a lot
Jacob
Answer:
Jacob,
Unfortunately I've never actually edited role contents en mass before. I did once write a small script in Perl to analyze role exports and report open authorization fields. That's why I know how they look.
I did experiment a little bit on a few roles some time ago, hence my knowledge about the linenumbers.
Once I have the need to mass change the way you have now I'll definately look at the solution I just gave you.
Cheers!
Jurjen
Answer:
My curiosity is provoked. Given the opportunities in HR via P_PERNR and dynamic structural authorizations, how can anyone have 1500 roles?
_________________
bwSecurity
Answer:
ps consider a CATT script for making mass changes.
_________________
bwSecurity
Answer:
"My curiosity is provoked. Given the opportunities in HR via P_PERNR and dynamic structural authorizations, how can anyone have 1500 roles?"
1500 users=1500 roles
_________________
www.bluedragonfishing.com
http://www.saphr-robinette.com/
Answer:
If 1500 users = 1500 roles then someone doesn't understand HR authorizations. It is possible (for example) to have one role that allows 1500 users to do no more than maintain their own time sheet and no one else's. Similarly it is possible to have one role that allows every user to see their own organization and no one else's.
_________________
bwSecurity
Answer:
My curiosity is provoked. Given the opportunities in HR via P_PERNR and dynamic structural authorizations, how can anyone have 1500 roles?
Merge three mid-sized companies and their systems?
Introducing P_ORGINCON suggests that the original poster is on his way to a better solution. At least structural authorizations are on their way. A step-by-step introduction of such a change isn't bad I think.
I know I would prefer it over a big-bang-change with 1500+ roles. (= way over 1500 users)
Jurjen
Answer:
Hi all
We have more than 10000 users, the reason for the large size of roles is that people in FI and Logistic also uses data from the HR system.
I have been looking into the solution Jurjen suggested, do anyone know what the node in table agr_1250 is used for?
Br.
Jacob
Answer:
Hi all
do anyone know what the node in table agr_1250 is used for?
Jacob,
I believe it holds an entry for all objects per profile as well as the object descriptions in the system language. You will probabely need to add a line per profile for the P_ORGINCON object as well.
Maybe you can create a role, without any transactions. In the role you manually add a P_ORGIN object, save, generate the profile and export the role. Now add P_ORGINCON and re-generate and export so you can look at the difference between the two export files.
HTH
Jurjen
Answer:
How about:
1. Download roles into a text file.
2. Using a text program, replace the P_ORGIN object with P_ORGIN_ZZ
3. Upload roles into your system.
4. Generate the roles. P_ORGIN_ZZ is not recognized, and therefore gets deleted.
5. Create a role/profile for PLOG_CON.
6. Create a CATT and insert the manual profile into each role.
Answer:
Oops number 5 should have been P_ORGINCON.