Question:
I know I can create a function to do this, but was wondering if anyone knows of an SAP standard function that will remove expired (end-dated) roles from users globally.
Don't mean to start any debate over the value of having end-dated roles from an administrative purpose, just curious if such a beast exists to save some programming work.
Answer:
There is a program called PFCG_TIME_DEPENDENCY that does this. Do a search on this site. It has been mentioned many times.
Answer:
If you mean for SAP to physically REMOVE the record from the user in ADDITION to removing the profile, PFUD, PFCG_TIME_DEPENDENCY, or its underlying report ( which should be used instead of PFCG_TIME_DEPENDENCY ) does NOT remove the "expired" role record but removes the profiles.
I recall a newer program SAP may provide in OSS or 4.7 that may accomplish this. I would search SE11 table AGR_USERS "where used" to see if it is in your system.
Other than that you will need to write your own, if I recall the code was posted here under a reference to SSM_CUST so the records are cleansed on any save of the user ( includes PFUD, SU01, PFCG_TIME_DEPENDENCY et.al)
Answer:
SAP's concept is to use the validity dates of the role (and the user...) to remove the profiles. This quickly removes the access if appropriate measures are taken to trigger it.
Tarr
Answer:
Gotcha, turns out what I'm looking for is available in 4.7: PRGN_COMPRESS_TIMES
Deletes expired roles (optional)
Compresses duplicate role assignments
Thanks
Answer:
Have you tested that program? I have played around with it a bit, but it seems to not do what it is supposed to. I find it looks at other users and/or roles than what is put in selection fields.
Answer:
Not yet, R/3 is on 4.6c where I'm currently at, I just looked at the code on the BW system, but haven't executed it - I'll watch for what you're describing.
Thanks,
Vincent
Answer:
I tested it (limited). It seems to work. Be sure and click on the right checkboxes. It does two things (actually three). It removes expired roles, deletes duplicate role assignments and it simulates both of those.
Answer:
It might have something to do with us using CUA... Good for some things, but really annoying at times!