Hi All,
We are on GRC SP13.
We are using Business roles for user provisioning/de-provisioning to connected ECC system.
GRC has been rolled out already for half modules of ECC by different vendor and they used Master-Derived role design for those modules.
Hence they are using single roles (derived roles) for Provisioning and De-provisioning.
For the remaining half modules, this is handled by different vendor and since client was not happy with Master - Derived roles, for this half they used composite and enabler roles.
For the first half part GRC is already LIVE and working fine.
For the second half I am setting up everything and we are using business roles for Provisioning/de-provisioning.
Everything was working fine until now.
If we are using business roles there is a parameter 4019 which needs to be used to avoid inconsistencies in business roles assignments in GRC system and Target system.
But by enabling this parameter what I have observed is sync jobs data is not proper.
Without this parameter the sync jobs used to wipe out all the role assignments data and then re-write the same in the GRC repository using the information received from backend system.
But if we set this parameter to YES, then the sync job will not be wiping out the user-role assignment, and only new assignments will be inserted/updated ensuring consistency of the business role assignments. But what I observed is if any of the business role is removed after running sync jobs though role is removed in the backend GRC tables still showing that few roles which are part of that business role are still assigned.
My question is whether we can case Business roles provisioning for half of the roles and Single roles provisioning for the other half of the roles? Will this work properly or will it not be consistent.
Please share your thoughts on this.
Regards,
Sai.
