Announcing the SAVIYNT KNOWLEDGE EXCHANGE unifying the Saviynt forums, documentation, training, and more in a single search tool across platforms. Click HERE to read the Announcement.

Wrong number of SAP roles and profiles imported from SAP S/4 HANA

VicyB
Regular Contributor
Regular Contributor

Hello everybody,

we set up the connection to SAP S/4 HANA and are currently facing the following situation:

  • the connection and the import job is successful
  • the number of accounts is correct
    • the status of accounts is correct
  • entitlements:
    • the number of tcodes is correct
    • the number of SAP roles is incorrect: We import 377 SAP roles more than we have in S/4 (based on the report RSUSR070)
    • the number of profiles is incorrect: We import 3,407 profiles less than we have in S/4 (based on the report RSUSR020)

The following tables are entered in the "tables" field in the connection: USR04,USR02,TSTC,TSTCT,AGR_AGRS,AGR_TEXTS,AGR_DEFINE,AGR_TIME,AGR_USERS,USORG,UST04,UST10C,UST10S,UST12,AGR_1252,AGR_1251
In the import job, we have the following tables entered: USR04,USR02,TSTC,TSTCT,AGR_AGRS,AGR_TEXTS,AGR_DEFINE,AGR_USERS,USORG,UST04,UST10C,UST10S,UST12,AGR_1252,AGR_1251

Is there a way to explain or fix the mismatch in the numbers between Saviynt and S/4?

Thank you!

6 REPLIES 6

sai_sp
Saviynt Employee
Saviynt Employee

@VicyB Saviynt's SAP connector does not have any filters. It imports all the data it receives when it makes a call to the SAP function module. Can you try to run an import again and capture the logs for the same and please raise a support ticket for a deep dive to find out what the issue is.

VicyB
Regular Contributor
Regular Contributor

Hello @sai_sp ,

based on the Saviynt documentation, there is a filter for what is imported according to the tables that are in use:

VicyB_0-1684484911409.png

The logs do not show any errors because the job runs successfully.

The question rather is which tables Saviynt needs to import all profiles and roles correctly.

Thank you!

sai_sp
Saviynt Employee
Saviynt Employee

@VicyB You can add what tables to import and what not, but you can not filter on what data to bring in from a table.

Profiles are imported using UST04,UST10C (for composite profiles), UST10S (for single profiles)

Roles are imported through AGR_AGRS (composite roles), AGR_Texts (Single Roles), AGR_USERS in certain cases when the user has the role but it is not found in any of the tables 

VicyB
Regular Contributor
Regular Contributor

Hello @sai_sp ,

thank you for the table details, that is quite helpful. 

We are internally checking whether the AGR_USERS table delivers roles that aren't found in the S/4 reports (this would explain the number mismatch). 

In our research we also found the tables USR10 and USR11 to be important for profile import. They are  also mentioned in the SAV documentation but not listed as mandatory for the import: https://docs.saviyntcloud.com/bundle/SAP-v23x/page/Content/Prerequisites-SAP-v2022x.htm

Can you advise to incorporate those tables for a correct import or are those tables not bringing any change to the import?

Thank you!

VicyB
Regular Contributor
Regular Contributor

Hello everybody,

we are still working on solving the number mismatch, so any advice is highly appreciated!

In the logs we also saw that the table AGR_DEFINE is (sometimes) used for Role Import. However, the number of records imported from AGR_DEFINE is not the same as the number of total roles that are imported. Instead, the total amount of roles is based on AGR_USERS in our case - which is more than the AGR_DEFINE table has. 

Also, the question on the USR10 table is still open, please provide us with an information on why this table is not supported.

Thank you for the help!

VicyB
Regular Contributor
Regular Contributor

Hello everybody,

we received feedback from the connector team which solves the issue:

The connector only imports entitlements from the S/4 which either have a relation to other entitlements or are related to an account. "Standalone" entitlements can't be imported due to the SAP ABAP programming of the S/4. 

On another note: We were also able to import additional SAP roles by setting the SAP_TABLE_LANG attribute in the connection to another language ("D" in our case), because SAP roles in S/4 can be associated with different languages. Hence, they can be filtered out in the import due to this setting.