Comparing User Master Records

 

You can set a time limit on the assignment of roles to user master records. As a result some data will become invalid on a particular day, whilst other data becomes valid.

You cannot set time limits for authorization profiles and their entry in user master records.

To ensure that only authorization profiles which are valid are contained in the user master record each day, you must execute a daily profile comparison.

So that changes in the user master record are effective, you should execute the comparison before the user logs on.

 

There are two ways to execute the comparison.

1. As a background job before the start of each day.

   If report PFCG_TIME_DEPENDENCY is run every night, the authorization profiles in the user master will be current each morning (assuming that the job has run correctly). The best procedure is to schedule this as a periodic background job.

   Report PFCG_TIME_DEPENDENCY must also have run after each import of roles from other systems.

2. Using Transaction PFUD, Compare User Master

As an administrator, it is recommended that you use this transaction regularly to check that no errors have occurred in the background job. Any such errors can then be corrected manually.

To ensure that the authorization profiles in the user master records are always current, you should always execute a complete comparison of all roles (by choosing Complete comparison).

Following the comparison the system displays a log which includes any errors that occurred (background processing log for background report).

You have the following options in Transaction PFUD:

• Schedule or check job for the full comparison

Here you can start report PFCG_TIME_DEPENDENCY by specifying the time when the job is to start. The overview displays the status of jobs that have already been scheduled.

• Manual profile selection

Before comparing the user master record, you can select the profiles that are to be compared. The system displays an overview of the user master records to which profiles have been added, or from which profiles have been removed, during the comparison. If you deselect the relevant checkbox, you can exclude the profiles that should not be included in the user master record comparison. You start the comparison by choosing User master comp.

To compare the user master records belonging to selected users, first position the cursor on a user name and then choose Select user. You execute the comparison by choosing User master comp.

The status display for the user master comparison is only set to green once the comparison is executed.

• Complete comparison

With a complete comparison, all invalid authorization profiles are removed from the user master record and all new authorization profiles are inserted in the user master record.

The options Add new profiles, Delete expired authorization profiles and Output error messages are related to the actions described above.

You can also specify whether or not HR Organizational Management should be included in the comparison (Reconcile with HR Organizational Management).