How data gets inserted in Basetreehasobject table while calculating SOD violations in one identity manager. Am looking especially how data gets inserted or deleted for SAP Function instances.

How data gets inserted in Basetreehasobject table while calcualting SOD violations in one identity manager. Am looking especially how data gets inserted or deleted for SAP Function instances. 

  • What version are you using? What are you trying to achieve?

  • Using 8.1.2 version. If a violation for a person is related to SAPFunctionInstance then those are not getting deleted automatically from BaseTreehasObject table and remains on my UI. So if we remove these instances from table then the violations will be removed for the user.

    For example - If any violation is related to profiles it will be present in BaseTreeHasSAPProfile and then will be present in BaseTreeHasObject. 
    Question 1 - In the same way, what is the base table for SAP function Instances which stores all the data related to an org?

    Question 2 - Which process or trigger is responsible to insert or delete the data into BaseTreeHasObject table related to SAPFunctionInstances.

  • If a violation for a person is related to SAPFunctionInstance then those are not getting deleted automatically from BaseTreehasObject table and remains on my UI.

    What should be the trigger to remove those entries if the violation still exists?

    If the person, or to be more precise the SAP user, does not have the capabilities (SAP Role, Profile membership, ...) anymore to meet the SAP function definition, the violation should be removed during the next test cycle.