Question regarding the table SAPRoleInSAPRole / Workflow step "roleInRole"

Hello,

We are still using version 8.1.5 of the One Identity Manager.

We are currently testing the system behavior with a new SAP/HANA-based CUA in our test environment.
We are able to test the communication so that our One Identity Manager communicatie to the new CUA.

Now we are faced with the following problem: the sync is no longer running successfully and we currently do not know why.

The error occurs in the "roleInRole" step and reads as follows:

ErrorMessages (<date>) [2134003] Error executing synchronization.
[1777018] Error executing synchronization project (SAP R/3 (xxx))'s workflow (Initial Synchronization).
[1777124] Error executing projection step (roleInRole) of projection configuration (Initial Synchronization (Initial Synchronization)).
[1777219] Error executing synchronization step (roleInRole)!
[System.AggregateException] One or more errors occurred.
[1777239] The mapping rule (Child role <-> CHILD_AGR) was unable to execute synchronization between system objects (SAPRole_Child - SAPRole_Parent) and (SAPRole_Child - SAPRole_Parent) successfully!
[1777161] Property (VRT_UID_SAPRoleChild@SAPRoleInSAPRole) could not set the value (SAPRole) from system object (SAPRole)!
[1777076] Cannot determine the value for the property (UID_SAPRoleChild@SAPRoleInSAPRole)! The value to convert (SAPRole) was not found in property (Name@SAPRole).


We cannot yet fully explain or deduce why the error is occurring in the "roleInRole" workflow step.
What is interfering with the sync in this combination of SAP roles?

Perhaps you can help us with this and support us in troubleshooting.

  • Hi,

    in case you have marked your configured SAP connection as "Central user administration (CUA) instance" and your synchronization shell is built for CUA (i.e. you have mappings "profileCUA" and "roleCUA") the names of roles mirrored from all connected systems into the central system will be read from SAP table "USRSYSACTT". The SAP connector selects all entries having a value in column "SUBSYSTEM". You should check the amount of roles synchronized into One IM database.

    The issue you are facing says one of the roles from roleInRole membership does not exist in One IM database. Have you seen a synchronization error during processing workflow step "roleCUA"?

    regards,

       Tino

  • Thanks for the feedback Tino.

    The error message occurs in the workflowstep "roleInRole" step - we could not detect an error in the step "CUARole".
    Based on this observation, however, we noticed that there is no SAP role in SAP that is supposed to act as a parent based on the SAP roles from the error message

    We will talk to our SAP colleagues about this