Customizing Access request and approval screens in GRC Access Control
A common need for many companies is to customize access request and approval ABAP Web Dynpro screens of 10.0 and 10.1 based on the business requirements. Though the IMG customizing in SAP GRC access control provides some alternative to accomplish this, there is another Web Dynpro feature which can be utilized to do additional screen modifications without any additional coding effort for all the users.
Below steps would explain it for access request submission and approval screen:-
Access Request Submission
1. Go to Transaction SE80 and Open package GRAC_ACCESS_REQUEST.
2. Drill down to Web Dynpro->Web Dynpro Application
3. Select the application GRAC_OIF_REQUEST_SUBMISSION and double click
4. From the menu choose Web Dynpro Application-> Test -> In Browser – Admin Mode
5. Hiding Field/Tab
i. Place the cursor at the field or the tab that needs to be customized and right click and choose ‘Settings for Current Configuration’.
ii. Change the Visibility property to ‘Invisible’. Save and Close.
6. Customizing ALV
i. Place the cursor at the ALV to be customized e.g. ALV under User Access tab and right click and choose ‘Settings for Current Configuration’.
ii. Add/Remove columns, change sequence etc. Save and Close
8. Above steps can also be done for other UI elements present on pop ups that open through access request submission screen like: Existing Assignments etc.
7. Launch the access request submission through NWBC to see the effects
Access Request Approval
Modifying access request approval screen is little tricky as it requires as GUID to be passed externally in the URL, apart from that the other steps are similar to access request submission explained above.
1. Go to Transaction SE16 and Enter table name as GRACREQ, enter any request number in REQNO field.
2. Click execute button and copy the value of field REQ_ID
3. Select the application GRAC_OIF_REQUEST_APPROVAL and double click
4. From the menu choose Web Dynpro Application-> Test -> In Browser – Admin Mode
5. Below dump screen will be launched initially.
6. Append the string &OBJECT_ID=ACCREQ/<REQ_ID copied in step 2> e.g. &OBJECT_ID=ACCREQ/4CC001105B2A42DCE10000000A421B2B in the URL displayed in Step 5. Approval screen should be launched correctly after that.
7. Customize the UI similar to how it was done for access request submission screen.
The above process can be done for any Web Dynpro application. To find the Web Dynpro application name, right click on any ABAP Web Dynpro screen and choose option More Field Help.
Can changes made in this fashion be made visible in the EUP Templates on GRC 10?
EUP templates work independently of webdynpro personalization.
I have already read this thread about how to perform a change at WebDynpro level for all the users:
I am really interested in how to modify the Approval screen not the Request Screen. And my requirement is modify Approval Screen for only certain users.
What i want is when a user open their tasks the new pop-up window opened is the Z screen Approval.
So what i have done is i have created a new Z application for GRFN_POWL_INBOX and then i put this application into a Link for my Launchpad.
I have also created a Z application for the Approval screen. The i have a Z screen for Work Inbox and another Z screen for Approval screen. The problem is i don't know how to link this new Approval screen with the Work Inbox screen. I want when i push the button over a task the Z window is called instead of the standar one as you can see into the image below:
Kind regards and thank you.
Refer this blog which might help you to enhance the screen.
Thanks for your indications.
However i am not an expert over this topic and the only thing i would to do is when you push over a task into the Work Inbox then it should be open the Z application instead of the standar.
How could i link this?
Kind regards and thank you again.
Any additional idea?
Kind regards and thank you.
Any chance of getting "UserGroup" at Header level within the form?
Hi Harinam, frankly it will not serve the purpose of new design which enables specifying user group for multiple system in single request.
You can explore the option of User defaults if you have fixed set of user groups with some criteria for assigning them.
Is it possible to change Request For dropdown List i want to display only Self and Other.
And how can i do that, i think there is not customization on that or where do i assign texts?
I followed the steps provided in your blog.And following is the issue which i'm facing,
I appended &OBJECT_ID=ACCREQ/REQ_ID to the url and it opens me the approval screen,but it does not have submit button.But when i open the same from workinbox,it shows me all buttons.
PFB the snapshot for reference.
Screen opened by appending OBJECT_ID to URL.
Screen opened by click of link in workinbox.
Pls help me to resolve the issue.
if you check the last screen shot by me, it also doesn't shows the submit button as the request in this way is opened in display mode.
Any specific reason why you want Submit button as the customizing of the screen will work without that as well.
I have a requirement where i have one custom webdynpro component in which i have button. On the click of that button, i need to open the approver screen(same screen opened by clicking the link in workinbox) so that the approver can approve the request.
From which table we will get workitem id for the particular request?
You can find it in GRACREQ table.
My issue resolved.Solution is posted in this thread . Thank you very much for your prompt reply.
This is excellent posting. Would you be able to provide the steps to un-hide the same field which was made hidden as per the blog.
Follow the same steps till step 4 - ii and instead of Invisible select Not personalized option to make the field visible again.
Can we hard code Role Type as Composite role in Role Search screen of access request submission page.
You need to implement SAP delivered BAdI -
GRAC_ACCREQ_SEARCH_CRITERIA (System & Role Type defaulted)
With this BAdI you can default Role type in your Access Request.
Default values for search parameters appearing on Role search of Access Request
Description: Implementing this BAdI allows the customization of default search
parameters that appear on searching roles from access request. With this
Access Request search can be made easier and faster for the user.
All the parameters that are added via this implementation will appear as default
search parameters on Role search Screen
Just like any other ABAP object, you may need to transport this to Prod.
This is the only solution to your requirement.
Hope this helps.
Is it possible to set this configurations per user and not for all of them?
I mean (scenario):
If it is not possible with this tip, is it possible to set this configuirations witht the Launchpads? Can i create menu and modify event the buttons the users can see?
Applying BAdI is just going to enable some default values in search criteria. It has no impact on the buttons you mentioned. If you need user specific selection criteria, you may use variants.
This may help you.
No doubt this is good stuff...thanks for that...but when I browse on my system I only see these WD apps...any idea where I can find the Access Request form.
I'm trying to hide tabs in my Access Request form.
Looks like your GRC system is on NW 731 or 740. Please check the node 'FPM Applications' instead of webdynpro applications.
Let me know if you're still not able to find the application.
Yes Jatin...we're on NW 740 v1100 GRC 10.1 and I did locate it like you said...thanks a lot...let me work on hiding these tabs...will get back if I get stuck...regards rajiv
Thanks I was able to hide the tabs...now I only have User Access tab & Attachment tab...but when I hit submit it asks me to enter Last Name & Email...and it should not because I don't have that user details tab.
I've also created my own EUP a copy of SAP and made Last Name & Email as NOT mandatory.
Do you know how to make the request NOT ask for Last name & Email id for the access request.
If you are using access request then by default it uses 999 EUP so you have to change the field property in 999 EUP.
In case you are using template based request, then it might be possible that the custom EUP has some problem. To verify this, go to SE16 and enter table name as GRACEUPCONFIG and enter the EUP number. In the column CONTEXT_FNAME check whether there are any values or not, if not then implement note 1713880.
Jatin Im not using EUP999 I created my own EUP 111 and nothing is mandatory...except for a few things which are not causing the issue.
Anyway the issue now is that when I select the drop down REQUEST FOR 'OTHER' it works fine but when I select 'SELF' it forces me to put the Last Name & Email even tough in EUP 111 the fields are NOT mandatory.
I would recommend raising an OSS for the same as it needs to be debugged and checked in detail.
Thank you for the amazing document Jatin. This has been bugging me for days and Thanks to Alessandro (who uploaded this document in his blog) and to you for creating it, I finally know how to customize AR Forms and a myriad of other things I'm yet to explore in SE80.
To second 'Picho's' question earlier, I would appreciate it if you could explain how to restrict what gets shown in the drop down menus (Request Type, Request For etc) please. Is there an option just like the one you explained in this blog?
Leo, you can check auth object GRAC_REQ.
or you can handle it through code but UI customization for drop down value is not possible.
Thanks Jatin. Appreciate it.
thank you for this great document!
I have a question, i wanna enhance the risk analysis report with fields from a diffrent source (diffrent table, Excel is also possible or a api Report).
Thank you a lot for your help!
i was following these recomendations however i cannot see the way to performa a change:
I would like to change the name of the Role inside the button Add by another custom Name. Please see screenshot below:
Is this feasible thorugh NWBC or it requires programming changes?
Any idea how to perform this?
Regards and thank you.
How do we remove the mandatory option for a field?
I tried to hide this field , but while submitting the access request , the field pop out again marked as mandatory.
you can do specify that in the End User Personalization in customizing (SPRO). Search for EUP and you will find tons of helpful material.
As far I know EUP can be specified for template based requests or for any paths triggered after submitting requests. Correct me if am wrong.
Can you help me how can I specify a EUP for access request created through Access request >> Access request creation
first of all this is a document and not a discussion thread. Please move your questions into a proper thread in the future.
Anyways, Access Request Creation uses the EUP 999.
I will make sure my questions are raised on proper thread.
Thanks for the suggestion, EUP 999 worked for me.
Can any one help me how to increase the length of characters for Description maintained in Access request template. Do we need customization or we can change through configuration settings in the application type GRAC_OIF_REQUEST_TEMPLATE.