SAP GRC 10.0/10.1/12.0 – Emergency Access Management (EAM) for Web based applications
GRC 10.0/10.1 – EAM for Web based applications
Emergency Access Management (EAM) is basically designed to support ABAP based applications. Hence there are lot of limitations and issues if it is used for Webdynpro and Web based applications.
Please go through below SAP notes when trying to implement EAM for Webdynpro or Web-based applications to understand the GRC EAM limitations.
Important points to be considered
1. Firefighter approach will not work for Webdynpro and Web based applications if Firefighter ID is a service UserID. Please check the below SAP note for the same
2. Since SAP is not supporting SSO for service UserIDs, recommended work around is to convert Firefighter IDs from Service to Dialog user type to make them work properly.
3. When Firefighter ID is made as dialog user type, make sure that no password aging policy is implemented in that system.If you have password aging active in your system, then you will be requested to change the password at regular intervals.
4. Maintain password to the Firefighter ID after converting to dialog user type or generate the password and save it. Now this Firefighter ID can be used to login as Firefighter.
5. Once the above changes are made and when Firefighter user executes NWBC or CRM_UI transactions, web links shows a screen with Change password for Firefighter IDs. To avoid this issue implement the below SAP note.
6. The log for the activities performed by Firefighter id are picked first from transaction logs (STAD) and then from Change Log tables (CDHDR,CDPOS). If the log details are not available then activity details will not be retrieved by GRC. I believe that such information is not captured in above 2 if the firefighter id logs onto web applications and that is why it will not be picked.
Before gathering the above information, i have gone through lot of discussion on this forum regarding the same.
There is a idea submitted in the Idea place requesting SAP to enhance GRC 10 to support EAM for CRM,SRM, TM etc which uses Web UI. Please check it out.
GRC 12.0 – EAM for Web based applications
As mentioned above, GRC EAM functionality is not supported for Web based applications until GRC version 10.1. However as many of the customers are moving towards FIORI and many other web applications, SAP GRC has rolled out the EAM functionality for Web based applications based on the idea raised in the influence SAP forum.
Details can be viewed in the following SAP Note: