Running risk analysis for the SAP S/4HANA and SAP Fiori System.

GRC 10.1 SP 22 (Initially introduced with SP 19) / GRC 12 SP 03, made it possible to include SAP S/4HANA and SAP Fiori applications in the risk analysis. For this purpose, the authorization object S_SERVICE has been activated in the GRC risk analysis rules as part of SAP FIORI applications and SAP S/4 HANA integrations.

The blog post explains the steps required to be configured in the GRC system for running the risk analysis for SAP S/4HANA and SAP Fiori systems. Based on the landscape, you may have the SAP S/4HANA and SAP Fiori configured on the same system or you may have separate system for SAP S/4HANA and SAP Fiori. The connector configurations for the above mentioned scenarios are slightly different.

STEP 1: Connector Configuration

As mentioned above,  the SAP Fiori and the SAP S/4HANA system could be on the same box or they can be set up as separate systems. We will be covering both the scenarios.

Scenario 1 :SAP S/4HANA & SAP FIORI on Same Box

In this case only one connector is to be created. Create connector for SAP S/4HANA Box. The connection type should be “SAP”.

Scenario 2: SAP S/4HANA & SAP FIORI are on Different Boxes

In this case two connector are to be created in GRC. One for SAP S/4HANA and another for SAP Fiori box. Both the SAP S/4HANA and SAP Fiori connector will be of type SAP.

The SAP FIORI Connector is to be maintained as Subsequent Connector of SAP S/4HANA connector.

Once the connector/s are created and maintained, the same needs to be assigned to the integration scenarios. To maintain connection settings:

1. Enter Transaction SPRO
2. Navigate to SAP Reference IMG > Governance, Risk, and Control > Common Component Settings > Integration Framework > Maintain Connection Settings.
3. Select the Integration Scenario AUTH for Risk analysis.
4. Add SAP S/4HANA and SAP Fiori connector in the connector list.
5. Click Save.

STEP 2: Creation of Risk and Setting up the Ruleset

The customer might want to use the SAP delivered rules OR would want to use custom rules along with the standard delivered rule OR the customer might just want to create custom rule and use the same.

The rule creation and generation process is different, all the 3 scenarios are covered below.

Scenario 1: The customer wants to use the SAP Standard ruleset

1. Activate BC Sets
2. GRAC_RA_RULESET_COMMON
3. GRAC_RA_RULESET_S4HANA_ALL
4. After activating BC Set, all standard rules will be available for CONNECTOR Group “SAP_S4A_LG”.
5. As SAP Fiori apps are case sensitive, Connector Group “SAP_S4A_LG” & “S/4HANA Connector” requires to be maintained in Configuration Parameter 1022 & 1046.
6. After maintaining Connector Group “SAP_S4A_LG” under configuration parameters (1022 & 1046), there is a requirement for downloading and uploading the same rules again
   .
   Note- this step is required because Case Sensitive data goes into different table i.e. GRACFUNCACTEXT.. … *EXT tables. Follow the steps mentioned below.
   
   
   1. Download the rules for SAP_S4A_LG.
      SPRO ==> IMG ==> GRC ==> Access Control ==> Access Risk Analysis ==> SOD Rules ==>Download SOD Rules.
      Select system “SAP_S4A_LG” and provide path & names of all files and download.
      
   2. Upload the same rules again for SAP_S4A_LG.
      SPRO ==> IMG ==> GRC ==> Access Control ==> Access Risk Analysis ==> SOD Rules ==> Upload SOD Rules.
      Select system “SAP_S4A_LG” and provide path & names of all files and Upload with Overwrite option.
   3. Add the SAP Fiori and SAP S/4HANA connector to the connector group SAP_S4A_LG
      SPRO ==> IMG ==> GRC ==> Common Component Setting ==> Integration Framework ==> Maintain connectors and connection Types.
      Select the connector Group “SAP_S4A_LG” and Add the SAP S/4HANA and SAP Fiori connector to the connector group.
   4. Generate the Rules.
      SPRO ==> IMG ==> GRC ==> Access Control ==> Access Risk Analysis ==> SOD Rules ==> Generate SOD Rules.

Note: If you do not wish to perform point number 6 described in Scenario 1, you can also make use of the new report “GRAC_RULE_CONVERT_TO_EXTOBJ” , Delivered via SAP note “2805767”. The note has been created specifically to populate the data in the extended tables. Before running the report, ensure that the Connector Group “SAP_S4A_LG” & “S/4HANA Connector” is set in the configuration parameters 1022 and 1046.

Scenario 2: Customer wants to use SAP provided Standard ruleset and modify as per their requirements.

1. Activate BC Sets
   GRAC_RA_RULESET_COMMON
   GRAC_RA_RULESET_S4HANA_ALL
2. After activating BC Set, all standard rules will be available for CONNECTOR Group “SAP_S4A_LG”.
3. Create your own Custom Connector Group (say… C_S4_LG). Add S/4HANA & SAP Fiori connector in the Connector List.
4. Maintain your Custom Connector Group “C_S4_LG” & “S/4HANA Connector” under 1022 & 1046 configuration Parameter.
5. Download the rules for SAP_S4A_LG. Select system “SAP_S4A_LG” and provide path & names of all files and download.
   1. SPRO ==> IMG ==> GRC ==> Access Control ==> Access Risk Analysis ==> SOD Rules==> Download SOD Rules. Select system “SAP_S4A_LG” and provide path & names of all files and download.
   2. Upload the same rules again for “C_S4_LG”
      SPRO ==> IMG ==> GRC ==> Access Control ==> Access Risk Analysis ==> SOD Rules ==> Upload SOD Rules. Select system “Custom_S4_ALL” and provide path & names of all files and Upload with Overwrite option.
   3. Generate the Rules.
      SPRO ==> IMG ==> GRC ==> Access Control ==> Access Risk Analysis ==> SOD Rules ==> Generate soD Rules.

Scenario 3: In case the customer wants to create their own custom rules without having SAP Standard rules

1. Create your own Custom Connector Group (say… C_S4_LG). Add SAP S/4HANA connector in the Connector List.
2. Maintain your Custom Connector Group “C_S4_LG” & “S/4HANA Connector” under 1022 & 1046 configuration Parameter.
3. Create your Functions / Risk Manually or Use custom TXT files and upload your rules against your Connector Group “C_S4_LG”.
4. Generate the Rules.
   SPRO ==> IMG ==> GRC ==> Access Control ==> Access Risk Analysis ==> SOD Rules ==> Generate soD Rules.

Note: While create custom Risk, kindly ensure, proper abbreviations/Prefix are used for different types of Actions. Refer to the KBA 2655122 for more details on the same.

Once the above mentioned steps are configured and rules are generated, the entries in the following extension table will get populated.

• GRACACTRULEEXT
• GRACFUNCACTEXT
• GRACFUNCPRMEXT
• GRACPROFACTVLEXT
• GRACPROFPRMVLEXT
• GRACROLEACTVLEXT
• GRACROLEPRMVLEXT
• GRACUSERACTVLEXT
• GRACUSERPRMVLEXT

Now if the user/role has conflicting actions pertaining to SAP S/4HANA/SAP Fiori system, the corresponding violations will be flagged in the Risk Analysis result.

Important Information

1. In order to run risk analysis for SAP S/4HANA and SAP Fiori plugin only, GRCPINW/GRCPIERP package is to be installed on both SAP S/4HANA and SAP Fiori system. UIGRAC01(For GRC 12)/UIGRC001(For GRC 10.1) package is not required for running Risk analysis.
2. UIGRAC01(For GRC 12)/UIGRC001(For GRC 10.1) package on SAP Fiori is only required in case you want to use the GRC Fiori Apps.

List of important notes

• 2704494 – S4HANA & Fiori Risk Analysis does not show correct violations.
• 2639161 – S_SERVICE authorization causing huge risk violations results.
• 2652312 – Enhancement to SAP S/4HANA risk analysis to use same SAP S/4HANA ruleset even if Fiori Application is rendered from a different system.
• 2655122 – Prefix / Abbreviation requires with Action for creating & running risk analysis