GRC 5.3 to 10 upgrade.pdf
- 1. ©2011 SCI213 Customer Experience: Migration Process from SAP BusinessObjects Access Control 5.3 to 10.0 Alpesh Parmar – Levi Strauss & Co
- 2. ©2011 1 Agenda • LS&CO Background • Pre-requisites before migrating data • Migration Architecture and Flow • Migration Utility • Tips and Tricks • Migrating GRC 5.3 to AC 10.0 • Data Validation • Q&A
- 3. ©2011 2 Levi Strauss & Co.: An Authentic American Icon Selling our products involves: 110 countries 55,000+ retail locations 1,500 brand-dedicated stores Making our products involves: 55 countries 750 contractor factories A global leader in Jeanswear and Khaki wear Based in San Francisco, California, with approximately 14,000 employees world wide 2010 net revenue of $4.4 billion
- 4. ©2011 3 Prerequisites before starting migration • Upgrade the GRC AC 5.3 server to NW 700 SP11 or higher • Upgrade GRC AC 5.X to 5.3 SP13 or higher • Install latest version of migration utility on GRC AC 5.3 server • Make sure that GRC 10.0 is installed on an ABAP server and all the necessary BC sets have been activated • All the relevant users have been created in GRC 10.0 system • GRC 10.0 PI (Plug-in) is installed in all the target SAP systems • Folder to export data with read/write access is available on GRC 5.3 server • Folder to import data with read access is available on GRC 10.0 server • Default configuration parameters must be maintained on GRC 10.0
- 5. ©2011 4 Data Export From RAR/CUP/ERM 5.3 From SPM 5.3/CC 4.0
- 6. ©2011 5 Data Import To GRC 10.0 System See Appendix
- 7. ©2011 6 Migration Utility – GRC AC 5.3 Configure the folder to save exported files Export Config and Master Data (See Slide 9) Export Transactional Data http://<server>:<port>/webdynpro/dispatcher/sap.com/grc~acmigapl/GRC2010Migration URL for the utility
- 8. ©2011 7 Step 1: Set up data export location Select the folder for exporting data from GRC 5.3 system and click ‘OK’ to save the location. After receiving this message, click on ‘Close’ to close this screen.
- 9. ©2011 8 Export Configuration/Master Data 3 Step approach Objects and components Set up filter or transformation for each component Preview data or display dependent component Number of Pages
- 10. ©2011 9 Set up Filter Click on ‘Filter’ icon to open filter settings window Choose Application e.g. RAR/CUP/ERM Choose Field/Column from the application Choose Filter Criteria Click ‘OK’ to save the filter settings In this example, I don’t want to move any rules related to HR as we don’t have SAP HR installed. I also selected ‘copy to dependents’ so where ever ‘HR00’ is used as Business Process in RAR Rule related DB tables, migration utility will not export those entries.
- 11. ©2011 10 Set up Filter Click on this icon to open to set up transformation Here, I want to remove space from the connector ID/name. Connector is defined as PE2 – 501 in 5.3 but I would like to convert it to PE2-501 in 10.0. Choose Application e.g. RAR/CUP/ERM Set up ‘5.3’ value and ‘10.0’ value Click ‘OK’ to save the filter settings Choose Field/Column from the application
- 12. ©2011 11 Available objects to migrate Click on ‘Next’ button once you have selected object/components to migrate, set up filters and transformations… Click on the checkbox to select the objects you want to migrate/alternatively you can pick and choose the components under each object you need to migrate
- 13. ©2011 12 Export Configuration/Master Data Review all the selected objects Click on ‘Previous’ button to go back and make changes or click on ‘Next’ move to next step. Checkbox in the ‘Filter’ and ‘Transformation’ will confirm setting up of Filter/Transformation
- 14. ©2011 13 Export Configuration/Master Data Click on ‘Start Export’ to initiate the process See the progress of the data export process See the messages related to the export process
- 15. ©2011 14 Tips and Tricks - I • Set up filters to exclude data related to certain entry from migration • Copy filters to all the dependent component so you don’t have to re-create the same filter – the migration utility is little slower and there is no mass change or upload method to change this configuration • Set up necessary transformation e.g. Business Process ID is allowed to have 10 characters in GRC 10.0. RAR 5.3 only allowed 4 characters for B.P. where as CUP/ERM 5.3 allowed 40 characters for B.P. • Set up only necessary transformation as you can not copy or carry forward transformations to different components e.g. Business process related transformation has to be set up in RAR, CUP and ERM objects. • Manipulate exported files to set up easy transformations by using a tool like EditPlus/Notepad++. Don’t use MS Excel as it will change the file format. • Don’t forget to move exported files to data import location readable by 10.0
- 16. ©2011 15 Export SPM 5.3 Data Execute ‘/GRCPI/GRIA_EXPORT_AC_DATA‘ program via SE38 in SAP system Click on this checkbox to initiate data export for SPM (Firefighter) In case of CC 4.0, click this checkbox to export data
- 17. ©2011 16 Start Data Import Execute ‘GRAC_MIGRATION_DATA_IMPORT‘ program via SE38 in GRC 10.0 system Click on ‘Start Process’ to start the data import Select the version of GRC and click on Next button
- 18. ©2011 17 Import Common Configuration into 10.0 Provide the location where all the files are stored and click on ‘Get Files’ button Click on ‘Submit’ to go to next step Select the files you want to import. You can click Select All button to select all files. If you don’t want to overwrite data, click on ‘Append’ checkbox
- 19. ©2011 18 Import Common Configuration into 10.0 Click on ‘Import’ to start the data import Read the logs
- 20. ©2011 19 Import RAR/CUP/SPM/ERM 5.3 data in GRC 10.0 Select the radio button depending on the data you want to import Repeat the process to import RAR/ERM/CUP/SPM data Migrating Workflow data is not recommended
- 21. ©2011 20 Tips and Tricks - II • Repeat the above process to migrate SPM/FF data from different SAP system to GRC 10.0. MAKE SURE TO SELECT APPEND MODE • If you forgot to set up transformation/filter for one of the components or wanted to manipulate the file before importing, you can re-import all the data with overwrite option. This will wipe out any relevant data • If you are not able to delete rules or mitigating controls, there are programs available to remove rules and mitigation related data • If you keep trying to import RAR data, it will keep adding child organization unit so make sure to remove unused org. unit once you are done • Don’t try to migrate workflow data as it still requires manual effort. GRC 10.0 uses SAP Business workflow which is very powerful and flexible so it is better to configure workflow from scratch
- 22. ©2011 21 Data Validation Compare following data after migration: • Connectors in RAR/CUP/ERM 5.3 and GRC 10.0 • Roles in ERM/CUP 5.3 against GRC 10.0 • Functions, Function Action, Function Permission • Business Processes, Risks • Mitigating Controls, User/Role level mitigation • Firefighter, FF Owner and FF Controller
- 23. ©2011 22 Appendix Items to complete after importing common configuration data: • Maintain connectors and connector related settings (IMG) • Repository Sync (IMG/SE38) Authorization Sync (GRAC_PFCG_AUTHORIZATION_SYNC) Profile/Role/User Sync (GRAC_REPOSITORY_OBJECT_SYNC) • Maintain Configuration Settings (IMG) • Import roles for all defined connectors (IMG/Front-end) • Create Org Units (IMG)
- 24. ©2011 23 Q & A
- 26. ©2011 25 Feedback Please complete a session evaluation for this session! Session ID: SCI213