Products

Products Industries
Industries Support
Support Training
Training Community
Community Developer
Developer Partner
Partner

About
About

 
Home / Community / Blogs + Actions

Emergency Access Management

February 2, 2014 | 891 Views |

Arif Mahamud
more by this author

Retagging required

Analytics | governance risk and compliance sap grc

share
0 share
0 tweet share
0

Follow

Purpose and functionality

1. EAM allow users to take responsibility for task outside of their normal
job function.
2. Allow temporary access for users when assigned with solving
problem, giving them provisionally broad, but regulated access.
 3. This temporary access will monitored and reviewed by the
application.
4. EAM provides the ability to manage and utilize firefighting activities
centrally from the access control application
5. The log files can be distributed to controller and owner via workflow
for additional approval

Defining Users

1. The owner of the ID

2. The controller
3. The users who will log on through EAM.

Important Roles and Terms

1. Firefighter: a business users requiring emergency access.

2. Firefighter ID:
3. A user id with elevated priviledges.
4. Access T-code GRAC_SPM
5. Firefighting: the act of using a firefighter id.
6. Controller: review and approves (if necessary) the log file generated
by the firefighter.
7. Owner: a user responsible for the firefighter id and assignment the
controller of the firefighter.

Firefighter Application type:

There are two deferent applications that can be used that can be used:

1. ID based firefighter Application

2. Role Based firefighter Application.

Configure in the IMG using parameter 4000 (Application type)

Only once application can be configured at a given time.
GRC Server package

1. The main application runs in the GRC server.

2. It is possible to assignment user for all system using NWBC or portal.
3. Provisioning of the emergency access can also be done via access
request(Workflow)

Process

1. Firefighter access is done centrally using the GRC system.

2. Firefighter logon to the GUI back and execute t-code GRAC_SPM
3. Click on the login.

Emergency Access Architecture

Plug-in

1. Once component called plug-in that is installed in remote system.

2. Emergency Access Management access the plug-in using RFC.

Prerequisite

1. Create users and roles as needed

2. Execute program GRAC_ROLEREP_USER_SYNC

Centralized firefighter overview and prerequisites

Centralized firefighter overview

1. EAM provides a centralized console through which firefighter can

logon to deferent system for firefighting.
2. In id based scenarios, firefighter do not have to logon to individual
client system to do firefighting.

Centralized firefighter prerequisites

 1. Application type is 1 for id based firefighting
2. Set parameter group 6 super users management
3. Set parameter id 4000
4. Firefighter user must exists in the central access control system and
the role SAP_GRAC_SPM_FIREFIGHTER

Centralized Logon Pad

● Access Control provides centralized logon pad for accessing the

firefighter IDs in all connected back end systems

The centralized logon pad allows:

1. Displaying all firefighter IDs assigned to the user

2. Logging on to all connected back end systems
3. Sending messages to other firefighters who are using a specific
firefighter ID
4. Unlocking a firefighter session not closed properly

While a Firefighter Session is running

1. The status of the firefighter ID will display in red

2. The firefighter can take the following actions:

● Click Additional Activity to enter more information

● If the firefighter ID is in use by another firefighter, choose Message to

send notification to the other firefighter

● Choose Unlock to unlock the firefighter ID if it is locked

EAM Configuration

Parameter setting

4000-Application type

4001-Default Firefighter Validity Period (Days)

4002-Send Email Immediately

4003-Retrieve Change Log

4004-Retrieve System log

 4005-Retrieve Audit log

4006-Retrieve OS Command log

4007-Send Log Report Execution Notification Immediately

4008-Send FirefightId Login Notification

4009-Log Report Execution Notification

4010-Firefighter ID role name

Monitoring Emergency Access

Firefighter Report types and purpose

Using firefighter reports

1. Resulting change log is stored in CDHDR and CDPOS tables

2. Log data is retrieved from the client system and stored in GRC for
report generation

Alert Moderator

1 Comment
You must be Logged on to comment or reply to a post.

Harish Prakash

November 19, 2015 at 12:58 pm

Hello
It is very informative, as a improvement please could you add screen shots for each
steps that would give more clarity on the topics.
Thanks