How to Remove Indirect Responsibility "Application Diagnostics" for Every User After Upgraded to R12

How to Remove Indirect Responsibility Application Diagnostics for Every User After Upgrade

APPLIES TO:

APPLIES TO:

Oracle Applications Manager - Version 12.1.3 to 12.2 [Release 12.1 to 12.2]
Information in this document applies to any platform.

GOAL: 

Upgraded from 11.5.10.2 and every active user received the Application Diagnostics responsibilities. How to remove these?

SOLUTION: 

With R12.0.6 and higher, access to Oracle Diagnostics is controlled by Roles.  As part of the upgrade if a Responsibility assigned to a user is defined to have one of the roles for Oracle Diagnostics access then the Responsibility Application Diagnostics is given automatically to the users. This is part of the inheritance that takes place. This is not an bug and expected to happen.

This can be seen on the system which Responsibility has the role inheritance in place by running the following SQL:

select a.sub_name, a.super_name, b.display_name
from wf_role_hierarchies a, wf_roles b
where a.super_name in ('UMX|ODF_APPLICATION_END_USER_ROLE',
'UMX|ODF_APPLICATION_SUPER_USER_ROLE',
'UMX|ODF_DIAGNOSTICS_SUPER_USER_ROLE')
and a.sub_name=b.name;

If any of the users are assigned any of the responsibilities in the SQL results, then it is expected that they will then inherit the Oracle Diagnostics responsibility. This is usually reported when users are assigned the responsibilities iProcurement, or iSupplier, but there are others.

One can change this to keep users from being assigned the Oracle Diagnostics responsibility then one would need to update the role for the responsibility that has the inheritance defined as follows:

1. Log into Applications as the sysadmin user.
2. Responsibility - User Management.
3. Navigate - Roles & Role Inheritance.
4. In search fields use:
Type = Roles and responsibilities
name = eg iProcurement
5. From the results for the specific responsibility (used by users) select the the "View In Hierarchy" link.
6. Then expend each item to see which the role for Diagnostics has attached.
The possible roles are:
Diagnostics Super User Role
Application Super User Role
Application End User Role
 - Refer to Document 358831.1 to understand what access each of these give.
7. If one does not want the users to have this access, then select the remove node icon for the Name (which will be one of the 3 roles listed above.)
8. It will ask for confirmation and list he products affected (if one selected the correct node to remove then it will only list the one responsibility - ie the one that was selected, if one sees more than one responsibility then one may have selected the wrong "remove node" link).

Once this is done the users should see the responsibility Oracle Diagnostics removed, if not then it may be necessary to run the following concurrent requests and re-test:
a. "Workflow Directory Services User/Role Validation" Parameters: 100000, Yes, No, No
b. "Workflow Directory Services User/Role Validation" Parameters: 100000, No, Yes, No

BEFORE WORKAROUND :

Following Screen shot shows, Direct Responsibilities I have added.

Following Screen shot shows , Indirect Responsibilities are added automatically.

Process to Remove, Indirect Responsibilities those are added automatically :

STEP 1:

1. Log into Applications as the sysadmin user.

2. Responsibility - User Management.

3. Navigate - Roles & Role Inheritance.

4. In search fields use:
Type = Roles and responsibilities
name = eg iProcurement
5. From the results for the specific responsibility (used by users) select the the "View In Hierarchy" link. 

6. Then expend each item to see which has the role for Diagnostics attached.
The possible roles are:
Diagnostics Super User Role
Application Super User Role
Application End User Role

7. If one does not want the users to have this access, then select the remove node icon for the Name (which will be one of the roles listed above.)
8. It will ask for confirmation and list he products affected (if one selected the correct node to remove then it will only list the one responsibility - ie the one that was selected, if one sees more than one responsibility then one may have selected the wrong "remove node" link).

Once this is done the users should see the responsibility Oracle Diagnostics removed, if not then it may be necessary to run the following concurrent requests and re-test:
a. "Workflow Directory Services User/Role Validation" Parameters: 100000, Yes, No, No
b. "Workflow Directory Services User/Role Validation" Parameters: 100000, No, Yes, No

AFRTER WORKARROUND: