A Firefighter ID reaches its validity date and stops working. In the standard configuration, no one is notified in advance. The assigned firefighter discovers it - the moment an emergency task needs to be executed and he doesn’t have access to it. For a control whose entire purpose is to govern privileged, time-boxed access, that silence is a real gap. SAP Note 3354809 closes it.
Why silent FFID expiry is a problem
Every FFID carries a validity, and when that period closes the access is automatically expired and Firefighter user is required to raise a new request. The challenge in the standard behaviour is not that the ID expires; it is that the expiry happens without notice.
Three failure modes follow from that:
- An existing emergency activity stalls, because the firefighter can no longer log in at the moment they most need to.
- The owner, who is accountable for the ID, has no opportunity to extend or retire it.
- The audit narrative shows a privileged-access control that changed state with no notification and no owner action, which is exactly the kind of unmanaged transition an auditor is trained to question.
The enhancement, and where it came from
SAP delivered this capability through the Customer Connect programme, the channel by which customers propose improvements to standard functionality and SAP evaluates them for release. The request became a shipped enhancement rather than a custom workaround, which matters: it is supported standard code, not a modification each organization has to build and defend on its own.
SAP Note 3354809, Email Notification Alert for the expiring FFIDs, delivers the enhancement. Companion note 3367485 records the Customer Connect item itself. Treat the notes as the authoritative source for prerequisites and manual steps; this article is the orientation around them.
Objects the note brings and enhances
The note works through three linked objects. One is an enhancement; the other two are specific to this reminder.
- GRAC_DOC_FFID_EMAILRMDR: A document class that holds the email content the framework renders into the outbound message: subject line, body, and the FFID and validity variables that make the message specific rather than generic.
- 0AC_FFID_EXPIRENOTIF: A message class registered through an enhancement to the existing GRFNVNOTIFYMSG table. That table is standard GRC notification content; the note extends it so the framework recognises this expiry event and knows which document class to use for it.
- GRAC_FFID_EXPIRE_REMINDER: The reminder program the note introduces, can be created as a custom transaction. It looks at FFIDs for the expiry and raises the notification, and is designed to run on a schedule rather than on demand.
How the notification works end to end
The reminder program runs as a scheduled background job and evaluates FFID validity against a lead time. For each ID approaching expiry it invokes the notification framework using message class 0AC_FFID_EXPIRENOTIF, which resolves to the GRAC_DOC_FFID_EMAILRMDR template and sends email to the relevant recipients, the assigned firefighter and the FFID owner. Because the check is schedule-driven and lead-time aware, the warning arrives before the validity date, not after it, which is the entire point.
Implementing it
The list of objects, prerequisites, and any manual activities are listed in SAP Note 3354809. Here is how to implement:
- Apply the note in the GRC system, following its prerequisites and manual steps. Then confirm the three objects are present: the document class, the GRFNVNOTIFYMSG entry for the message class, and the program.
- Create a transaction code for the program GRAC_FFID_EXPIRE_REMINDER using SE93.
- Schedule the program as a periodic background job in SM36, choosing a frequency and lead time that suit the organization's FFID validity conventions. Daily execution with a multi-day lead window is a common, low-risk pattern.
- Verify SAPconnect (SCOT) configuration for outbound mail, and current email addresses must be maintained for firefighters and owners.
Closing perspective
Proactive notification of expiry is a small yet effective enhancement. With Note 3354809 the long pending issue/gap is addressed.
References
- SAP Note 3354809 - Email Notification Alert for the expiring FFIDs
- SAP Note 3367485 - CC: Email Notification Alert for the expiring FFIDs
