Hi Joy
Have you considered making the Portal UME based on ECC? In doing this the ECC SAP Role becomes a portal group that you can then assign portal role to.
It means they user always receives their associated portal roles based on their ECC access. In addition, they user loses their Portal access when they lose their ECC. I find this helpful as Portal roles do not have expiration dates.
Alternatively, in GRC you could map related roles in the BRM definition so the user chooses their ECC and gets the mapped portal?
Regards
Colleen