Hi,
after the SP upgrade, did you check the role(assigned to FF id) status. Is it in generated version.
i think you should also run SU25 on GRC system. then synchronize the User and Role jobs again. Thereafter check the GRACUSERROLE table.
Is your 4010 role in GRC system same as 4010 role in connector systems.
Regards
plaban