Determining the validity period of indirect role assignments
SAP roles that are assigned to departments, cost centers, locations, or business roles are indirectly assigned through them to user accounts. By default, indirect assignments are unlimited. The TargetSystem | SAPR3 | ValidDateHandling configuration parameter is used to determine the validity period of indirect assignments.
You can enter a valid from date if the requests are made in the IT Shop. An entry in SAPUserInSAPRole only exist between the first and last days of the request's validity period. The request's validity period is copied to role assignments under the following prerequisites:
By default, an entry in the SAPUserInSAPRole table is created for every new role assignment. If the same assignment is created by different means of inheritance, the number of entries in the SAPUserInSAPRole table grows rapidly. In this case, if the validity period is identical, the same entries can be reused. Existing role assignments can be reused under the following prerequisites:
- The Valid from date of the existing assignment is in the past.
- The Valid until date of the existing assignment is 9999-12-31 or the new assignment has the same Valid until date as the existing assignment.
Any other unlimited assignment or any other assignment with the same Valid until date does not generate a new entry in the SAPUserInSAPRole table. The number of entries in the SAPUserInSAPRole table can be reduced in this way.
NOTE: In databases that are migrated from versions older than 7.0, you may see assignments with a Valid until date of 9998-12-31. This is a valid date for unlimited role assignments, which means that these assignments can also be reused.
By default, the first day that indirect assignments are valid is 1900-01-01. This does not tell us when the assignments were created. If you need this information, in the Valid from field, you can enter the date on which the SAP role will be assigned. The date of the assignment is set as the first valid day of the indirect role assignments under the following prerequisites:
IMPORTANT: Calculating indirect role assignments can become much slower depending on the amount of data to be processed.
Do not set the UseTodayForInheritedValidFrom configuration parameter if the information about the valid from date of the role assignment is not absolutely necessary in SAP R/3!
Detailed information about this topic
Related topics
SAP products
| Installed modules: |
System Roles Module |
You can define One Identity Manager products as a collection of different groups, roles, or profiles in SAP. SAP products are system roles with the system role type "SAP product". Employees can obtain SAP products directly, inherit them though hierarchical role, or request them in the IT Shop.
The employee’s user account is assigned the groups, roles, and profiles in the SAP product independent of the assignment method. If an SAP product changes by adding or removing a group, role, or a profile in One Identity Manager, user account memberships are changed accordingly.
To edit SAP products
- Select the SAP R/3 | Products category.
- Select an SAP product in the result list.
– OR –
Click 
in the result list.
This opens the master data form for a system role.
- Edit the system role's master data.
- Save the changes.
Detailed information about this topic
- One Identity Manager System Roles Administration Guide
General master data for SAP products
Table 71: Configuration parameters for risk assessment of SAP user accounts
| QER | CalculateRiskIndex |
Preprocessor relevant configuration parameter controlling system components for calculating an employee's risk index. Changes to the parameter require recompiling the database.
If the parameter is enabled, values for the risk index can be entered and calculated. |
Enter the following data for a system role.
Table 72: System role master data
|
Display name |
Name for displaying the system roles in One Identity Manager tools. |
|
System role |
Unique identifier for the system role. |
|
Internal product name |
An additional internal name for the system role. |
|
System role type |
Specifies the type of company resources, which comprise the system role. |
|
Service item |
In order to use a service item within the IT Shop, assign a service item to it or add a new service item. For more information about service items, see the One Identity Manager IT Shop Administration Guide. |
|
System role manager |
Manager responsible for the system role. Assign any new employee. This employee can edit system role master data. They can be used as attestors for system role properties.
If the system role can be requested in the IT Shop, the manager will automatically be a member of the application role for product owners assigned the service item. |
|
Share date |
Specify a date for enabling the system role. If the date is in the future, the system role is considered to be disabled. If the date is reached, the system role is enabled. Employees inherit company resources that are assigned to the system role.
If the share date is exceeded or no date is entered, the system role is handled as an enabled system role. Company resource inheritance can be controlled with the Disabled option in these cases.
NOTE: Configure and enable the Share system roles schedule in the Designer to check the share date. For detailed information about schedules, see the One Identity Manager Operational Guide. |
|
Risk index (calculated) |
Maximum risk index values for all company resources. The property is only visible if the QER | CalculateRiskIndex configuration parameter is enabled. For detailed information about calculating the risk index, see the One Identity Manager Risk Assessment Administration Guide. |
|
Comment |
Text field for additional explanation. |
|
Remarks |
Text field for additional explanation. |
|
Description |
Text field for additional explanation. |
|
Deactivated |
Specifies whether employees and workdesks inherit the company resources contained in the system role.
If this option is set, the system role can be assigned to employees, workdesks, hierarchical roles, and IT Shop shelves. However they cannot inherit the company resources contained in the system role. The system role cannot be requested in the Web Portal.
If this option is not set, company resources assigned to the system role are inherited. If the option is enabled at a later date, existing assignments are removed. |
|
IT Shop |
Specifies whether the system role can be requested through the IT Shop. This system role can be requested by staff through the Web Portal and the request granted by a defined approval procedure. The system role can still be assigned directly to employees and hierarchical roles. For detailed information about IT Shop, see the One Identity Manager IT Shop Administration Guide. |
|
Only for use in IT Shop |
Specifies whether the system role can only be requested through the IT Shop. This system role can be requested by staff through the Web Portal and the request granted by a defined approval procedure. The system role may not be assigned directly to hierarchical roles. |
|
Spare field no. 01 ... Spare field no. 10 |
Additional company-specific information. Use the Designer to customize display names, formats, and templates for the input fields. |
For detailed information about system roles, see the One Identity Manager System Roles Administration Guide
Assigning SAP products to employees
SAP products can be assigned directly or indirectly to employees. In the case of indirect assignment, employees, and SAP products are arranged in hierarchical roles. The number of SAP products assigned to an employee is calculated from the position in the hierarchy and the direction of inheritance.
If you add an employee to roles and that employee owns a user account, the user account is added to all groups, roles, or profiles included in the SAP products owned by the employee. The groups, roles, or profiles are not inherited if the SAP product is disabled or if the share date is still in the future.
Prerequisites for indirect assignment:
- Assignment of system roles, employees, groups, roles, and profiles is permitted for role classes (departments, cost centers, locations, or business roles).
- User accounts are marked with the Groups can be inherited option.
- The user accounts, groups, roles, and profiles belong to the same SAP client.
Furthermore, SAP products can be assigned to employees through IT Shop requests. SAP products can be assigned through IT Shop requests by adding employees to a shop as customers. All SAP products are assigned to this shop can be requested by the customers. Requested SAP products are assigned to the employees after approval is granted.
Detailed information about this topic
Related topics
