サポートと今すぐチャット
サポートとのチャット

Identity Manager 8.1.5 - Administration Guide for Connecting to SAP R/3

Managing SAP R/3 environments Setting up SAP R/3 synchronization Basic data for managing an SAP R/3 environment Basic data for user account administration SAP systems SAP clients SAP user accounts SAP groups, SAP roles, and SAP profiles SAP products Providing system measurement data Reports about SAP systems Configuration parameters for managing an SAP R/3 environment Default project templates for synchronizing an SAP R/3 environment Referenced SAP R/3 table and BAPI calls Example of a schema extension file

Determining an SAP user account rating

NOTE: In this section, roles, and profiles are grouped under the term "SAP system entitlements" to make it easier to understand.

A rating for a user account is determined in One Identity Manager by rating profiles and roles in which the user account is a member. Licenses have to be entered for the profiles and roles as a prerequisite. You have to make this assignment once manually after the objects have been synchronized. When the most significant user account is determined, the license names and any manually issued license value are taken into account.

A recalculation task for the DBQueue Processor is generated to determine license rating. The recalculation task is generated when:

  • The TargetSystem | SAPR3 | Accounts | CalculateLicence is set
  • The System measurement enabled option for the SAP system is disabled/enabled
  • The Has user account management option for the SAP client is disabled/enabled
  • User account assignments to roles or profiles are changed
  • Role assignment validity periods are changed
  • License's rating changes
  • License assignments to roles or profiles are changed
  • Employee assignment to user accounts
  • The user account substitute is changed

The most highly rated user account is determined in One Identity Manager in a two-step process.

  1. Determining the significance of a user account within a client (client related)

    Memberships in system entitlements within a client are calculated for an SAP user account. Through this, the SAP system entitlement with the highest rating is found. The license for the most significant SAP system entitlement is added to the user account as Calculated license (client). The most significant SAP system entitlement meets the following criteria:

    1. The assigned license has the lowest license rating (in alphanumeric sort order).
    2. If several SAP system entitlements with the same license rating are assigned or no license rating has been given, the valid license is that with the highest rating.
  2. Determining the most highly rated user account (employee related)
    1. The most significant user account is determined from all the employee’s user account sin all clients and all systems. The criteria from 1a) and 1b) apply for these user accounts. The license for the most highly rated user account is added to the user account as Calculated license (employee). A reference to the user account calculated with the most significance is entered for all of the employee's other user accounts in Calculated ref. name. These user account contain the license "11 (Multi-client/system) or "04 (substitute)".
      Table 76: Employee-related license
      User accounts Calculated license (employee)
      Most significant user account Calculated license (client)
      Remaining user accounts in clients of the same system as the most significant user account 04 (Deputy manager or supervisor)
      Remaining user accounts in other systems besides the most significant user account 11 (Multi-client/system)
    2. If a user account is not assigned an employee, the rating calculated under 1) is seen as the most significant and the license entry is added to the user account as Calculated license (employee).

Figure 6: Determining an SAP user account rating

Related topics

Transferring calculated licenses

In order to execute system measurement in the SAP R/3 environment, you need to transfer employee related calculated licenses to the active license. This transfer is done separately for each client in the system.

NOTE: If Publishing calculated licenses is run, the active license stored directly with the user account is overwritten by the calculated license!

Exception: "04 (substitute)" is entered as active license and the substitute time period is currently valid or is in the future.

NOTE: Publishing calculated licenses is only for clients with CUAClosed status "No CUA system" or empty CUA status.

To transfer calculated licenses to active licenses

  1. Select the SAP R/3 | Clients category.
  2. Select the client whose licenses are to be transferred.
  3. Select the Publish calculated licenses task.

    A security prompt appears.

  4. Confirm the security prompt with Yes.

Once the calculated licenses are transferred to active licenses, the active licenses are published in the target system.

One Identity Manager transfers the calculated employee related license for all this client‘s user accounts to the active license. You can edit this data later, if required. Once the licenses are published in the SAP R/3 system and system measurement has been carried out, you can synchronize the current measurement data with the One Identity Manager database.

Special characteristics of user accounts with a deputy license

If the active license "04 (substitute)" is entered in the user account and the substitution period is current valid, the active license is not replaced by the calculated employee-related license. The same applies if the substitution period is in the future (Substituted from later than "today").

If the substitution period has expired, the calculated employee-related license is transferred to the active license by the task Publishing calculated licenses. Information about the substitute and the substitution period is deleted from the user account.

NOTE: In order to publish an active license "04 (substitute) in the target system, the price list and all usable user types must be enabled in the program part system measurement in the SAP R/3 environment.
Related topics

Disabling license calculation

You can disable calculation of user account ratings for individual SAP client, SAP systems or for all SAP systems managed in One Identity Manager. Licenses calculated for the user accounts are no longer calculated and the active license is not updated. The licenses stored with roles and profiles do not work anymore. Therefore, One Identity Manager does not provide new data for system measurement that is based on currently assigned SAP roles and profiles.

The active license can still be accessed and published in the target system. If active licenses are changed in the target system, the changes are loaded into One Identity Manager by synchronization.

To disable license calculation

  • In the Designer, disable the TargetSystem | SAPR3 | Accounts | CalculateLicence configuration parameter.

    - OR -

  • In SAP, disable the System measurement enabled option.

    - OR -

  • In the client, disable the Has user administration.

Related topics

Reports about SAP systems

One Identity Manager makes various reports available containing information about the selected base object and its relations to other One Identity Manager database objects. The following reports are available for SAP systems.

NOTE: Other sections may be available depending on the which modules are installed.
Table 77: Reports for the target system
Report Description
Overview of all assignments (system) This report finds all roles containing employees with at least one user account in the selected system.
Overview of all assignments (client) This report identifies all roles containing employees with at least one user account in the selected client.
Overview of all assignments (group, role, profile) This report find all roles containing employees with the selected group, role, or profile.
Show orphaned user accounts This report shows all user accounts in the client that are not assigned to an employee. The report contains assigned system entitlements and risk assessment.
Show employees with multiple user accounts This report shows all employees with more than one user account in the client. The report contains a risk assessment.
Show entitlement drifts This report shows all the client's system entitlements that are the result of manual operations in the target system rather than using the One Identity Manager provisioning engine.
Show unused user accounts This report shows all the client's user accounts that have not been used in the last few months.
Show user accounts with an above average number of system entitlements This report contains all the client's user accounts with an above average number of system entitlements.
SAP user account and group administration This report contains a summary of user account and group distribution in all clients. You can find the report in the My One Identity Manager | Target system overviews category.
Data quality summary for SAP user accounts This report contains different evaluations of user account data quality in all client. You can find the report in the My One Identity Manager | Data quality analysis category.
関連ドキュメント

The document was helpful.

評価を選択

I easily found the information I needed.

評価を選択