サポートと今すぐチャット
サポートとのチャット

Identity Manager 8.2.1 - Administration Guide for Connecting to SAP R/3

Managing SAP R/3 environments Setting up SAP R/3 synchronization Basic data for managing an SAP R/3 environment Basic data for user account administration SAP systems SAP clients SAP user accounts SAP groups, SAP roles, and SAP profiles SAP products Providing system measurement data Reports about SAP objects Removing a Central User Administration Troubleshooting an SAP R/3 connection Configuration parameters for managing an SAP R/3 environment Default project templates for synchronizing an SAP R/3 environment Referenced SAP R/3 table and BAPI calls Example of a schema extension file

Configuring single role assignment

Only directly assigned single and composite roles are mapped in SAPUserInSAPRole. Assignments of single roles to composite roles are mapped in SAPCollectionRPG. You can establish which single roles are indirectly assigned to a user account through both tables.

The following applies by default for the inheritance of single roles by user accounts: If a single role is assigned to a user account and this single role is part of a composite role that is also assigned to the user account, then the assignment of the single role is additionally mapped in the SAPUserInSAPRole table if the validity period of the assigned single and composite role is not identical.

To not map memberships in single roles in the SAPUserInSAPRole table if the single roles are part of assigned composite roles

  • In the Designer, disable the TargetSystem | SAPR3 | KeepRedundantProfiles configuration parameter.

    The table contains only the membership in the composite role.

Effect of the KeepRedundantProfiles configuration parameter

A single role is assigned to a user account, as well as a composite role that contains this single role.

  • The configuration parameter is set. Both role assignments have a different validity period.

    The SAPUserInSAPRole table contains both the composite role assignment and the single role assignment.

  • The configuration parameter is set. Both role assignments have the same validity period.

    The SAPUserInSAPRole table contains only the assignment of the composite role.

  • The configuration parameter is not set.

    The SAPUserInSAPRole table contains only the assignment of the composite role. This applies regardless of the validity period of either role assignment.

Related topics

Inheriting SAP profiles and SAP roles in a central user administration

If user accounts are managed through the central user administration, SAP roles and profiles can only inherited by user accounts if the user accounts have access permission for the client that the role and profiles belong to. By default, roles and profiles can only be inherited by user account if access to the clients is guaranteed explicitly. Otherwise, the roles and profiles are not inherited.

User accounts can be granted the missing client access automatically as soon as a role or profile is inherited by the client.

To automatically grant missing access permission to user accounts

  • In the Designer, set the TargetSystem | SAPR3 | AutoFillSAPUserMandant configuration parameter.

The missing access permission is granted when inheritance is calculated (entry in the SAPUserMandant table) and the roles and profiles are assigned to the user accounts.

WARNING: As inheritance is an automated process, user accounts can therefore be given access permission to clients without the target system owners knowing about it.

Related topics

Additional tasks for managing SAP groups, SAP roles, and SAP profiles

After you have entered the main data, you can run the following tasks.

Overview of SAP groups, SAP roles, and SAP profiles

To obtain an overview of a group

  1. Select the SAP R/3 > Groups category.
  2. Select the group in the result list.
  3. Select the SAP group overview task.

To obtain an overview of a profile

  1. Select the SAP R/3 > Profiles category.
  2. Select a profile in the result list.
  3. Select the SAP profile overview task.

To obtain an overview of a role

  1. Select the SAP R/3 > Roles category.
  2. Select the role in the result list.
  3. Select the SAP role overview task.
関連ドキュメント

The document was helpful.

評価を選択

I easily found the information I needed.

評価を選択