Assigning function definitions
Use this task to specify the function definitions for which a mitigating control is valid. You can only assign function definitions that are enabled on the assignment form.
To assign SAP function definitions to mitigating controls
- Select the Risk index functions | Mitigating controls category.
- Select the mitigating control in the result list.
- Select the Assign function definitions task.
- In the Add assignments pane, double-click the function definitions you want to assign.
- OR -
In the Remove assignments pane, double-click the function definitions whose assignment is to be deleted.
- Save the changes.
Calculating mitigation
The reduction in significance of a mitigating control supplies the value by which the risk index of an SAP function is reduced when the control is implemented. One Identity Manager calculates a reduced risk index based on the risk index and the significance reduction. One Identity Manager supplies default functions for calculating reduced risk indexes. These functions cannot be edited with One Identity Manager tools.
The reduced risk index is calculated from the SAP function and the significance reduced sum of all assigned mitigating controls.
Risk index (reduced) = Risk index - sum significance reductions
If the significance reduction sum is greater than the risk index, the reduced risk index is set to 0.
Configuration parameters for SAP functions
The following configuration parameters are additionally available in One Identity Manager after the module has been installed.
Table 31: Configuration parameters for the module
|
TargetSystem | SAPR3 | SAPRights |
Preprocessor relevant configuration parameter for controlling component parts for testing authorizations in SAP R/3 using SAP functions. If the parameter is set, the components are available. Changes to the parameter require recompiling the database. |
| TargetSystem | SAPR3 | SAPRights | TestWithoutTCD |
Checks SAP authorizations without taking SAP transactions into account. |
Default project template for the SAP R/3 Compliance Add-on Module
A default project template ensures that all required information is added in One Identity Manager. This includes mappings, workflows, and the synchronization base object. If you do not use a default project template you must declare the synchronization base object in One Identity Manager yourself.
Use a default project template for initially setting up the synchronization project. For custom implementations, you can extend the synchronization project with the Synchronization Editor.
Use the "SAP® R/3® authorization objects" project template to synchronize authorization packages and transactions. The template uses mappings for the following schema types.
Table 32: Mapping SAP R/3 schema types to tables in the One Identity Manager schema
| TOBJ |
SAPAuthObject |
| ObjectClass |
SAPAuthObjectClass |
| AUTHX |
SAPField |
| Transaction |
SAPTransaction |
| TACT |
SAPActivity |
| objectHasField |
SAPAuthObjectHasField |
| ObjectHasActivity |
SAPAuthObjectHasSapActivity |
| FieldHasRcTable |
SAPFieldHasSAPRCTable |
| tMenu01 |
SAPMenu |
| menuHasTransaction |
SAPMenuHasSAPTransaction |
| ProfileHasAuthObjectField |
SAPProfileHasAuthObjectElem |
| RcTable |
SAPRCTable |
| RcVariable |
SAPRCVariable |
| TRANSACTIONHASTOBJ |
SAPTransactionHasSAPAuthObject |
