Function definition overview
You can display the most important information about a function definition on the overview form.
To obtain an overview of a function definition
-
In the Manager, select the Identity Audit > SAP functions > Function definitions category.
-
Select the function definition in the result list.
-
Select the Function definition task.
To obtain an overview of a working copy
-
In the Manager, select the Identity Audit > SAP functions > Function definition working copies category.
-
Select the function definition in the result list.
-
Select the Function definition task.
Defining function instances
One and the same function definition can be used for different concrete instances. Specify an SAP client in the function instances to which to apply the SAP function. In addition, the variables that are assigned to the authorization fields are given specific values. Function instances can only be created for SAP functions that are enabled.
To create a function instance
-
In the Manager, select the Identity Audit > SAP functions > Function instances category.
-
Click 
in the result list.
-
Edit the function instance's main data.
- Save the changes.
To edit a function instance
-
In the Manager, select the Identity Audit > SAP functions > Function instances category.
-
In the result list, select a function instance and run the Change main data task.
-
Edit the function instance's main data.
- Save the changes.
NOTE: One Identity Manager users with the Identity & Access Governance | Identity Audit | Maintain SAP functions application role can create and edit function instances for the SAP functions if they are listed as the manager.
Detailed information about this topic
Main data for function instances
Enter the following main data of a function instance.
Table 20: Function instance properties
|
Function definition |
The function instance is created for this function definition. |
|
Client |
SAP client to which the SAP function should be applied. |
|
Variable set |
Variable set with functions defined, which are used in the function definition. The variable set and the function instance must be assigned to the same SAP client. |
|
Manager/supervisor |
Application role whose members are responsible for the function instance and variable sets in terms of content.
To create a new application role, click . Enter the application role name and assign a parent application role. |
|
Display name |
Function instance display name. This is formatted from the function definition name, the assigned client and variable set. |
|
Description |
Text field for additional explanation. A new function instance takes the description from the function definition. |
|
Function Instance Elements |
Displays authorization objects and function elements of the SAP function with specified values that are determined from the assigned variable set. Changes to the variables or variable set are displayed as soon as the DBQueue Processor has processed the corresponding authorization tasks. |
Checking field variable definitions
Before you use function instances in compliance rules, check whether all variable which are used in the function definition are defined in the variable set. If there is no function definition or variable set assigned to the function instance, the check-in fails with an error message. Variables that are not defined in the associated variable set are listed in the error message.
To check variable definitions
-
In the Manager, select the Identity Audit > SAP functions > Function instances category.
-
Select the function instance in the result list.
-
Select the Change main data task.
-
Select the Check variable definitions task.
