Disabling license calculation
You can disable calculation of user account ratings for individual SAP client, SAP systems or for all SAP systems managed in One Identity Manager. Licenses calculated for the user accounts are no longer calculated and the active license is not updated. The licenses stored with roles and profiles do not work anymore. Therefore, One Identity Manager does not provide new data for system measurement that is based on currently assigned SAP roles and profiles.
The active license can still be accessed and published in the target system. If active licenses are changed in the target system, the changes are loaded into One Identity Manager by synchronization.
To disable license calculation
-
In the Designer, disable the TargetSystem | SAPR3 | Accounts | CalculateLicence configuration parameter.
- OR -
-
In SAP, disable the System measurement enabled option.
- OR -
-
In the client, disable the Has user administration.
Related topics
Reports about SAP objects
One Identity Manager makes various reports available containing information about the selected base object and its relations to other One Identity Manager database objects. The following reports are available for SAP systems.
NOTE: Other sections may be available depending on the which modules are installed.
Table 71: Data quality target system report
|
Show overview |
User account |
This report shows an overview of the user account and the assigned permissions. |
|
Show overview including origin |
User account |
This report shows an overview of the user account and origin of the assigned permissions. |
|
Show overview including history |
User account |
This report shows an overview of the user accounts including its history.
Select the end date for displaying the history (Min. date). Older changes and assignments that were removed before this date, are not shown in the report. |
|
Overview of all assignments |
group
Role
Profile
Structural profile |
This report finds all roles containing identities who have the selected system entitlement. |
|
Show overview |
group
Role
Profile |
This report shows an overview of the system entitlement and its assignments. |
|
Show overview including origin |
group
Role
Profile |
This report shows an overview of the system entitlement and origin of the assigned user accounts. |
|
Show overview including history |
group
Role
Profile |
This report shows an overview of the system entitlement and including its history.
Select the end date for displaying the history (Min. date). Older changes and assignments that were removed before this date, are not shown in the report. |
|
Show entitlement drifts |
Client |
This report shows all system entitlements that are the result of manual operations in the target system rather than provisioned by One Identity Manager. |
|
Show user accounts overview (incl. history) |
Client |
This report returns all the user accounts with their permissions including a history.
Select the end date for displaying the history (Min. date). Older changes and assignments that were removed before this date, are not shown in the report. |
|
Show user accounts with an above average number of system entitlements |
Client |
This report contains all user accounts with an above average number of system entitlements. |
|
Show identities with multiple user accounts |
Client |
This report shows all the identities that have multiple user accounts. The report contains a risk assessment. |
|
Show system entitlements overview (incl. history) |
Client |
This report shows the system entitlements with the assigned user accounts including a history.
Select the end date for displaying the history (Min. date). Older changes and assignments that were removed before this date, are not shown in the report. |
|
Overview of all assignments |
Client
system |
This report finds all roles containing identities with at least one user account in the selected target system. |
|
Show unused user accounts |
Client |
This report contains all user accounts, which have not been used in the last few months. |
|
Show orphaned user accounts |
Client |
This report shows all user accounts to which no identity is assigned. |
Table 72: Additional reports for the target system
|
SAP roles and profiles with rule violations |
The report shows all SAP roles and profiles that match SAP functions and thereby violate compliance rules.
The report is available if the SAP R/3 Compliance Add-on Module is available. |
|
SAP authorizations, SAP functions, and conflicts |
The report presents all rule violations, SAP function and authorization assignments for the selected SAP role/SAP profile including all assignments by child roles/profiles.
The report is available if the SAP R/3 Compliance Add-on Module is available. |
| SAP user account and group administration |
This report contains a summary of user account and group distribution in all clients. You can find the report in the My One Identity Manager > Target system overviews category. |
| Data quality summary for SAP user accounts |
This report contains different evaluations of user account data quality in all client. You can find the report in the My One Identity Manager > Data quality analysis category. |
Overview of all assignments
The Overview of all assignments report is displayed for some objects, such as authorizations, compliance rules, or roles. The report finds all the roles, for example, departments, cost centers, locations, business roles, and IT Shop structures in which there are identities who own the selected base object. In this case, direct as well as indirect base object assignments are included.
Example:
-
If the report is created for a resource, all roles are determined in which there are identities with this resource.
-
If the report is created for a group or another system entitlement, all roles are determined in which there are identities with this group or system entitlement.
-
If the report is created for a compliance rule, all roles are determined in which there are identities who violate this compliance rule.
-
If the report is created for a department, all roles are determined in which identities of the selected department are also members.
-
If the report is created for a business role, all roles are determined in which identities of the selected business role are also members.
To display detailed information about assignments
-
To display the report, select the base object from the navigation or the result list and select the Overview of all assignments report.
-
Click the 
Used by button in the report toolbar to select the role class for which you want to determine whether roles exist that contain identities with the selected base object.
All the roles of the selected role class are shown. The color coding of elements identifies the role in which there are identities with the selected base object. The meaning of the report control elements is explained in a separate legend. To access the legend, click the 
icon in the report's toolbar.
-
Double-click a control to show all child roles belonging to the selected role.
-
By clicking the 
button in a role's control, you display all identities in the role with the base object.
-
Use the small arrow next to to start a wizard that allows you to bookmark this list of identities for tracking. This creates a new business role to which the identities are assigned.
Figure 7: Toolbar of the Overview of all assignments report.
Table 73: Meaning of icons in the report toolbar
|
|
Show the legend with the meaning of the report control elements |
|
|
Saves the current report view as a graphic. |
|
|
Selects the role class used to generate the report. |
|
|
Displays all roles or only the affected roles. |
Removing a Central User Administration
One Identity Manager supports you in releasing individual clients from a Central User Administration or in completely removing a . After the changeover, individual clients can be managed independently of each other in One Identity Manager. Some tasks can be automated, others must be performed manually afterward. For example, this includes setting up new synchronization projects and removing the CUA distribution model from the SAP R/3 environment.
Recommendations
-
Link user accounts to identities
Before removing a CUA, you must ensure that each user account is linked to an identity. When the CUA is removed, a new user account is created in each client. Therefore, if a user account has access permissions in different clients, multiple user accounts are created. The connection between these user accounts can be established only through the linked identity.
-
Create a backup of the One Identity Manager database
The data conversion cannot be undone. Make sure that there is an up-to-date backup of the One Identity Manager database.
To remove a CUA, first release the individual child systems and check for successful conversion. After all child systems have been detached, you can convert the central system and delete the CUA from the SAP R/3 environment's distribution model.
Detailed information about this topic
Related topics
