Chat now with support
Chat with Support

Identity Manager 8.0 - Administration Guide for Connecting to SAP R/3

Managing SAP R/3 Environments Setting up SAP R/3 Synchronization Base Data for Managing SAP R/3 SAP Systems SAP Clients SAP User Accounts SAP Groups, SAP Roles and SAP Profiles SAP Products Providing System Measurement Data Reports about SAP Systems Appendix: Configuration Parameters for Managing an SAP R/3 Environment Appendix: Default Project Templates for Synchronizing an SAP R/3 Environment Appendix: Referenced SAP R/3 Tables and BAPI Calls Appendix: Example of a Schema Extension File

Supported User Account Types

Supported User Account Types

Different types of user accounts, such as default user accounts, administrative user accounts or service accounts, can be mapped in One Identity Manager.

The following properties are used for mapping different user account types.

  • Identity (column IdentityType)

    The identity describes the type of user account.

    Table 45: Identities of User Accounts
    Identity Description Value of the column "IdentityType"
    Primary identity Employee's default user account. Primary
    Organizational identity Secondary user account used for various roles within the organization, f. ex. In sub-agreements with other functional areas. Organizational
    Personalized admin identity User account with administration rights used by one person. Admin
    Sponsored identity User account used for example for training purposes. Sponsored
    Shared identity User account with administration rights used by several people. Shared
    Service identity Service account. Service
  • Privileged user account (column IsPrivilegedAccount)

    Use this option to flag user accounts with special, privileged permissions. This includes administrative user accounts or service accounts, for example. This option is not used to flag default user accounts.

Default User Accounts

Normally, each employee obtains a default user account, which has the permissions they require for their regular work. The user accounts are linked to the employee. The effect of the link and the scope of the employee’s inherited properties on the user accounts can be configured through an account definition and its manage levels.

To create default user accounts through account definitions

  1. Create an account definition and assign the manage level "Unmanaged" or "Full managed" to it.
  2. Specify the effect of temporarily or permanently disabling, deleting or the security risk of an employee on its user accounts and group memberships for each manage level.
  3. Create a formatting rule for IT operating data.

    An account definition specifies which rules are used to generate the IT operating data for example, whether the container for a user account is made up of the employee's department, cost center, location or business role and which default values will be used if no IT operating data can be found through the employee's primary roles.

    Which IT operating data is required, depends on the target system. The following setting are recommended for default user accounts:

    • Use the default value "1" in the formatting rule for the column IsGroupAccount and set the option Always use default value.
    • Use the default value "primary" in the formatting rule for the column IdentityType and set the option Always use default value.
  4. Enter the effective IT operating data for the target system. Select the concrete target system under Effects on.

    Specify in the departments, cost centers, locations or business roles, which IT operating data should apply when you set up a user account.

  5. Assign the account definition to employees.

    When the account definition is assigned to an employee, a new user account is created through the inheritance mechanism and subsequent processing.

Administrative User Accounts

An administrative user account must be used for certain administrative tasks. Administrative user accounts are normally predefined in the target system and have fixed identifiers and login names, for example, "Administrator".

Administrative user accounts are loaded through synchronization into the One Identity Manager. To assign a manager to administrative user accounts, assign an employee to the user account in One Identity Manager.

NOTE: You can automatically label administrative user accounts as privileged user accounts. To do this, set the schedule "Mark selected user accounts as privileged" in the Designer.

Privileged User Accounts

Privileged user accounts are used to provide employees with additional privileges. This includes administrative user accounts or service accounts, for example. The user accounts are marked with the property Privileged user account (IsPrivilegedAccount).

NOTE: The criteria used to label user accounts automatically as privileged, are defined as extensions to the view definition (ViewAddOn) on the table TSBVAccountIsPrivDetectRule (table type "Union"). The evaluation is done in the script TSB_SetIsPrivilegedAccount.

To create privileged users through account definitions

  1. Create an account definition. Create a new manage level for privileged user accounts and assign this manage level to the account definition.
  2. If you want to prevent properties for privileged user accounts being overwritten, set the property IT operating data overwrites for the manage level, to the value "Only initially". In this case, the properties are populated just once when the user accounts is created.
  3. Specify the effect of temporarily or permanently disabling, deleting or the security risk of an employee on its user accounts and group memberships for each manage level.
  4. Create a formatting rule for IT operating data.

    An account definition specifies which rules are used to generate the IT operating data for example, whether the container for a user account is made up of the employee's department, cost center, location or business role and which default values will be used if no IT operating data can be found through the employee's primary roles.

    Which IT operating data is required, depends on the target system. The following settings are recommended for privileged user accounts:

    • Use the default value "1" in the formatting rule for the column IsPrivilegedAccount and set the option Always use default value.
    • You can also specify a formatting rule for the column IdentityType. The column owns different permitted values, which represent user accounts.
    • To prevent privileged user accounts inheriting default user groups, define a template for the column IsGroupAccount with the default value "0" and set the option Always use default value.
  5. Enter the effective IT operating data for the target system.

    Specify in the departments, cost centers, locations or business roles, which IT operating data should apply when you set up a user account.

  6. Assign the account definition directly to employees who work with privileged user accounts.

    When the account definition is assigned to an employee, a new user account is created through the inheritance mechanism and subsequent processing.

NOTE: Specify a formatting rule for a naming schema if it is required by the company for privileged user account login names.

Central User Administration in One Identity Manager

Central User Administration in One Identity Manager

If user accounts are managed through the central user administration (CUAClosed) in SAP R/3, access to the child client can be guaranteed to or withdrawn from user accounts in One Identity Manager. To do this, clients are marked as central system or child system in One Identity Manager. User accounts are managed in the central system. You specify the child system in which each user account obtains its access permissions (table SAPUserInSAPMandant). Only SAP groups, role or profiles from these clients and from the central system can be assigned to a user account.

To use automatic employee assignment for central user administration (CUA) user accounts, assign the account definition to the CUA central system. Account definitions cannot be used to assign user accounts to child systems.

To grant access permissions in a child system to a user account

  1. Assign all the clients to the user account to which it can have access permissions.

    For more information, see Assigning Child Systems.

  2. Assign SAP groups, roles, profiles from the child systems to the user account.

    For more information, see Additional Tasks for Managing SAP User Accounts.

Related Topics

Entering Master Data for SAP User Accounts

Entering Master Data for SAP User Accounts

A user account can be linked to an employee in the One Identity Manager. You can also manage user accounts separately from employees.

 NOTE: It is recommended to use account definitions to set up user accounts for company employees. In this case, some of the master data described in the following is mapped through templates from employee master data.

 NOTE: If employees obtain their user accounts through account definitions, they have to have a central SAP user account.

To edit master data for a user account

  1. Select the category SAP R/3 | User accounts.
  2. Select the user account in the result list and run the task Change master data.

    - OR-

    Click in the result list toolbar.

  3. Edit the user account's resource data.
  4. Save the changes.

To manually assign or create a user account for an employee

  1. Select the Employees | Employees.
  2. Select the employee in the result list and run Assign SAP user accounts from the task view.
  3. Assign a user account.
  4. Save the changes.
Detailed information about this topic

General Master Data for an SAP User Account

General Master Data for an SAP User Account

Table 46: Configuration Parameters for Risk Assessment of SAP User Accounts
Configuration parameter Active Meaning

QER\CalculateRiskIndex

Preprocessor relevant configuration parameter controlling system components for calculating an employee's risk index. Changes to the parameter require recompiling the database.

If the parameter is set, values can be entered and calculated for the risk index.

 NOTE: You can only add user account to client which are marked as central system if user accounts in the SAP system manged with central user administration.

Enter general data for a user account on the Address tab.

Table 47: SAP User Account Address Data
Property Description
Employee Employee that uses this user account. An employee is already entered if the user account was generated by an account definition. If you create the user account manually, you can select an employee in the menu. If you use automatic employee assignment, an associated employee is created and entered into the user account when the user account is saved.

Account definition

Account definition through which the user account was created.

Use the account definition to automatically fill user account master data and to specify a manage level for the user account. The One Identity Manager finds the IT operating data of the assigned employee and enters it in the corresponding fields in the user account.

 NOTE: The account definition cannot be changed once the user account has been saved.

To create the user account manually through an account definition, enter an employee in the Employee box. You can select all the account definitions assigned to this employee and through which no user account has been created for this employee.

Manage level User account's manage level. Select a manage level from the menu. You can only specify the manage level can if you have also entered an account definition. All manage levels of the selected account definition are available in the menu.
Client

The client to be added in the user account. Central system, if user accounts are manged with CUAClosed. You can only edit the client when the user account is added.

User account User account identifier. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

NOTE: Existing user accounts cannot be renamed.
First name The user’s first name. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.
Last name The user’s last name. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.
Form of address Form of address in the associated client's language. If you have assigned an account definition, the form of address is found by template rule depending on the mange level. The form of address depends on the gender of the assigned employee.
Academic title Additional information about the user account.
Alias Alternative ID for the user account that is used as log in for certain internet transactions.
Nickname Additional information about the user account.
Name formatting Name format and country for name formatting. Name and country formats determine the formatting rules for composing a full name of an employee in SAP R/3. Name formatting specifies the order in which parts of names are put together so that an employee‘s name is represented in an extensively long form. The country is serves to uniquely identify the formatting rule.
Country for name formatting
ISO 639 - language Default language for the user account according to ISO 639
Function Additional information about the user account. Used when addresses are printed.
Employee number SAP internal key for identifying an employee.
Department Additional information about the user account. Used when addresses are printed.
Room in building Additional information about the user account.
Floor Additional information about the user account.
Building (number or token) Additional information about the user account.
Communications type Unique identifier for the communications type
Company The company to which the user account is assigned.

When a user account is added, the company of the assigned client is used. If the client is not assigned to a company, the company with the smallest address number is found and assigned to the user account.

NOTE: Company is a mandatory field! Changes to user accounts cannot be saved in on synchronization SAP R/3 if a company is not assigned to them in .One Identity Manager

Assign these user accounts a default company in the SAP R/3 system where possible.

Risk index (calculated)

Maximum risk index values for all assigned groups, roles and profiles. This property is only visible if the configuration parameter "QER\CalculateRiskIndex" is set. For more detailed information, see the .One Identity Manager Risk Assessment Administration Guide

Category Categories for the inheritance of groups, roles and profiles by the user account. Select one or more categories from the menu. Groups, roles and profiles can be selectively inherited by user accounts. To do this, groups, roles and profiles and user accounts or contacts are divided into categories.

Identity

User account's identity type

Table 48: Permitted values for the identity.
Value Description
Primary identity Employee's default user account.
Organizational identity Secondary user account used for different roles in the organization, for example for subcontracts with other functional areas.
Personalized admin identity User account with administrative permissions, used by one employee.
Sponsored identity User account that is used for training purposes, for example.
Shared identity User account with administrative permissions, used by several employees.
Service identity Service account.
Privileged user account Specifies whether this is a privileged user account.

Groups can be inherited

Specifies whether the user account groups, roles and profiles can inherit through the employee. If this option is set, the user account inherits groups, roles and profiles through hierarchical roles or IT Shop requests.

  • If you add an employee with a user account to a department, for example, and you have assigned groups to this department, the user account inherits these groups.
  • If an employee has requested group membership in the IT Shop and the request is granted approval, the employee's user account only inherits the group if the option is set.
Related Topics
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating