Chat now with support
Chat with Support

Identity Manager 8.0 - Administration Guide for SAP R/3 Structural Profiles Add-on

Effectiveness of Structural Profiles

Effectiveness of Structural Profiles

Table 5: Configuration Parameter for Conditional Inheritance
Configuration parameter Active Meaning

QER\Structures\Inherite\GroupExclusion

Preprocessor relevant configuration parameter for controlling effectiveness of group memberships. If the parameter is set, memberships can be reduced on the basis of exclusion definitions. Changes to the parameter require recompiling the database.

If structural profiles are assigned to user accounts, an employee may obtain two or more structural profiles, which are not permitted in this combination. To prevent this, declare the structural profiles as mutually exclusive. To do this, you specify which of the two structural profiles should apply to the user accounts if both are assigned.

You can assign an excluded structural profile directly, indirectly or by IT Shop request at anytime. One Identity Manager determines whether the assignment is effective.

NOTE:

  • You cannot define a pair of mutually exclusive structural profiles. That means, the definition "Structural profile A excludes structural profile B" AND "Structural profile B excludes structural profile A" is not permitted.
  • You must declare each structural profile to be excluded from a structural profile separately. Exclusion definitions cannot be inherited.

The effect of the assignments is mapped in the tables SAPUserInSAPHRP and BaseTreeHasSAPHRP through the column XIsInEffect.

Prerequisites
  • The configuration parameter "QER\Inherite\GroupExclusion" is enabled.
  • Mutually exclusive structural profiles belong to the same client.

To exclude structural profiles

  1. Select the category SAP R/3 | Structural profiles.
  2. Select a structural profile in the result list.
  3. Select Exclude structural profiles in the task view.
  4. Assign the structural profiles that are mutually exclusive to the selected location in Add assignments.

    - OR -

    Remove structural profiles that are no longer mutually exclusive in Remove assignments.

  5. Save the changes.

For more information about the effectiveness of group memberships, see the One Identity Manager Administration Guide for Connecting to SAP R/3.

Inheriting Structural Profiles based on Categories

Inheriting Structural Profiles based on Categories

In One Identity Manager, structural profiles can be selectively inherited by user accounts. For this, structural profiles and user accounts are divided into categories. The categories can be freely selected and are specified by a template. Each category is given a specific position within the template. The mapping rule contains different tables. Use the user account table to specify categories for target system dependent user accounts. Enter your categories for the structural profiles in the group table. Each table contains the category items "Position1" to "Position31".

Every user account can be assigned to one or more categories. Every structural profile can be assigned to one or more categories as well. The structural profile is inherited by the user account when at least one user account category item matches an assigned structural profile. The structural profile is also inherited by the user account if the structural profile or the user account is not put into categories.

NOTE: Inheritance through categories is only taken into account when structural profiles are assigned indirectly through hierarchical roles. Categories are not taken into account when structural profile are directly assigned to user accounts.

To use inheritance through categories

  1. Define the categories in the tenant.

    NOTE: If central user administration is implemented, define the categories in the central system as well as in the child system. The same categories must be defined in the child system as in the central system so that structural profiles from a child system can be inherited by user accounts.
  2. Assign categories to user accounts through their master data.
  3. Assign categories to structural profiles through their master data.

To define a category

  1. Select the category SAP R/3 | Clients.
  2. Select the client from the result list. Select Change master data in the task view.
  3. Change to the Categories tab.
  4. Open the member tree of the table "SAP structural Profiles".
  5. Click the icon in front of the item name to enable category.
  6. Enter a name for the category in the column for the respective One Identity Manager login language.
  7. Save the changes.
Detailed information about this topic
  • One Identity Manager Administration Guide for Connecting to SAP R/3
  • One Identity Manager Target System Base Module Administration Guide
Related Topics

Mapping Personnel Planning Data

Mapping Personnel Planning Data

Personnel planning data and parts of the organization structure from the SAP HCM system can be mapped in the One Identity Manager. Set up a synchronization project to import personnel planing data. For more information, see Setting up a Synchronization Project for Synchronizing with an SAP HCM System. The data source import "One Identity Manager" is given (column ImportSource = "SAP R/3") for all objects imported into the SAP database in this way.

Use this synchronization project to import employee master data and departments into the One Identity Manager database. In addition, information about master identities, work hours, communication data and department managers are imported. This information can be evaluated during identity audit, by assigning employees to SAP user accounts.

Furthermore, you can configure synchronization for other personnel planning data. For more information, see Setting up a Synchronization Project for Synchronizing additional Personnel Planning Data.

Setting up a Synchronization Project for Synchronizing additional Personnel Planning Data

Setting up a Synchronization Project for Synchronizing additional Personnel Planning Data

You can import typically required personnel planning data into the One Identity Manager database using the initial synchronization project for personnel planning. This includes general employee master data, communications data, departments and their managers. For more information, see Project Templates for Synchronizing Personnel Planning Data.

The SAP HCM system has other personnel planning data available. To import these, create a new synchronization project and configure mapping for the additional data. You can use predefined schema types to do this.

Prerequisite
  • Synchronization for SAP R/3 base administration is set up.

To set up a synchronization project for additional personnel planning data

  1. Set up an initial synchronization project as described in the One Identity Manager Administration Guide for Connecting to SAP R/3. The following anomalies apply:
    1. On the page SAP HCM settings in the system connection wizard, state whether you want to configure any addition settings. Set the option Show expert settings to do this.
    2. If you have set the option Show expert settings, select the address type to import on the SAP HCM Settings page.

      If the option is not set, the page is not shown. The address type 1 (Permanent residence address) is imported by default.

    3. On the SAP connector schema page click Next.

      TIP: You can enter a file with additional schema types on this page. The connector schema is extended by these custom schema types. You can also enter this data after saving the synchronization project. For more detailed information, see the .One Identity Manager Administration Guide for Connecting to SAP R/3
    4. Select the project template "SAP HCM Employees and Departments" on the page Select project template in the project wizard.
    5. The page Restrict target system access is not shown. The target system is only loaded.
    6. Disabled the option Activate and save the new synchronization project automatically. on the last page of the project wizard.
    7. Click Finish to complete the project wizard.

      This creates and allocates a default schedule for regular synchronization. The synchronization project is created.

  2. Create mappings for the additional schema types in the Synchronization Editor.
    Table 6: Mapping Properties
    Property Meaning
    Mapping name Display name of the mapping.

    Mapping name is used as key. It cannot be changed after saving.

    Mapping direction Permitted direction of mapping for all property mapping rules. Select "in direction of One Identity Manager"
    Description Spare text box for additional explanation.
    Hierarchy synchronization

    Specifies whether the mapping part is mapping in the hierarchy. This option is important for optimizing synchronization.

    Only suitable for updates Set this option if schema class objects are never added during synchronization but only updated or deleted.
    Schema class in the One Identity Manager

    One Identity Manager schema class to which the mapping applies. Displays all schema classes with a configured mapping, in the menu.

    • Click to edit schema class properties.

    Create a new schema class to set up a mapping for another schema type.

    • Click to create a new schema class.
    Target system schema class Schema class to which the mapping applies. Displays all schema classes with a configured mapping, in the menu.

    Click and create a new schema class for a schema type.

    TIP: If you require a schema type, which cannot be selected here, add your own schema type.

    For more information about setting up mappings and schema classes, see the One Identity Manager Target System Synchronization Reference Guide.

  3. Edit the workflow "Inital synchronization" in the Synchronization Editor. Create additional synchronization steps for the new mappings.
    1. Select "One Identity Manager" from the Synchronization direction menu.

    For more detailed information about setting up synchronization steps, see the One Identity Manager Target System Synchronization Reference Guide.

  4. Save the synchronization project in the database.
  5. If you required schema types that cannot be selected when you add a mapping, add your own schema types. For more detailed information, see the .One Identity Manager Administration Guide for Connecting to SAP R/3
  6. Run a consistency check.

  7. Activate the synchronization project.

To synchronize on a regular basis

  1. Select the category Configuration | Start up configurations.
  2. Select a start up configuration in the document view and click Edit schedule....
  3. Edit the schedule properties.
  4. To enable the schedule, click Activate.
  5. Click OK.

To start initial synchronization manually

  1. Select the category Configuration | Start up configurations.
  2. Select a start up configuration in the document view and click Execute.
  3. Confirm the security prompt with Yes.
Detailed information about this topic
  • One Identity Manager Target System Synchronization Reference Guide
Related Topics

For more detailed information about setting up synchronization server, see the One Identity Manager Administration Guide for Connecting to SAP R/3.

Related Documents