Assigning Function Definitions

Assigning Function Definitions

Use this task to specify the function definitions for which a mitigating control is valid. You can only assign function definitions that are enabled on the assignment form.

To assign SAP function definitions to mitigating controls

1. Select the category Risk index functions | Mitigating controls.
2. Select the mitigating control in the result list.
3. Select the task Assign function definitions.
4. Double-click on the function definitions you want to assign in Add Assignments

   - OR -

   Double-click on the function definitions you want to remove in Remove Assignment.

5. Save the changes.

Calculating Mitigation

Calculating Mitigation

The significance reduction of a mitigating control supplies the value by which to reduce an SAP function's risk index if the control is implemented. One Identity Manager calculates a reduced risk index based on the risk index and the significance reduction. One Identity Manager supplies default functions for calculating reduced risk indexes. These functions cannot be edited with One Identity Manager tools.

The reduced risk index is calculated from the SAP function and the significance reduced sum of all assigned mitigating controls.

Risk index (reduced) = Risk index - sum significance reductions

If the significance reduction sum is greater than the risk index, the reduced risk index is set to 0.

Appendix: Configuration Parameters for SAP Functions

Appendix: Configuration Parameters for SAP Functions

The following configuration parameters are additionally available in One Identity Manager after the module has been installed.

Appendix: Default Project Templates for the SAP R/3 Compliance Add-on Module

Appendix: Default Project Templates for the SAP R/3 Compliance Add-on Module

A default project template ensures that all required information is added in the One Identity Manager. This includes mappings, workflows and the synchronization base object. If you do not use a default project template you must declare the synchronization base object in One Identity Manager yourself.

Use a default project template for initially setting up the synchronization project. For custom implementations, you can extend the synchronization project with the .Synchronization EditorOne Identity Manager tool for configuring target system synchronization.

Use the project template "SAP® R/3® authorization objects" for synchronization of authorization packages and transactions. The template uses mappings for the following schema types.

Table 32: MappingList of object matching rules and property mapping rules which map the schema properties of two connected systems to one another. SAP R/3 schema types to tables in the One Identity Manager schema.

SchemaData model of a connected system. The schema describes all the master data from the connected system. see target system schema; see One Identity Manager schema; see connector schema; see extended schema Type in the Target SystemAn instance of a target system in which the employees managed by One Identity Manager have access to network resources. Example: An Active Directory domain X for target system type "Active Directory", a directory Y for target system type "LDAP", a client Z for target system type "SAP R/3".	Table in the One Identity Manager schema
TOBJ	SAPAuthObject
ObjectClass	SAPAuthObjectClass
AUTHX	SAPField
Transaction	SAPTransaction
TACT	SAPActivity
objectHasField	SAPAuthObjectHasField
ObjectHasActivity	SAPAuthObjectHasSapActivity
FieldHasRcTable	SAPFieldHasSAPRCTable
tMenu01	SAPMenu
menuHasTransaction	SAPMenuHasSAPTransaction
ProfileHasAuthObjectField	SAPProfileHasAuthObjectElem
RcTable	SAPRCTable
RcVariable	SAPRCVariable
TRANSACTIONHASTOBJ	SAPTransactionHasSAPAuthObject