Chat now with support
Chat with Support

Identity Manager 8.1.4 - Administration Guide for Connecting to SAP R/3

Managing SAP R/3 environments Setting up SAP R/3 synchronization Basic data for managing an SAP R/3 environment Basic data for user account administration SAP systems SAP clients SAP user accounts SAP groups, SAP roles, and SAP profiles SAP products Providing system measurement data Reports about SAP systems Configuration parameters for managing an SAP R/3 environment Default project templates for synchronizing an SAP R/3 environment Referenced SAP R/3 table and BAPI calls Example of a schema extension file

Supported user account types

Different types of user accounts, such as default user accounts, administrative user accounts, service accounts, or privileged user accounts, can be mapped in One Identity Manager.

The following properties are used for mapping different user account types.

  • Identity

    The Identity property (IdentityType column) is used to describe the type of user account.

    Table 43: Identities of user accounts
    Identity Description Value of the IdentityType column
    Primary identity Employee's default user account. Primary
    Organizational identity Secondary user account used for different roles in the organization, for example for subcontracts with other functional areas. Organizational
    Personalized admin identity User account with administrative permissions, used by one employee. Admin
    Sponsored identity User account that is used for a specific purpose, such as training. Sponsored
    Shared identity User account with administrative permissions, used by several employees. Shared
    Service identity Service account. Service

    NOTE: To enable working with identities for user accounts, the employees also need identities. You can only link user accounts to which an identity is assigned with employees who have this same identity.

    The primary identity, the organizational identity, and the personalized admin identity are used for different user accounts, which can be used by the same actual employee to perform their different tasks within the company.

    To provide user accounts with a personalized admin identity or an organizational identity for an employee, you create subidentities for the employee. These subidentities are then linked to user accounts, enabling you to assign the required permissions to the different user accounts.

    User accounts with a sponsored identity, group identity, or service identity are linked to dummy employees that do not refer to a real person. These dummy employees are needed so that permissions can be inherited by the user accounts. When evaluating reports, attestations, or compliance checks, check whether dummy employees need to be considered separately.

    For detailed information about mapping employee identities, see the One Identity Manager Identity Management Base Module Administration Guide.

  • Privileged user account

    Privileged user accounts are used to provide employees with additional privileges. This includes administrative user accounts or service accounts, for example. The user accounts are labeled with the Privileged user account property (IsPrivilegedAccount column).

Default user accounts

Normally, each employee obtains a default user account, which has the permissions they require for their regular work. The user accounts are linked to the employee. The effect of the link and the scope of the employee’s inherited properties on the user accounts can be configured through an account definition and its manage levels.

To create default user accounts through account definitions

  1. Create an account definition and assign the Unmanaged and Full managed manage levels.
  2. Specify the effect of temporarily or permanently disabling, deleting, or the security risk of an employee on its user accounts and group memberships for each manage level.
  3. Create a formatting rule for IT operating data.

    You use the mapping rule to define which rules are used to map the IT operating data for the user accounts, and which default values are used if no IT operating data can be determined through a person's primary roles.

    Which IT operating data is required depends on the target system. The following setting are recommended for default user accounts:

    • In the mapping rule for the IsGroupAccount column, use the default value 1 and enable the Always use default value option.
    • In the mapping rule for the IdentityType column, use the default value Primary and enable Always use default value.
  4. Enter the effective IT operating data for the target system. Select the concrete target system under Effects on.

    Specify in the departments, cost centers, locations, or business roles that IT operating data should apply when you set up a user account.

  5. Assign the account definition to employees.

    When the account definition is assigned to an employee, a new user account is created through the inheritance mechanism and subsequent processing.

Administrative user accounts

An administrative user account must be used for certain administrative tasks. Administrative user accounts are usually predefined by the target system and have fixed names and login names, such as Administrator.

Administrative user accounts are imported into One Identity Manager during synchronization.

NOTE: Some administrative user accounts can be automatically identified as privileged user accounts. To do this, in the Designer, enable the Mark selected user accounts as privileged schedule.

You can label administrative user accounts as a Personalized administrator identity or as a Shared identity. Proceed as follows to provide the employees who use this user account with the required permissions.

  • Personalized admin identity

    1. Use the UID_Person column to link the user account with an employee.

      Use an employee with the same identity or create a new employee.

    2. Assign this employee to hierarchical roles.

  • Shared identity

    1. Assign all employees with usage authorization to the user account.

    2. Link the user account to a dummy employee using the UID_Person column.

      Use an employee with the same identity or create a new employee.

    3. Assign this dummy employee to hierarchical roles.

    The dummy employee provides the user account with its permissions.

Privileged user accounts

Privileged user accounts are used to provide employees with additional privileges. This includes administrative user accounts or service accounts, for example. The user accounts are labeled with the Privileged user account property (IsPrivilegedAccount column).

NOTE: The criteria according to which user accounts are automatically identified as privileged are defined as extensions to the view definition (ViewAddOn) in the TSBVAccountIsPrivDetectRule table (which is a table of the Union type). The evaluation is done in the TSB_SetIsPrivilegedAccount script.

To create privileged users through account definitions

  1. Create an account definition. Create a new manage level for privileged user accounts and assign this manage level to the account definition.
  2. If you want to prevent the properties for privileged user accounts from being overwritten, set the IT operating data overwrites property for the manage level to Only initially. In this case, the properties are populated just once when the user accounts are created.
  3. Specify the effect of temporarily or permanently disabling or deleting, or the security risk of an employee on its user accounts and group memberships for each manage level.
  4. Create a formatting rule for the IT operating data.

    You use the mapping rule to define which rules are used to map the IT operating data for the user accounts, and which default values are used if no IT operating data can be determined through a person's primary roles.

    Which IT operating data is required depends on the target system. The following settings are recommended for privileged user accounts:

    • In the mapping rule for the IsPrivilegedAccount column, use the default value 1 and set the Always use default value option.
    • You can also specify a mapping rule for the IdentityType column. The column owns different permitted values that represent user accounts.
    • To prevent privileged user accounts from inheriting the entitlements of the default user, define a mapping rule for the IsGroupAccount column with a default value of 0 and set the Always use default value option.
  5. Enter the effective IT operating data for the target system.

    Specify in the departments, cost centers, locations, or business roles which IT operating data should apply when you set up a user account.

  6. Assign the account definition directly to employees who work with privileged user accounts.

    When the account definition is assigned to an employee, a new user account is created through the inheritance mechanism and subsequent processing.

TIP: If customization requires that the login names of privileged user accounts follow a defined naming convention, create the template according to which the login names are formed.

Central user administration in One Identity Manager

If user accounts are managed through the central user administration (CUAClosed) in SAP R/3, access to the child client can be guaranteed for or withdrawn from user accounts in One Identity Manager. To do this, clients are marked as central system or child system in One Identity Manager. User accounts are managed in the central system. You specify the client in which each user account obtains its access permissions. (SAPUserMandant table). Only SAP groups, role, or profiles from these clients can be assigned to a user account. A user account only has access authorizations in the central system if the central system is also explicitly assigned in the SAPUserMandant table.

To use automatic employee assignment for central user administration (CUA) user accounts, assign an account definition to the CUA central system using the SAPUser user table.

The access authorizations for central and child systems are read into theOne Identity Manager database through synchronization. In One Identity Manager, access authorization can be granted by IT Shop requests and indirect assignment, as well as by indirect assignment.

To grant a person access to a client by indirect assignment or request

  1. Create an account definition to generate user accounts in the central system.

    In the User account table field, select the SAPUser table. For more information, see Master data for an account definition.

    This account definition is required to generate a user account in the central system if the employee does not yet have a user account.

  2. Create an account definition for the client for which you want to grant access. The following special features apply:

    Table 44: Master data of an account definition for accessing clients
    Property Description
    User account table Select SAPUserMandant from the menu.

    Target system

    Client for which you want to grant access.

    Required account definition

    From the menu, select the account definition to generate user accounts in the central system. A user account is then created in the central system if the employee does not yet have a user account.

    Manage level (initial)

    Select Unmanaged from the menu.

    Service item

    Service item through which you can request the account definition in the IT Shop. Assign an existing service item or add a new one.

    IT Shop

    Enable the option if access to the child system can be requested in the Web Portal.

    Only for use in IT Shop

    Enable the option if access to the child system can only be requested in the Web Portal. Indirect assignment by business roles or organizations is not possible. However, access by a user account to the child system can still be granted directly.

    An account definition is required for each child system and for the central system in which you want to grant access.

  3. Assign the account definition for the client to a hierarchical role or IT Shop shelf.

  4. Add the person as a member to the hierarchical role or as a customer to the IT Shop.

To grant a user account direct access to a client

You can now assign the SAP groups, roles, and profiles from this client to the user account.

Detailed information about this topic
Related topics

Entering master data for SAP user accounts

A user account can be linked to an employee in One Identity Manager. You can also manage user accounts separately from employees.

NOTE: It is recommended to use account definitions to set up user accounts for company employees. In this case, some of the master data described in the following is mapped through templates from employee master data.

NOTE: If employees are to obtain their user accounts through account definitions, the employees must own a central user account and obtain their IT operating data through assignment to a primary department, a primary location, or a primary cost center. If employees are to obtain their user accounts through account definitions, the employees must own a central SAP user account and obtain their IT operating data through assignment to a primary department, a primary location, or a primary cost center.

To create a user account

  1. In the Manager, select the SAP R/3 | User accounts category.

  2. Click in the result list.

  3. On the master data form, edit the master data for the user account.

  4. Save the changes.

To edit master data for a user account

  1. In the Manager, select the SAP R/3 | User accounts category.

  2. Select the user account in the result list and run the Change master data task.

  3. Edit the user account's resource data.

  4. Save the changes.

To manually assign or create a user account for an employee

  1. In the Manager, select the Employees | Employees category.

  2. Select the employee in the result list and run the Assign SAP user accounts task.

  3. Assign a user account.

  4. Save the changes.
Detailed information about this topic

General master data of an SAP user account

Table 45: Configuration parameters for risk assessment of SAP user accounts
Configuration parameter Effect when set

QER | CalculateRiskIndex

Preprocessor relevant configuration parameter controlling system components for calculating an employee's risk index. Changes to the parameter require recompiling the database.

If the parameter is enabled, values for the risk index can be entered and calculated.

NOTE: You can only add user account to client which are marked as central system if user accounts in the SAP system manged with central user administration.

Enter general data for a user account on the Address tab.

Table 46: SAP user account address data
Property Description
Employee Employee that uses this user account. An employee is already entered if the user account was generated by an account definition. If you create the user account manually, you can select an employee in the menu. If you are using automatic employee assignment, an associated employee is found and added to the user account when you save the user account.

You can create a new employee for a user account with an identity of type Organizational identity, Personalized administrator identity, Sponsored identity, Shared identity, or Service identity. To do this, click next to the input field and enter the required employee master data. Which login data is required depends on the selected identity type.

Account definition

Account definition through which the user account was created.

Use the account definition to automatically fill user account master data and to specify a manage level for the user account. One Identity Manager finds the IT operating data of the assigned employee and enters it in the corresponding fields in the user account.

NOTE: The account definition cannot be changed once the user account has been saved.
Manage level Manage level of the user account. Select a manage level from the menu. You can only specify the manage level can if you have also entered an account definition. All manage levels of the selected account definition are available in the menu.
Client

The client to be added in the user account. Central system, if user accounts are manged with CUAClosed. You can only edit the client when the user account is added.

User account

User account identifier. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.

NOTE: Existing user accounts cannot be renamed.
First name The user’s first name. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.
Last name The user’s last name. If you have assigned an account definition, the input field is automatically filled out with respect to the manage level.
Form of address Form of address in the associated client's language. If you have assigned an account definition, the form of address is found by template rule depending on the mange level. The form of address depends on the gender of the assigned employee.
Academic title Additional information about the user account.
Alias Alternative ID for the user account that is used as log in for certain internet transactions.
Nickname Additional information about the user account.
Name formatting Name format and country for name formatting. Name and country formats determine the formatting rules for composing a full name of an employee in SAP R/3. Name formatting specifies the order in which parts of names are put together so that an employee‘s name is represented in an extensively long form. The country serves to uniquely identify the formatting rule.
Country for name formatting
ISO 639 - language Default language for the user account according to ISO 639
Function Additional information about the user account. Used when addresses are printed.
Employee number SAP internal key for identifying an employee.
Department Additional information about the user account. Used when addresses are printed.
Room in building Additional information about the user account.
Floor Additional information about the user account.
Building (number or token) Additional information about the user account.
communications type Unique identifier for the communications type
Company The company to which the user account is assigned.

When a user account is added, the company of the assigned client is used. If the client is not assigned to a company, the company with the smallest address number is found and assigned to the user account.

NOTE: Company is a required field. Changes to user accounts cannot be saved in SAP R/3 on synchronization if a company is not assigned to them in One Identity Manager.

Assign a default company to these user accounts in the SAP R/3 system where possible.

Risk index (calculated)

Maximum risk index value of all assigned groups, roles, and profiles. The property is only visible if the QER | CalculateRiskIndex configuration parameter is set. For detailed information, see the One Identity Manager Risk Assessment Administration Guide.

Category Categories for the inheritance of groups, roles, and profiles by the user account. Groups, roles, and profiles can be selectively inherited by user accounts. To do this, groups, roles, and profiles and user accounts or contacts are divided into categories. Select one or more categories from the menu.

Identity

User account's identity type Permitted values are:

  • Primary identity: Employee's default user account.

  • Organizational identity: Secondary user account used for different roles in the organization, for example for subcontracts with other functional areas.

  • Personalized administrator identity: User account with administrative permissions, used by one employee.

  • Sponsored identity: User account that is used for a specific purpose, such as training.

  • Shared identity: User account with administrative permissions, used by several employees. Assign all employees that use this user account.

  • Service identity: Service account.

Privileged user account Specifies whether this is a privileged user account.

Groups can be inherited

Specifies whether the user account can inherit groups, roles, and profiles through the employee. If this option is set, the user account inherits groups, roles, and profiles through hierarchical roles or IT Shop requests.

  • If you add an employee with a user account to a department, for example, and you have assigned groups to this department, the user account inherits these groups.
  • If an employee has requested group membership in the IT Shop and the request is granted approval, the employee's user account only inherits the group if the option is set.
Related topics
Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating