Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Identity Manager 8.2 - Administration Guide for Connecting to SAP R/3

Table of Contents

Managing SAP R/3 environments

Architecture overview One Identity Manager users for managing SAP R/3

Setting up SAP R/3 synchronization

Users and authorizations for synchronizing with SAP R/3 Installing the One Identity Manager Business Application Programing Interface

Uninstalling BAPI transports

Setting up the synchronization server Creating a synchronization project for initial synchronization of an SAP client Special features of synchronizing with a CUA central system

Excluding a child system from synchronization

Displaying synchronization results Customizing the synchronization configuration

How to configure SAP R/3 synchronization Configuring synchronization of different clients Changing system connection settings of SAP clients

Editing connection parameters in the variable set Editing target system connection properties

Updating schemas Adding other schema types Creating a schema extension file

Defining tables Defining functions Defining schema types

Speeding up synchronization with revision filtering Restricting synchronization objects using user permissions Post-processing outstanding objects Configuring the provisioning of memberships Configuring single object synchronization Accelerating provisioning and single object synchronization Help for analyzing synchronization issues Disabling synchronization Synchronizing single objects Ignoring data error in synchronization

Basic data for managing an SAP R/3 environment

Setting up account definitions

Creating an account definition

Main data for an account definition

Creating manage levels

Main data for manage levels

Creating a formatting rule for IT operating data Collecting IT operating data Modify IT operating data Assigning account definitions to employees

Assigning account definitions to departments, cost centers, and locations Assigning account definitions to business roles Assigning account definitions to all employees Assigning account definitions directly to employees Assigning account definitions to system roles Adding account definitions to the IT Shop

Assigning account definitions to a target system Deleting an account definition

Editing a server

Main data for a Job server Specifying server functions

Target system managers

Basic data for user account administration

User account types External identifier types SAP parameters

Displaying main data of SAP parameters General main data of SAP parameters Assigning SAP parameters to departments, cost centers, and locations Assigning SAP parameters to business roles Editing parameter values for indirect SAP parameter assignment Inheritance of parameter values by SAP user accounts

Printers Cost centers Start menus Companies Login languages Security policies Communication types Licenses Special versions Password policies for SAP user accounts

Predefined password policies Using password policies Editing password policies

General main data of password policies Policy settings Character classes for passwords

Custom scripts for password requirements

Checking passwords with a script Generating passwords with a script

Password exclusion list Checking a password Testing password generation

Initial password for new SAP user accounts Email notifications about login data

SAP systems SAP clients

General main data of SAP clients Specifying categories for inheriting SAP groups, SAP roles, and SAP profiles Editing synchronization projects

SAP user accounts

Linking user accounts to employees Supported user account types Central user administration in One Identity Manager Entering main data of SAP user accounts

General main data of an SAP user account SAP user account login data Phone numbers Fax numbers Email addresses Fixed values for an SAP user account Measurement data SNC data for an SAP user account

Directly assigning SAP parameters Additional tasks for managing SAP user accounts

Overview of SAP user accounts Changing the manage level of SAP user accounts Assigning SAP groups and SAP profiles directly to an SAP user account Assigning SAP roles directly to an SAP user account Assigning structural profiles Granting access to clients of a central user administration Assigning SAP licenses Locking and unlocking SAP user accounts Assigning extended properties Renaming SAP user accounts

Assigning employees automatically to SAP user accounts

Editing search criteria for automatic employee assignment

Automatically creating departments based on SAP user account information Locking SAP user accounts Deleting and restoring SAP user accounts Entering external user identifiers for an SAP user account

SAP groups, SAP roles, and SAP profiles

Editing main data of SAP groups, SAP roles, and SAP profiles

General main data of SAP groups General main data of SAP roles General main data of SAP profiles

Assigning SAP groups, SAP roles, and SAP profiles to SAP user accounts

Assigning SAP groups, SAP roles, and SAP profiles to organizations Assigning SAP groups, SAP roles, and SAP profiles to business roles Assigning SAP user accounts directly to SAP groups and SAP profiles Assigning SAP user accounts directly to SAP roles Adding SAP groups, SAP roles, and SAP profiles to system roles Adding SAP groups, SAP roles, and SAP profiles to the IT Shop Assignment and inheritance of SAP profiles and SAP roles to SAP user accounts Configuring single role assignment Inheriting SAP profiles and SAP roles in a central user administration

Additional tasks for managing SAP groups, SAP roles, and SAP profiles

Overview of SAP groups, SAP roles, and SAP profiles Effectiveness of SAP groups, SAP roles, and SAP profiles SAP group, SAP role, and SAP profile inheritance based on categories Assigning extended properties to SAP groups, SAP roles, and SAP profiles Showing SAP authorizations

Validity period of role assignments

Assigning the validity period of direct role assignments Configuring the validity period of indirect role assignments Determining the validity period of indirect role assignments

General main data of SAP products Assigning SAP products to employees

Assigning SAP products to organizations Assigning SAP products to business roles Assigning SAP products directly to employees Adding SAP products to system roles Adding SAP products to the IT Shop

Additional tasks for managing SAP products

Overview of SAP products Assigning SAP groups, SAP roles, and SAP profiles to an SAP product Assigning account definitions to SAP products Assigning subscribable reports to SAP products Assigning extended properties to SAP products Editing conflicting system roles

Providing system measurement data

Mapping the measurement data Entering licenses for SAP user accounts Finding licenses using SAP roles and SAP profiles

Determining an SAP user account rating Transferring calculated licenses Disabling license calculation

Reports about SAP objects

Overview of all assignments

Removing a Central User Administration

Release child systems Converting the central system Checking for successful conversion

Configuration parameters for managing an SAP R/3 environment Default project templates for synchronizing an SAP R/3 environment

Project template for client without CUA Project template for the CUA central system Project template for CUA subsystems

Referenced SAP R/3 table and BAPI calls Example of a schema extension file

Referenced SAP R/3 table and BAPI calls

The following overview provides information about all the tables in an SAP R/3 system referenced during synchronization and the BAPI calls that are run.

Table 80: Referenced tables and BAPIs
Tables	BAPI Calls
ADR2 ADR3 ADR6 ADRP AGR_1016 AGR_AGRS AGR_DEFINE AGR_USERS ANLA ANLZ AUTHX CSKS CSKT DD02L DD03L DD03M DD04L DD04T DD07L HRP1000 HRP1001 PA0000 PA0001 PA0002 PA0007 PA0016 PA0034 PA0041 PA0105 PA0709 RSECUSERAUTH RSECTXT SEC_POLICY_CUST SEC_POLICY_RT T000 T001 T001P T002 T591S T500P T548T T77PR T77UA TACT TACTT TACTZ TMENU01 TMENU01T TMENU01R TOBJ TOBJT TOBCT TPARA TSAD3 TSAD3T TSAC TSACT TSP03 TSTC TSTCT TTREE TTREET TUPLT TUTYP TUTYPA TUTYPPL TUZUS USGRP_USER USGRPT USL04 USLA04 USOBHASH USOBT_C USOBX_C USR01 USR02 USR05 USR06 USR06SYS USR10 USR11 USR12 USR21 USREFUS USREXTID USRSTAMP USRSYSACTT USRSYSPRF USRSYSPRFT UST04 UST10C UST10S UST12 USVART USZBVLNDSC USZBVLNDRC USZBVSYS V_USCOMPA	BAPI_USER_CREATE1 BAPI_USER_GET_DETAIL BAPI_USER_CHANGE BAPI_USER_DELETE BAPI_USER_LOCK BAPI_USER_UNLOCK BAPI_USER_ACTGROUPS_ASSIGN BAPI_USER_ACTGROUPS_DELETE BAPI_USER_PROFILES_ASSIGN BAPI_USER_PROFILES_DELETE BAPI_USER_LOCACTGROUPS_READ BAPI_USER_LOCACTGROUPS_DELETE BAPI_USER_LOCPROFILES_READ BAPI_USER_LOCPROFILES_DELETE BAPI_USER_SYSTEM_ASSIGN SUSR_USER_CHANGE_PASSWORD_RFC BAPI_USER_LOCPROFILES_ASSIGN BAPI_USER_LOCACTGROUPS_ASSIGN RFC_READ_TABLE

Example of a schema extension file

<?xml version="1.0" encoding="utf-8" ?>

<SAP>

<Functions>

<Function Definition = "USER GET" FunctionName="BAPI_USER_GET_DETAIL" OutStructure = "" Key ="USERNAME" X500 ="CN">

<Mapping>

<Data ParameterName = "USERNAME" PropertyName = "BNAME" />

</Mapping>

</Function>

<Function Definition = "USER SET" FunctionName="BAPI_USER_CHANGE" OutStructure ="" Key ="USERNAME" X500 ="CN">

<Mapping>

<Data ParameterName = "USERNAME" PropertyName = "BNAME" />

</Mapping>

</Function>

<Function Definition = "USER DEL" FunctionName="BAPI_USER_DELETE" OutStructure ="" Key ="USERNAME" X500 ="CN" >

<Mapping>

<Data ParameterName = "USERNAME" PropertyName = "BNAME" />

</Mapping>

</Function>

<Function Definition = "USER PROFILE SET" FunctionName="BAPI_USER_PROFILES_ASSIGN" OutStructure ="" Key ="USERNAME" X500 ="CN">

<Mapping>

<Data ParameterName = "USERNAME" PropertyName = "BNAME" />

<Data ParameterName = "BAPIPROF~BAPIPROF" PropertyName = "$Value$" />

</Mapping>

</Function>

<Function Definition = "BWProfileAdd" FunctionName="/VIAENET/SAPHR_RSECUSERAUT_ADD" OutStructure ="" Key ="ZUSRNAME,ZHIER" X500 ="CN,OU">

<Mapping>

<Data ParameterName = "ZUSRNAME" PropertyName = "UNAME" />

<Data ParameterName = "ZHIER" PropertyName = "AUTH" />

</Mapping>

</Function>

<Function Definition = "BWProfileDel" FunctionName="/VIAENET/SAPHR_RSECUSERAUT_DEL" OutStructure ="" Key ="ZUSRNAME,ZHIER" X500 ="CN,OU">

<Mapping>

<Data ParameterName = "ZUSRNAME" PropertyName = "UNAME" />

<Data ParameterName = "ZHIER" PropertyName = "AUTH" />

</Mapping>

</Function>

<Function Definition = "BWProfileDelFkt" FunctionName="/VIAENET/SAPHR_RSECUSERAUT_DEL" OutStructure ="" Key ="ZUSRNAME,ZHIER" X500 ="CN,OU">

<Mapping>

<Data ParameterName = "ZUSRNAME" PropertyName = "BNAME" />

<Data ParameterName = "ZHIER" PropertyName = "$VALUE$" />

</Mapping>

</Function>

<Function Definition = "BWProfileAddFkt" FunctionName="/VIAENET/SAPHR_RSECUSERAUT_ADD" OutStructure ="" Key ="ZUSRNAME,ZHIER" X500 ="CN,OU">

<Mapping>

<Data ParameterName = "ZUSRNAME" PropertyName = "BNAME" />

<Data ParameterName = "ZHIER" PropertyName = "$VALUE$" />

</Mapping>

</Function>

</Functions>

<Tables>

<TABLE Definition = "TUZUS-Table" TableName="TUZUS" Key="SONDERVERS" X500="CN" SQL="LANGU = sy-langu" Load="SONDERVERS,TEXTSVERS" />

<TABLE Definition = "USR05-Table" TableName="USR05" Key="BNAME,PARID" X500="CN,OU" SQL="MANDT = '$MANDT$'" Load="BNAME,PARID,PARVA">

<Mapping>

<Data ParameterName = "$BNAME$" PropertyName = "BNAME" />

<Data ParameterName = "$PARID$" PropertyName = "PARID" />

</Mapping>

</TABLE>

<TABLE Definition = "USR04-Table" TableName="USR04" Key="BNAME,MANDT" X500="CN,OU" SQL="MANDT = sy-mandt" Load="" />

<TABLE Definition = "RSECUSERAUTH-Table" TableName="RSECUSERAUTH" Key="UNAME,AUTH" X500="CN,OU" SQL="" Load="" />

<TABLE Definition = "RSECUSERAUTH-SingleUser" TableName="RSECUSERAUTH" Key="AUTH" X500="CN" SQL="UNAME = '$BNAME$'" Load="" >

<Mapping>

<Data ParameterName = "$BNAME$" PropertyName = "BNAME" />

</Mapping>

</TABLE>

</Tables>

<SAPExtendedSchematypes>

<SAPExtendedSchematype Bem = "M:N, add/del - function" Name = "BWUserInBWP" DisplayPattern="%UNAME% - %AUTH%" ListObjectsDefinition = "RSECUSERAUTH-Table" ReadObjectDefinition = "RSECUSERAUTH-Table" InsertObjectDefinition = "BWProfileAdd" DeleteObjectDefinition = "BWProfileDel" />

<SAPExtendedSchematype Bem = "simple read-only table" Name = "LicenceExtension" DisplayPattern="%SONDERVERS%" ListObjectsDefinition = "TUZUS Table" ReadObjectDefinition ="TUZUS Table" InsertObjectDefinition = "" WriteObjectDefinition = "" DeleteObjectDefinition = "" ParentType = "SAPSYSTEM" />

<SAPExtendedSchematype Bem = "Test" Name = "USERFunctionTable" DisplayPattern="%BNAME% (%MANDT%)" ListObjectsDefinition = "USR05-Table" ReadObjectDefinition ="USER GET" WriteObjectDefinition = "USER SET" DeleteObjectDefinition = "USER DEL" >

<Properties>

<Property Name = "SAPBWP" Description="all the user's BW profiles" ListFunction="RSECUSERAUTH-SingleUser" AddFunction="BWProfileAddFkt" DelFunction="BWProfileDelFkt" ReplaceFunction="" IsMultivalued = "true" />

<Property Name = "USERPROFILE" Description="all the user's profiles" ListFunction="USR04-Table" AddFunction="" DelFunction="" ReplaceFunction="USER PROFILE SET" IsMultivalued = "true" />

</Properties>

</SAPExtendedSchematype>

</SAPExtendedSchematypes>

</SAP>

Detailed information about this topic

Creating a schema extension file

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© 2024 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy Cookie Preference Center