Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

The EmpowerID SAP S/4HANA connector lets you create, synchronize, and manage SAP S/4HANA user, role/profile and role/profile assignment information in EmpowerID. Imported user information can be managed and synchronized with data in any connected back-end user directories. When EmpowerID inventories SAP S/4HANA, it creates an account in the EmpowerID Identity Warehouse for each SAP S/4HANA user, a group for each SAP S/4HANA role or profile, and assigns group membership to users based on their role or profile memberships in SAP S/4HANA.

Info

Additionally, the connector supports the inventory of SAP TCODEs, SAP Authorization Objects and its field type values as rights in EmpowerID. Successfully inventorying these objects requires additional configuration in EmpowerID. This is demonstrated in the Connect to SAP S/4 HANA article.

Once connected, you can manage this data from EmpowerID in the following ways:

...

  • Each EmpowerID server used to run workflows or perform inventory functions must have the librfc32.dll assembly copied into the C:\Windows\System32 folder. EmpowerID uses the assembly to perform various SAP processes (inventory, workflows, etc.). You can download the assembly from EmpowerID at the following link: https://dl1.empowerid.com/files/librfc32_64.zip

  • For read-only connections, along with access to the below-mentioned tables, the service account needs access to the RFC_READ_TABLE BAPI

  • All mandatory fields must not be empyt empty (E.G., LastName, PersNumber)

  • The standard tables should have the same structure across all the systems

  • The systems should have unique records across all the standard tables. For example, the records should not have any leading or trailing spaces on the Primary Key columns

  • The system should be free of any data issues. For example, there should not be any duplicate company codes pointing to the same address number.

  • The following network configurations should be in place for connecting to the SAP system:

    • All necessary ports should be open on the server used to connect to the SAP system

    • The host name of the SAP system should be resolvable to an IP address

...

REQUIRED TABLE ACCESS

REQUIRED REMOTE PROCEDURE CALLS

ADCPAGR_DEFINE

BAPI_USER_ACTGROUPS_ASSIGN

ADR3AGR_TEXTS

BAPI_USER_CHANGE

ADRPAGR_AGRS

BAPI_USER_CREATE1

AGR_12511016

BAPI_USER_EXISTENCE_CHECK

AGR_DEFINE1251

BAPI_USER_GETLISTAGR_

USERSUSR10

BAPI_USER_GET_DETAIL

TSTCTUSR11

BAPI_USER_LOCK

USR02UST10C

BAPI_USER_UNLOCK

USR11UST10S

PING

USRACLUST12

RFCPING

UST04TSTC

RFC_GET_FUNCTION_INTERFACE

UST10STSTCT

RFC_GET_NAMETAB

ADR2ADR6

RFC_PING

ADR6ADRP

RFC_READ_TABLEAGR_

1016USR02

REQUIRED ACTIVITY

AGR_AGRSUSR21

Execute

ADR2

ADR3

ADCP

USREFUS

UST04

AGR_TEXTSUSERS

TSTCUSRACL

USCOMPANY

USR10

USR21

USREFUS

UST10C

UST12

USR01

USR06

AUTHX

DD04T

TADIR

TDEVC

TOBJ

USOBT

USOBT_C

USOBX

USOBX_C

AGR_1252

Tip

As each organization's implementation, practices, and procedures with SAP differs, EmpowerID uses an SAP Data Analysis Utility to ensure the necessary tables can be read and the necessary BAPI's can be invoked. The utility reads from all the same tables as the connector and copies data from those tables into the EmpowerID Identity Warehouse. This provides EmpowerID with the opportunity to review and analyze data in order to modify connector logic before setting up the connection.

...