The EmpowerID SAP S/4HANA connector lets you create, synchronize, and manage SAP S/4HANA user, role/profile and role/profile assignment information in EmpowerID. Imported user information can be managed and synchronized with data in any connected back-end user directories. When EmpowerID inventories SAP S/4HANA, it creates an account in the EmpowerID Identity Warehouse for each SAP S/4HANA user, a group for each SAP S/4HANA role or profile, and assigns group membership to users based on their role or profile memberships in SAP S/4HANA.
Additionally, the connector supports the inventory of SAP TCODEs, SAP Authorization Objects and its field type values as rights in EmpowerID. Successfully inventorying these objects requires additional configuration in EmpowerID. This is demonstrated in the Connect to SAP S/4 HANA article.
Once connected, you can manage this data from EmpowerID in the following ways:
Account Management
Inventory user accounts
Create user accounts
Update user accounts
Enable and Disable user accounts
Change user passwords
Role Management
Inventory roles or profiles as groups
Inventory role or profile memberships as group accounts
Add and Remove members to and from roles or profiles
Attribute Flow
Users in SAP S/4HANA are inventoried as accounts in EmpowerID. The below table shows the attribute mappings of SAP S/4HANA user attributes to EmpowerID account attributes.
SAP User Attribute | EmpowerID Attribute | Description |
|---|---|---|
NAME_FIRST | FirstName | First name of the user |
NAME_LAST | LastName | Last name of the user |
NAMEMIDDLE | MiddleName | Middle name of the user |
BNAME | LogonName | User name of the user |
TEL_NUMBER_MOBILE | MobileNumber | Mobile number of the user |
TEL_NUMBER | Telephone | Home phone number of the user |
SMTP_ADDR | Email ID of the user | |
LANGU | PreferredLanguage | Language of the user |
UFLAG | Disabled | Determines whether user is active |
TITLE | PersonalTitle | Personal Title of the user |
TITLE_ACA1 | AcademicTitle | Academic Title of the user |
FUNCTION | BusinessFunction | Business Function of the user |
ROOMNUMBER | RoomNumber | Room Number of the user |
FLOOR | Floor | Floor of the user |
BUILDING | BuildingCode | Building Code of the user. |
FAX_NUMBER | Fax | Fax of the user |
USERALIAS | Alias | Alias of the user |
USTYP | UserType | User Type of the user |
SECURITY_POLICY | SecurityPolicy | Security Policy of the user |
DEPARTMENT | Department | Department name of the user |
CLASS | UserGroup | User Group of the user |
GLTGV | ValidFrom | Valid From date set for the user |
GLTGB | ValidUntil | Valid Until date set for the user |
ACCNT | AccountNo | Account Number of the user |
KOSTL | CostCenter | Cost Center of the user |
TZONE | TimeZone | Time Zone of the user |
PWDCHGDATE | PasswordLastChanged | Date the user’s password was last changed |
TRDAT+LTIME | LastLogonTime | Date and time the user last logged on |
company | Company | Company name of the user |
PNAME | UserPrincipalName | SNC Name of the user |
Prerequisites
To connect EmpowerID to SAP, you need an SAP account, and you need to install SAP GUI Server on your EmpowerID Server.
You also need the following from SAP to create your Account Store.
Host Name of the BAPI endpoint
Username that is authorized to read from and write to the BAPI
Password
App server FQDN
Instance number
System ID
Additionally the following conditions must be met:
Each EmpowerID server used to run workflows or perform inventory functions must have the
librfc32.dllassembly copied into theC:\Windows\System32folder. EmpowerID uses the assembly to perform various SAP processes (inventory, workflows, etc.). You can download the assembly from EmpowerID at the following link: https://dl1.empowerid.com/files/librfc32_64.zipFor read-only connections, along with access to the below-mentioned tables, the service account needs access to the RFC_READ_TABLE BAPI
All mandatory fields must not be empty (E.G., LastName, PersNumber)
The standard tables should have the same structure across all the systems
The systems should have unique records across all the standard tables. For example, the records should not have any leading or trailing spaces on the Primary Key columns
The system should be free of any data issues. For example, there should not be any duplicate company codes pointing to the same address number.
The following network configurations should be in place for connecting to the SAP system:
All necessary ports should be open on the server used to connect to the SAP system
The host name of the SAP system should be resolvable to an IP address
The SAP proxy account used for the S/4HANA connector needs to have access to the below tables as well as the ability to make the remote procedure calls listed:
REQUIRED TABLE ACCESS | REQUIRED REMOTE PROCEDURE CALLS |
|---|---|
AGR_DEFINE | BAPI_USER_ACTGROUPS_ASSIGN |
AGR_TEXTS | BAPI_USER_CHANGE |
AGR_AGRS | BAPI_USER_CREATE1 |
AGR_1016 | BAPI_USER_EXISTENCE_CHECK |
AGR_1251 | BAPI_USER_GETLIST |
USR10 | BAPI_USER_GET_DETAIL |
USR11 | BAPI_USER_LOCK |
UST10C | BAPI_USER_UNLOCK |
UST10S | PING |
UST12 | RFCPING |
TSTC | RFC_GET_FUNCTION_INTERFACE |
TSTCT | RFC_GET_NAMETAB |
ADR6 | RFC_PING |
ADRP | RFC_READ_TABLE |
USR02 | REQUIRED ACTIVITY |
USR21 | Execute |
ADR2 | |
ADR3 | |
ADCP | |
USREFUS | |
UST04 | |
AGR_USERS | |
USRACL | |
USCOMPANY | |
USR01 | |
USR06 | |
AUTHX | |
DD04T | |
TADIR | |
TDEVC | |
TOBJ | |
USOBT | |
USOBT_C | |
USOBX | |
USOBX_C | |
AGR_1252 |
As each organization's implementation, practices, and procedures with SAP differs, EmpowerID uses an SAP Data Analysis Utility to ensure the necessary tables can be read and the necessary BAPI's can be invoked. The utility reads from all the same tables as the connector and copies data from those tables into the EmpowerID Identity Warehouse. This provides EmpowerID with the opportunity to review and analyze data in order to modify connector logic before setting up the connection.