SAP S/4 HANA Connector

The EmpowerID SAP S/4HANA connector lets you create, synchronize, and manage SAP S/4HANA user, role/profile and role/profile assignment information in EmpowerID. Imported user information can be managed and synchronized with data in any connected back-end user directories. When EmpowerID inventories SAP S/4HANA, it creates an account in the EmpowerID Identity Warehouse for each SAP S/4HANA user, a group for each SAP S/4HANA role or profile and assigns group membership to users based on their role or profile memberships in SAP S/4HANA.

Once connected, you can manage this data from EmpowerID in the following ways:

Account Management

• Inventory user accounts

• Create user accounts

• Update user accounts

• Enable and Disable user accounts

• Change user passwords

Role Management

• Inventory roles or profiles as groups

  • Inventory role or profile memberships as group accounts

  • Add and Remove members to and from roles or profiles

SAP TCODE Inventory

• Inventories all SAP modules from the TDEVC table and stores them in the ResourceSystemModule table in EmpowerID

• Inventories SAP transaction codes from the TSTC table and stores this information in the AzLocalRights table in EmpowerID along with the relation between the transaction codes and the SAP modules.

• Inventories the relationship between roles/profiles and TCODES and stores this information in the AzAssigneeLocalRightScope table in EmpowerID

SAP Authorization Object and FieldTypes Inventory

• Inventories SAP authorization objects from the TOBJ table and stores that information in the AzLocalRights table in EmpowerID with AzLocalRightTypeID of 7

• Inventories SAP FieldTypes from the AUTHX table and stores that information in the AzFieldType table of EmpowerID

• Inventories the relationship between authorization objects and fieldtypes and stores that information in the AzGlobalRightFieldType table of EmpowerID

• Inventories the relationship between SAP single role to authorization object from the AGR_1251 table in SAP and stores that information in the AzAssigneeLocalRightScope table in EmpowerID

• Inventories the relationship between SAP transaction codes and authorization objects from the USOBX_C table in SAP and stores that information in the AzGlobalRightRelatedRight table in EmpowerID

• Inventories the relationship between Role > AuthObject > FieldType > Low and High values from the AGR_1251 and AGR_1252 tables and stores that information in the AzAssigneeRightAzGlobalRightFieldType of EmpowerID. The multiple explicit values are stored in the AzAssigneeRightAzGlobalRightFieldTypeValue table of EmpowerID.
  
  

Account Attributes

Users in SAP are inventoried as accounts in EmpowerID. The following table shows the attribute mapping of SAP User attributes to EmpowerID Account attributes:

Role Attributes

Roles in SAP are inventoried as Groups in EmpowerID. The following table shows the attribute mapping of SAP Role attributes to EmpowerID Group attributes:

Profile Attributes

Profiles in SAP are inventoried as Groups in EmpowerID. The following table shows the attribute mapping of SAP Profile attributes to EmpowerID Group attributes:

Prerequisites

To connect EmpowerID to SAP, you need an SAP account, and you need to install SAP GUI Server on your EmpowerID Server.

You can connect EmpowerID to SAP R/3 system two ways:

1. Application Server

2. Message Server

Each has its own set of prerequisites. Expand the drop-down for that connection method to view.

Additionally, the following conditions must be met:

• Each EmpowerID server used to run workflows or perform inventory functions must have the librfc32.dll assembly copied into the C:\Windows\System32 folder. EmpowerID uses the assembly to perform various SAP processes (inventory, workflows, etc.). You can download the assembly from EmpowerID at the following link: https://dl1.empowerid.com/files/librfc32_64.zip

• For read-only connections, along with access to the below-mentioned tables, the service account needs access to the RFC_READ_TABLE BAPI

• All mandatory fields must not be empty (E.G., LastName, PersNumber)

• The standard tables should have the same structure across all the systems

• The systems should have unique records across all the standard tables. For example, the records should not have any leading or trailing spaces on the Primary Key columns

• The system should be free of any data issues. For example, there should not be any duplicate company codes pointing to the same address number.

• The following network configurations should be in place for connecting to the SAP system:

  • All necessary ports should be open on the server used to connect to the SAP system

  • The host name of the SAP system should be resolvable to an IP address

The SAP proxy account used for the S/4HANA connector needs to have access to the below tables as well as the ability to make the remote procedure calls listed:

Next Steps

Connect to SAP S/4 Hanna