SAP S/4 HANA Connector

The EmpowerID SAP S/4HANA Connector enables seamless integration between EmpowerID and SAP S/4HANA systems. It allows you to create, synchronize, and manage user accounts, roles, profiles, and their assignments. Additionally, the connector supports the inventory of SAP Transaction Codes (TCodes), Authorization Objects, and their field type values as rights within EmpowerID. This comprehensive solution streamlines the management of SAP identities and access rights.

Key Features

Account Management

• Inventory User Accounts: Automatically import SAP S/4HANA user accounts into EmpowerID.

• Create User Accounts: Provision new SAP S/4HANA user accounts directly from EmpowerID.

• Update User Accounts: Modify existing user account information.

• Enable and Disable User Accounts: Control the activation status of user accounts.

• Change User Passwords: Reset or update user passwords securely.

Role and Profile Management

• Inventory Roles and Profiles: Import SAP roles and profiles as groups in EmpowerID.

• Manage Memberships: Add or remove users from roles or profiles.

• Synchronize Assignments: Keep role and profile assignments up-to-date across systems.

SAP TCode Inventory

• Inventory SAP Modules: Retrieve all SAP modules from the TDEVC table and store them in the ResourceSystemModule table in EmpowerID.

• Inventory Transaction Codes: Import SAP transaction codes from the TSTC table, storing relationships between TCodes and SAP modules.

• Assign Rights: Map transaction codes to local rights within EmpowerID for access control.

SAP Authorization Objects and Field Types Inventory

• Inventory Authorization Objects: Import from the TOBJ table into the AzLocalRights table with AzLocalRightTypeID of 7.

• Inventory Field Types: Import field types from the AUTHX table into the AzFieldType table.

• Map Relationships: Establish relationships between authorization objects, field types, roles, and transaction codes for comprehensive rights management.

Prerequisites

General Requirements

• SAP Account: A user account in SAP with the necessary permissions.

• SAP GUI Server Installation: Install SAP GUI Server on your EmpowerID server.

• librfc32.dll Assembly: Each EmpowerID server used to run workflows or perform inventory functions must have the librfc32.dll assembly copied into the C:\Windows\System32 folder. EmpowerID uses this assembly to perform various SAP processes (inventory, workflows, etc.). You can download the assembly from EmpowerID at the following link: https://dl1.empowerid.com/files/librfc32_64.zip

Connection Methods

EmpowerID can connect to SAP S/4HANA via two methods:

1. Application Server

   • Required Information:

     • Hostname of the application server

     • Client ID

     • Instance number

     • Network port (default is 33 + instance number)

     • Service account username and password

2. Message Server

   • Required Information:

     • Hostname of the message server

     • Logon group name

     • System ID

     • Service account username and password

Note: Ensure the appropriate ports are open and the hostnames are resolvable.

SAP Account Permissions

• Access to Necessary Tables: The SAP proxy account used for the S/4HANA connector needs read access to specific SAP tables (listed in the Required SAP Tables and Columns section below).

• Remote Procedure Calls (BAPIs and RFCs): The service account must be able to execute required BAPIs and RFCs (listed in the Required Remote Procedure Calls section below).

• Read-Only Connections: For read-only connections, the service account needs access to the RFC_READ_TABLE BAPI.

• Mandatory Fields: Ensure all mandatory fields (e.g., LastName, PersNumber) are populated.

• Standard Table Structure: Standard tables should have consistent structures across all systems.

• Unique Records: Records should not have leading or trailing spaces on primary key columns.

• Data Quality: The system should be free of data issues, such as duplicate company codes pointing to the same address number.

Network Configurations

• Port Accessibility: The EmpowerID server used to connect to the SAP system should have all necessary ports open.

• Hostname Resolution: Ensure the SAP system's hostname is resolvable to an IP address.

• SAP GUI Installation: Install the SAP GUI Server on your EmpowerID server if not already installed.

Data Integrity Requirements

• Consistent Data: Ensure data across SAP systems is consistent and free from anomalies.

• Unique Identifiers: Systems should have unique records, especially on primary key columns.

• No Data Issues: Resolve any data issues before integration, such as duplicates or invalid references.

Required SAP Tables and Columns

The service account must have access to the following SAP tables and their specified columns:

Required Remote Procedure Calls (BAPIs and RFCs)

The service account must be able to execute the following remote procedure calls:

Attribute Mapping

User Attributes

SAP users are imported into EmpowerID accounts with the following attribute mappings: