Assigning ECC Backend roles to Portal Directly

[Former Member]

Hi Experts,

How can I assign roles to a portal user from backend ECC system directly. The requirement is the roles should not be assigned in User administration in Portal. Please suggest on the steps to achieve the same.

[ChrisSolomon]

Just to be clear...you do know that portal "roles" have nothing to do with backend/"ECC" roles (you "can" use them but not typical).

In most cases, you will use whatever is you user store for your portal....for example, Active Directory.....you will "group" users in Active Directory.....for example "US employees" group.....then in the portal, you assign portal roles to your AD group(s) (*not directly to users as this becomes a user management nightmare!).

Now, your portal role simply dictates WHAT groups of iViews, pages, etc the user has access to within the portal. Think of it as simply exposing content....it shows the users all the possible "doors" to the ECC/backend that they "might" access.....but allowing them to be able to then open/enter those doors is where the ECC security roles will pick it up from there. Once the user has the "door" exposed to them from their portal role for their group(s), then the actual user will be passed through (the iView) to the actual backend/ECC application...which is where the backend user's role is then used. Because you set up "trust" between the portal and the backend, it doesn't display a login page but instead simply passes in the user's credentials (user/pass tokenized/cert)...this is how the backend "knows" who the user is in it's own user store (not AD).

Make sense?

[Former Member]

Thanks for the reply Christopher. Actually let me put it this way. There is a HR Administrator role in backend. I want the required roles pertaining to HR Administrator in Portal to be automatically assigned if I assign any user to HR administrator in SU01 in the backend. Is it possible?

[ChrisSolomon]

Nothing automated. The problem is, your backend does not know "hey, I gave them this backend role(s) and this maps over to the following AD group(s), so let's automatically assign this user that AD group(s) now.". I have seen nothing "standard" to do this but have seen folks automate it themselves in some cases (requires custom coding....especially if needing to assign to multiple groups with your own group names and such).

And remember, the portal really does not do a whole lot itself....it is more of a centralized "window" to expose content on all the other systems connected to it. In that sense, it is pretty "dumb" to the inner workings of any other system it acts as the gate keeper too.

[Former Member]

Hi Christopher,

Thanks. This is exactly what I was looking for. Was really helpful to understand that there is no standard functionality to achieve this. I would go ahead and deep dive on the custom options to achieve this and proceed further. Appreciate your support and detailing to make me understand the concepts. Kudos.

[Former Member]

Dear Felix,

i understand you want to automate portal assignment of roles, when a role is assigned to a user in ECC backend.

This is only possible in one scenerio:

Portal datasource is SAP ECC system. in this case, users login to portal using their ECC userids.

Under such circumstances, ECC roles are visible in Portal content administrator as Backend Groups.

So lets say backend role A is shown as  Group A in Portal.

You create a new Portal Group in Portal UME, lets say  Group B.

Assign Portal Role C to Portal Group B.

Assign Backend Group A to Portal Group B as child Group.

And you are done.

Assing user Z to backend role A in ECC. when this user logs in to portal, Portal Group B and portal Role C are atutomatically loaded based on design time configurations.

Hope you are looking for this.

If your Datasource is not ECC, this will not work until you have some eloborate systems like SAP IDM in place.

regards,

Ankur