SAP ECC 6.0 and LDAP Authorization management

[former_member608032]

Hi Their,

I am trying to find out an information about SAP ECC 6.0 EHP7 and LDAP authorization management. So far I understand SAP-LDAP configuration allow central user administration and it will allow accessing the SAP systems but what is not clear to me is

1.Does User has to be created in SAP or only Windows user id (LDAP) user should be sufficient to access SAP

2.If user creation is not required, would it be possible to manage authorizations in LDAP level. I mean direct assignment LDAP group - SAP Role. In this way user can access SAP with his required authorisations

3.If second step is possible, would it be possible with PD Org method or direct role assignment.

It would really appreciate if anyone answer my questions. Thank you

Pavan

[former_member608032]

Any update from any one

[former_member608032]

Hi Colleen,

We are trying to automate the User id creation and role assignment using LDAP configuration. I mean if a new user created in AD level with groups ( example AD_SAP_READ only). Then an user has to be created automatically in SAP ECC system and assign equivalent roles accordingly to AD group in roles tab in SAP Screen.

However, I understand we have to perform a role - group mapping in SAP system with LDAPMAP.

My question is this setup is possible in SAP ECC 6.0 as I understand this is possible in SAP HANA

[Allan1]

Did you find a solution?

Regards

[Colleen]

Hi Pavan

For question 1 - you must have a SAP SU01 account to access the ABAP stack and then have SAP security roles assigned that provide your authorisations

You can look at LDAP transactions to automate some account creation or updates.

What are you trying to design/achieve here?... might help to get some recommendations or guidance if possible.

Regards

Colleen