Auto Script which creates SAP Account when AD gets created.

[Former Member]

Hello Experts - Requirement is "Create SAP User account automatically when AD account gets created", can I acheive this through ECATT scripts?

If this is possible, idea is to create an ECATT script and schedule it to run every night to find all new users on AD and create their account on SAP and lock their accounts.

Do you think this can be acheived thru ECATT's?

If not ECATT, is there any way out to acheive my objective. We are planning to reduce overhead for SAP User admins, I was thinking on following steps:

1) New User request for AD

2) After approval create AD account

3) Design a scrip, which will look for all new users on AD and will create & lock them on SAP (Nightly Job or something)

Your thoughts?

Your suggestions are much appreciated.

Thanks.

[Former Member]

Aj,

Requirement is "Create SAP User account automatically when AD account gets created", can I acheive this through ECATT scripts?

Talk with your devleoper,_will they be able to create a program_, which looks for users created in AD and automatically (pulls the script from the program & creates users in SAP. not an easy task. Best idea is to create manually / ECATT ,when there is no other workaround. (if you go for third party tools,funding will be an issue)

Thanks,

Sri.

[Former Member]

There is standard functionality for this in transactions LDAP* or even via more sophisticated provisioning tools such as SAP IdM...

No need to code it on your own...

Cheers,

Julius

[Former Member]

Hi ,

I would totally agree with Julius , most of the companies have started implementing SAP IDM,

if you have GRC 5.3 ( CUP ) you can do it using the compliant user provisioning tool

you will need JCO connectors to all the systems including active directory to have the users created all at the same time.

[Former Member]

In this case it can be done simply with an LDAP sync, but if you want to provision users with roles through to the backend systems because your authentication methods support it then IdM is the way to go.

SAP IdM also supports SAML 2.0 as a provider.

This is not a small project but is the correct approach to stagger implementations with a view to the future.

SAPgui scripting is at the other end of the spectrum of investment and realizable security......

Cheers,

Julius

[martin_voros]

Hi,

 I would  totally agree with Julius , most of the companies have started implementing SAP IDM,

do you have any numbers for this? For small landscape you can be fine (I understand that iDM is much more than user distribution between systems) with CUA when we are talking about SAP systems only. There are other IdM solutions from different vendors as well. So it's hard to believe that most of the companies have started implementing IdM from SAP.

Anyway, I agree that usually homemade synchronizing solution is a way to hell. LDAP is way to go.

Cheers

[Former Member]

>

> Hi,

>

>

>  I would  totally agree with Julius , most of the companies have started implementing SAP IDM,
> 

>

> do you have any numbers for this? For small landscape you can be fine (I understand that iDM is much more than user distribution between systems) with CUA when we are talking about SAP systems only. There are other IdM solutions from different vendors as well. So it's hard to believe that most of the companies have started implementing IdM from SAP.

>

> Anyway, I agree that usually homemade synchronizing solution is a way to hell. LDAP is way to go.

>

> Cheers

"most of the companies have started implementing SAP IDM" is a re-definition of the term most. Where most = minority.

When IDM 7.2 comes out I expect there to be a fair bit more uptake as there are a good number of improvements that make it easier to integrate into SAP environments. I think a lot of the problems with the gestation of the product under the SAP brand is that SAP have told customers that they should stop using CUA and use IDM instead when they are designed to do very different things.

[koehntopp]

There's more to IdM than creating users.

I actually would like to question the very first sentence:

Hello Experts - Requirement is "Create SAP User account automatically when AD account gets created"

I'm pretty certain that's not the real requirement, it probably started with someone saying "Can't we make it easier to create SAP accounts after we already have created users in AD?".

Some things to ponder:

- Do ALL AD users need a SAP account? (license cost)

- Is there only one SAP system? What about DEV and QAS systems?

- How do you assign authorizations?

- What do you do when AD information changes?

- What do you do when people change position or leave the company?

If these are all questions you want to address, you might want to look at an identity management solution.

If you haven't thought about any of these yet, call us in a year and we can plan the cleanup project )))

Frank.

[Former Member]

Hi Martin,

I have commented that way because most of the consulting work I have been doing recently is in the field of SAP GRC

the past one year almost all of my clients have asked for SAP IDm solution.

User base for one of the client was - 25,000+

another is with 12000+

My practical experience now is that SAP GRC 5.3 also clients are interested only in RAR 5.3/SPM 5.3

after implementing these two tools, they straight away jump to SAP IDM.

I think SAP IDm is able to do what CUA /any other centralized tool can do for user administration for both SAP and Non-SAP system the only think it cannot perform is Compliant user provisioning.

This is my opinion.

[Former Member]

> My practical experience now is that SAP GRC 5.3 also clients are interested only in RAR 5.3/SPM 5.3 after implementing these two tools, they straight away jump to SAP IDM.

This is also SAP's official recommendation since a few months. I would not invest any effort in CUP nor ERM at the moment to be honest.

Cheers,

Julius

[martin_voros]

Thanks for your comment. Obviously, you have different experience than me. It looks like your clients are bigger so I can see that implementing IdM makes more sense for them and it's easier from them to find budget for IdM.

Julius: obviously SAP recommend another product from them. I am not saying it's a bad product. I played a little bit with IdM 7.1SP4 and it looks interesting. Has anyone experience with IdM from different vendor in SAP landscape?

Cheers

[Former Member]

Hi Martin,

I have a customer with 16 million users in SU01. They don't use IdM and don't need it either at the moment.

I have another customer with 700 users and they are implementing IdM because it makes sense. They need it to reduce complexity.

There are no IdM license costs, unless you provision non-SAP systems.

You can skip GRC by using a well designed concept for report RSUSR008_009_NEW if it meets your requirements - particularly the number of systems. It does however have it's limits (per ABAP client) and is not user friendly at first. Also no nice pie-charts for managers, etc.

Emergency User Access comes in many shapes and sizes... SAP declined a development suggestion from me to improve the "FireFighter" tool so I developed it on my own for my customers using BAPIs and they are happy. The main requiremenent not fullfilled is that the user context changes so that you loose access to HR data, queries, variants, workflow items, purchase orders, etc. The FireFighter users also become obvious targets of attacks and the application users (dialog) need authority to change the FireFighter's passwords to use the application - which means that they can use RFC to do the same without using the FireFighter transactions / logs / etc.

Regarding other IdMs, I have experience with some, but documented here on SDN is only the password syncronization problems which Novell suffers from. These "problems" are intentional - or better said --> their own fault for using "hacks"...

If you search for "Novell" you will find them.

Cheers,

Julius

[martin_voros]

Thanks Julius. I did not know that there are no license cost issues when you use it only for SAP systems. Still you need to run project and pay resources (internal or external) to implement it. I agree with you that the number of users is not only criteria to justify usage of IdM or not. But I still think that there is a higher change of adopting IdM with customers who have systems with high number of users.

I guess you don't want to release your solution as open source

Cheers

[Former Member]

> I guess you don't want to release your solution as open source

I thought about it after SAP declined the development suggestion, but now throw it in for customers who are only missing that segment of the pie once they get there on their own.

You can contact me via my SDN Business Card as it is not a commercial topic for SDN nor a competitor product if customers are on the right track of enterprize licenses.

> Still you need to run project and pay resources (internal or external) to implement it.

That is omnipresent, depending on the product and the project management. You can also spend a fortune and never go-live...

I would describe the SAP IdM more as a development environment than a system which only requires some basic config and hit the "Go" button. But you dont have to make it look like Michael Jackson in the end when Winnitou does the trick - this is particularly true of the workflows and requirements for them.

I think we are drifting a bit off topic now... we wanted an AD sync to ABAP (without AD admins being able to logon as emergency users...?)

Cheers,

Julius

[Former Member]

Hi,

We had similar suitation. where we need to create users in MDM as well as in portal systems. So comapany maintained two user form request forms. One is for MDM / another one for portal systems

First the request comes to MDM security team,they will create users. Once done,they will send email confirmation that users are create in MDM system.

Same list will be forwarded to the portal security team,then users are created in portal.

We did not use CATT scripts as it was not allowed.

PS:

the SAP standard offers the option to synchronize ABAP users with an LDAP directory such as Microsoft Active Directory.

The configuration of this interface is described in the SAP Online Help and in the following White Paper Integration of SAP central user administration with Microsoft Active Directory:

BAPI_USER_CREATE

Thanks,

Sri