1 About the Connector

1.4.1 Support for Both SAP R/3 and SAP CUA

The connector can be used to integrate Oracle Identity Manager with either or both SAP R/3 and SAP CUA. From release 9.1.1 onward, this connector replaces release 9.1.0 of both the SAP User Management and SAP CUA connectors.

See Section 3.8, "Switching Between SAP R/3 and SAP CUA Target Systems" for more information.

1.4.2 Mapping Standard and Custom Attributes for Reconciliation and Provisioning

You can create mappings for attributes that are not included in the list of default attribute mappings. These attributes can be part of the standard set of attributes provided by the target system or custom attributes that you add on the target system.

See Chapter 4, "Extending the Functionality of the Connector" for more information.

1.4.3 SoD Validation of Entitlement Requests

The connector supports the SoD feature introduced in Oracle Identity Manager release 9.1.0.2. The following are the focal points of this software update:

• The SoD Invocation Library (SIL) is bundled with Oracle Identity Manager. The SIL acts as a pluggable integration interface with any SoD engine.

• The SAP User Management connector is preconfigured to work with SAP GRC as the SoD engine. To enable this, changes have been made in the approval and provisioning workflows of the connector.

  Note:

  The default approval workflow and associated object form are configured for the SoD validation capabilities of SAP GRC. You can use them to develop your own approval workflows and object forms.

• The SoD engine processes role and profile entitlement requests that are sent through the connector. This preventive simulation approach helps identify and correct potentially conflicting assignment of entitlements to a user, before the requested entitlements are granted to users.

1.4.4 Full and Incremental Reconciliation

In full reconciliation, all records are fetched from the target system to Oracle Identity Manager. In incremental reconciliation, only records that are added or modified after the last reconciliation run are fetched into Oracle Identity Manager.

At the end of a reconciliation run, an attribute of the scheduled task holds the time stamp at which the reconciliation run began. If that attribute is set to 0, then full reconciliation is performed. If that attribute holds a non-zero value, then incremental reconciliation is performed.

During full reconciliation, a single reconciliation event is generated for a particular target system account. However, during incremental reconciliation, two reconciliation events are generated for each account:

• The first reconciliation event contains all account data other than the Locked/Unlocked status.

• The second reconciliation event contains the Locked/Unlocked status.

You can switch from incremental to full reconciliation at any time. See Section 3.1, "Performing Full Reconciliation" for more information.

1.4.5 Limited (Filtered) Reconciliation

To limit or filter the records that are fetched into Oracle Identity Manager during a reconciliation run, you can specify the subset of added or modified target system records that must be reconciled.

See Section 3.4.2, "Limited Reconciliation" for more information.

1.4.6 Batched Reconciliation

You can break down a reconciliation run into batches by specifying the number of records that must be included in each batch.

See the description of the Batch Size attribute in Section 3.4.3, "Reconciliation Scheduled Tasks" for more information.

1.4.7 Enabling and Disabling Accounts

Valid From and Valid Through are two user attributes on the target system. For a particular user in SAP, if the Valid Through date is less than the current date, then the account is in the Disabled state. Otherwise, the account is in the Enabled state. The same behavior is duplicated in Oracle Identity Manager through reconciliation. In addition, you can set the value of the Valid Through date to a current date or a date in the past through a provisioning operation.

1.4.8 Linking of SAP HRMS and SAP R/3 or SAP CUA Accounts

An SAP HRMS account created for an individual can be linked with the SAP R/3 or SAP CUA account created for the same user. For a particular user, an attribute of SAP HRMS holds the user ID of the corresponding SAP R/3 or SAP CUA account.

You can duplicate this link in Oracle Identity Manager by using the following entries of the Lookup.SAP.UM.Configuration lookup definition:

• Support HRMS 0105 Infotype Linking

• Validate Personnel Number before Linking

• Overwrite Link

See Section 2.3.2.1, "Linking of SAP HRMS and SAP R/3 or SAP CUA Accounts" for more information.

1.4.9 SNC Communication Between the Target System and Oracle Identity Manager

You can configure Secure Network Communication (SNC) to secure communication between Oracle Identity Manager and the target system.

See Section 2.3.11, "Configuring SNC to Secure Communication Between Oracle Identity Manager and the Target System" for more information.

1.4.10 Specifying Accounts to Be Excluded from Reconciliation and Provisioning Operations

You can specify a list of accounts that must be excluded from all reconciliation and provisioning operations. Accounts whose user IDs you specify in the exclusion list are not affected by reconciliation and provisioning operations.

See Section 2.3.8, "Setting Up the Lookup.SAP.UM.ExclusionList Lookup Definition" for more information.

1.4.11 Configuring Password Changes for Newly Created Accounts

When you log in to SAP by using a newly created account, you are prompted to change your password at first logon. For accounts created through Oracle Identity Manager, password management can be configured using one of the following approaches:

• Configure the connector so that users with newly created accounts are prompted to change their passwords at first logon.

• Configure the connector so that the password set while creating the account on Oracle Identity Manager is set as the new password on the target system. The user is not prompted to change the password at first logon.

This feature is configured using the Dummy password parameter of the IT resource and the Change Password entry of the Lookup.SAP.UM.Configuration lookup definition. In addition, the Password Disabled entry of this lookup definition allows you to specify whether or not the password must be optional during Create User provisioning operations.

1.4.12 Specifying the SAP JCo Trace Level

The connector uses the SAP JCo for reconciliation and provisioning operations. The JCo trace level is a numeric specification of the level of trace data that must be logged when the SAP JCo is used. You can specify the trace level as a parameter of the IT resource.

See Table 2-10, "Parameters of the IT Resource" for more information.

1.4.13 Connection Pooling

A connection pool is a cache of objects that represent physical connections to the target. Oracle Identity Manager connectors can use these connections to communicate with target systems. At run time, the application requests a connection from the pool. If a connection is available, then the connector uses it and then returns it to the pool. A connection returned to the pool can again be requested for and used by the connector for another operation. By enabling the reuse of connections, the connection pool helps reduce connection creation overheads like network latency, memory allocation, and authentication.

One connection pool is created for each IT resource. For example, if you have three IT resources for three installations of the target system, then three connection pools will be created, one for each target system installation.

The configuration properties of the connection pool are part of the IT resource definition. Section 2.3.12, "Configuring the IT Resource" provides information about setting up the connection pool.

1.4.14 Specifying the Use of a Logon Group on the Target System for Connector Operations

In SAP, a logon group is used as a load-sharing mechanism. When a user logs in to a logon group, the system internally routes the connection request to the logon group member with the least load. You can configure the connector to use a logon group for logging in to the target system for reconciliation and provisioning operations.

See Section 2.3.12.1, "Parameters for Enabling the Use of a Logon Group" for more information.

1.4.15 Transformation and Validation of Account Data

You can configure validation of account data that is brought into or sent from Oracle Identity Manager during reconciliation and provisioning. In addition, you can configure transformation of account data that is brought into Oracle Identity Manager during reconciliation. The following sections provide more information:

• Section 4.7, "Configuring Validation of Data During Reconciliation and Provisioning"

• Section 4.8, "Configuring Transformation of Data During Reconciliation"

1.5.1 Lookup Definitions Synchronized with the Target System

During a provisioning operation, you use a lookup field on the process form to specify a single value from a set of values. For example, you use the Date Format lookup field to select a date format from the list of supported date formats. When you deploy the connector, lookup definitions corresponding to the lookup fields on the target system are automatically created in Oracle Identity Manager. Lookup field synchronization involves copying additions or changes made to the target system lookup fields into the lookup definitions in Oracle Identity Manager.

The Lookup.SAP.UM.LookupMappings and Lookup.SAP.CUA.LookupMappings lookup definitions are used to map each lookup definition with the BAPI that is used to fetch values for the lookup definition from the target system. The Code Key column of these lookup definitions contains names of the lookup definitions that are synchronized with the target system. The Decode column contains the name and parameters of the corresponding BAPIs.

Table 1-2 lists the entries in these lookup definitions. The Decode column holds a list of the parameters required to fetch lookup field values from the target system.

The following is the format of entries in the lookup definitions listed in this table:

• Code Key format: IT_RESOURCE_KEY~LOOKUP_FIELD_ID

  Note:

  For multivalued attributes (roles and profiles), the format is as follows:

  IT_RESOURCE_KEY~SYSTEM_NAME~LOOKUP_IELD_ID
  

  In this format:

  • IT_RESOURCE_KEY is the numeric code assigned to the IT resource in Oracle Identity Manager.

  • LOOKUP_FIELD_ID is the target system code assigned to the lookup field entry.

  Sample value: 1~PRT

• Decode format: IT_RESOURCE_NAME~LOOKUP_FIELD_ENTRY

  In this format:

  • IT_RESOURCE_NAME is the name of the IT resource in Oracle Identity Manager.

  • LOOKUP_FIELD_ENTRY is the value or description of the lookup field entry on the target system.

  Sample value: SAP IT~Printer

The SAP User Management Lookup Recon scheduled task is used to synchronize values of these lookup definitions with the target system. See Section 3.2, "Scheduled Task for Lookup Field Synchronization" for more information about this scheduled task.

While performing a provisioning operation on the Administrative and User Console, you select the IT resource for the target system on which you want to perform the operation. When you perform this action, the lookup definitions on the page are automatically populated with values corresponding to the IT resource (target system installation) that you select.

During lookup field synchronization, new entries are appended to the existing set of entries in the lookup definitions. You can switch from an SAP R/3 target to a SAP CUA target, or you can switch between multiple installations of the same target system. Because the IT resource key is part of each entry created in each lookup definition, only lookup field entries that are specific to the IT resource you select during a provisioning operation are displayed.

1.5.2 Preconfigured Lookup Definitions

Table 1-3 describes the other lookup definitions that are created in Oracle Identity Manager when you deploy the connector. These lookup definitions are either prepopulated with values or values must be manually entered in them after the connector is deployed.

1.6.1 User Attributes for Reconciliation

The Lookup.SAP.UM.ReconAttrMap lookup definition maps resource object fields and target system attributes. The Code Key column stores the names of resource object fields. The format of the Decode column is as follows:

FIELD_TYPE;FIELD_NAME;STRUCTURE_NAME

In this format, FIELD_TYPE can be TEXT, LOOKUP, CHECKBOX, or DATE.

Table 1-4 lists entries in this lookup definition.

The Lookup.SAP.UM.ReconChildAttrMap lookup definition maps resource object fields and multivalued target system attributes. Table 1-5 lists entries in this lookup definition.

The format of Decode entries in this lookup definition is as follows:

FIELD_TYPE;FIELD_NAME;TABLE_NAME;OIM_CHILD_TABLE_NAME

In this format, FIELD_TYPE can be TEXT, LOOKUP, CHECKBOX, or DATE.

1.6.2 Reconciliation Rules

The following sections provide information about the reconciliation rules for this connector:

• Section 1.6.2.1, "Reconciliation Rule"

• Section 1.6.2.2, "Viewing Reconciliation Rules in the Design Console"

1.6.3 Reconciliation Action Rules

The following sections provide information about the reconciliation rules for this connector:

• Section 1.6.3.1, "Reconciliation Action Rules for Reconciliation"

• Section 1.6.3.2, "Viewing Reconciliation Action Rules in the Design Console"

1.7.1 User Provisioning Functions

Table 1-7 lists the supported user provisioning functions and the adapters that perform these functions. The functions listed in the table correspond to either a single or multiple process tasks.

1.7.2 User Attributes for Provisioning

The Lookup.SAP.UM.ProvAttrMap lookup definition maps process form fields with single-valued target system attributes. The Code Key column holds the names of process form fields. The format of values in the Decode column is as follows:

FIELD_TYPE;FIELD_NAME;STRUCTURE_NAME;FIELD_NAME_X;STRUCTURE_NAME_X

In this format:

• FIELD_TYPE can be TEXT, DATE, CHECKBOX, or LOOKUP.

• FIELD_NAME is the name of the field.

• STRUCTURE_NAME is the name of the structure.

• FIELD_NAME_X is the name of the field used to indicate whether or not the value in FIELD_NAME must be applied.

• STRUCTURE_NAME_X is the name of the structure that holds FIELD_NAME_X.

Table 1-8 lists the entries in this lookup definition.

The Lookup.SAP.UM.ProvChildAttrMap lookup definition maps process form fields with multivalued target system attributes. The Code Key column holds the names of the child form fields. The format of the Decode column is the same as that for the Lookup.SAP.UM.ProvAttrMap lookup definition.

Table 1-9 lists the entries in this lookup definition.