Ident_SAPR3UM_Sync

Workflow for Export from Identity Store and Import to SAP ECC UM and backwards

Ident_SAPR3UM_Sync synchronizes the Identity Store and SAP ECC User Management in both directions. It processes groups before accounts on the outbound and return paths so that group structures are already present when later account updates refer to them.

Use this workflow for scheduled bidirectional synchronization when SAP ECC User Management, also known as SAP R/3 UM, remains an active source as well as a target of changes.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

Ident_SAPR3UM_Sync

Category

Target Scheduled / SAPR3UM

Technology

Tcl-based scheduled workflow

LDAP object class

dxmWorkflow

Workflow type

Sync

Connected system / controller type

-

Configuration wizard

LDAP-LDAP,SAPR3UM

Active in the factory data

not set

Factory data version

7.0

Factory data path

Workflows/Default/Target Scheduled/SAPR3UM/Ident_SAPR3UM_Sync

Prerequisites

  • Configure SAP-R3-UMAgent so that it can connect to SAP ECC User Management.

  • Configure MetaCP for the corresponding target system subtree in the Identity Store.

Workflow and Activities

Step Activity Description Agent Runs after

1

Ident2SAPR3UM_SyncGroup_MetaCP

Export of groups

MetaCP

start activity

2

Ident2SAPR3UM_SyncGroup_UMAgent

Import of groups

SAP-R3-UMAgent

Ident2SAPR3UM_SyncGroup_MetaCP

3

Ident2SAPR3UM_SyncAccount_MetaCP

Export of accounts

MetaCP

Ident2SAPR3UM_SyncGroup_UMAgent

4

Ident2SAPR3UM_SyncAccount_UMAgent

Import of accounts

SAP-R3-UMAgent

Ident2SAPR3UM_SyncAccount_MetaCP

5

SAPR3UM2Ident_SyncGroup_UMAgent

export of groups

SAP-R3-UMAgent

Ident2SAPR3UM_SyncAccount_UMAgent

6

SAPR3UM2Ident_SyncGroup_MetaCP

import of groups to role

MetaCP

SAPR3UM2Ident_SyncGroup_UMAgent

7

SAPR3UM2Ident_SyncAccount_UMAgent

export of accounts

SAP-R3-UMAgent

SAPR3UM2Ident_SyncGroup_MetaCP

8

SAPR3UM2Ident_SyncAccount_MetaCP

import of accounts to role

MetaCP

SAPR3UM2Ident_SyncAccount_UMAgent

Jobs and Agents

Activity Job Agent Operation Input channel Output channel

Ident2SAPR3UM_SyncGroup_MetaCP

Ident2SAPR3UM_SyncGroup_MetaCP

MetaCP

Full Export

Ident2SAPR3UM_SyncGroup

OutData

Ident2SAPR3UM_SyncGroup_UMAgent

Ident2SAPR3UM_SyncGroup_UMAgent

SAP-R3-UMAgent

Full Export

InData

Ident2SAPR3UM_SyncGroup

Ident2SAPR3UM_SyncAccount_MetaCP

Ident2SAPR3UM_SyncAccount_MetaCP

MetaCP

Full Export

Ident2SAPR3UM_SyncAccount

OutData

Ident2SAPR3UM_SyncAccount_UMAgent

Ident2SAPR3UM_SyncAccount_UMAgent

SAP-R3-UMAgent

Full Export

InData

Ident2SAPR3UM_SyncAccount

SAPR3UM2Ident_SyncGroup_UMAgent

SAPR3UM2Ident_SyncGroup_UMAgent

SAP-R3-UMAgent

Full Export

SAPR3UM2Ident_SyncGroup

OutData

SAPR3UM2Ident_SyncGroup_MetaCP

SAPR3UM2Ident_SyncGroup_MetaCP

MetaCP

Delta Import

InData

SAPR3UM2Ident_SyncGroup

SAPR3UM2Ident_SyncAccount_UMAgent

SAPR3UM2Ident_SyncAccount_UMAgent

SAP-R3-UMAgent

Full Export

SAPR3UM2Ident_SyncAccount

OutData

SAPR3UM2Ident_SyncAccount_MetaCP

SAPR3UM2Ident_SyncAccount_MetaCP

MetaCP

Delta Import

InData

SAPR3UM2Ident_SyncAccount

Configuration Parameters

Table 1. Parameters of job Ident2SAPR3UM_SyncGroup_MetaCP
Parameter Default value

debug_trace

0

delta_mode

delta-or-full

delta_on

1

exact_action

FALSE

init_mode

REAL

max_trace_entries

10

min_source_entries

0

notify_not_ok

0

statistics

TRUE

test_mapping_only

FALSE

test_max_entries

0

trace_level

1

trace_recordcount

0
Table 2. Parameters of job Ident2SAPR3UM_SyncGroup_UMAgent
Parameter Default value

controller_tracelevel

1
Table 3. Parameters of job Ident2SAPR3UM_SyncAccount_MetaCP
Parameter Default value

debug_trace

0

delta_mode

delta-or-full

delta_on

1

exact_action

FALSE

init_mode

REAL

max_trace_entries

10

min_source_entries

0

notify_not_ok

0

statistics

TRUE

test_mapping_only

FALSE

test_max_entries

0

trace_level

1

trace_recordcount

0
Table 4. Parameters of job Ident2SAPR3UM_SyncAccount_UMAgent
Parameter Default value

controller_tracelevel

1
Table 5. Parameters of job SAPR3UM2Ident_SyncGroup_UMAgent
Parameter Default value

controller_tracelevel

1
Table 6. Parameters of job SAPR3UM2Ident_SyncGroup_MetaCP
Parameter Default value

debug_trace

0

delta_mode

full

delta_on

0

exact_action

FALSE

init_mode

REAL

max_trace_entries

10

min_source_entries

0

notify_not_ok

0

statistics

TRUE

test_mapping_only

FALSE

trace_level

1

trace_recordcount

0
Table 7. Parameters of job SAPR3UM2Ident_SyncAccount_UMAgent
Parameter Default value

controller_tracelevel

1
Table 8. Parameters of job SAPR3UM2Ident_SyncAccount_MetaCP
Parameter Default value

debug_trace

0

delta_mode

full

delta_on

0

exact_action

FALSE

init_mode

REAL

max_trace_entries

10

min_source_entries

0

notify_not_ok

0

statistics

TRUE

test_mapping_only

FALSE

trace_level

1

trace_recordcount

0

A Tcl-based workflow runs scheduled in the C++-based Server (IdS-C). Its activities run in the order defined by the dxmPredecessorActivity-DN chain, and each activity starts a job that runs one agent with one input and one output channel. Agents exchange their data through files or directly through the meta controller, so a typical workflow consists of an export activity that writes the data of the connected system and an import activity that maps and loads that data into the Identity Store.

You start these workflows manually from the Identity Manager or attach them to a schedule.

In this workflow, the C++-based Server runs these activities in sequence:

  1. Ident2SAPR3UM_SyncGroup_MetaCP exports group changes from the Identity Store.

  2. Ident2SAPR3UM_SyncGroup_UMAgent imports those group changes into SAP ECC User Management.

  3. Ident2SAPR3UM_SyncAccount_MetaCP exports account changes from the Identity Store.

  4. Ident2SAPR3UM_SyncAccount_UMAgent imports those account changes into SAP ECC User Management.

  5. SAPR3UM2Ident_SyncGroup_UMAgent exports group changes from SAP ECC User Management.

  6. SAPR3UM2Ident_SyncGroup_MetaCP imports those group changes into the Identity Store.

  7. SAPR3UM2Ident_SyncAccount_UMAgent exports account changes from SAP ECC User Management.

  8. SAPR3UM2Ident_SyncAccount_MetaCP imports those account changes into the Identity Store.

If one activity fails, the workflow stops at that point and the remaining activities do not run.

Operation

  1. Start Ident_SAPR3UM_Sync manually or on a schedule.

  2. The workflow begins with the Identity Store to SAP direction by exporting groups with MetaCP and importing them with SAP-R3-UMAgent, then repeating the same pattern for accounts.

  3. After the outbound pass finishes, the workflow changes direction and exports groups from SAP ECC User Management with SAP-R3-UMAgent before importing them into the Identity Store with MetaCP.

  4. It then repeats the return pass for accounts so that both object types are processed in both directions during the same run, with groups always preceding accounts.

  5. When the workflow completes successfully, the scheduled run has applied outbound changes to SAP ECC User Management and has imported the latest returned group and account data into the Identity Store.