SAPR3UM2Ident_Validation

Workflow for Validation from SAP ECC UM to Identity Store

A validation workflow compares the content of the connected system with the state that DirX Identity holds for the corresponding target system. It runs in one of two modes, controlled by the mode parameter of the workflow:

  • InitialLoad - exports all accounts and groups and their relationships from the connected system and imports them into the target system subtree of the Identity Store in replace mode. Use this mode when you take a target system into operation.

  • Validation - detects deviations between the state known in DirX Identity and the state in the connected system, for example accounts or groups that were created or deleted outside of DirX Identity, and writes a message about each deviation into the "to do" field (dxrToDo) of the affected target system object.

Both modes update the dxrTSState attribute and the group member attributes of the affected target system objects.

SAPR3UM2Ident_Validation validates SAP ECC User Management against the corresponding target system subtree in the Identity Store. For both object types, SAP-R3-UMAgent exports the data from SAP ECC User Management and MetaCP imports it for validation in DirX Identity.

The workflow processes groups first and accounts second during the validation run.

The workflows in this reference are delivered as factory data and are loaded into the Connectivity configuration database during the initial configuration. They are samples: use the Identity Manager to copy a workflow into your own scenario and adapt the copy. Do not change the delivered objects, because a product update can replace them.

At a Glance

Name

SAPR3UM2Ident_Validation

Category

Target Scheduled / SAPR3UM

Technology

Tcl-based scheduled workflow

LDAP object class

dxmWorkflow

Workflow type

Validation

Connected system / controller type

-

Configuration wizard

SAPR3UM-LDAP

Active in the factory data

not set

Factory data version

7.0

Factory data path

Workflows/Default/Target Scheduled/SAPR3UM/SAPR3UM2Ident_Validation

Prerequisites

  • Configure SAP-R3-UMAgent so that it can connect to SAP ECC User Management.

  • Configure MetaCP for the corresponding target system subtree in the Identity Store.

Workflow and Activities

Step Activity Description Agent Runs after

1

SAPR3UM2Ident_ValGroup_UMAgent

Full-Export from SAPR3UM for group validation

SAP-R3-UMAgent

start activity

2

SAPR3UM2Ident_ValGroup_MetaCP

Import of groups

MetaCP

SAPR3UM2Ident_ValGroup_UMAgent

3

SAPR3UM2Ident_ValAccount_UMAgent

Full-Export from SAPR3UM for account validation

SAP-R3-UMAgent

SAPR3UM2Ident_ValGroup_MetaCP

4

SAPR3UM2Ident_ValAccount_MetaCP

import of accounts

MetaCP

SAPR3UM2Ident_ValAccount_UMAgent

Jobs and Agents

Activity Job Agent Operation Input channel Output channel

SAPR3UM2Ident_ValGroup_UMAgent

SAPR3UM2Ident_ValGroup_UMAgent

SAP-R3-UMAgent

Full Export

SAPR3UM2Ident_ValGroup

OutData

SAPR3UM2Ident_ValGroup_MetaCP

SAPR3UM2Ident_ValGroup_MetaCP

MetaCP

Delta Import

InData

SAPR3UM2Ident_ValGroup

SAPR3UM2Ident_ValAccount_UMAgent

SAPR3UM2Ident_ValAccount_UMAgent

SAP-R3-UMAgent

Full Export

SAPR3UM2Ident_ValAccount

OutData

SAPR3UM2Ident_ValAccount_MetaCP

SAPR3UM2Ident_ValAccount_MetaCP

MetaCP

Delta Import

InData

SAPR3UM2Ident_ValAccount

Configuration Parameters

Table 1. Workflow parameters of SAPR3UM2Ident_Validation
Parameter Default value

mode

InitialLoad
Table 2. Parameters of job SAPR3UM2Ident_ValGroup_UMAgent
Parameter Default value

controller_tracelevel

1
Table 3. Parameters of job SAPR3UM2Ident_ValGroup_MetaCP
Parameter Default value

debug_trace

0

delta_mode

full

delta_on

0

exact_action

FALSE

init_mode

REAL

max_trace_entries

10

min_source_entries

0

notify_not_ok

0

statistics

TRUE

test_mapping_only

FALSE

trace_level

1

trace_recordcount

0
Table 4. Parameters of job SAPR3UM2Ident_ValAccount_UMAgent
Parameter Default value

controller_tracelevel

1
Table 5. Parameters of job SAPR3UM2Ident_ValAccount_MetaCP
Parameter Default value

debug_trace

0

delta_mode

full

delta_on

0

exact_action

FALSE

init_mode

REAL

max_trace_entries

10

min_source_entries

0

notify_not_ok

0

statistics

TRUE

test_mapping_only

FALSE

trace_level

1

trace_recordcount

0

A Tcl-based workflow runs scheduled in the C++-based Server (IdS-C). Its activities run in the order defined by the dxmPredecessorActivity-DN chain, and each activity starts a job that runs one agent with one input and one output channel. Agents exchange their data through files or directly through the meta controller, so a typical workflow consists of an export activity that writes the data of the connected system and an import activity that maps and loads that data into the Identity Store.

You start these workflows manually from the Identity Manager or attach them to a schedule.

In this workflow, the C++-based Server runs these activities in sequence:

  1. SAPR3UM2Ident_ValGroup_UMAgent exports group data from SAP ECC User Management.

  2. SAPR3UM2Ident_ValGroup_MetaCP imports that group data into the Identity Store validation flow.

  3. SAPR3UM2Ident_ValAccount_UMAgent exports account data from SAP ECC User Management.

  4. SAPR3UM2Ident_ValAccount_MetaCP imports that account data into the Identity Store validation flow.

If one activity fails, the workflow stops at that point and the remaining activities do not run.

Operation

  1. Start SAPR3UM2Ident_Validation manually or on a schedule.

  2. The workflow exports group data from SAP ECC User Management with SAPR3UM2Ident_ValGroup_UMAgent and imports it with SAPR3UM2Ident_ValGroup_MetaCP.

  3. After the group pass finishes, the workflow exports account data with SAPR3UM2Ident_ValAccount_UMAgent and imports it with SAPR3UM2Ident_ValAccount_MetaCP.

  4. Depending on the selected mode, the run either refreshes the target system subtree from SAP ECC User Management or records deviations between that system and the Identity Store on the affected target system objects.

  5. When the workflow finishes successfully, DirX Identity has processed both group and account data for the connected SAP ECC User Management target system.