Sap Cua Authomatically Synchronize Roles
In a just refreshed system from QAS to DEV, I want to have ONLY the users that are suppose to be there. We have a CUA system where that info is already there. The question is, how does the CUA system synchronize or update user master record information to the DEV system? Is is done automaticaly, user by user, on demand or what? Thank you in.
When CUA is configured in the System the user creation process is little different than regular process. When you transport the role to child system the central system will know about the role. In a just refreshed system from QAS to DEV, I want to have ONLY the users that are suppose to be there. We have a CUA system where that info is already there. The question is, how does the CUA system synchronize or update user master record information to the DEV system?
This section applies to the SAP ERP connector only. It is relevant for CA Identity Manager and CA Secure Cloud.
It is not relevant for CA Identity Governance.The SAP ERP connector lets you manage SAP Central User Administration (CUA) environments. SAP CUA maintains user records in a central master system, and automatically distributes these records to its child systems.You can acquire the child systems as endpoints as well as managing the master system as a CUA master. How the SAP ERP Connector Works with SAP CUAAfter the SAP ERP connector has connected to an SAP CUA master system, you can use your CA product to manage identities on the SAP CUA master system.
The master then propagates your changes to the child systems. Note: Passwords are.Example: Add a role to the SAP CUA master using CA Identity ManagerIn this example, you use the User Console to create an account on the SAP CUA master. Note: With SAP Kernel 6.40, an attempt to change the password of an account that does not reside on the Master system will return PASSWORD NOT ALLOWED.When connecting to a CUA master system using a pre-expired password, the following occurs:. On Account Creation for both CUA Master and CUA ChildThe password is pre-expired. You must change the password upon first logon. On Account ModifyCUA Master - The password is pre-expired. You must change the password upon first logon after the change.CUA Child - The password change is not distributed to child systems.
Password management must be done locally.Distribution Settings in SAP CUASome distribution settings in your CUA environment can cause unexpected results.If you use the SAP connector to change an attribute in a way that conflicts with the CUA distribution model, the modification attempted by the connector may be ignored. In some cases, SAP returns an error.
Steps need to be performed to set up the CUA:Steps to Set Up the CUA. Create Administrator. Specify Logical systems. Assign logical systems to client. Create system users. Create RFC destinations. Create CUA.
Set field distributor parameters. Synchronization of company addresses. Transfer UsersBelow are the systems considered as an example to set up CUA:.
Sap Cua Authomatically Synchronize Roles In Hindi
System ABC with client 123. System PQR with client 456.
System XYZ with client 789Here, we will set system ABC (client 123) as a CUA central system(D16 is also refered as CUA system) and other systems(T16,PQR and XYZ) as child systems. As per this structure, we will proceed with above mentioned steps:.
1. Create Administrator UserIn a completely new system that is to be set up, an administration user needs to be created with which all further steps can be performed. To create such administrator user:. Login to all systems with user SAP.
and create the user in t-code SU01. Assign the relevant administrator role to user. Apply the security measures to secure SAP. user against misuse2. Specify Logical systemsIn CUA landscape, SAP systems are identified with Logical system names. Due to this, Logical systems need to be created for every system which is going to be included in CUA landscape.
This is one time task to be performed before setting up CUA. The Logical systems can be defined be following below steps:. Login to system ABC (client 123) with administrator user created in step 1. Go to t-code BD54 You can; alternatively maintain the table view VTBDLS using transaction SM30.
Choose Edit? New Entries. In the LogSystem column, create a new logical name in capital letters for every CUA system (that is, for the central and all child systems including those from other SAP Systems). Here, the standard naming convention for logical system is CLNT. In this way, the below logical systems will be created in CUA central system (ABC system):. ABCCLNT123. PQRCLNT456.
XYZCLNT789In the same way, create the logical system name for the central system in all child systems.D16 is CUA and it has T16 logical system in BD54T16 is child and it has CUA D16 logical system in BD543.