W24 Role Management in an Enterprise Portal Installation Frank Buchholz SAP AG

Transcription

1 W24 Role Management in an Enterprise Portal Installation Frank Buchholz SAP AG 6$3 6HFXULW\ &RPSHWHQFH 7HDP URL: 1

2 &RQWHQWV 1. A short history of roles 2. The new role concept for Enterprise Portal Role Concept for EP 5.0 and SAP Systems 4. Migration of existing roles into EP Generation of authorization roles in SAP systems SAP AG 2001, TechED Vienna, W24 /Buchholz2 2

3 &RQWHQWV 1. A short history of roles SAP AG 2001, TechED Vienna, W24 /Buchholz3 3

4 +LVWRU\ RI WKH SURILOH JHQHUDWRU ' * $ $ $ Session Manager Session Manager in SAPGui Shortcuts New Frontend/Layout SAP Easy Access Profile Generator Central User Management Individual personalized Menues, cross-system Global Fields Enh. Global Fields Transaction Variants Enhanced Transaction Variants integr. Tabs, TabControls and Menues Transaction Variants + GuiXT SAP AG 2001, TechED Vienna, W24 /Buchholz4 4

5 +LVWRU\ RI WKH SURILOH JHQHUDWRU FRQW Before Release 4.6 Profile generator purely an authorization management tool. Users have to work with huge menu structures in which they have to navigate heavily and where what they see does not match their authorizations. As of Release 4.6 Unification of menu information and authorization profiles. Maintenance through PFCG. Role-based user menues. Introduction of composite roles for simplification of administration SAP AG 2001, TechED Vienna, W24 /Buchholz5 5

6 Role Concept for mysap Workplace 2.11 User n:n Composite Role n:n Single Role 1:1 Auth. Profiles Employee Menu Menu, T-codes SU22/SU24 data Service Rep Menu Menu, T-codes SU22/SU24 data Manager Menu Menu, T-codes SU22/SU24 data SAP AG 2001, TechED Vienna, W24 /Buchholz6 6

7 Roles on Workplace Server and in Component Systems Central System Workplace Server Composite Roles with menu structures Single Roles (no authorizations) Component Systems Core R/3 APO CRM Single Roles Authorizations SAP AG 2001, TechED Vienna, W24 /Buchholz7 z The role determines the visual appearance of a user s Workplace. You use it to structure the Launch Pad and the display of the Mini-Apps. A user s role determines the transactions, information, and services that he or she may access via the Workplace. The Launch Pad can contain more than one role (individual roles and composite roles) for a given user. z The following types of roles are available: y Individual roles: You create and maintain individual roles in the component systems and then transport them to the Workplace Server. The component systems contain the individual roles supplied by SAP. You can use these roles and modify them according to your requirements. y Collective roles: You create and maintain collective roles only on the Workplace Server. You create collective roles by grouping together individual roles. The collective role determines the visual appearance of the Launch Pad in the user s Workplace. z Report RSUSR070 provides an overview of the user roles that are supplied by SAP. You can use this report to generate a description of the existing roles in each R/3 System. z You can assign both individual roles and collective roles to a user. Authorization profiles are only assigned to individual roles. You can assign Mini-Apps to both individual roles and collective roles. z You can include many objects in a role such as transactions, reports, Mini-Apps, general web links, executable files, Knowledge Warehouse links, Non-SAP systems. 7

8 P\6$3 :RUNSODFH MiniApps displayed in Workspace Role Menu displayed in LaunchPad SAP AG 2001, TechED Vienna, W24 /Buchholz8 8

9 &RQWHQWV 1. A short history of roles 2. The new role concept for Enterprise Portal 5.0 SAP AG 2001, TechED Vienna, W24 /Buchholz9 9

10 2YHUYLHZ 3RUWDO 6HPDQWLFV Role work set 1 work set 2 work set 3 activity 1 activity 2 activity 3 activity 4 Semantic Structure activity 1 activity 2 activity 3 activity 4 Role A content template consisting of one or more work sets that model a typical job Work set A set of coherent activities that belong to one or more related work intents Activity A (complex) task or activity which is performed in the context of a work set WS2.1 activity 1 activity 2 WS2.2 activity 1 activity 2 SAP AG 2001, TechED Vienna, W24 /Buchholz10 10

11 5ROH,PSOHPHQWDWLRQ 6HPDQWLF /D\HUV Semantic Layers in the PCD The most basic semantic layer of the PCD is the service layer. Services are the atomic building blocks of roles. Note that the PCD does not store the service itself but rather only metadata about this service. To put it simple, the PCD only stores the links to the services. Types of services are: - Documents - Reports - URLs - Transactions -iviews -etc. Services Services are the atomic basis of roles and WS. SAP AG 2001, TechED Vienna, W24 /Buchholz11 11

12 5ROH,PSOHPHQWDWLRQ 6HPDQWLF /D\HUV FRQW Semantic Layers in the PCD Work Sets Services On top of these services, the layer of work sets is the first semantic layer of the PCD to allow bundling of services in folder hierarchies. Note that all services in work sets are not copies but references to services in the PCD s service layer. On the other hand, work sets and their folders are reuse-items for the creation of other work sets or roles. Folder work sets (WS) bundle services in folder hierarchies. Services can be used by many work sets. Services are the atomic basis of roles and WS. SAP AG 2001, TechED Vienna, W24 /Buchholz12 12

13 5ROH,PSOHPHQWDWLRQ 6HPDQWLF /D\HUV FRQW Semantic Layers in the PCD Roles determine the next semantic layer of the PCD. As in work sets, all services and potentially even complete folders are references to the PCD s work set or service layer. Roles Role Work Sets Folder Services The role layer aims at modelling a set of pages, work sets, and services to define the portal s navigation structure. Roles reuse work sets and/or services. They can also use other roles. Work sets (WS) bundle services in folder hierarchies. Services can be used by many work sets. Services are the atomic basis of roles and WS. SAP AG 2001, TechED Vienna, W24 /Buchholz13 13

14 2YHUYLHZ 1DYLJDWLRQ )UDPHZRUN Content of first and second level navigation determined by role design, which also determines content and layout of the content area. EP 5.0 Title Area Top-level Navigation with two levels 1 2 EP 5.0 Content Area Choosing an item on the first level has the effect that its corresponding second level is shown and a portal page for one of these second level items is displayed in the content area. Portal Page Content Area assembled out of iviews SAP AG 2001, TechED Vienna, W24 /Buchholz14 14

15 2YHUYLHZ 1DYLJDWLRQ )UDPHZRUN FRQW WS 2 Folder 1 2-level Navigation Bar WS 3 WS Role Structure Role Defined top-level navigation entry point Portal Service Page a Service b Service c In this example, work set 2 gets automatically activated in the navigation bar when folder 1 is chosen by a user. The associated portal page for work set 2 gets displayed. Note that services contained in work set 2 are displayed on its portal page, either as iviews on the page or as navigational items in an optional detail navigation. Folder 1 WS 2 Service a Service b Service c WS 3 Service d Service e WS 4 Service f Service g SAP AG 2001, TechED Vienna, W24 /Buchholz15 15

16 1DYLJDWLRQ,PSO 7\SHV RI 1DYLJDWLRQ 7RS/HYHO Top-level navigation will provide two hierarchy levels. Choosing a first level item will switch the second level to the according sub-items. At the same time, one of the second level items will be activated by default and its associated portal page is displayed. By clicking on another second level tab, one typically reaches another page, which then fills the content area. Home Budget Mgt Overview mystaff Budget&Monitoring myprojects Knowledge Top-Level Navigation CostCenters InternalOrders &Projects Annual Planning Year Cost Center &RQWHQW Planning Steps Check ƒorg. Structure Assignment ƒemployee Assignment ƒassets Assigned Planning ƒheadcount Planning QI-QIV ƒtransfer to CO ƒkey Figure Planning QI-QIV ƒautomatic Cost Element Planning ƒrefresh Reports ƒmanual Cost Element Adjustments Print Results Budgeting 2002, private %HIRUH 3ODQQLQJ 5HIHU WR WKH 3ODQQLQJ 6FKHGXOH WKLV \HDU 7KH ERDUG KDV VHW KHDGFRXQW WDUJHWV DQG UHLQIRUFHG D QHZ WUDYHO SROLF\ WR FXW WUDYHO H[SHQVHV $OVR IRU QHZ HPSOR\HHV WKH LQLWLDO VDODU\ SORLF\ LQFHQWLYH RIIHULQJV KDYH FKDQJHG )RU PRUH LQIRUPDWLRQ FRQVLGHU WKH JXLGHOLQH LQ +5,QIRFHQWHU DQG 0DQDJHPHQW,QIRFHQWHU 9DULDQFH &RVW (OHPHQWV 3ODQ $FWXDO 3ODQ 3ODQ3ODQ )RUHFDVW 6DODU\ 7UDLQLQJ 5HFUXLWLQJ 'HSUHFLDWLRQ $VVHWV &RPSDQ\ &DUV 7UDYHO 'LVWULEXWLRQV 7RWDO Content Area Requests ƒchange Org. Structure Assignment ƒ Change Employee Assignment ƒ Assets Assigned ƒchange Internal Order ƒchange Project ƒ Contact HR Department ƒ Contact Financial Departments ƒ Hotline 4711 More Planning Reports ƒcost Elements QI QIV ƒkey Figures QI QIV ƒheadcount QI QIV SAP AG 2001, TechED Vienna, W24 /Buchholz16 16

17 1DYLJDWLRQ,PSOHPHQWDWLRQ 7RS/HYHO 1DYLJDWLRQ Budget & Monitoring Overview CostCenters Internal Orders & Projects Annual Planning In this example, the first-level Budget & Monitoring triggers 4 second-level items. A possible underlying PCD folder structure is shown on the right hand side. SAP AG 2001, TechED Vienna, W24 /Buchholz17 17

18 1DYLJDWLRQ,PSOHPHQWDWLRQ 'HWDLOHG 1DYLJDWLRQ Home Budget Mgt mystaff Budget&Monitoring myprojects Knowledge Overview CostCenters InternalOrders &Projects Annual Planning ¾Check ƒorg. Structure Assignment ƒemployee Assignment ƒassets Assigned ¾Planning ƒheadcount Planning QI-QIV ƒtransfer to CO ƒkey Figure Planning QI-QIV ƒautomatic Cost Element Planning ƒrefresh Reports ƒmanual Cost Element Adjustments Detail Navigation IView If the top-level navigation is not sufficient for a page s navigational structure, an optional detail navigation can be used, which is similar to the LaunchPad in previous Workplace releases. IView IView IView SAP AG 2001, TechED Vienna, W24 /Buchholz18 18

19 1DYLJDWLRQ,PSOHPHQWDWLRQ 'HWDLOHG 1DYLJDWLRQ Budget & Monitoring Overview CostCenters Internal Orders & Projects Annual Planning Check Continuing the previous example, we see that in this case the item Annual Planning is activated on the second-level of the top navigation. The page that is displayed in the Content Area is now determined by the content of the corresponding PCD-Folder Annual Planning. In this example, the sub-folders check and planning determine folder-entries in the detailed navigation. The contained services determine the executable services in the detailed navigation menu structure. Org. Structure Assignment Employee Assignment Assets Assigned... Planning Headcount Planning QI-QIV Transfer to CO Key Figure Planning QI-QIV Automatic Cost Element Pl. Refresh Reports Manual Cost Element Adjust.... SAP AG 2001, TechED Vienna, W24 /Buchholz19 19

20 3DJHV Every Role, work set, and Role Folder can include one or more pages which determines the visualization of iviews in the content area. A page is a complete page design consisting of one or more iviews, with page layout, template settings etc applied to it. A page layout is the visual structuring of a page. In this page layout, iviews are placed in containers which determine the structuring of the page. SAP AG 2001, TechED Vienna, W24 /Buchholz20 20

21 3DJH /D\RXW,9LHZV Budget & Monitoring Overview IView CostCenters iview IView iview Internal Orders & Projects Annual Planning Check Headcount Planning QI-QIV Transfer to CO Key Figure Planning QI-QIV iview IView iview Automatic Cost Element Pl. Refresh Reports Manual Cost Element Adjust. Planning Org. Structure Assignment Employee Assignment IViews, as a special type of services, are not displayed as executable items in a detail navigation but rather occupy a rectangular space on a portal page. As we are looking at the page which is included in the folder Annual Planning, the IViews in the above example must all be included in the page. IV IV IV IV IV IV, detail navigation IV SAP AG 2001, TechED Vienna, W24 /Buchholz21 21

22 &RQWHQWV 1. A short history of roles 2. The new role concept for Enterprise Portal Role Concept for EP 5.0 and SAP Systems SAP AG 2001, TechED Vienna, W24 /Buchholz22 22

23 System Landscape Enterprise Portal SAP Central System Dev QS PRD SAP Component System Directory- Server Dev QS PRD SAP AG 2001, TechED Vienna, W24 /Buchholz23 z The role determines the visual appearance of a user s Workplace. You use it to structure the Launch Pad and the display of the Mini-Apps. A user s role determines the transactions, information, and services that he or she may access via the Workplace. The Launch Pad can contain more than one role (individual roles and composite roles) for a given user. z The following types of roles are available: y Individual roles: You create and maintain individual roles in the component systems and then transport them to the Workplace Server. The component systems contain the individual roles supplied by SAP. You can use these roles and modify them according to your requirements. y Collective roles: You create and maintain collective roles only on the Workplace Server. You create collective roles by grouping together individual roles. The collective role determines the visual appearance of the Launch Pad in the user s Workplace. z Report RSUSR070 provides an overview of the user roles that are supplied by SAP. You can use this report to generate a description of the existing roles in each R/3 System. z You can assign both individual roles and collective roles to a user. Authorization profiles are only assigned to individual roles. You can assign Mini-Apps to both individual roles and collective roles. z You can include many objects in a role such as transactions, reports, Mini-Apps, general web links, executable files, Knowledge Warehouse links, Non-SAP systems. 23

24 Step 1: Migration of roles Enterprise Portal SAP Central System Maintain Portal Roles Dev QS PRD Read composite and single roles Publish Portal Role names SAP Component System Directory- Server Dev QS PRD SAP AG 2001, TechED Vienna, W24 /Buchholz24 z The role determines the visual appearance of a user s Workplace. You use it to structure the Launch Pad and the display of the Mini-Apps. A user s role determines the transactions, information, and services that he or she may access via the Workplace. The Launch Pad can contain more than one role (individual roles and composite roles) for a given user. z The following types of roles are available: y Individual roles: You create and maintain individual roles in the component systems and then transport them to the Workplace Server. The component systems contain the individual roles supplied by SAP. You can use these roles and modify them according to your requirements. y Collective roles: You create and maintain collective roles only on the Workplace Server. You create collective roles by grouping together individual roles. The collective role determines the visual appearance of the Launch Pad in the user s Workplace. z Report RSUSR070 provides an overview of the user roles that are supplied by SAP. You can use this report to generate a description of the existing roles in each R/3 System. z You can assign both individual roles and collective roles to a user. Authorization profiles are only assigned to individual roles. You can assign Mini-Apps to both individual roles and collective roles. z You can include many objects in a role such as transactions, reports, Mini-Apps, general web links, executable files, Knowledge Warehouse links, Non-SAP systems. 24

25 Step 2: Generation of Authorization Roles Enterprise Portal SAP Central System Maintain Portal Roles Dev QS PRD Generate authorization roles Transport Publish Portal Role names SAP Component System Directory- Server Dev QS PRD The authorization administrator of the SAP system decides about the authorizations attached to the role. Transport SAP AG 2001, TechED Vienna, W24 /Buchholz25 z The role determines the visual appearance of a user s Workplace. You use it to structure the Launch Pad and the display of the Mini-Apps. A user s role determines the transactions, information, and services that he or she may access via the Workplace. The Launch Pad can contain more than one role (individual roles and composite roles) for a given user. z The following types of roles are available: y Individual roles: You create and maintain individual roles in the component systems and then transport them to the Workplace Server. The component systems contain the individual roles supplied by SAP. You can use these roles and modify them according to your requirements. y Collective roles: You create and maintain collective roles only on the Workplace Server. You create collective roles by grouping together individual roles. The collective role determines the visual appearance of the Launch Pad in the user s Workplace. z Report RSUSR070 provides an overview of the user roles that are supplied by SAP. You can use this report to generate a description of the existing roles in each R/3 System. z You can assign both individual roles and collective roles to a user. Authorization profiles are only assigned to individual roles. You can assign Mini-Apps to both individual roles and collective roles. z You can include many objects in a role such as transactions, reports, Mini-Apps, general web links, executable files, Knowledge Warehouse links, Non-SAP systems. 25

26 Step 3: Central User Management Enterprise Portal SAP Central System Central User Management Dev QS PRD Read Portal Users Synchronize SAP Users SAP Component System Directory- Server Dev QS PRD SAP AG 2001, TechED Vienna, W24 /Buchholz26 z The role determines the visual appearance of a user s Workplace. You use it to structure the Launch Pad and the display of the Mini-Apps. A user s role determines the transactions, information, and services that he or she may access via the Workplace. The Launch Pad can contain more than one role (individual roles and composite roles) for a given user. z The following types of roles are available: y Individual roles: You create and maintain individual roles in the component systems and then transport them to the Workplace Server. The component systems contain the individual roles supplied by SAP. You can use these roles and modify them according to your requirements. y Collective roles: You create and maintain collective roles only on the Workplace Server. You create collective roles by grouping together individual roles. The collective role determines the visual appearance of the Launch Pad in the user s Workplace. z Report RSUSR070 provides an overview of the user roles that are supplied by SAP. You can use this report to generate a description of the existing roles in each R/3 System. z You can assign both individual roles and collective roles to a user. Authorization profiles are only assigned to individual roles. You can assign Mini-Apps to both individual roles and collective roles. z You can include many objects in a role such as transactions, reports, Mini-Apps, general web links, executable files, Knowledge Warehouse links, Non-SAP systems. 26

27 Step 4: Generation of Authorization Role assignments Enterprise Portal Maintain Portal Role assignments SAP Central System Central User Management Generate Authorization Role assignments Dev QS PRD Read Portal Users SAP Component System Directory- Server Dev QS PRD The authorization administrator of the SAP system decides about the authorization role assignments. SAP AG 2001, TechED Vienna, W24 /Buchholz27 z The role determines the visual appearance of a user s Workplace. You use it to structure the Launch Pad and the display of the Mini-Apps. A user s role determines the transactions, information, and services that he or she may access via the Workplace. The Launch Pad can contain more than one role (individual roles and composite roles) for a given user. z The following types of roles are available: y Individual roles: You create and maintain individual roles in the component systems and then transport them to the Workplace Server. The component systems contain the individual roles supplied by SAP. You can use these roles and modify them according to your requirements. y Collective roles: You create and maintain collective roles only on the Workplace Server. You create collective roles by grouping together individual roles. The collective role determines the visual appearance of the Launch Pad in the user s Workplace. z Report RSUSR070 provides an overview of the user roles that are supplied by SAP. You can use this report to generate a description of the existing roles in each R/3 System. z You can assign both individual roles and collective roles to a user. Authorization profiles are only assigned to individual roles. You can assign Mini-Apps to both individual roles and collective roles. z You can include many objects in a role such as transactions, reports, Mini-Apps, general web links, executable files, Knowledge Warehouse links, Non-SAP systems. 27

28 &RQWHQWV 1. A short history of roles 2. The new role concept for Enterprise Portal Role Concept for EP 5.0 and SAP Systems 4. Migration of existing roles into EP 5.0 SAP AG 2001, TechED Vienna, W24 /Buchholz28 28

29 Migration of roles SAP Portals will provide role/service migration tools to be able to create EP 5.0 roles from existing composite and single roles. Migration of single roles will create services and a roles tree structure in the PCD. Migration of composite roles will create the role tree and also migrate single roles to roles on EP 5.0. In addition the necessary services will also be created. SAP AG 2001, TechED Vienna, W24 /Buchholz29 29

30 0LJUDWLRQ RI UROHV After connecting to an existing component system, which contains composite and/or single roles, a portal administrator will see this list of roles in the migration tool. After selecting the roles to be migrated, all necessary services and the role trees will be created in the PCD. SAP AG 2001, TechED Vienna, W24 /Buchholz30 30

31 Migration of roles Enterprise Portal 5.0 SAP Migration SAP AG 2001, TechED Vienna, W24 /Buchholz31 31

32 Migration of roles SAP AG 2001, TechED Vienna, W24 /Buchholz32 32

33 &RQWHQWV 1. A short history of roles 2. The new role concept for Enterprise Portal Role Concept for EP 5.0 and SAP Systems 4. Migration of existing roles into EP Generation of authorization roles in SAP systems SAP AG 2001, TechED Vienna, W24 /Buchholz33 33

34 Generation of Authorization Roles Enterprise Portal 5.0 Migration of composite roles or single roles (one time or regularly) Composite role SAP System (This is usually a development system) Portal Role Services (List of transactions) Replication followed by manual maintenance Authorization role Menu (List of transactions) Authorization data Derived authorization role Automatic generation Authorization proposals Merging proposals Generated auth.profile Generated authorizations SAP AG 2001, TechED Vienna, W24 /Buchholz34 34

35 Maintain Portal Role Enterprise Portal 5.0 PCD Editor SAP AG 2001, TechED Vienna, W24 /Buchholz35 35

36 Publish Portal Roles to SAP System Enterprise Portal 5.0 SAP Auth Admin SAP AG 2001, TechED Vienna, W24 /Buchholz36 36

37 Generate Authorization Roles SAP System Transaction WP3R In development system SAP AG 2001, TechED Vienna, W24 /Buchholz37 37

38 Generate Authorization Roles SAP AG 2001, TechED Vienna, W24 /Buchholz38 38

39 Generation of Authorization Role assignments Enterprise Portal 5.0 SAP System (This is usually the productive Central User Management system) Portal Role assignment User Portal Role assignment Replication followed by manual maintenance: The administrator selects the authorization roles or derived authorization roles which will be assigned to the user. Authorization role Derived authorization role Generated auth.profile Generated authorizations SAP AG 2001, TechED Vienna, W24 /Buchholz39 39

40 Maintain Portal Role assignments Enterprise Portal 5.0 User Management Component SAP AG 2001, TechED Vienna, W24 /Buchholz40 40

41 Publish Portal Role assignments to SAP System Enterprise Portal 5.0 SAP Auth Admin SAP AG 2001, TechED Vienna, W24 /Buchholz41 41

42 Generate Authorization Role assignments SAP System Transaction WP3R In central user management system SAP AG 2001, TechED Vienna, W24 /Buchholz42 42

43 Generate Authorization Role assignments SAP AG 2001, TechED Vienna, W24 /Buchholz43 43

44 /RJRQ DQG (QMR\ Home Budget Mgt mystaff Budget&Monitoring myprojects Knowledge Overview CostCenters InternalOrders &Projects Annual Planning Year Cost Center &RQWHQW Planning Steps Check ƒorg. Structure Assignment ƒemployee Assignment ƒassets Assigned Planning ƒheadcount Planning QI-QIV ƒtransfer to CO ƒkey Figure Planning QI-QIV ƒautomatic Cost Element Planning ƒrefresh Reports ƒmanual Cost Element Adjustments Print Results Budgeting 2002, private %HIRUH 3ODQQLQJ 5HIHU WR WKH 3ODQQLQJ 6FKHGXOH WKLV \HDU 7KH ERDUG KDV VHW KHDGFRXQW WDUJHWV DQG UHLQIRUFHG D QHZ WUDYHO SROLF\ WR FXW WUDYHO H[SHQVHV $OVR IRU QHZ HPSOR\HHV WKH LQLWLDO VDODU\ SORLF\ LQFHQWLYH RIIHULQJV KDYH FKDQJHG )RU PRUH LQIRUPDWLRQ FRQVLGHU WKH JXLGHOLQH LQ +5,QIRFHQWHU DQG 0DQDJHPHQW,QIRFHQWHU 9DULDQFH &RVW (OHPHQWV 3ODQ $FWXDO 3ODQ 3ODQ3ODQ )RUHFDVW 6DODU\ 7UDLQLQJ 5HFUXLWLQJ 'HSUHFLDWLRQ $VVHWV &RPSDQ\ &DUV 7UDYHO 'LVWULEXWLRQV 7RWDO Requests ƒchange Org. Structure Assignment ƒ Change Employee Assignment ƒ Assets Assigned ƒchange Internal Order ƒchange Project ƒ Contact HR Department ƒ Contact Financial Departments ƒ Hotline 4711 More Planning Reports ƒcost Elements QI QIV ƒkey Figures QI QIV ƒheadcount QI QIV SAP AG 2001, TechED Vienna, W24 /Buchholz44 44

45 Example of Planning a User Administration Solution 45

46 Introduction Requirements: Regionally organized teams should be able to efficiently adminster a large system landscape It should be possible to extend the system landscape efficiently It should be possible to perform the implementation project step-bystep in self-contained project phases Content of this Presentation: Planning the user administration Technical role design with separate Central User Adminsitration and mysap Workplace/Portal The system configuration proposed here is only one of many possible configurations. Similar results can be achieved with different configurations. SAP AG 2001, TechED Vienna, W24 /Buchholz46 46

47 User Administration Phase 1 Requirements: Around 6000 users Around 30 component systems Completion of the concept including all tests within two months System landscape on SAP R/3 4.6C (applications) and SAP R/3 4.6D (mysap Workplace 2.11) Additional SAP Web Application Server 6.10 (SAP Web AS 6.10) as system management instance Proposed Solution: Central User Administration (CUA) for all systems for central user administration Administration of the mysap Workplace and authorizations continues to be performed regionally by multiple teams Separation of CUA (authorization administration) and mysap Workplace (menu administration) CUA on SAP Web AS 6.10 No use yet of an LDAP server (Planned for phase 2) SAP AG 2001, TechED Vienna, W24 /Buchholz47 47

48 6\VWHP /DQGVFDSH 3KDVH Global Landscape WP HR CS CUA 6.10 WP CS CS WP CS CS WP CS CS Region EUR Region AMS Region AOA SAP AG 2001, TechED Vienna, W24 /Buchholz48 48

49 User Administration Phase 2 Requirements: > Users > 50 component systems Completion of the concept including all tests within a year Use of Enterprise Portal 5.0 System landscape on SAP R/3 4.6C/SAP R/3 Enterprise (Applications) Avoid redundant maintenance of user data Possible Basis of Solution : CUA for each regional system landscape An LDAP server Creation of employee data in the global HR system Replication of this data in to the Corporate Directory (LDAP) The employee data is added to the user data in the LDAP server The regional CUAs replicate themselves using the LDAP server SAP AG 2001, TechED Vienna, W24 /Buchholz49 49

50 6\VWHP /DQGVFDSH 3KDVH Global Landscape HR CS CS Employee data that is not confidential SAP User Data CUA 6.10 LDAP Server Meta Directory CUA 6.10 CUA 6.10 CUA 6.10 CS CS CS CS CS CS CS CS CS Region EUR Region AMS Region AOA SAP AG 2001, TechED Vienna, W24 /Buchholz50 50

51 Technical Role Design with Separate Central User Administration and mysap Workplace 51

52 The Problem... For every authorization role, multiple derived roles for administering different authorizations for organizational levels are created There is a different number of derived roles that should be assigned for each user group The mysap Workplace menu is assigned to the user using exactly one composite role If you enter derived roles in composite roles, you can assign the menu and the authorizations in one step. However, you require as many composite roles as there are meaningful combinations of derived roles. ÎFrom a certain number of roles, the regular maintenance of composite role menus becomes so inefficient that the system can no longer be administered. SAP AG 2001, TechED Vienna, W24 /Buchholz52 52

53 The Solution... Separate CUA and mysap Workplace Assignment of one or more associated authorization roles through CUA. In general, composite authorization roles are assigned in the CUA. You can also assign system-specific single authorization roles. Assignment of a composite menu role on the mysap Workplace (This assignment is also administered through CUA) Use of the fact that system-specific single roles in a composite role are not distributed if the composite role is assigned on a system other than the CUA system. Use of the fact that the menu for a composite role is only visible in the Launchpad if the composite role is assigned on the mysap Workplace. SAP AG 2001, TechED Vienna, W24 /Buchholz53 53

54 Assignment of Composite Authorization Roles CUA System Composite Authorization Role FI Clerk Europe Assignment of a Composite Role Karen Component System Accounts Receivable Master Accounts Receivable Americas Accounts Receivable Europe System-specific, derived single roles Assignments of the Single Roles Accounts Receivable Europe General Ledger Master General Ledger Americas General Ledger Europe General Ledger Europe Composite role assignments are triggered by the CUA and automatically create single role assignments for the users in the component systems The user has still not been assigned a mysap Workplace menu SAP AG 2001, TechED Vienna, W24 /Buchholz54 z There are three different types of system that play an important role: component systems, the CUA system and the mysap Workplace system. z The allocation of composite authorization roles provide the user (Karen) with all of the authorizations that she requires in the component systems to execute all of the functions contained in the composite role within a certain range of organizational restrictions defined by the composite role, but with no menu. z In technical terms: There are a large number of composite roles in the CUA system. They cover different functions as well as identical functions restricted to different organizational units. Example: There are composite authorization roles such as FI Clerk Europe in the CUA system that may consist of two derived single roles such as Accounts Receivable Europe and General Ledger Europe that together cover FI Clerk functions, but restricted to the Europe region. z The derived roles exist in the CUA system as well as in the corresponding component system. Derived roles may have a large number of brothers that are restricted to other organizational units or cover all organizational units (master roles) z The user administrator operates only in the CUA system. The administrator allocates only the composite authorization role to the user in the CUA system. CUA automatically resolves the allocation of single roles in the component systems. 54

55 Assignment of Composite Menu Roles Workplace System Composite Role Menu FI Clerk Europe Assignment of a Composite Role Through CUA Karen Component System Accounts Receivable Master Accounts Receivable Americas Accounts Receivable Master Accounts Receivable Europe System-Specific Single Roles General Ledger Master General Ledger Master General Ledger Americas General Ledger Europe Single role assignments are not distributed and are therefore not assigned to the users in the component systems The assignment of composite roles in the mysap Workplace affects only the assignment of a menu to the user SAP AG 2001, TechED Vienna, W24 /Buchholz55 z There are three different types of system that play an important role: component systems, the CUA system and the mysap Workplace system. z The allocation of composite authorization roles provide the user (Karen) with all of the authorizations that she requires in the component systems to execute all of the functions contained in the composite role within a certain range of organizational restrictions defined by the composite role, but with no menu. z In technical terms: There are a large number of composite roles in the CUA system. They cover different functions as well as identical functions restricted to different organizational units. Example: There are composite authorization roles such as FI Clerk Europe in the CUA system that may consist of two derived single roles such as Accounts Receivable Europe and General Ledger Europe that together cover FI Clerk functions, but restricted to the Europe region. z The derived roles exist in the CUA system as well as in the corresponding component system. Derived roles may have a large number of brothers that are restricted to other organizational units or cover all organizational units (master roles) z The user administrator operates only in the CUA system. The administrator allocates only the composite authorization role to the user in the CUA system. CUA automatically resolves the allocation of single roles in the component systems. 55

56 Advantages: Simpler Role Maintenance Avoids Double Menus: Assigning two functionally identical composite roles such as FI Clerk Europe and FI Clerk Chile, but different organizational data leads to double menus in the Launchpad, if CUA and the mysap Workplace are configured on the same system. Simplifies Menu Maintenance: The menu of functionally identical composite roles must only be maintained once, in the composite menu role. SAP AG 2001, TechED Vienna, W24 /Buchholz56 56

57 Advantages: Simpler User Administration You only need to assign composite roles: The use of composite authorization roles is not compulsory. It does, however, prevent the incomplete, manual assignment of single roles in the component systems and in so doing makes user administration significantly simpler. CUA on SAP Web AS 6.10 allows LDAP connection: Connecting the CUA to a Corporate Directory avoids redundant user administration and is therefore recommended for level 2. SAP AG 2001, TechED Vienna, W24 /Buchholz57 57

58 Advantages: Consistency with Enterprise Portal 5.0 Experience from large mysap Workplace projects shows that connecting the initial menu and authorizations leads to difficulties. Enterprise Portal 5.0 will separate roles from authorizations. Portal roles are maintained in the portal, while the authorization roles are created and maintained in the component systems at the request of the portal. Enterprise Portal 5.0 will not contain SAP Basis. The mysap Workplace will become superfluous, although Central User Administration remains an important part of the system landscape. SAP AG 2001, TechED Vienna, W24 /Buchholz58 58

59 :5ROH0DQDJHPHQWLQDQ (QWHUSULVH3RUWDO,QVWDOODWLRQ 4XHVWLRQV" Frank Buchholz SAP AG 6$3 6HFXULW\ &RPSHWHQFH 7HDP URL: 59

60 &RS\ULJKW 6$3 $* $OO ULJKWV UHVHUYHG No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice. Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors. Microsoft, WINDOWS, NT, EXCEL, Word, PowerPoint and SQL Server are registered trademarks of Microsoft Corporation. IBM, DB2, OS/2, DB2/6000, Parallel Sysplex, MVS/ESA, RS/6000, AIX, S/390, AS/400, OS/390, and OS/400 are registered trademarks of IBM Corporation. ORACLE is a registered trademark of ORACLE Corporation. INFORMIX -OnLine for SAP and INFORMIX Dynamic Server TM are registered trademarks of Informix Software Incorporated. UNIX, X/Open, OSF/1, and Motif are registered trademarks of the Open Group. HTML, DHTML, XML, XHTML are trademarks or registered trademarks of W3C, World Wide Web Consortium, Massachusetts Institute of Technology. JAVA is a registered trademark of Sun Microsystems, Inc. JAVASCRIPT is a registered trademark of Sun Microsystems, Inc., used under license for technology invented and implemented by Netscape. SAP, SAP Logo, R/2, RIVA, R/3, ABAP, SAP ArchiveLink, SAP Business Workflow, WebFlow, SAP EarlyWatch, BAPI, SAPPHIRE, Management Cockpit, mysap.com Logo and mysap.com are trademarks or registered trademarks of SAP AG in Germany and in several other countries all over the world. All other products mentioned are trademarks or registered trademarks of their respective companies. SAP AG 2001, TechED Vienna, W24 /Buchholz60 60