Document Version: 1.0 2014-05-21 Additional Documentation
Typographic Conventions Type Style Example Description Words or characters quoted from the screen. These include field names, screen titles, pushbuttons labels, menu names, menu paths, and menu options. Textual cross-references to other documents. Example EXAMPLE Example Example <Example> Emphasized words or expressions. Technical names of system objects. These include report names, program names, transaction codes, table names, and key concepts of a programming language when they are surrounded by body text, for example, SELECT and INCLUDE. Output on the screen. This includes file and directory names and their paths, messages, names of variables and parameters, source text, and names of installation, upgrade and database tools. Exact user entry. These are words or characters that you enter in the system exactly as they appear in the documentation. Variable user entry. Angle brackets indicate that you replace these words and characters with appropriate entries to make entries in the system. EXAM PLE Keys on the keyboard, for example, F2 or EN TER. 2 2013 SAP AG or an SAP affiliate company. All rights reserved. Typographic Conventions
Document History Version Date Change 1.0 2014-05-20 First version Document History 2013 SAP AG or an SAP affiliate company. All rights reserved. 3
Table of Contents 1 Single Sign-on in SAP S&OP... 5 1.1 SSO using X.509 Certificates... 5 1.2 SSO using SAML 2.0... 6 1.3 SSO with SAP Jam... 9 1.4 Configuring X.509 and SAML for SAP S&OP Users... 9 2 Change History... 11 2.1 Configuring Change History... 11 2.1.1 Enabling Change History for Planning Areas... 11 2.1.2 Enabling Change History for Master Data-Based Key Figures... 11 2.1.3 Enabling Change History for Key Figures... 12 2.2 Capturing Data Changes... 12 2.2.1 Capturing Changes in the SAP S&OP Add-in for Microsoft Excel... 12 2.2.2 Viewing Change History in the Web User Interface... 13 3 Virtual Master Data Type... 14 3.1 Creating a Virtual Master Data Type... 14 4 2013 SAP AG or an SAP affiliate company. All rights reserved. Table of Contents
1 Single Sign-on in SAP S&OP Single sign-on (SSO) for (S&OP) is based on SAP HANA XS security features. SAP offers two options to handle SSO: SSO using X.509 Certificates and SSO using SAML 2.0. The following points are essential to understanding how SSO works for SAP S&OP: SAP S&OP users are SAP HANA users Communication between the SAP S&OP clients (Web browser, Microsoft Excel) and SAP HANA is carried out with REST-based http on the SAP HANA XS layer Collaboration (SAP Jam) requires integration into the Cloud IdP used by SAP Jam (BizX) and a special trust connection using SAML bearer assertions to get OAuth tokens (this is not part of SAML SSO) SSO requires integration into your SSO landscape for both on demand and on premise deployment models For information on how to set up or to integrate with HANA XS for x.509 and SAML, refer to the SAP HANA Security Guide (http://help.sap.com/hana/sap_hana_security_guide_en.pdf). 1.1 SSO using X.509 Certificates The SAP S&OP Microsoft Excel user interface and the web user interface both support x.509 certificate-based authentication. In order to use x.509, satisfy the following prerequisites: Your private certificates are installed on your computer SAP HANA x.509 public certificate is configured The following diagram illustrates the SAP S&OP system overview for X.509 for an on demand deployment: SAP Sales and Operations Additional Documentation Single Sign-on in SAP S&OP 2013 SAP AG or an SAP affiliate company. All rights reserved. 5
The following illustration depicts an on premise deployment of SAP S&OP: The following diagram illustrates the x.509 authentication flow for the Microsoft Excel user interface: 1.2 SSO using SAML 2.0 SAML 2.0 is currently supported for the SAP S&OP Web user interface (browser). A future release will enhance the Microsoft Excel user interface to support SAML 2.0. The following diagram illustrates the SAP S&OP system overview for the minimal landscape of SAP S&OP for an on demand deployment: 6 2013 SAP AG or an SAP affiliate company. All rights reserved. Single Sign-on in SAP S&OP
The following picture illustrates an on premise deployment of SAP S&OP: SAP Sales and Operations Additional Documentation Single Sign-on in SAP S&OP 2013 SAP AG or an SAP affiliate company. All rights reserved. 7
The following diagram shows a SAML 2.0 flow for SSO into SAP S&OP: Although it is possible to set up a minimal environment using SAP Jam s Cloud IdP (BizX) as the only IdP, a more typical environment is depicted in the following diagram (on demand). In the reference landscape there are three IdPs: BizX, SAP IdP, and OP IdP. In this case, the on premise IdP is the central user store of the company. The role of the SAP IdP is to be either the proxy to the on premise IdP or to be set up as the central cloud user store of the company (if no on premise IdP is used or users are replicated to the cloud). In this scenario BizX is set up as a proxy to the SAP IdP. 8 2013 SAP AG or an SAP affiliate company. All rights reserved. Single Sign-on in SAP S&OP
The following diagram illustrates an on premise deployment of SAP S&OP: 1.3 SSO with SAP Jam Single sign-on between SAP S&OP and SAP Jam is part of the general setup for Jam collaboration in SAP S&OP. In this case, SAP S&OP to SAP Jam trust is established using SAML 2.0 bearer assertions to get OAuth tokens for SAP S&OP users. Please see the SAP S&OP Security Guide and the SAP S&OP Installation and Upgrade Guide (http://help.sap.com/sop) for details. 1.4 Configuring X.509 and SAML for SAP S&OP Users Prerequisite: HANA XS is already setup for X.509 and /or SAML. To configure x.509 and SAML for : 1. Navigate to the User Management window in the SAP S&OP Web user interface. 2. Create the required users. You can carry out a bulk upload of users with SQL in SAP HANA. 3. Assign roles and permissions. 4. If X.509 is configured, enable users for X.509 authentication by setting the corresponding check in the User Management screen and add the key of the X.509 certificate of the user in the popup under Configure. A typical X.509 key looks like this. Issued To: CN=User ID, O=Organization, C=Country Issued By: CN=Certification Authority, O=Certifying Organization, C=Certification Country 5. Replace all text Italics with your specific information. Note: You can usually find the pattern for your company by looking at your certificate details in a browser. 6. If SAML is configured, enable users for SAML authentication by setting the corresponding check in the User Management screen and add the user identity mapping for your IdP in the popup under Configure. This will only work after the SAML IdP is configured in SAP HANA. SAP Sales and Operations Additional Documentation Single Sign-on in SAP S&OP 2013 SAP AG or an SAP affiliate company. All rights reserved. 9
7. Enable the SAP S&OP package (sap/sop) for X.509 or SAML authentication using the SAP HANA Admin user interface. Please see the HANA XS Security Guide for details. (http://help.sap.com/hana/sap_hana_security_guide_en.pdf) for details. 10 2013 SAP AG or an SAP affiliate company. All rights reserved. Single Sign-on in SAP S&OP
2 Change History Change History allows you to capture any changes made to time series data including for example, SCM operator changes. Whenever data changes in your system in the following ways, Change History tracks those modifications: Key Figures Reason Codes Descriptions Note: Change History does not depend on SAP Jam integration. If you are an on demand customer and want to enable Change History, please contact the SAP S&OP team by filing an OSS message. 2.1 Configuring Change History Prerequisites: In order to use Change History, you must set the Change History permission for the role assigned to your user in the User Management window of the Web user interface. You can enable Change History for: Planning Areas Master Data Types Key Figures 2.1.1 Enabling Change History for Planning Areas 1. Navigate to the Planning Area and Details window in the Configuration user interface. 2. Select the Planning Area History Enabled checkbox. 3. Save your changes. Note: Once you enable Change History for a planning area, it is recommended that you retain that selection. 2.1.2 Enabling Change History for Master Data-Based Key Figures Enabling Change History for master data-based key figures tracks modifications made to key figure aggregates in the system. For example, if you change a product group of a product, and there is a key figure value for that product, SAP S&OP tracks the fact that the value now belongs to a different product group. 1. Navigate to the Planning Area and Details window in the Configuration user interface. SAP Sales and Operations Additional Documentation Change History 2013 SAP AG or an SAP affiliate company. All rights reserved. 11
2. Select the MDT-based Key Figure Changes Enabled checkbox. 3. Save your changes. Note: Once you enable Change History for master data-based key figure changes, it is recommended that you retain that selection. Caution: This setting is not recommended because it will track every change for the Master Data Update and increases the table size, thereby affecting performance. For most implementations, this setting is not required. 2.1.3 Enabling Change History for Key Figures Enabling Change History for key figures tracks key figure changes for specified key figures. This feature is available only for stored key figures and their dependent calculated key figures. You cannot track individual, calculated key figures. For example, if the calculated key figure Revenue depends on two stored key figures, Price and Quantity, and they are history enabled, then changes to Revenue will also be captured. If only one of those stored key figures is history enabled, then any changes tracked for Revenue will be incorrect. In order for calculated key figure changes to be accurate, then all stored key figure inputs to that calculated key figure must be history enabled. To enable Change History for key figures: 1. Navigate to the Key Figures window in the Configuration user interface. 2. Select the key figure whose data changes you want to track 3. Select the History Enabled checkbox. 4. Save your changes. Note: For best performance, SAP recommends that you select a maximum of three key figures for change tracking. 2.2 Capturing Data Changes You can capture changes to data through the SAP S&OP Add-in for Microsoft Excel and the Web user interface. 2.2.1 Capturing Changes in the SAP S&OP Add-in for Microsoft Excel 1. Navigate to the SAP S&OP Add-in for Microsoft Excel. 2. Select the planning view you want to change. 3. Make your changes. 4. When the Save Key Figure Changes dialog appears, enter a reason code and a comment (optional). 5. Click Save. Note: You can only save changes for stored key figures that are history enabled. 12 2013 SAP AG or an SAP affiliate company. All rights reserved. Change History
2.2.2 Viewing Change History in the Web User Interface You can only track changes for the baseline value in scenarios. If those values change, the changes are displayed in the Change History window with a reason code of Scenario Copy. If you make changes to the data from the SAP S&OP add-in for Microsoft Excel, these modifications are tracked and displayed in the Change History window. When you execute a Statistical Forecast, this appears in the Change History window with the Statistical Forecast reason code. To view Change History in the Web user interface: 1. Select the Change History navigation icon. 2. Select the Planning Area dropdown. This displays planning areas that are enabled for Change History. 3. Using the Changes From and To fields, select the date range for which you want to display data changes. 4. From the Data filter, select at least one object type (i.e., key figures, attributes, and time periods). The key figure filter list only shows stored key figures that are history enabled, along with their dependent calculated key figures. In the Attributes filter, you can select any attributes and also filter for attribute values. Time selection filter represents your planning horizon (i.e., monthly, yearly, quarterly). 5. Click Run. This displays your specified data changes in the Change History Results area of the window. The changes are sorted based on the Change Date field. You can use this functionality for key figures at any aggregated level. 6. Click the Download to CSV button to export your data changes to a CSV file. 7. Click Edit View to modify the displayed data. When you execute a data load and the data changes, this appears in the Change History window with the Data Import reason code. SAP Sales and Operations Additional Documentation Change History 2013 SAP AG or an SAP affiliate company. All rights reserved. 13
3 Virtual Master Data Type Virtual master data types are used to create a join between two or more master data types. For example, you can use a Virtual Master Data Type for the following case, in which: There are the Master Data Types S1PRODUCT, S1CUSTOMER, S1LOCATION The S1CUSTOMER master data type has the key CUSTID and attribute CUSTOMERGROUP There is a Master Data Type S1PRODUCTCUSTOMERLOC with an attribute of, say, ACTIVE defined at an aggregated level of PRDID, CUSTOMERGROUP and LOCID You can define a Virtual Master Data Type to join the S1CUSTOMER and S1PRODUCTCUSTOMERLOC master data types on CUSTOMERGROUP, such that the ACTIVE attribute can be available to PRDID, CUSTID and LOCID level. 3.1 Creating a Virtual Master Data Type 1. Click the Configuration navigation icon. 2. Select the Master Data Types window. 3. Click NEW to enter a name for the Master Data Type, for example, S1VPRODUCTCUSTOMERLOCATION. 4. From the Master Data Type dropdown, select Virtual. The Composed Of area appears in the Master Data Types window. 5. Click the + icon to add Master Data Types to the Composed Of area. You must select a minimum of two Master Data Types. All master data types are supported in the virtual master data type's functionality. For example, select S1CUSTOMER and S1PRODUCTCUSTOMERLOC. 6. Click the Join Conditions icon. 7. Select the Master Data Types and Attributes you want to join. Only those Master Data Types selected in the Composed Of area are available in the Join Conditions dialog. The Attributes must have data types of an equal value, for example, both must have nvarchar or timestamp. For example, define a join on S1CUSTOMER- >CUSTOMERGROUP = S1PRODUCTCUSTOMERLOC->CUSTOMERGROUP. Note that a join condition can be optional, in which case the Virtual Master Data Type returns all possible combinations of the composed of Master Data Types. 8. Click OK. 9. In The Attributes Assignment area, the key fields associated with the Composed Of Master Data Types are selected by default. Select the Reference Attributes and Reference Master Data Types for each of the attributes selected. When you select All Attributes from the Assigned Attributes dropdown, all attributes are available for selection. The Reference Attributes are a selection of available attributes from the Master Data Types you selected in the Composed Of area. For example, refer to the following table: 14 2013 SAP AG or an SAP affiliate company. All rights reserved. Virtual Master Data Type
10. Save your changes. 11. Activate your changes by clicking the Activate icon. 12. Click the Logs icon to view the status of your operation. Once the activation is complete, all of the objects your activated show a status of Active. Note: If you mark the Master Data Types in the Composed Of area for deletion, the join conditions and all attributes associated with those Master Data Types will also be marked Pending for Deletion. You can independently mark for deletion the attributes and the join conditions associated with the Master Data Types defined in the Composed Of area. SAP Sales and Operations Additional Documentation Virtual Master Data Type 2013 SAP AG or an SAP affiliate company. All rights reserved. 15
www.sap.com/contactsap Material Number 2013 SAP AG or an SAP affiliate company. All rights reserved. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice. Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors. National product specifications may vary. These materials are provided by SAP AG and its affiliated companies ( SAP Group ) for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty. SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and other countries. Please see www.sap.com/corporate-en/legal/copyright/index.epx#trademark for additional trademark information and notices.