Automatic Creation of Roles and Role Mappings in GRC

[Former Member]

Hi,

we are planning to use SAP Identity Management and SAP GRC Access Management.

In SAP IDM we have defined several business roles that contain privilieges in SAP systems. When a user is requesting a role, the request will first be sent to SAP GRC for approval and risk checking.

In order to get this to work, we need to load the business roles of SAP IDM into SAP GRC and we also need to configure the role mapping between the business roles and the technical SAP privileges.

From what I understood, this could be implemented by loading the required information via Excel filles into SAP IDM.However, this is a quite cumbersome and error-rpone approach an we would like to automate this.

Is there a way to use e.g. web service calls to create/delete roles and role mappings in SAP GRC?

BTW: is a documentation of all available GRC web service calls and their parameters available?

Thanks for your help in advance!

Best regards

Tom

[koehntopp]

Hi Tom,

as stated before, the web service description is in the config guide.

Unfortunately there is no web service to create roles or even mappings in CUP - this is one of many I would also like to se created

I don't think in your context you will be able to directly send Business Roles to CUP. The role mapping only happens after you send the request, so I'm not sure if that's in time for risk analysis - you will need to try that.

Are you a customer or a consultant - anyway, feel free to contact me if you need further help integrating CUP and IdM. This is an evolving interface with many possible scenarios, so it's not easy to give you good advise without seeing the full picture.

Frank.

[Former Member]

Hi Tom,

Check out the below HOWTO guide on GRC and IDM integration:

http://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/b0da2dba-0480-2b10-a7ae-f055ab6e9...

Regards

-Ranjiv

[Former Member]

Tom,

There is a document available for all the available GRC web services. As far as I know, there is no web service which will allow you to manipulate the role creation/updation/deletion in to GRC CUP.

Regards,

Alpesh