CUA-Impact Analysis and Fail over strategy

[Former Member]

Hi All,

we are planning to implement CUA in our solution manager.

pls share your views for the following.

1. What will be the possible impact in the exisitng landscape.

2. what will happen when the Central system is down. Is there any fail over strategy followed as a best practise.

3. Implementing CUA in solution manager is ok or which system will be ideal for CUA Implmentation.

Thanks,

Subhashini.

[Bernhard_SAP]

this ongoing discussion might be also interesting for you:

[Bernhard_SAP]

P.S.:

and for

> 2. what will happen when the Central system is down. Is there any fail over strategy followed as a best practise.

-->SAP note 320449

b.rgds, Bernhard

[Former Member]

Hi Bernhard,

Thanks for your reply.

from the mentioned thread I understood that....

Implementing CUA in solution manager is OK.

and It should be High available system(we have two system landscape only SMD and SMP).

Now again I have one more question.

1. what will the fail over stategy that we can maintain to avoid such downtime.

2. Can we implement 2 CUA groups in the two systems.

kindly share your views as I just started learning about CUA.

Thanks,

Subhashini.

[Former Member]

Hi Subhashini,

Implementing CUA in solution manager is ok or which system will be ideal for CUA Implmentation.

At previous client place they had installed solution manager & CUA in one system (i.e client is different for both)

Child system connected to CUA are : BI ,SAP 4.7(upgraded to ECC6.0)

Thanks,

Sri

[Former Member]

Hi Sri,

Thanks for your reply.

I saw the note 320449 and found that the corrections are given for SAP_BASIS Release 610 to 640. but our release is 701. will it suit us.

Kindly advice.

Thanks,

Subhashini.

[Former Member]

>

>
> I saw the note  320449  and found that the corrections are given for SAP_BASIS Release 610 to 640. but our release is 701. will it suit us. 

The note is classified as 'Recommendations/Additional Info'. So yes, it will suit you.

>

>
1. what will the fail over stategy that we can maintain to avoid such downtime.
2. Can we implement 2 CUA groups in the two systems.

<ol>

<li>You cannot avoid all downtimes, but apart from 'usual maintenance' a SolMan is one of the systems in a landscape that you can keep a little more quiet when it comes to downtimes or jo-jos. It doesn't change so very often for: instance parameters, re-arringing of file-systems, database-restarts due to parameters etc. etc. which all other systems -IMHO- face more frequently than a SolMan. I don't know about that (in)famous Hotpackage 18, but seems there was a 'minor' catastrophe. Does that answer your question or did you mean something else by 'fail-over-strategy'?

<li>Please explain what do you mean with 'CUA-groups'??

</ol>

[Former Member]

Hi Mylene,

Thanks for the reply.

The reply clarifies my Question 1.

And Regarding Question 2. My explanation is

I read that it is a good practise to group dev and Quality system in one CUA group and Production systems in the other CUA group to avoid confusion .

I was thinking of how to implment this groups whether in the same system but different clients. or in different systems.

I have not practically done CUA. So Kindly correct me if am wrong in my explanation.

Thanks,

Subhashini.

[Former Member]

I'm sorry, but I never heard of 'CUA groups'. Can you please provide a link to that document where you read that? I would like to study it myself, so as to get an impression what exactly it means ... thanks in advance.

[Bernhard_SAP]

> I have not practically done CUA. So Kindly correct me if am wrong in my explanation.

Therefore I suggest, that you set up first a small CUA from your TST/DEV Solman to one or two DEV/TST clients as child system of that CUA. Then play around a bit to get used to the handling of a CUA. connect your QAS/PRD systems only after you are firm with the handling.... If you want to run only 1 master system for all of your systems or use 2 CUAs is your consideration.

It depends for instance on:

number of different users in your DEV / QAS-PRD systems (if you have only devlopers in your DEV, which do not exist in QAS/PRD the impact of having 2 central systems is not too big)

Hardware ressources (remember: CUA uses ALE - 3 idocs per user and assigned system for every change)

Number of users at all

number of admins

etc.

So just test a small CUA landscape first. Think over your expiriences and enlarge/setup the landscape(s) upon your expiriences (connecting all systems at once bears a risk for all conncted systms of course, so connecting one by one migth be a good idea...)

good luck.

Bernhard

[Former Member]

Hi CUA,

is slowly being phased out, why not find out if you are going to use GRC 5.3 / IDM 7.1 .

In our previous project implementation we had CUA and solution manager on one system as users started growing system was going down atleast 3-4 four times a week.

Then we realised it was the user to role assignment in bulk, this was impacting the functioning of Solution manager also.

we finally had to create a zprogram which will force security team to make changes to specific logical systems in the landscape. Of course we did not plan to have CUA for the production, GRC 5.3.

Remember CUA works only on the ABAP . GRC 5.3 can provision on both ABAP + JAVA Systems

Edited by: Franklin Jayasim on Jul 28, 2010 6:43 PM

[Bernhard_SAP]

Hi Franklin,

who from SAP told you, that CUA is slow phasing out?

...by the way Franklin: we are waiting for your feedback in thread

thx, Bernhard

[Former Member]

>

> 
> is slowly being phased out, why not find out if you are going to use GRC 5.3 / IDM 7.1 .
> 

Yes, some of the SAP salespersons (sorry Bernhard, but it's true - ours tried the same) are using arguments along those lines ("will one day run out of maintenace, since it is to be substituted with ...") to get IdM sold. Franklin, if you had tried to verify such by searching SMP, SDN and a couple of other places, you would have found out that there's no real data on this assumption (as of now).

Anyway - instead of stating (yet another) unveryfied phrase, you could have asked the board here - I am absolutely convinced that the SAP moderators of this board would have found out for you and answered.

>

> 
> In our previous project implementation we had CUA and solution manager on one system  as users started growing system was going down atleast 3-4 four times a week.
> 
> Then we realised it was the user to role assignment in bulk, this was impacting the functioning of Solution manager also.

If such a problem occurs, wouldn't that be exactly what 'Basis people' are for? Find the cause and a solution? It can be solved ...

@Subhashini: good luck - it will be interesting to read your opinions when you update this!

[Former Member]

> If such a problem occurs, wouldn't that be exactly what 'Basis people' are for? Find the cause and a solution? It can be solved 
>

I have seen the problem many times before. The basis team are not being given enough biscuits and other treats.

[Former Member]

Hi All,

I have very bad experience with CUA. Not just me our whole team had to run around the Basis team in circles.

can it be corrected using HA/Alternative plans(yes) , will the company/Client be ready to invest to do it when they can get the work done using GRC/IDM?

The question asked at one of the clients place during discussion is why do I need CUA , GRC & IDM all at the same time?

[Former Member]

Can I assume from this advice that you have not done any performance testing and tuning with GRC and IdM either?

> The question asked at one of the clients place during discussion is why do I need CUA , GRC & IDM all at the same time?

Basis folks love such surprises from "discussions"... and biscuits won't get you very far. Chocolates and more CPU power maybe...

An imaginable scenario is to provision all non-PROD systems from CUA and PROD environments from IdM with the users. GRC is optional then depending on the components used and how the roles (concept) are built in the first place...

Cheers,

Julius

[Former Member]

> 
> Basis folks love such surprises from "discussions"... and biscuits won't get you very far. Chocolates and more CPU power maybe... 

British caramel shortcakes, more CPU, more memory and faster disks )

I remain unconvinced. I cannot see where IdM, GRC should have no issues at all, while CUA on SolMan is a problem child. Obviously there was something very wrong with that SolMan installation - performancewise.

May you fare better with IdM and GRC - consider making them HA and do some performance-testing/tuning while you're at it - so that your CUA problems will not return ...

Edited by: Mylène Dorias on Jul 30, 2010 8:48 AM

Come to think of it - I would appreciate it very much, if you could make that Z-Abap available to us - could be a live-saver!!

[Former Member]

Regarding GRC performance and High availability & automatic provisioning I have not found any technical issues.

two customers are happy with the stable performance so far and they do not have CUA,

[Former Member]

Hi Julius,

GRC yes , experienced few issues related to risk analysis, but SAP supported and corrected some of the settings and gave steps on how to enable logging in a clustered environment.

IDM only one implementation so far, I do not want to comment until I HR trigger.

CUA- is question mark due to the progression of tools from SAP to administer on both JAVA & ABAP with automization.

In the present project the plan is to check out authentication methods for SSO. There is a performance/Infrastructure team who is planning to handle the hardware , performance & tuning

[Former Member]

Hi Julius,

"An imaginable scenario is to provision all non-PROD systems from CUA and PROD environments from IdM with the users. GRC is optional then depending on the components used and how the roles (concept) are built in the first place..."

At the clients place where CUA was an issue, NON-PROD ( CUA with that Zprogram is used) but password resets until the "GO LIVE phase" is through GRC5.3 ( this saves a lot of time for security team). IDM( POC state) scoped for production only after Go LIVE phase.

[Former Member]

Hi Mylène Dorias ,

With Help of SAP who resolved performance & tuning issues(of course my configuration mistakes) GRC has been stable at three of the client sites its being used successfully

IDM is a very big challenge( since I am new maybe ) to install & configure , but one of the client in Atlanta ( famous soft drinks company guess !!!!) when they talked over the phone they told me that they have more than 100 ( IDM 7.0 ) repositories well configured and stable for the past two plus years , user and role administration is very successful.

I am not a supporter of GRC or IDM please do not misunderstand , I am just throwing the decisions made by some of my clients. CUA issue was only with one client ( in the year 2008).

The biggest advantage I see in GRC/IDM is provisioning on the Java side

[Former Member]

Hi Mylene,

pls find below the link from where i got the idea.

Kindly check it.

thanks,

Subhashini.

[Former Member]

Thank you, Subhashini, for the link. That was an interesting read. I never considered having more than one CUA - I mean that loses me the 'C' of the thing, no - make it a DcUA (de-central)?

What I did not really understand, was the statement of John Navarro, claiming - I quote:

I don't want all those user IDs in DEV and QA. 

I cannot wrap my brain around this statement - why would I not want my PRD-users in my QAS?? I mean, I can understand not wanting them in my DEV, but QAS - for gods sake ... that's where I exspect them to test ... all of them (not at the same time, maybe, but ...). How would one go about CUA-attributes that were to be 'redistributed'? For example: I have set the users last name and a couple of other data on the 'address'-screen to 'redistribute' (same for all values in tabstrip 'parameters') - because I am too lazy to maintain users every time they marry, get divorced, move around in the company building, switch departments, having new telephone-numbers etc., so they are to maintain those data themselves and I redistribute them to the CUA master. If I were to have -say- two masters: one for the PRD-systems, one for the QAS-systems ... how would I get them to synchronise the redistributed values?

I have no idea. Really. Take into account, having more than 10 portals on the landscape that need several backend-systems at once - o.k. this is getting too complicated.

So: no - I would keep all of them central in one SolMan and make that SolMan a HA-solution and take great pains to get the sizing right. We are talking a SolMan-landscape here - two at least: DEV and PRD, where PRD is HA. Three would be better - for testing aspects.

[Former Member]

> What I did not really understand, was the statement of John Navarro, claiming - I quote:
> " I don't want all those user IDs in DEV and QA. "
> 
> I cannot wrap my brain around this statement - why would I not want my PRD-users in my QAS?? I mean, I can understand not wanting them in my DEV, but QAS

I had issues with my forum points and decided to search for my name and voilau2026 I saw this thread

Sorry Iu2019m late on the party I can see your point on possibly wanting your Prod users in QA for testing but in my case I donu2019t need 40k users in DEV for unit testing but itu2019s your choice. There is always a number of ways to configure CUA and each CUA design is based on system limitation or other business requirements.

We have HR position base security and the HR data is managed in PROD ECC 6.0 and not in Solution Manager, thatu2019s one reason we have our own CUA for PROD (ECC 6.0, SRM 5.0, BI 7.0, SUS, etc). In our shop having CUA in multiple landscapes (DEV, QA and PROD) is beneficial. We can almost expect the same results in security as we move through different environments.

Somebody posted a nice discussion page on the Pros and Cons of CUA and I canu2019t seem to find it, it was a good read on CUAu2019s.

Mylene, sorry if you lost sleep on my old post but I can see your point on how you came about your CUA design.

Edited by: John Navarro on Aug 27, 2010 11:28 PM - ECC 6.0 for PROD

[Former Member]

Hi Mylene,

thanks for the reply.....

Am totally confused now....

As per your suggestion can we go afhead like this

All the Dev systems will be having the Central system- SMD(Solman development).

All the QAS and PROD systems will be having the central system- SMP(Solman production) which is a high available system.

Kindly share your view whether my understanding is correct or not.

Thanks,

Subhashini.

[Former Member]

Do not rely solely on what I write

Hopefully there are others to join this thread ...

And no - I would keep all of the system-landscapes (DEV/PRD/QAS) together in one big SolMan ...

[Former Member]

Hi Bernhard,

Thanks for your reply.

I have started the test implementation of CUA in our solman development box.

Will update you all once done.

Thanks for all your support. The thread gave me lot of information about CUA.

Regards,

Subhashini.

[Former Member]

Hello all --

I work with subashini on the same assignment.. I went through all the posts on this topic. Thank you all. Thought of sharing some of the details of this requirement so that it may help us to get a suggestion .

The volume of user base for our landscape would be around 2300 SAP ABAP users(ECC users--1800, BW users -- 400, SRM users --100). Apart from these users we have nearly 35000 ESS users who login through portal. They have an Communication ID created in ABAP system which are used to fetch details to portal.

Now that we will need to implement CUA we have below criteria

1) Total production Users(Some will have dev & QA access) that SOLMAN CUA is about to handle is approx 38000.

2) The SOLMAN System is not a HA system. Its not a cluster system. Also the config of the system is also not great ( Need to get the config details from the basis team).

3) Also client is not ready to spend on GRC/IDM. We do have approva but its not in good shape.. Doubt approva has a IDM facility as well.. Need to explore the same. Please give your suggestion on using approva.

With above constraints we will need to find a failover statergy for SOLMAN CUA. Please suggest your options. Once SOLMAN CUA goes down will there be any way that we will be able to create/modify users access in a system that fall's in CUA. Please post us any available options(even can be custom). Also post your suggestions of using approva as an option.

I saw frank posting on Z program when there was a performance issue in solman. If possible please give the details of the same.

[Former Member]

HI Sridhar,

Sorry to respond so late, I was on travel.

when I come back to Arizona, I will surely let you know the program name(I dont remember)

I will have to search my emails and give you the correct information.

I can do this probably Monday/Tuesday.