CUA Implementation

[Former Member]

Dear Experts,

Currently we are planning phase to implement CUA in our IT landscape.

We have systems like ECC, CRM, BI and solution Manager. We plan to implement Solution manager server as Parent system.

Each child system we have separate roles.

ECC ->ZECC_ROLES (Total 6 roles)
 CRM ->ZCRM_ROLES (Total6 roles)
 BI -> ZBI_ROLES (Total8 roles)

Some users we create only at ECC, some of them only create in ECC & CRM and some of them in all system.

1.In case to (parent system) create/distribute a user(test01) for all the child system, how to assign the roles to a user in Parent system. We want user(test01) should be assigned only ECC 6 roles in ECC System. the Same user at CRM should be assigned to only CRM related 6 roles. similar way BI also.

Could you please someone let us know how to handle the role allocation separately in CUA Central system(parent system) ?.

Thanks

Malai

[sdipanjan]

Please go through the following SAP Help descriptions and let us know if you have any doubt:

[Operating Central User Administration|http://help.sap.com/saphelp_nw70ehp1/helpdata/en/08/ed591f9ff00343952f11a7b707f28a/frameset.htm]

[Central User Administration (CUA)|http://help.sap.com/saphelp_nw70ehp1/helpdata/en/8d/270bea613d2443bad6ce0524f08ca0/frameset.htm]

Regards,

Dipanjan

[mvoros]

Hi,

after you set up a CUA then you will realize how you can do it. The transaction SU01 will display additional fields. The easiest way to implement CUA is to follow CUA cookbook (just search for CUA cookbook).

How many CUAs do you want to have in your landscape? Have you thought about having separate CUA for production environment? You can have one CUA one for DEV and QA systems and one for production systems. This set up gives testing environment where you can test how it works and then roll out same changes for production systems.

Cheers

[Henrik1]

"You can have one CUA one for DEV and QA systems and one for production systems. "

I would highly recommend this for a number of reasons. As already mentioned, you can test your settings, but it will also allow for easier segregation of access for user admins if required. Furthermore, your production system is most likely a high-availability system, where as development may not be. So depending on where you put your CUA, you need to keep that in mind.

But apart from that, it is really easy to use, and not at all difficult to set up.

[Former Member]

Dear Henrin/Martin:

Thank you very much.

We are going to setup a single CUA at Solution Manager server. Why because we frequestly to do the system refresh of QUA and DEV systems.Plan to implement at DEV, QUA & PRD system.

Could you please tell me

1. How to handle the user allocation in PRD child system. The same user will have different roles like ECC,CRM & BI.

(Assuming that all the child systems roles copied into parent system right). in this case when i create a user<AAAAAA> for all the system (ECC, CRM & BI) in Parent system. For ECC child system user <AAAAAA> should be assinged only ECC roles. For CRM child system same user <AAAAAA> should be assinged only CRM roles, simalary BI too.

Is it possible to allocate the roles individually on system basis for one user.

Thanks

Malai

[mvoros]

Hi,

just read SAP documentation. The first link posted to this forum contains the following quote which answers your question.

The Roles and Profiles tab pages each contain an additional column for each entry, specifying the system for which the user is assigned the role and/or profile.

Cheers

[Bernhard_SAP]

> We are going to setup a single CUA at Solution Manager server. Why because we frequestly to do the system refresh of QUA and DEV systems.Plan to implement at DEV, QUA & PRD system.

Just to give you an idea what steps are necessary if you want to perform a client copy, pls read also:

https://wiki.sdn.sap.com/wiki/display/Security/Bestpractice-HowtoperformaclientcopywhenCUAisactive

b.rgds, Bernhard

[Former Member]

Hi,

You dont need to create the roles in the parent system. The roles should be created in the respective system landscapes which would be the child systems. you can assign the same user the different roles in the different systems by selecting the respective systems and the roles available in there. The Roles tab in the UMR of parent system gives the option of selecting the system and the roles available in the respective system.

However it is recommended to have a seperate CUA system/client for the production and non production systems.

[Former Member]

Thanks

[Former Member]

Hi Thirumalai ,

Yes , you will be able to assign roles to user profile with respect to what system and roles does user requires access. After setting up central system and completing all configuration steps with child systems , you will be able to find an extra tab " SYSTEM " in central system which you cannot find in decentralized system. In this field you can enter the logical system name of the system (ECC / CRM /BI) in which does user access is requested. There after in role tab you need to enter the logical system name in system field and respective role namesin the role filed respectively and then save the user profile.

Please note that when ever you create any role in the child system landscape(i.e for example in ECC systems) you need to complete the text comparision from central system to child system , else the newly created roles will not be replicated to central system and you will not be able to perform any role assignments in the respective child systems.

Regards

Kantikiran