Provisioning to ABAP not working

[Former Member]

I am trying to get provisioning working to one client in our Dev ABAP system (had to start somewhere), and I can't get it to work. I have the UI set up and it seems to work fine, as far as assigning abap roles/privileges. When I assign or unassign a role for a user in the UI, it appears to work, as it shows up in the Provisioning Audit with status of OK. However, the changes are not making it to the abap client. I am not seeing any errors. We copied the SAP Provisioning Framework that we loaded into our own folder, and modified the jobs/tasks there. We are using IDM 7.1 SP5. Any suggestions as to what I might be missing? As a newbie to SAP and IDM, I have read every single guide that I can find on IDM, but it seems that the provisioning to SAP documentation is a little lacking. Any help would be greatly appreciated!

[former_member2987 · Accepted solution]

Lori,

There's a couple of things I would check. Sorry if I've listed anything you've already done.

1. If you're usign the IDM Provisioning Framework, copy the ABAP provisioning tasks to a new folder. This helps to make sure you're not over writing either the framework or other ABAP provisioning tasks.

2. Make sure all tasks are enabled and have dispatchers assigned. You'd be surprised how often this is a problem

3. There are a number of constants that will be assigned within the IDM tasks for connection to the ABAP system. Verify that they are correct.

If you're still having trouble take a look at the Job Logs. Are the Jobs even firing?

Matt

[Former Member]

Matt,

I don't know if the attributes are correctly set in the task, because I don't know what they should be. There is a long list of attributes in my tasks.

Yes, I have tried testing the task, it says it runs OK, but the actual provisioning doesn't happen.

I tried disabling and enabling all of the tasks in this task group, that didn't help.

Thanks,

Lori

[Former Member]

Well, we finally got provisioning to work to ABAP. I think it was because we were assigning the person to the role, not the role to the person.

[former_member2987]

Can you explain in more detail?

Thanks,

Matt

[Former Member]

We were bringing up the person, and assigning the role that way. After we brought up the role, and assigned the person to it, it provisioned.

[Former Member]

Sorry, I actually stated that backwards. We now select the person, and assign the role to that person. I think this was two different issues. I also could not get provisioning to work by just assigning the business role, I also had to assign privileges, which should have come with the business role. I resolved this by adding the mx_autoprivilege attribute to the mx_role entry type. Now the privileges that are assigned to the role provision when the role is assigned. Thanks to everyone who helped.

Lori

[Former Member]

1. Yes, we created our own Provisioning folder and copied all of the SAP Provisioning Framework into it. I am working with the copies.

2. Yes, I have verified they are enabled and have dispatcher assigned and active.

3. Constants - If you are referring to Job constants, some have them and some don't. I really don't know how to tell if they are correct or not.

I just unassigned and assigned a role to a user, it shows up in the UI Provisioning Audit as OK, but I am expecting the ProvisionABAP task group to run but it doesn't. There is no joblog.

In comparing the SAP Provisioning framework that I copied, I am noticing that the task "Group System provisioning" which is in the ProvisionABAP task group has a Links tab with links listed on it. However, my copied task does not have a Links tab at all. How do these links get created? Could this be my problem?

Thanks Matt for your response, I am so appreciative of any help you can give me.

Lori

[former_member2987]

Lori,

Regarding the constants: Check with a BASIS person in your organization to make sure that these values make sense for the system you are connecting to.

I don't recall the task off the top of my head, but make sure the sub tasks are all there and that there are no conditional tasks that need to be customized and that there are no event or error handling tasks going on.

Matt

[Former Member]

What I don't understand is, why does the test provisioning task run through all of the tasks and say it worked? If there was something wrong in the tasks configuration, wouldn't it fail? I did find a warning message in the Identity Center joblog after I ran the test that says "Cache TIMEOUT: 30********* But it has a 1 under Mod and Total as if it worked. I don't know what to do with this cache timeout.

Lori

[former_member2987]

Lori,

You raise a good point here. Are the attributes correctly set in the task? Maybe it's not doing anything, so nothing can happen.

Have you tried testing just the task?

Also, I've seen this before, make sure the pass is enabled. Try disabling the pass, and then reenablling it.

Matt