CUA, best practices

[Former Member]

We got ECC(DEV,QA,PR), BW(DEV,QA,PR), CRM(DEV,QA, PR), Solution manager. so totally 10 clients. I was looking for best practices for implementing a CUA.

I seen clients who did CUA in soltionmanager for 3 clients of a same system.

I worked on CUA system in which we used production as a CUA master for (DEV,QA,PR in ECC) .

I know we can use dedicated system or solution manager as CUA master.

my question is

how good it will be at performance level if we go for CUA in Sol. manager for all 9 clients. Is it possible?

We don't want to go for 3 CUA's on each system.I mean BW,CRM,ECC.

well, I am very much confused with these permitations and combinations.

Can I got some advice on this please.

[morten_nielsen]

Hi Keerti

Go for a single CUA Master client, the "central" part of CUA gets lost if your creating three CUA System.

Depending on the sizing of your hardware off course, I can't see any problem at all for controlling 10 client from the Sol Man you will find a lot of CUA system out there with more than 10 clients. If needed you can run there distribution of user as a background job, but in my humble opinion - that's a lousy solution.

What I always recommend is to find a system with a high version, security and availability level, and use this as the master.

Another good point would be to set it up using Trusted RFC's, by doing so you will get the "correct" audit trail in your SUIM report / Change document.

And a last - Check and apply all relevant OSS Notes.

Regards

Morten Nielsen

[WolfgangJanzen]

Yes, the general recommendation is that the CUA master system should have a newer release - for one quite simple reason: with each release new functionality will be provided, preserving downwards-compatibility (i.e. the new release contains the old features plus some new ones; additional user attributes will have to be optional - with well-defined default values).

If the CUA master stores more user attributes than the CUA client systems can handle, then the CUA client systems simply discard them. However, if the CUA master system lacks some user attributes then those user attributes will have to be set to their default values in the CUA client systems (if the release of the CUA client system is higher than the release of the CUA master system).

Last not least: each new release might also contain better tools (here: for user management). So, it's advisable to use the latest release for the CUA master system (to be able to benefit from those enhancements).

Cheers, Wolfgang

[Former Member]

Hello,

We are using a consulting company to set up and manage our SAP environment. They are only recommending one CUA for all environments and clients. The CUA will service DEV, QA, and Production. I am estimating there will be at least 15 to 20 clients. I have been searching for a recommended architecture or best practices on setting up CUAs, but have not been able to find much information. We are also integrating portal and CUA with Active Directory for single sign on. Any recommendations or help on this would be appreciated. Thank you.

[Former Member]

I would not recommend having one CUA for all systems. At least you should have a split between Prod & the rest. The main reason for this is that if you have a central CUA, you cannot perform any testing or validation on that CUA without affecting all the systems that are serviced.

Out of preference I prefer separate ones for Dev, Test & Prod to keep the same logical separation withthe administration.

Not sure of the SSO impact, there are a few posters on here who know their stuff in that area & will be able to advise.

[Former Member]

Robert,

I have to agree with Alex on keeping your CUA on separte landscapes (DEV, QA, PROD). Base on my experience it will be a nightmare of having one CUA on all my landscapes and clients. In my production system I have 40,000 User IDs alone. I don't want all those user IDs in DEV and QA. With portal coming into play your CUA will play a more critical role with UME settings.

Example: If you have 3 environment for CUA (DEV, QA, PROD) you can properly test security roles and Portal iViews from DEV->QA->PROD. I have built and rebuilt CUAs numerous times. I highly recommend keeping a CUA for each landscape.