SAP Provisioning Framework

[Former Member]

Hi,

I have a very basic question on SAP Provisioning Framework 7.2

In one of existing implementations, I have seen SAP PF being used. They had imported this framework and pointed the "ProvisionABAP" and "DeprovisionABAP" tasks in the ABAP repository under "Event task". Once this was done, the moment they assign a role to a user from the IdM UI, it magically started assigning the technical role to the user. If this user doesnt exist in the system, it also would create this user. Everything is fine.

My question is what are the other tasks for under the below folder? There are task to lock a user, change the password, Set ABAP role & Profile etc..

Is it correct to assume that I can enable these tasks as 'public', make them appear in the IdM UI and be able to select this task in the IdM UI inorder to say lock a user or change the password ? Doesn't it require anything else to be done ?

I am really not able to understand the full power of this Framework. I don't see many documents/Use cases on how this framework can be used more extensively.

[Former Member · Accepted solution]

Hi Gandalf

The tasks under AS ABAP Tasks are the building blocks for the hook tasks and shouldn't be called directly.  They will execute but on a single repository rather then every repository which is probably not what you're after.

Essentially, you want to modify the user data through a UI task.

Use this to trigger the appropriate hook task on each repository that the user is a member of.

The framework will do the rest.

The triggers can be done through subordinate tasks, attribute or entry type triggers...  For example, you can attach a task to the modification event of the MX_PASSWORD attribute to trigger the change password hook tasks.

Peter

[Former Member · Accepted solution]

Hi Peter,

Can I create any number of MX_HOOK_TASK<n>. I am only able ot see upto 11 in my repoositiry constants and they are already assigned to some tasks in my SAP PF. Can I add new ones and also change the existing assignments ?

Thanks

[ivan_petrov · Accepted solution]

Yes you can. But standard  SAP provisioning handles only predefined ones. The once that were created by you should be handled by you

[Former Member · Accepted solution]

Hi Ivan,

I understand from your response that we can create additional Hook tasks, but we have to also write the code to handle the logic of setting the repository. 

With regard to the SAP Standard Hook tasks, I can see from the documentation below that for resetting password, we have to use MX_HOOK8_TASK.

Is it true that whenever I need to reset password, I should assign my custom password reset task to MX_HOOK8_TASK and not to the other Hook tasks ?

[ivan_petrov · Accepted solution]

Hi Gandalf,

It means that if you have password change and if you are using standard SAP provisioning task HOOKTASK 8 will be called and if you didn't attach any task there the exception will be raised. If you were attached task there than this task will be executed.

And yes you do not need to put this functionality in any other HOOKTASKs. If you are familiar with events not only here, but in general as a developer, you can look at HOOKTASKs like EVENTs. If user was created EVENT(HOOKTASK) was fired, and if the password was set for this user, coresponding EVENT will be fired also.

Best Regards,

Ivan

[Murali_Shanmu]

As per the documentation

"The core part contains the logic to decide which plug-in tasks are called, while the connectors

contain the plug-in tasks that are referenced from the repositories. Each connector has its own set

of plug-in tasks, but the number in the task name identifies the core function of the task, so that a

task with the same number will perform the same action."

Cheers,

Murali.