SAP IdM on Single Hardware.

[former_member404908]

Hi guys,

I'm doing an production installation for over 2600 employees and I have a 24 core, 64Gb Ram hardware that I suppose that is enough to keep it up.

My question is if have you guys ever installed all IdM components in a single hardware? Any regards about it? Any problem?
Also I will install GRC 10.0 and SSO 1.0.

Does SAP support this kind of installation?

Thank you.

[former_member2987 · Accepted solution]

Gabriel,

You can do this for DEV and QA environments but for Production, take a look at the architecture documents such as this one:  http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/c0b952d7-dfd7-2b10-7981-e3db245e7...

Production should have separate hosts for runtimes, and if you run a LINUX/UNIX only environment you will need at least one Windows machine at least through SAP IDM 7.2 SP7.

Regards

Matt

[former_member404908 · Accepted solution]

Thank you Matt, for the reply.

Our Dev/QA is already installed. on the same hardware configuration as above.

But if we decide to go all in one system, there is any regard about it? Performance? What else?

Regards,

Gabriel

[Former Member · Accepted solution]

Hey Gabriel

I've installed it on single hardware a few times.  It works fine (although it lacks something in disaster proofing).  The biggest issue is the database in terms of performance but you have more than enough grunt to do that in that server.  I've done similar numbers on an 8 Gb RAM machine.

Peter

[Former Member · Accepted solution]

When running everything on one host its important to limit the maximum memory allocation for each component. The database could be limited to 16G instead of the default which would allowing it to run off with all of it.

One of the challenges will be to predict how the host-OS, drives and network stack/adapters handles the number of sessions and IO traffic with everything running in one OS instance under heavy load. Will the database have its own drive(s) for data and transaction log or is IO also shared along with the CPUs and memory, will you have multiple network adapters?

In the end its probably only real-life load-tests that can say how the system will respond, and if you already have a similar QA environment you should be able to find out.

-

Chris

[former_member2987 · Accepted solution]

Gabriel,

No problem.  I would agree with Chris that Memory is an issue, you'll also need to worry about CPU utilization and some scaling factors.  As your IDM implementation grows you might need additional dispatchers.  Running multiple dispatchers on the same host is strongly discouraged and can cause database deadlocks.

As Peter mentioned the fact that you have everything on one server is also bad for High Availability and Disaster Recovery, at the very least your databases (NW and IDM) should be on another server, preferably in a cluster.

Matt

[former_member404908 · Accepted solution]

Well,

I will manage memory as hard as I can and I am aware of the risks we are taking when installing all components(AS ABAP 702, AS Java 731, GRC 10.0, IdM 7.2(UI, DB, RT, MC), SSO 1.0), in a single hardware(The components are directly installed over a Hardware, no VM's).

The point is, would it work fine, regardless availability?

[former_member2987 · Accepted solution]

Gabriel,

As we've all said, it will work.  Just don't expect it to scale.

Matt

[Former Member · Accepted solution]

I agree with Matt. It will work, and for 2600 users of whom only a subset will be using IdM on a daily basis (I'm guessing since no usage patterns are mentioned) it will probably work really well unless you have hundreds to thousand ABAP systems to connect to or some other unmentioned requirements. Also not sure how much SSO traffic you expect. The hardware appears more than adequate, I'm somewhat envious to be honest :-), but disk IO could become a problem and you dont mention anything about that subsystem.

Another downside is that any time an upgrade (OS or application) requires a system restart all your services on your single host environment will be completely down, and the chances for such an event increases with the number of services a host runs.

Also consider potential conflicts with expectations of support-software versions, Java, NetWeaver, DLLs or some other dependency between the services during upgrades - Lets say you want the new UI5 interface in IdM 7.2spX which requires NW7.3 with a specific patch level for instance, how (if at all) does that affect other services on the same host?

I guess its mostly about managing expectations though.

[Former Member]

Yes, it's possible and SAP should support it as well. In fact, I would say that it can be done with less hardware than you have available...

[former_member404908]

Roorda,

Have you ever seen somethin like this? So many things in a single O.S.? What problems did you find?

Regards,

Gabriel

[Former Member]

Hi Gabriel,

We have several customers doing this. Just remember that the DB contains all information and configuration details and is the single point of failure. The identity center, the user interface and the dispatchers are easily set up again after a disaster

Thanks,

Sietze