CUA Best Practices for Large Landscapes

[Former Member]

Hi All,

We have a fairly large landscape with 5 systems (ECC, BW, SRM, CRM and XI). Each system with 5 layers (Dev, Test, Training, Pre Prod and Production). And each layer has around 2-5 clients (ECC Dev has 5 different clients).

Altogether there are around 60 clients in the landscape.

so, what is the best practice to set up CUA in this type of environment?

Should we set up separate CUA central system for each layer or just keep one for production and another for non-production clients?

Also, are there any other important points to keep in mind while carrying out the entire activity?

Thanks a lot in advance,

Regards,

Bhavya

[mvoros]

Hi,

I assume that you don't have CUA at this moment. Have you thought about implementing IdM instead of CUA? In big landscape you should be able to get ROI pretty quickly. CUA allows you to manage users from one client. IdM implementation could give you automatic user provisioning plus many other features. Also CUA won't get any feature updates from SAP in future.

Cheers

[Former Member]

Hi Martin,

Thanks for the response. Unfortunately, at the moment we do not have enough budget to have IdM as a part of the current implementation. We might consider at a later stage to migrate CUA to IdM.

As for the CUA, could you please advise how to go about in the current situation?

Thank you,

Bhavya

[Former Member]

Hi, you may be pleased to know that 60-odd clients isn't really that big for a CUA implementation 🙂

General rule of thumb is that you always split prod & non-prod.  Prod CUA master should be on the system with the greatest likelyhood of availability & the same rule to the non-prod systems.  Having a regularly refreshed test box as a CUA master is going to cause a few issues....

You need to think about how you are going to be using the child systems.  Assuming that prod is separated (different team performing admin perhaps) then will you have one set of admins for Dev and another for the rest? We can achieve segregation through S_USER_SAS so that segregation doesn't have to be performed by having different masters.

Based on what you have said I would be thinking generally around 1 CUA for Prod, 1 CUA for Dev & Test, 1 CUA for Training & Pre-prod.  You could have a separate CUA for each tier if you really want but may be overkill unless it is mandated by company architectural or regulatory requirements.

As Mr Voros commented, also consider this as an opportunity to use IdM.