Integrate SAP IDM with SAP PI

[Former Member]

Hello Experts,

Can anyone please let me know that how can we integrate SAP IDM with SAP NW PI (Process Integration)?

And which protocol SAP IDM supports to send/receive data?

Thanks

Amit Srivastava

[former_member2987 · Accepted solution]

Amit,

This is an interesting question that I have encountered from time to time.

IDM is based on a central database repository called the Identity Store held on a SQL Server, Oracle or DB2 database.

This being said, the easiest way to integrate is to have PI write the information to a custom table within the database (or a separate database if you prefer) and then have IDM read the information using a FROM Database pass.

Optionally you can put the information in a LDAP directory (and use the FROM LDAP pass).

If you need these activities to occur in "real time" you can use an IDM Event agent to watch the assigned database table for changes that would start IDM workflows that would process the data.

I am not aware of any supported functionality for having PI put information directly into the Identity Store.

Hope this points you in the right direction.

Regards,

Matt

[bxiv · Accepted solution]

With PI being a dual/double stack, are you not using UME for IDs on the ABAP side to be created on the Java side?

It may be helpful to provide more information on what you are looking to accomplish with IDM and PI.

[Former Member · Accepted solution]

Hello Billy,

I am using SAP Process Orchestration (PI7.31 Single stack)

Actually, my requirement is that Employee termination needs to be propagated to multiple downstream systems e.g. Identity Management System. The ERP system and downstream systems are on independent platforms. So i though i will use SAP PO to integrate the same but not sure how i will do the same?

Thanks

Amit Srivastava

[Former Member · Accepted solution]

Hello Matt,

Thanks for your reply!!

Thanks

Amit Srivastava

[bxiv · Accepted solution]

I would go with Matt's suggestion about using LDAP and let IDM lock/delete the account in LDAP to control access to PI.  I would think this would be less administration in the long run, but you are going to need to find a way to add groups/roles to the user ID, which I would find a way to control through AD; as PI has enough to do in it already. 

[former_member2987 · Accepted solution]

Amit,

Why not just pass the termination information to IDM and then let the IDM workflow handle the deprovisioning as a result of the new information.

This lets you have an auditable and flexible workflow that can handle not only ERP and other parts of the SAP Landscape, but also reach out into the rest of your enterprise and handle your Enterprise Directory, Mail Server, etc.

Matt

[Former Member]

Hello All,

Thanks for the much appreciated help!!

Thanks

Amit Srivastava

[ivan_petrov]

Hi Amit,

All mentioned above is correct, but there are also other ways to trigger IDM workflow.

- The most easiest one is using IDM REST API - this way you can make a direct call to IDM Task and provide some parameters.  

- If this still doesn't fit your needs, you can always write a java class inherit ToPass or FromPass, depends on your needs and integrate this class in IDM via ToCustom or FromCustom passes.

Of course as Mat said I'll also use IDM to handle the action it self in order to use its flexibility, but still this is your choice

Best regards,

Ivan