Integrate HR org structure and CUA?

[Former Member]

We are considering a new design for our authorization management on our production ECC 6.0 system.

There will be 2 productive ECC 6.0 systems; which system you use will depend on your global location. We currently utilize the HR org structure to assist us with provisioning and deprovisioning accounts on our durrent single ECC 6.0 instance, and we hang composite roles off of positions in the org structure, so that a fair amount of authorization management is automated.

If we were to put a CUA client over the two productive ECC 6.0 clients, how might that be integrated with the HR organizational model? Does CUA integrate well with an org structure? Any experiences with this would be helpful.

[Former Member]

Hi Mary,

Firstly, are the org structures in the two ECC clients identical - in sync with each other?

If the org structures are different then it would limit the options that you would have:

- CUA client would simply be used for the provisioning of the user id

- The role to position allocation would still take place locally in each of the ECC clients

- You would have to maintain the 105 relationships locally in the ECC clients

- You would have to set the role maintenance option in SCUM to local maintenance

If the org structure is the same on both ECC clients, then it would provide you with some additional options:

Option 1 - use the approach described above to allow for local maintenance

Option 2 - ALE the org structure to the CUA client, then allocate the composite roles to the positions on the org structure and maintain the 105 relationship on the CUA client.

- the roles will then be distributed to the correct child system when the org recon is run

Option 3 - Use one of the ECC systems as the CUA client (Which we are busy implementing at the moment)

I'm using my ECC system as my central CUA for the production system, I know that many people would disagree with this due to upgrade requirements and all the rest. However in the Netweaver environment the ECC client is typically on the highest basis release, which caters for the CUA requirement and CUA is far more stable these days which reduces the risk. The other reason we have chosen this route is also the capacity of the ECC production system which is suitable.

Also the HRORG is maintained on the same system, therefore less ALE requirements to move the org structure between systems etc. In the landscape we currently have BI and Portal, future applications/modules include ESS, MSS, APO and SEM.

To achieve the solution I create all roles for all applications in the landscape, in the ECC client - for non-ECC roles the role definition is only role name and description (the correct authorisations are then maintained in the relevant child system). These are then distributed via RFC to the various child systems, it requires a couple of small changes but does work fine. All roles are then inlcuded into a composite role, regardless of which child system the role belongs to. The composite role is then allocated to the position in the HR org and once the HR recon is run, the role allocations are distributed to the correct child system. An example of a Line Manager Composite role would include:

- HR Line Manager (ECC Client)

- Cost Centre Manager (ECC Client)

- BW Line Manager Menu role (Portal)

- BW Line Manager Data role (BI client)

- Purchasing Approval (ECC Client)

I'm not sure if this has helped you, but in short the CUA integration with HRORG does work reasonably well and depending on the approach you choose it could affect the amount of maintenance that takes place. Just remember that the structural profile allocations would always take place locally on the ECC clients and only the role allocations can be managed from the CUA.

Regards

Sujeet

[Former Member]

Sujeet,

Thank you for your thorough reply. You have help me to visualize it better. Our design for HR is not finalized, but what you have told me is quite helpful. I believe the org structures in the two systems will be identical and in sync with one another.

A follow up question: we frequently have exceptional roles (sometimes composites, sometimes single roles) that fall outside of the normal composite role. They may be delimited, or they may be more of a permanent nature. Are these maintained in the CUA client, or directly in the child client?

Also, can two composites be assigned to a position record in an org structure?

[Former Member]

Hi Mary,

In terms of role assignement, my understanding is that you can only have one approach - either via the CUA client (using HR-Org or direct assignment) or assigned locally in each child system (again using HR-Org or direct assignment). If you take a look at the distribution parameters for role assignment in transaction SCUM, you only have the option of Global or Local.

Ideally you would want to use one approach for role assignment as well, either via indirect assignment or direct assignment, but it is always a problem when you have contractors/consultants working on the systems who are not allocated to a position.

As far as I'm aware it is only possible to assign one composite to a position - however it seems to be possible to have one composite assigned to a position, and multiple single roles assigned to the same position as well. At this stage I don't have a requirement to assign mutiple composite roles to a position so I have not investigated this further. I would be interested to know if there is a solution to this.

You can also take a look at the following link:

http://help.sap.com/saphelp_nw2004s/helpdata/en/8b/3c713eeaac5441e10000000a114084/frameset.htm

Regards

Sujeet

[Former Member]

Hi,

How to ALE the org model from one system to other. Can you please specify the steps.

Thanks.

Neha