SAP IDM with MS Active Directory (OU names in Arabic)

[Former Member]

Dear Gurus,

With SAP IDM , we need to integrate with MS Active directory such a way that SAP IDM only fetches users who have “SAP” in one of the AD field. That means do not read entire AD but only fetches users in SAP who have “SAP” tagged in one of the AD field.

Is it possible ? We tried that in SAP LDAP connector but its not possible in LDAP connector in SAP as LDAP connector is reading through all the users in our CUA system.

Question is it possible through SAP IDM that we use some thing (maybe  BAPI) to restrict users and do not read all users but only users having “SAP” in one of the AD field.

Also note that our AD has some OU's name in Arabic.

Regards,

[Former Member · Accepted solution]

If you want to filter this in the ADS Initial Load job then you can modify the repository LDAP Filter:

(&(objectclass=person)(orgUnit=SAP))

Replace orgUnit=SAP with your your attribute and tag.

Br,

Chris

[Former Member · Accepted solution]

This has to be done on AD side or SAP side?

[Former Member · Accepted solution]

This screenshot is from the SAP side in the SAP IdM repository configuration.

[Steffi_Warnecke]

You set the filter in IdM in the "From LDAP"-pass on the "Source"-tab.

[Steffi_Warnecke]

Hello,

you can just read the AD users with a "From LDAP directory"-pass into a temp-table and use that one for the query in a "To Identity story" to filter for those users (e.g. with "SAP" in a certain field), you want to create and update in IdM.

Regards,

Steffi.

[Former Member]

The problem is we are not suppose to read all the users in SAP .

We just have to only read selected users in SAP (e.g. with "SAP" in a certain field). Due to security reasons, the client wants SAP CUA to read only selected users from AD, not all

Is this possible?

[former_member2987]

You would need to write an LDAP filter in the LDAP URL field in the From LDAP pass.

This seems to be a good url for learning about LDAP filters or you can build the filter in a tool like Apache Directory Explorer or Softerra.

[Former Member]

Another dilemma to it,  the client doesn't want to change anything on AD. All they want  us to do things on SAP side  and get only selected users from AD to SAP

[former_member2987]

Hi Muhammad,

It's set from the IDM side per 's Post below.

Matt