Automatically synchronize IdM with systems

[youssef_anegay3]

Hello

i have searched in the forum, but did not find the right answer to my qyestion. And i am sorry if it exist and i did not see it.

We have IdM connected to several ABAP/HANA/Java systems. When we create the repositories, we run the initial loads.

But in the systems we keep creating new roles. What are the best practices to update IdM with the new modifications? Do i have to schedule all initial loads to run regurarly everyday ?

Thanks for your answers and help

Y.

[jaisuryan · Accepted solution]

Hi Youssef,

You will have to create and schedule an update job that writes new roles into IDM. This job is copy of Initial loads with only relevant passes enabled. Below link provides you required information to set up the job.

Using an Update Job for Reading New Privileges and New Company Addresses - SAP Identity Management C...

Kind regards,

Jai

[youssef_anegay3 · Accepted solution]

Hi Jai

thanks for your answer ... that is exactly what i was looking for ... The page is for IdM 8.0 .. I guess it is the same for 7.2 no ?

BR

Y.

[jaisuryan · Accepted solution]

Hi Youssef,

Yes, It should be the same.

Anyway, it is documented by SAP for 7.2 as well.

Using an Update Job for Reading New Privileges and New Company Addresses - SAP NetWeaver Identity Ma...

Kind regards,

Jai

[youssef_anegay3 · Accepted solution]

Excellent ! thanks !

[youssef_anegay3 · Accepted solution]

I have one more question thought ... i do not quite understand why i should set the triggers for the priviledge in the write tasks to {D} ... why not just let the "-1" as it is by default ?

[peterwass · Accepted solution]

If I recall correctly, {D} sets it to 'inherited' and -1 sets it to none. Its very early in the morning so it may be the other way round

In most cases, inherited is good as it lets you set things on the repository.

Peter

[terovirta · Accepted solution]

The tasks on the privileges are attributes in Id Store, so the {D} maps to one of the attribute operators, -1 stands for the attribute value for none.

When the privileges are created in Initial Load all tasks are set to -1 as the users are also read from target and existing privileges are assigned to users. This is done to prevent reprovisioning to take place. If the privileges would have "live" tasks set, then once the privilege is assigned to the user, IdM would trigger provisioning workflow.

In the Update Job you don't have to set the tasks to -1 unless you're also touching users. You can set all tasks (add/del member, validate add/del, provision/deprovision) to inherited with {D} and set the modify task to -1 (as you don't want all the privileges triggering modify workflow, only the system privilege).

regards, Tero

[youssef_anegay3 · Accepted solution]

Thanks Peter and Tero for your answers ... finally got it ;-). I will set it to {D} then as mentioned in the documentation. At least for our ECC and APO system.

But we have an BPC system also. In BPC, there are two layers of authorizations. One in the SU01 ABAP and the other directly in the BPC web interface. When we set the rights in the BPC interface, it creates new roles dynamically and affects them to the user in the abap side. In this case, is it more wise to use initial jobs always instead of update jobs ?