SAP IDM Connection to Ariba

[Former Member]

HI Experts,

We are on IDM 7.2 Service Pack 9 Patch Level 6

We need to connect our IDM system to Ariba. I believe that we don't have a connector available for SAP to Ariba.

What is the best way to do this? If we have to use webservices is there any standard documentation that we can refer to?

Regards,

Aman

[Former Member · Accepted solution]

Hi Aman,

I just finished integrating IDM 7.2 SP10 with Ariba, and we did it using privileges as Ariba groups.  The provisioning was done using flat files (1 for user master information and 1 for user-to-group assignment) that were sent (via SFTP) to PI.  PI picked up the 2 flat files and converted them into the format accepted by Ariba.

Hopefully this helps,

Rick

[Former Member · Accepted solution]

Hi Rick,

Thanks this is the most suitable option.

We are trying to do this.

Regards

Aman

[Colleen]

Hi Aman

Ariba has the SAP ECC Sync program to replicate roles across to groups.

You could have shell roles and provision via IdM to ECC and then run the sync across

I'm not sure if fixed, but there was some code/bug issue with replicating the user master across due to timezone length (reported that last year but haven't been close to it). The other main drawn back is the code makes use of the PFCG long description field to list the groups (bad use of it and I wish they had a table or some mapping to achieve this instead).

Program: /ARBA/MASTER_DATA_EXPORT

SM30 table: /ARBA/USR_GRP (add all the roles you want in the sync in that table)

PFCG - each shell role should have the group listed as a single line within the long description

Regards

Colleen

[Former Member]

Hi Colleen,

Thanks for your reply, your response above seems to be a very good solution.

We have two options right now-

1. To Use ECC Synch Program and use IDM to provision shell roles in ECC-

    But this option will increase number of users in ECC which are actually ariba users.

2. To Create webservice from IDM to connect to SAP PI, and transfer the user/ role data from IDM.

     But we are not sure who shell roles will be craeted in this passed back to IDM.

     also how provisioning will happen from IDM to PO using webservices..

Please advise .

Regards,

Aman

[Colleen]

Hi Aman

I can't comment on your PO/IdM Integration. I actually don't have much idM experience and only jumped in this thread due to Ariba/ECC integration knowledge

What you could attempt to do is see what API/function module has been exposed on Ariba side that consumes the ECC file. If you can figure that our with the development team then you could attempt to write some type of script within IdM that can build a flat file.

Not sure if it's possible but can you have a dummy system in IdM for Ariba and have all of the Ariba Groups or mappings.

If you find this is technically possible then your provisioning is IdM > flat file > Ariba (possibly via PI/PO)

If you use the ECC to Ariba program that i mentioned you won't be passing information back to IdM. You will treat the SAP ECC shell role like a normal SAP ECC role. The user is assigned the role via IdM and it provisions to SAP ECC. Afterwards, the program is scheduled and calculates the access within SAP ECC to provision to Ariba

So your provisioning for Ariba would be IdM > SAP ECC > Ariba

Regards

Colleen

[jrondorf]

No connector available afaik.

Regarding custom connector: this depends on the web services you have available in Ariba.

[former_member2987]

Hi Aman,

I don't think so. At least I did not see a mention here.

I think your best alternative is to open a note.

Matt