Application Development Discussions
Join the discussions or start your own on all things application development, including tools and APIs, programming models, and keeping your skills sharp.
cancel
Showing results for 
Search instead for 
Did you mean: 

CUA Project Propsal Questions

Former Member
0 Kudos

Hi Experts,

I am doing research on CUA and have been asked to provide answers to the following questions. If you have been though a CUA Config/implementation recently, I would appreciate your feedback. We are a company of 10,000+ SAP Users (approx. 1500 dev/QA users we would be using for CUA)

•Will Security save time by making Central Changes to user masters?

•Cost savings? Other benefits?

•How much time to configure each system?

•How much Basis involvement?

•Any other resources required?

•Will users benefit from Single Sign On with CUA?

•Will Basis have more work after system refreshes?

•What is Virsa's role/how does it integrate with CUA?

•Are there any known showstopper functionality deficits with CUA that would prevent us from using it

•We will use ourSolution Manager server for this project and for eventual production usage. Any suggestions or feedback regarding this?

•Hours the project would take?

1.BASIS

2.Security

3.Change Management

•Will a Refresh schedule be changed because CUA is implemented?

•Have you come across any issues with refreshes?

There are alot of questions and I will be more than happy even if only one question is answered. As always, thank you for your expertise and advise.

Teresa Wilson

1 ACCEPTED SOLUTION

Former Member
0 Kudos

Hi Teresa

> •Will Security save time by making Central Changes to user masters?

Yes if you have a broad landscape - i.e. lots of clients and systems

> •Cost savings? Other benefits?

User admin will be easier, CUA landscape monitoring will take additional overhead. Personally I would use say you could save 25% of time when administering users if your landscape is conducive to using CUA.

> •How much time to configure each system?

Once you have done one, it should take no longer than an hour for each system (less once you get the hang of it)

> •How much Basis involvement?

Not much - maybe get them to set up the RFC destinations (specific CUA ones are good, but watch out for people trying to use them for remote CATT execution etc). Basis may want to schedule the job which processes the userclone idocs in the target system. It depends how you do things in your place.

> •Any other resources required?

No

> •Will users benefit from Single Sign On with CUA?

I will defer to the far more knowledgable Mr Alsop on this one as I haven't a clue

> •Will Basis have more work after system refreshes?

Usually limited to removing, re-adding in the CUA system. It may save them time as the users can be pushed out of the master again if required (though will need to reprocess loads of failed idocs when they get locked)

> •What is Virsa's role/how does it integrate with CUA?

What do you mean by Virsa? company doesn't exist any more. If you use compliance calibrator then has no impact at all. If you use Access Enforcer then there might be, but without knowing what you are doing, it's hard to say.

> •Are there any known showstopper functionality deficits with CUA that would prevent us from using it

It can be a bit flakey, though has improved over the years. It is not a magic pill which will solve all your problems. You will get frustrated with it. You have to do change reporting out of the CUA master otherwise you will only get change logs by the idoc processing batch user ID. You need to keep on top of the idocs and log monitoring. If you have a simple setup with few clients then might not be worth it.

> •We will use ourSolution Manager server for this project and for eventual production usage. Any suggestions or feedback regarding this?

I would recommend 3 separate CUA's - one for dev, one for test, one for prod. Do not have one covering all because if the CUA master goes down for whatever reason then you have extra work. Assuming R/3 is your main system (with lets say a BW and an APO) then I generally prefer to set the R/3 system as the master as there are usually fewer problems when doing role admin for that client. That is only a personal preference though & lots of different parties recommend different things.

> •Hours the project would take?

> 1.BASIS

> 2.Security

> 3.Change Management

Impossible to say without knowing all details of your landscape. Basically, you should be able to set up and test a reasonably complex CUA in less than a day.

> •Will a Refresh schedule be changed because CUA is implemented?

I don't think so, though CUA should be taken into account as part of the activities

> •Have you come across any issues with refreshes?

Yes, BASIS people messing up the CUA config or not doing the post refresh steps they were supposed to do.

Good luck. It can be very useful and very frustrating at times. There are loads of installation guides out there. As I have said earlier, it will not be the answer to all of your problems and does require extra monitoring. In a project rampup situation where you have lots of users setup/changing in different clients then it can really help take a bit of the manual processing burden.

Hope that helps

Cheers

Alex

2 REPLIES 2

tim_alsop
Active Contributor
0 Kudos

>

> •Will users benefit from Single Sign On with CUA?

>

No, users will not benefit from Single SignOn if you implement CUA. However, if you implement CUA and then implement SSO, your implementation will likely be made easier since you can (a) be sure that each system has the same details about the users and (b) you have the ability to manage users in SAP in one place, instead of on each system.

Thanks,

Tim

Former Member
0 Kudos

Hi Teresa

> •Will Security save time by making Central Changes to user masters?

Yes if you have a broad landscape - i.e. lots of clients and systems

> •Cost savings? Other benefits?

User admin will be easier, CUA landscape monitoring will take additional overhead. Personally I would use say you could save 25% of time when administering users if your landscape is conducive to using CUA.

> •How much time to configure each system?

Once you have done one, it should take no longer than an hour for each system (less once you get the hang of it)

> •How much Basis involvement?

Not much - maybe get them to set up the RFC destinations (specific CUA ones are good, but watch out for people trying to use them for remote CATT execution etc). Basis may want to schedule the job which processes the userclone idocs in the target system. It depends how you do things in your place.

> •Any other resources required?

No

> •Will users benefit from Single Sign On with CUA?

I will defer to the far more knowledgable Mr Alsop on this one as I haven't a clue

> •Will Basis have more work after system refreshes?

Usually limited to removing, re-adding in the CUA system. It may save them time as the users can be pushed out of the master again if required (though will need to reprocess loads of failed idocs when they get locked)

> •What is Virsa's role/how does it integrate with CUA?

What do you mean by Virsa? company doesn't exist any more. If you use compliance calibrator then has no impact at all. If you use Access Enforcer then there might be, but without knowing what you are doing, it's hard to say.

> •Are there any known showstopper functionality deficits with CUA that would prevent us from using it

It can be a bit flakey, though has improved over the years. It is not a magic pill which will solve all your problems. You will get frustrated with it. You have to do change reporting out of the CUA master otherwise you will only get change logs by the idoc processing batch user ID. You need to keep on top of the idocs and log monitoring. If you have a simple setup with few clients then might not be worth it.

> •We will use ourSolution Manager server for this project and for eventual production usage. Any suggestions or feedback regarding this?

I would recommend 3 separate CUA's - one for dev, one for test, one for prod. Do not have one covering all because if the CUA master goes down for whatever reason then you have extra work. Assuming R/3 is your main system (with lets say a BW and an APO) then I generally prefer to set the R/3 system as the master as there are usually fewer problems when doing role admin for that client. That is only a personal preference though & lots of different parties recommend different things.

> •Hours the project would take?

> 1.BASIS

> 2.Security

> 3.Change Management

Impossible to say without knowing all details of your landscape. Basically, you should be able to set up and test a reasonably complex CUA in less than a day.

> •Will a Refresh schedule be changed because CUA is implemented?

I don't think so, though CUA should be taken into account as part of the activities

> •Have you come across any issues with refreshes?

Yes, BASIS people messing up the CUA config or not doing the post refresh steps they were supposed to do.

Good luck. It can be very useful and very frustrating at times. There are loads of installation guides out there. As I have said earlier, it will not be the answer to all of your problems and does require extra monitoring. In a project rampup situation where you have lots of users setup/changing in different clients then it can really help take a bit of the manual processing burden.

Hope that helps

Cheers

Alex