Hi,
Synchronizing SAP R/3 User Data with Corporate LDAP Directory
Purpose
The Enterprise Portal integrates a corporate LDAP directory as its primary store for central user data in the portal. One possible scenario is that you have been using an SAP R/3 System to administer your central user data, for example using Central User Administration (CUA). This means that you now need to populate the LDAP directory with user data from an SAP R/3 System. Possibly you wish to continue using the SAP R/3 System for central user management and would like to synchronize this data with the corporate LDAP directory at regular intervals.
Systems based on SAP Web Application Server (SAP Web AS) Release 6.10 or higher provide a directory interface for user management. This interface allows data from R/3 user management to be exported to a directory server and, if required, to be synchronized periodically.
Passwords are however not synchronized from the SAP Web AS to the corporate LDAP directory. This means that if your corporate LDAP directory contains user data that has been synchronized from a SAP Web AS, it does not contain any passwords and the Enterprise Portal cannot authenticate users against the corporate LDAP directory. You must set up the portal to authenticate users against the SAP Web AS or another SAP R/3 System directly.
If the user IDs in the corporate LDAP directory are the same as the users in all SAP R/3 Systems using the Single Sign-On mechanism with SAP logon tickets, there is no need to perform user mapping. For more details, see Single Sign-On to SAP Systems.
Prerequisites
You have developed a concept for data flows between SAP systems and your corporate LDAP directory. Note that only systems based on SAP Web Application Server 6.10 or higher can use the interface to an LDAP directory. SAP recommends that you use a 6.10 System for Central User Administration (CUA), which collects all the user data from connected SAP Systems. The data in the CUA System can then be synchronized with the directory. The following diagram shows an example of a system landscape with a directory.
Process Flow
First you synchronize the data from an SAP Web AS to the corporate LDAP directory. The process is described in the documentation for the SAP Web Application Server. See the section on Synchronization of the SAP Database with the LDAP Directory.
Then you need to set up the portal to authenticate its users against the SAP Web AS or another SAP R/3 System. See Configuring the Portal for SAP R/3 Authentication.
Configuring UME to Use an LDAP Server as Data Source
Purpose
There is no option to set up SAP User Management Engine (UME) to use an LDAP directory as data source during installation. Instead you have to install with a database and configure the UME manually after installation.
Prerequisites
· You have installed a SAP Web Application Server Java where the UME is configured to use the database of the J2EE Engine as data source.
· The LDAP directory has a hierarchy of users and groups that is supported by UME. The hierarchies supported by UME are groups as tree and flat hierarchy. For more information, see Organization of Users and Groups in LDAP Directory.
· The administrator of the LDAP directory must create a user that UME can use to connect to the LDAP server. This user should have read and search permissions for all branches of the LDAP directory. If UME also needs to write to the LDAP directory, the user must additionally have create and change authorizations.
Process Flow
...
1. Enter connection data for the LDAP server in the LDAP configuration tool.
2. Select the location of default users and groups.
3. Restart all cluster nodes.
4. Verify the configuration.
5. Change user in secure storage (optional).
Result
You have connected UME to an LDAP directory.
We strongly recommend that you configure Secure Sockets Layer (SSL) between the UME and the LDAP directory. Some directories, such as Microsoft Active Directory Server, require an SSL connection if you want to create users on the directory. For more information, see Configuring SSL Between the UME and an LDAP Directory.
You should check that the attribute mapping defined in the data source configuration file is appropriate for the schema that you use in your LDAP server. For more information, see Customizing a UME Data Source Configuration ® .
In addition, you can configure your LDAP directory for high availability. For more information, see Configuring High Availability of the LDAP Data Source.
Thanks,
Satya Kumar
Reward if it is useful
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.