Integration of SAP Netweaver User Management With LDAP: Applies To

I nt egr at i on of SAP Net w eaver User
Management w i t h LDAP
Applies to:
SAP Netweaver 7.0/7.1
Microsoft Active Directory 2003
Summary
The document describes the detailed steps of configuring the integration of SAP Netweaver User
Management with LDAP (Microsoft Active Directory 2003 is used as LDAP).
LDAP, being the integrated, provides a central user repository used to centrally maintain user data, thus
avoiding the redundant, error prone maintenance of user information in several systems and reduced total
cost to ownership.
Here the LDAP directory acts as a leading system wherein the Users are imported to the SAP system when
the user synchronization happens every time.
Author: Radha SK
Company: Team: Technical Validation -SAP Labs India, Bangalore
Created on: 1 J uly 2009
SAP COMMUNITY NETWORK SDN - sdn.sap.com | BPX - bpx.sap.com | BOC - boc.sap.com
2009 SAP AG 1
Integration of SAP Netweaver User Management with LDAP
Table of Contents
Prerequisites ....................................................................................................................................................... 3
Configuring LDAP Connector .......................................................................................................................... 4
Defining System Users .................................................................................................................................... 5
1. Access the LDAP Connector via Tcode LDAP choose System Users ..................................................... 5
2. Switch to change mode and choose New Entries ....................................................................................... 5
3. Enter the required data and Save the entries. Refer the below screenshot. .............................................. 5
Defining Server Details ....................................................................................................................................... 5
Logging on to the Directory Service ................................................................................................................... 6
Mapping .............................................................................................................................................................. 7
Mapping Using function modules8
Mapping Using function modules ....................................................................................................................... 8
Synchronization of SAP User Administration with LDAP Directory .................................................................... 8
LDAP Synchronization .................................................................................................................................... 9
Integration of J ava User Management Engine with LDAP ............................................................................... 11
Configuring J ava UME to use LDAP as a data source with the User Management Console ...................... 11
Procedure .................................................................................................................................................................. 11
Configuring J ava UME to use LDAP as a data source with the Config Tool ................................................ 13
Limitation of UME when AS ABAP is used as a data source ........................................................................... 15
Configuring J ava UME to use LDAP as a data source with the Netweaver Administrator Console (NWA) for
SAP Netweaver 7.1 J ava system. ................................................................................................................. 15
Procedure: ................................................................................................................................................................. 16
Related content ................................................................................................................................................. 17
Disclaimer and Liability Notice ........................................................................... Error! Bookmark not defined.
2009 SAP AG 2
Prerequisites
The LDAP connector requires access to some specific library which is installed on the specific application
server platform. The LDAP connector is called using ABAP functions and communicates with the directory
services using Lightweight Directory Access Protocol.
To check whether LDAP Connector is operable, that is checking the availability of LDAP Library on the
application server.
Run ldap_rfc command in the kernel directory and check the version details.

2009 SAP AG 3
Configuring LDAP Connector
1. Create and RFC of connector T-Type
Note: It is recommended to use the following naming convention: LDAP_<server_name>.
If there are multiple LDAP connectors on one server then use:
LDAP_<server_name>_<sequence_number>Example: LDAP_SERVER_01
2. Select Registered server program as activation type
3. Specify the Program ID same as the RFC destination.
4. Save your entries.
Refer the below screenshot for LDAP connector details

2009 SAP AG 4
Defining System Users
The communication user (Example: TestUser) has to be maintained in the LDAP server which used by the
LDAP connector to bind to the LDAP Directory Server.
1. Access the LDAP Connector via Tcode LDAP choose System Users
2. Switch to change mode and choose New Entries
3. Enter the required data and Save the entries. Refer the below screenshot.

Defining Server Details
Create a new logical LDAP Server. Here you have to maintain the connection details of the physical directory
1. On the initial screen of LDAP choose Server and switch to change mode.
2. Choose New Entries and Enter the required data and Save Entries
Refer the below screen shot for Server Entry details

2009 SAP AG 5
Logging on to the Directory Service
Now you must check the connection to the directory service by logging on to it.
1. In the initial screen of the LDAP transaction, specify the LDAP server name and the LDAP
connector.
2. Press Logon
3. Provide the System User or enter the directory service user and password.
4. Choose Execute.

2009 SAP AG 6
Mapping
In transaction LDAPMAP specific SAP data fields can be mapped to the desired directory attributes.
SAP offers directory specific proposals for the mapping of the directory attributes to the SAP data fields. After
importing the proposal the mapping details can be customized as desired.
For each attribute there is the option to specify whether the customized mapping is only valid for import,
export or for both ways of
synchronization.

2009 SAP AG 7
Mapping Using function modules
If the desired mapping is not a simple 1:1 relationship, function modules can be used to enable a more
complicated mapping procedure.
A simple example is the telephone number. The telephone number of a user is stored in the directory
attribute telephone (in MS Active Directory). The extension is normally split by a hyphen -.
In SAP the telephone number of a user is stored in two data fields ADDRESS-TEL1_NUMBR and
ADDRESS-TEL1_EXT.
Therefore the function module MAP_SPLIT_CHAR can be used.
This module reads the value for the telephone number from the directory attribute telephone. The extension
is split at the position where the system finds a hyphen - in the string and the two values are stored in the
SAP data fields ADDRESSTEL1_NUMBR and ADDRESS-TEL1_EXT.

Synchronization of SAP User Administration with LDAP Directory
Once the mapping indicators have been set, you have to synchronize the data from the LDAP server with the
SAP User Administration.
1. Execute report RSLDAPSYNC_USER in the transaction SE38.
2. Specify the logical LDAP server and LDAP connector
3. Define how the report has to process the entries of the objects that found during the search. The
search result is made up of three subsets.
a. Objects that exists in both in directory and database
b. Objects that exits only in directory
c. Objects that exits only in database
4. Save your entries and Execute.
2009 SAP AG 8

LDAP Synchronization
For example the user LDAP ABAP has been created in the Active Directory Server. When the
synchronization report is executed in an SAP system, the user LDAP ABAP is taken from the LDAP
directory server to the ABAP system. The below figure is LDAP synchronization log when the report has
been executed successfully.
2009 SAP AG 9

The following is the screenshot of the user LDAP ABAP is the ABAP User Management SU01

2009 SAP AG 10
Integration of Java User Management Engine with LDAP
Configuring Java UME to use LDAP as a data source with the User Management Console
Procedure
1. Login to the User Management console with the Administrator rights.
2. Start the User Management
3. Choose Data sources tab
4. Choose Modify Configuration
5. From Data Source, select the data source that best matches your LDAP directory. For Microsoft
Active Directory, choose ads_readonly_db
6. Choose the LDAP Server tab
7. Enter the required data for connection

2009 SAP AG 11

8. Choose Test Connection
If the test fails, user management configuration displays the entry from the security log. The monitoring
tools of your LDAP directory can also help you determine the cause of the problem. If necessary, go
back and reenter the connection data and test the connection until you are successful.
9. Sava all the changes
10. Restart the application server for the changes to take effect.
Once the server is restarted, you will see the users which are imported from the LDAP directory.
To see the users from LDPA directory, go to Identity management and search for the users from the source
LDAP. Below is snapshot of the users in the J ava UME which are imported from LDAP directory.
2009 SAP AG 12

Configuring Java UME to use LDAP as a data source with the Config Tool
The UME LDAP configuration tool simplifies the process of configuring the UME to use an LDAP directory. It
allows to choose the configuration file for configuring the data source files and also to enter the connection
data for the LDAP directory and the test the data.
1. Click on the Configtool.bat file in the installation folder.
<SAPJ 2EEEngine_installation>\ j 2ee\ conf i gt ool \ conf i gt ool . bat
2. In the configtool, choose UME LDAP

2009 SAP AG 13
3. Configure the LDAP Data Source as required and save your
entries

4. Click on the Test connection button to establish a connection with the LDAP directory with service
user.
2009 SAP AG 14

5. Restart the AS J ava
Now you can see the users in the User Management console in which the users are imported from the LDAP
data source.

Limitation of UME when AS ABAP is used as a data source
In a ABAP+J ava dual stack system, by default the system takes the User Management of an ABAP system.
In this case, it possible to configure LDAP as a data source in the J ava UME. It is also not possible to create
the users in the database of AS J ava.
For more information refer to SAP Note 718383
Configuring Java UME to use LDAP as a data source with the Netweaver Administrator Console
(NWA) for SAP Netweaver 7.1 Java system.
The above mentioned steps for configuring SAP Netweaver 7.0 java system to use LDAP as a data source
are valid for the SAP Netweaver 7.1 system as well.
The only difference is we can also configure the User Management with Netweaver Administrative console
as well.
2009 SAP AG 15
Procedure:
1. Login to NWA with Admin rights.
2. Choose Operation Management ->Users and Access ->Identity Management
3. Under Related Tasks, choose Configuration.
4. Fill in the required details of the LDAP server and Save your entries.
5. Restart the AS
Refer the below screenshot for the connection details

2009 SAP AG 16
Related content
SAP Online Help http://help.sap.com
http://service.sap.com/security ->Security in Detail ->Identity Management ->Directory
Services
2009 SAP AG 17
2009 SAP AG 18
Copyright
Copyright 2009 SAP AG. All rights reserved.
No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG.
The information contained herein may be changed without prior notice.
Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors.
Microsoft, Windows, Excel, Outlook, and PowerPoint are registered trademarks of Microsoft Corporation.
IBM, DB2, DB2 Universal Database, System i, System i5, System p, System p5, System x, System z, System z10, System z9, z10, z9,
iSeries, pSeries, xSeries, zSeries, eServer, z/VM, z/OS, i5/OS, S/390, OS/390, OS/400, AS/400, S/390 Parallel Enterprise Server,
PowerVM, Power Architecture, POWER6+, POWER6, POWER5+, POWER5, POWER, OpenPower, PowerPC, BatchPipes,
BladeCenter, System Storage, GPFS, HACMP, RETAIN, DB2 Connect, RACF, Redbooks, OS/2, Parallel Sysplex, MVS/ESA, AIX,
Intelligent Miner, WebSphere, Netfinity, Tivoli and Informix are trademarks or registered trademarks of IBM Corporation.
Linux is the registered trademark of Linus Torvalds in the U.S. and other countries.
Adobe, the Adobe logo, Acrobat, PostScript, and Reader are either trademarks or registered trademarks of Adobe Systems
Incorporated in the United States and/or other countries.
Oracle is a registered trademark of Oracle Corporation.
UNIX, X/Open, OSF/1, and Motif are registered trademarks of the Open Group.
Citrix, ICA, Program Neighborhood, MetaFrame, WinFrame, VideoFrame, and MultiWin are trademarks or registered trademarks of
Citrix Systems, Inc.
HTML, XML, XHTML and W3C are trademarks or registered trademarks of W3C, World Wide Web Consortium, Massachusetts
Institute of Technology.
J ava is a registered trademark of Sun Microsystems, Inc.
J avaScript is a registered trademark of Sun Microsystems, Inc., used under license for technology invented and implemented by
Netscape.
SAP, R/3, SAP NetWeaver, Duet, PartnerEdge, ByDesign, SAP Business ByDesign, and other SAP products and services mentioned
herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and other countries.
Business Objects and the Business Objects logo, BusinessObjects, Crystal Reports, Crystal Decisions, Web Intelligence, Xcelsius, and
other Business Objects products and services mentioned herein as well as their respective logos are trademarks or registered
trademarks of Business Objects S.A. in the United States and in other countries. Business Objects is an SAP company.
All other product and service names mentioned are the trademarks of their respective companies. Data contained in this document
serves informational purposes only. National product specifications may vary.
These materials are subject to change without notice. These materials are provided by SAP AG and its affiliated companies ("SAP
Group") for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be liable for errors or
omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the
express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an
additional warranty.

Integration of SAP Netweaver User Management With LDAP: Applies To

Uploaded by

Copyright:

Available Formats

You might also like

Integration of SAP Netweaver User Management With LDAP: Applies To

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Integration of SAP Netweaver User Management With LDAP: Applies To

Uploaded by

Copyright:

Available Formats

I nt egr at i on of SAP Net w eaver User

You might also like