The SAP collector from IG 3.5.1 only collects permission (activity groups) assignments for the directly connected system, even if this system is a CUA.

So collecting permission assignments for all systems managed by the CUA currently requires a collector for each SAP system, that does not make sense. As a workaround we do exports from SAP to CSV files and collect them into IG.

A new SAP collector should collect permission assignments for all SAP systems behind a CUA if connected to a CUA. Each assignment has the follwing attributes
- user
- system
- activity group
- valid-from
- valid-to
Especially the SAP system needs to be visible in the IG then (assignment value)!



Technical infos we´ve got from a SAP consultant who analyzed the current´s collector behavior as a starting point:

Currently the IG SAP collector currently calls BAPI_USER_GET_DETAIL once for each SAP User. This call only returns the local information of the user including only local (on that specific SAP system) roles/activity groups.

BAPI_USER_LOCACTGROUPS_READ is what should be called, because this call also returns all the roles/activity groups which makes sense for a SAP CUA.

by: Thomas R. | over a year ago | Integrations