SAP Connector Mapping Issue (HCM)

Hi Toni,

have you recently updated the SAP .NET Connector Middleware (NCo) on the machine running the sync to patch 3.0.25 from an older version?

Regards,

 Tino

Hi Tino,

thanks for you response.

In fact, it's a fairly new system and it didn't had any NCo previously. I installed the newest version on a nearly blank machine (only One Identity Manager and some common tools were installed at that point of time).

Any other suggestions maybe?

Thanks for your time

toni

Hi Toni,

so I guess your SAP account used in connection string has not enough access rights to execute functions having to do with HR module function calls (i.e. BAPI_PERSDATA_GETDETAIL ). Please have a look the the One IM product documentation or use the prepared SAP role delivered with the transports.

Regards,

  Tino

Hi Tino, thanks for the Hint!

I was using the SAP Role privided by 1IM, but it was missing some authorization objects and access to tables. I was able to detect them with tracing the syncronization on the SAP Client. Then I extended the SYNC role and voila - it worked!

Cheers

Toni

Hi Toni,

do you remember which specific authorizations are missing on the role? It seems that the issue is still present in version 9.1.1.

Enrico. 

Hi Enrico,

i am not sure what was missing exactly, but here is how the SYNC Role looks now:

• AAAB
  • S_RFC
  • S_TCODE
• BC_A
  • S_TABU_DIS
  • S_TABU_NAM
  • S_USER_AGR
  • S_USER_AUT
  • S_USER_GRP
  • S_USER_PRO
  • S_USER_SAS
  • S_USER_UID
• BC_C
  • S_DEVELOP
• BC_Z
  • S_ADDRESS1
• HR
  • P_ORGIN
• ZVIA
  • ZVIA_AUT
  • ZVIA_OP
• ZVIH
  • ZVIH_AUT
  • ZVIH_OP
• ZVIL
  • ZVIL_AUT
  • ZVIL_OP
  • ZVIL_TABLE

Hope it helps.

Toni

Really thank you, Toni!

It will be really useful!

Enrico

Hi Enrico,

due to an security update of our /VIAENET - BAPI we introduced new authentication objects ZVIA_OP, ZVIH_OP, ZVIL_OP  and ZVIL_TABLE in the past. If you have an older version of role /VIAENET/SYNC you should add this new objects to the role to have access to all functions of our BAPI.

Regards,

  Tino

Hi Tino, 

we used the transport files contained in the folder SAP\dvd\AddOn of the 9.1.1 installer. Is there a new version of the BAPI transport?

Our role has the same authorizations Can you send a screen of the detail for the ZVIH and ZVIL authorizations?

Enrico. 

Sure, attached.

What is the the issue you are looking a solution for?

Regards,

   Tino

The issue is the same described by Toni. We are using the SAP HCM Employee template but when we browse some resources like the HREmployee_Active or the Active_PA0000 resource, fields are empty except for the HR_Leaving_DATE or ORGEH ones that are correctly displayed. If we try with a user provided with the SAP_ALL Profile we can see all the fileds correctly populated, so we think the issue is related to missing authorizations for the /VIAENET/SYNC Role. We receive no error when we try to browse the resources but almost all the fileds have no value displayed, strings are empty, integers are 0 and dates are 30/12/1899. 

We are trying to figure out which authorization objects are missing.

Enrico. 

Hi Enrico,

you should notice the section "Authorizations for synchronizing with an SAP HCM system" at "Administration Guide for SAP R/3
Structural Profiles Add-on".

Authorizations for synchronizing with an SAP HCM system

You require the following authorizations for accessing the target system in order to
synchronize One Identity Manager with an SAP HCM system.
* Structural profile "ALL" (assigned in the T77UA table)
* Authorization object S_RFC (authorization check on RFC access) with activity 16, at least for the PERS, PADR, RH65, RPAI function groups.

Regards,

Tino

Hi Enrico,

you should notice the section "Authorizations for synchronizing with an SAP HCM system" at "Administration Guide for SAP R/3
Structural Profiles Add-on".

Authorizations for synchronizing with an SAP HCM system

You require the following authorizations for accessing the target system in order to
synchronize One Identity Manager with an SAP HCM system.
* Structural profile "ALL" (assigned in the T77UA table)
* Authorization object S_RFC (authorization check on RFC access) with activity 16, at least for the PERS, PADR, RH65, RPAI function groups.

Regards,

Tino

Really thank you Tino. 

This will help with my issue. 

Enrico.