One Identity Manager SAP Experience #2 SAP Modules, Connectors and Collateral

[MUSIC PLAYING] A very common question we are being asked by customers is whether we support a specific SAP module or not. To answer this question, I would like to explain how an SAP installation looks like. An SAP installation is basically a three-tiered architectural implementation with a database layer which is irrelevant to us since we are not directly speaking to a database instance. So the database can be at the moment any relational database management system available and supported by SAP and the application layer, which is an application server that is being installed on a specific system that uses the database. On this application service, there is a common kernel and basis services that provides authentication and authorization services amongst others to additional applications that are running on top of this kernel of basis system. These applications are also called in the SAP language, modules. So modules that are running on an ABAP-based application server mainly rely on the kernel, or SAP basis infrastructure to provide user accounts, authorizations, and profiles and roles that grant access to things or objects in the database. Any module or application that is available on the ABAP stack is being supported. So far that we will rely on the underlying kernel or basis infrastructure to provision user accounts, rolls, and profiles and grant specific access to this module or to this application in the SAP environment. However, SAP modules might have module-related or module specific permissions which we will not support with a standard connector. For example, SAP HR module has so-called structural profiles, which is an additional authorization layer in the SAP HR module which adds additional permissions for user accounts in the HR module which are not on the kernel, or basis level. This SAP HR structural profiles we support. Other modules might have additional permissions as well that we do not support. In this case, we will have to review the specifics of the module and can comment about support or not support it. Normally, any ABAP-based module that is relying on the underlying SAP kernel or basis information or basis support will be supported by the One Identity Manager SAP Connector. While managing R/3 environments, or S/4 environments at customer sites, we encountered different kinds of setups. On premise implementations of SAP can be accessed through the application server and by our Identity Manager job server to talk to these systems directly. Another architectural setup we encountered on customers is the load balancing solution where the architecture is hidden behind the message server which is used to load balance the environment, which is very customary in big customer implementations for SAP solutions. Another implementation that we encounter is when the SAP environment is not run by the customer itself but is hosted by some service provider. In that case, the communication is being routed through an SAP router. And the One Identity Manager is able to support all these implementations because we are relying on the SAP native and seal libraries that are using SAP native means to communicate with their environment. More information about our SAP connector can be found on this SAP certification website where we can see that our SAP connector is not only certified for NetWeaver but also for as S/4HANA. Further information about our support for SAP environments and SAP solutions can be found on our website. One Identity dot com slash Solutions slash SAP will contain information about SAP integration and SAP support in our One Identity Manager. These resources contain white papers which describe integration of SAP into One Identity Manager as well as GRC and access rights and permissions support in One Identity Manager and what the differences are in the native solutions and One Identity Manager. [MUSIC PLAYING]