One Identity Manager SAP Experience #14 SAP Synchronization Engine #3

[MUSIC PLAYING] Well, Identity Manager's SAP connector not only allows you to change the mappings of predefined schema objects, but it also allows you to add additional schema objects that are required at customer sites. This is due to customizations based in the SAP systems where the customers have additional tables, so-called Z-tables, that are being created to hold additional information which was not or is not available in the standard schema of SAP or any additional information the customer wants to be synchronized from the SAP system. In such a case, here on the connector configuration page is that the One Identity Manager connector has an option to add an XML document into the connector configuration where an additional or where additional schema objects can be defined and operations or functions on these schema objects are defined in this schema extension file. On the One Identity Manager documentation's website, there is an example for a schema extension file, and I am looking at the schema extension file right now. And the schema extension file is organized the way that functions are being defined to change, read, or delete attributes in such an additional schema object. Like, in this case, there is a user get function, which calls a BAPI in SAP. The BAPI is an application program requiring attributes to identify which objects to read and additional parameters that might be required. And these functions will be defined at the top of the document, and then at the bottom the additional information will be assigned like tables. So if you want to read a specific customer table-- like, in this case, TUZUS table-- then you would add this table, and you can get the information from this table or you will define information for this table, like what is the filter, which is a SQL statement, which SQL where clause, which is the key of this table. This information will be provided in this part of the document. And then in the last part, you will define the schema object. In this case, you will give the schema object a name and then reference the table from which you request this information, and for single attributes you want to change, read, or update, you will call out the functions, and the combination of table, function, and schema object will give you the schema object where the list of objects in that table will be read using, for example, RFC read table call, which will give you a list of the objects. And when you click on a specific object or when you require information from a specific object, then the specific function will be executed to retrieve the information for that object. So when you look into the One Identity Manager synchronization editor target system browser, when you click on the schema object, you will get a list of schema object which is more or less an RFC read table to retrieve these information from the target system in an easy or simple read SQL statement. And as soon as you click on a specific objective, a function will be executed to retrieve the specifics of that selected object. This can be set up in an XML document. And if you need further assistance with this XML document, our professional services or support organization will be gladly ready to help you with the configuration of this XML document. Customizations of the One Identity Manager SAP connector are possible by changing existing project templates, adding additional mappings, removing mappings, or by adding additional schema object types that are not present in our standard mapping and are customer specific. These are possible customizations. These are customizations that are OK customizations, however that some customers ask to be done in a way that additional BAPI calls are being executed in a process chain step added to the ad hoc projection step or to call and add additional stuff using web services is not recommended. Changes done this way might be incorporated in later versions of the SAP connector and will give the customer implementation problems to move these customizations back and add the new feature into the One Identity Manager standard connector. So for customization which are not in the scope of the connector, please don't do these customizations in case it is a customization that makes sense for a broad range of customers. We are gladly happy to consider the implementation of this change into our One Identity Manager SAP connector. However, if there is an absolute business need to implement these changes, we know that these changes are possible, that these changes are being done, but be aware that removing these changes will also need additional effort to execute this change. When synchronizing SAP HANA databases, the connector to be used with One Identity Manager is the native database connector. Native database connector provides connection capabilities based on ADO.NET to connect databases available on the market that is supported by ADO.NET. So in this case, I'll have started the synchronization editor where we can see that the native database connector has been selected. And when I continue to configure this connector and on the Connection Configuration Wizard, I can see the list of supported connectors. In this case, I'm going to synchronize SAP HANA. And when I select SAP HANA and Continue on the next page, I will be asked for specifics of the server, username, password, and the database I'm going to connect. Once the connection has been established and the schema objects are asked to be synchronized, One Identity Manager is providing a new database integration module pack that can be used to predefine the objects that should be synchronized and the mappings that should be configured. This database integration module has been released on our web page and can be downloaded separately and will be integrated into the product later. At the moment, the synchronization template will be provided as an XML document that can be imported during the configuration process of the connector, and it will provide the schema objects, the schema mappings, and the necessary processes to be executed. The new job processes, job chains that are available, are called DSI_ [INAUDIBLE] insert, update, delete, and accordingly for the additional objects and will trigger provisioning update deletes on the specific tablespaces in the selected SAP HANA database in this instance. [MUSIC PLAYING]