One Identity Manager SAP Experience #9 Fire Fighter Challenge

[MUSIC PLAYING] A very common challenge in an SAP environment is the privileged access scenario, called firefighter scenario, where in an emergency case a person needs high permission access to the SAP system to do fixes and maintenance operations in a broken or about to break system. This firefighter scenario requires that the user gets access to the system and that the permissions or activities that the user has executed in the system can be tracked and monitored and locked. So for that scenario, two alternatives exist. One alternative is that the user accesses the password of the firefighter user in the SAP system. That password is being provided to him in the One Identity Manager, and the password is stored in the Safeguard appliance, which is the privileged access management solution of One Identity. And that password released to the user will lead to the user to execute operations or run tasks in the SAP system, which will be locked by the SAP system itself, and the SAP locks can be used to audit the operations the user has executed. The other alternative is that the user does not get access to the password of the firefighter user account but for him, a session will be started with the firefighter user account logged in. And the user can run operations as that user without knowing the password of that firefighter user. In that case, the video session logs of the Safeguard solution can be used to record and review and audit the operations the user has done, as well as the SAP audit logs. Depending on the requirements of the customer scenario, both alternatives are possible. How do we get access to the password or the privileged session for the firefighter user? One Identity Manager provides integration with Safeguard to release the password or release a session that will grant high level authorized access to the SAP. So when the user is logged in, he can go into the IT shop. There is a predefined category called privileged access request, and in this privileged access requests, there is a password release request the user can execute to get the password released. Additional firefighter users can be made available here to be requested by authorized persons to get the session released to them and to execute these permissions operations in the SAP system. [MUSIC PLAYING]