1. www.novell.com Integrating Novell eDirectory ™ with SAP R/3 and MySAPPortal Matt Graves eBusiness Consultant Novell, Inc. mgraves@novell.com John Ovali Systems Engineer Novell, Inc. (Germany) jovali@novell.com

2. Vision…one Net A world where networks of all types—corporate and public, intranets, extranets, and the Internet—work together as one Net and securely connect employees, customers, suppliers, and partners across organizational boundaries Mission To solve complex business and technical challenges with Net business solutions that enable people, processes, and systems to work together and our customers to profit from the opportunities of a networked world

4. Change of a Paradigm

5. User Demand for one Net StorageApplication Intranet StorageApplicationStorageApplication ExtranetInternet Information

6. one Net Services StorageApplication Security Portal Intranet StorageApplicationStorageApplication ExtranetInternet eDirectory ™

7. Management vs. Provisioning ASSIGN Rights Policies Applications Settings DEPENDING on Servers Workstations LIMITS/BORDERS Intranet OFFER Resources Services DEPENDING on Applications Servers LIMITS/BORDERS Extranet

8. Provisioning vs. Novell Net Services OFFER Resources Services DEPENDING on Applications Servers LIMITS/BORDERS Extranet OFFER User services Admin services Resources DEPENDING on User LIMITS/BORDERS Internet (  none)

9. Novell eProvisioning Solutions User provisioning  Services to manage and maintain consistent user and employee identity in a heterogenous environment Application provisioning  Offer and maintain application and information in your LAN, WAN, and Internet, including billing and accounting Employee provisioning  Offer and maintain information and vital resources for your employees eDirectory-centric technologies reduce not only IT costs

10. Employee Provisioning eProvisioning Architecture Details User Provisioning Application Provisioning User and Resources Database— Novell eDirectory Client Applications Distribution Mechanism Portal Security Mechanisms Operating Systems Server Applications Direct Access User Accounts Metaframe User Accounts Single Sign-On Collaboration

11. Novell and SAP Integration

12. SAP or R/3?, SAPPortals or MySap... SAP=vendor R/3=product of this vendor  R/3 “classic” (ERP, Base + HR, FI, CO, MM...)  Other products: e.g., APO (Advanced Planning and Organizing), B2B, CRM, SCM, BW (“New Dimension”) SAPPortals=vendor, 100% daughter company of SAP AG MySAPPortal=product of SAPPortals

13. Terminology... Related to micro-economics  Menu entry = transaction (what it is what it does) Complex Client System

14. R/3 Organization Back-end System Processing Data Back-end System Processing Data MiddleWare Service to Show Data MiddleWare Service to Show Data Desktop Application Desktop Application

15. R/3 System Landscape R/3 Back-End Quality-Assurance System Q1,Q2,... Quality-Assurance System Q1,Q2,... Productive System P1,P2,P3,... Productive System P1,P2,P3,... Development System D1,D2,D3,... Development System D1,D2,D3,...

16. R/3 Component System Basic system  HR, CUA,... Other components (also called modules)  FI – Finance  CO—Controlling  S&D—Sales and Distribution ...

17. R/3 Back-end Overview Browser MySAP Portal MySAP Portal Profile Transaction CUA HR Novell eDirectory Role ITS SAP GUI (Win32) SAP GUI (Win32)

18. Rights Assignment Concept Complex, table-focused, multi-nested tables Biggest challenge on all R/3 projects UA—User Administration per client CUA—Central User Administration  Central  Can be used for all SAP products  Nice idea of a corporate-wide CUA mostly stays an idea  Extremely difficult to realize and administer

19. Rights Assignment and Login Concept User Role Profile Activity Group Transaction Client System

20. Rights Concept Corp. DivisionFISDMM RolleAccounting Debitors ISRWarehouse entry T-CodeExtend MM01VVX MM02XX... Activity Group

21. Novell and SAP: Three Initiatives HRCUAPortal DirXML ™ DriverLDAP Sync toolPortal and corp directory Vendor NovellVendor SAPVendor Novell Brings person‘s (employee) data to eDirectory Synchronizes specific user-data between CUA and eDirectory Stores portal and user information in the directory Supports also MS and Netscape HR-Driver is validatedeDirectory is the only certified directory eDirectory comes in the box with the portal product

22. The Forgotten Driver: SAP SD SAP SD DirXML ™ Driver Transfers customer data from eDirectory to SD Module (Sales and Distribution) Was originally made by marchFIRST Now available Not yet validated by SAP

23. What Customers Always Request Administer SAP users by eDirectory because of extreme complexity of SAP user administration  Not possible with our products Rights assignment has to be done with SAP tools, the same as it is with Exchange or Notes Single Sign-On mechanisms between modules and systems—causes confusion with our SSO

24. SAP HR— DirXML Driver

25. SAP HR and Novell eDirectory SAP HR Novell eDirectory John Ovali Systems Engineer ? PBX, Building Access Systems, Work Time Tracking Systems John Ovali 123-456 E-mail System

26. PBX, Building Access Systems, Work Time Tracking Systems SAP HR and Novell eDirectory SAP HR Novell eDirectory John Ovali Systems Engineer ? John Ovali 123-456 E-mail System John Ovali Systems Engineer jovali@novell.com 123-456

27. SAP HR and Novell eDirectory SAP HR Novell eDirectory John Ovali 123-456 E-mail System John Ovali Systems Engineer Jovali@novell.com 123-456 John Ovali Systems Engineer Jovali@novell.com 123-456 PBX, Building Access Systems, Work Time Tracking Systems

28. Novell DirXML eDirectory Application Index Database Subscriber Publisher XML Engine Stylesheets App Shim

29. What the DirXML Driver Does to SAP HR Transfers person (employee) data to Novell eDirectory  Name, Department, Title, ID, etc. Limited transfer back from eDirectory to HR module  Phone number  E-mail adress  Similar

30. What the DirXML Driver Does Not Do to SAP HR Does not create R/3 users Does not administer R/3 users (This has to be done using CUA, not HR module) Does not deliver Single Sign-on capabilities

31. DirXML-HR Driver: What the Customer Needs R/3 Classic Novell DirXML 1.1 SAP HR Consultant SAP ALE Consultant Novell Consultant

32. DirXML Server How the DirXML-SAP-HR Driver Works (Publisher Channel) R/3 Back-End Host DirXML Remote Shim Gets the XML Document and passes it to the DirXML engine DirXML Engine Processes the document and enters information into the directory Novell eDirectory Now contains these employee data—It can be used to distribute it to other applications as well HR Module Here all employee data is maintained ALE Application Link-Enabler Interface to all other applications—has to be well configured IDOC File with the transferred employee data, somewhere in the file system DirXML Driver Shim Polling-mechanism reads IDOC files and converts needed information to XML DirXML Remote Loader Takes the XML document and sends it encrypted using SSL to the DirXML Server SSL-encrypted

33. iDocs

35. SAP Organizations in ConsoleOne ®

36. SAP HR Title and Department from HR

37. Issues Queuing Future events Content of iDocs

38. SAPPortals and Novell eDirectory

39. User Management API PCD Role Data PCD Role Data Corporate LDAP Basic user data Basic group data User/group assignment Group hierarchy Corporate LDAP Basic user data Basic group data User/group assignment Group hierarchy Attribute Mapping Portal LDAP Portal-related user properties Portal-related group properties User/group role assignment Access information for component systems (user mapping) Portal LDAP Portal-related user properties Portal-related group properties User/group role assignment Access information for component systems (user mapping) Novell eDirectory

40. The SAPPortals Idea of Directory Use Corporate DirectoryPortal DirectoryContent Directory May be eDirectory, iPlanet, or ADS May be eDirectory or iPlanet (no ADS) Is proprietary in the file system of server Is intended to be there already Is intended to be set up on deployment Will be set up on deployment Read-only access to User and Group information, User to Group assignment Read/Write Access Group to Role Assignment Single Sign-On Role/Meta Data Content to Role Assignment

41. What SAPPortals Says... Corporate directory for user data is already there Set up a portal directory for portal data Maintain two directories But it is possible to use the same directory

42. SAPPortals User Management What we call a gadget they call an iView Roles contain iViews Roles are assigned to groups Users are assigned to groups Tied connection is iView-Role-Group-User Role in MySAPPortal does not equal the role in SAP R/3 Whatever role a user has is a menu entry on top of the browser window  don ’ t assign too many roles to a user

43. SAP CUA and Novell eDirectory

44. CUA Central User Administration One single CUA for all systems and modules is possible Modules or systems can have own CUAs Idea of a single corporate CUA mostly stays an idea—realization is too complex

45. SAP Basic and Novell eDirectory SAP R/3 Version 4.5 / 4.6 b/c WPAS 6.10 CUA LDAP Sync Tool (SAP) Novell eDirectory E-mail System Worktime tracking Others (e.g. MySAP Portal) HRFICO... Novell DirXML Driver

46. What the LDAP Sync Tool Does... Synchronizes R/3 user database with eDiretcory Cron job Attribute Mapping defines which R/3 field is mapped to which attribute in the directory Reads new users from the directory, then a role can be assigned to the user

47. What the LDAP Sync Tool Does Not Do... Give rights to new users from the directory other than the role assignment Does not assign the profile to the user, which is more important Make employees (or other persons) a user—it is not connected to other R/3 modules Transfer transaction groups or codes assigned to SAP users to the directory

48. What the Customer Needs SAP R/3 Version 4.5/4.6b/4.6c Web Application Server 6.10 (includes the Sync Tool)

49. Issues Scalability No Event System, polling only Only one sync direction at once (attribute level)

50. A Visionary Outlook to the Future

51. XML ODBC, LDAP NDAP, NCP Architecture Applications ERP, Lotus Notes Directories Active Directory, iPlanet NetWare Solaris, AIX LinuxNTW2K OS/390, Solaris, HP-UX, AIX, Linux, FreeBSD, AS400, RADIUS, IIS, IBM RACF, CA ACF, many others, others coming John Ovali NDS 8.5 (Flaim Database, Security, Maintenance Tools) Synchronization / Authorization / Native Single Sign-On Admin Authorization by redirection User

52. Distributed User Access Management Access to needed resources Decentric administration possible Centric control distributed administration properties Administration back to the roots of demand Advantages Shorter response time Smaller administration effort Significant reduction of cost Higher efficiency

53. User Access Management Add to e-mail distribution list, apply needed applications Access to File System Add user to workgroup

54. Your Benefit—Higher Efficiency User provisioning using eDirectory Application provisioning using eDirectory Employee provisioning using eDirectory Base support for future SLAs Higher security Fast ROI

55. Highly Recommended On... High employee fluctuation, e.g., seasonal influence  Accelerate registration (e.g., HR-System -> time tracking, access systems) Higher security needs  Data integrity (e.g., lock employee in HR systems –> deny access to building or remote dial-in services) High administration efforts  Significant reduction of cost