SAP Identity Management Overview

SAP Identity Management
Overview
October 2014 Public

Agenda
Introduction to Identity Management
Role Management and Workflows
Business-Driven Identity Management
Compliant Identity Management
Reporting
Password Management
Connectivity
Architecture
Identity Virtualization
Summary & Additional Information
Appendices
© 2014 SAP SE or an SAP affiliate company. All rights reserved. Public 2

Introduction to

SAP Security Portfolio
IT Application Security
IT Application Security – SAP Portfolio
Identity and access management (IAM)
Identity, governance and
administration Authentication and single sign-on
• Manage identity lifecycle
• Segregation of duties
• Emergency access
• Role management
• Reporting
• …
• Single sign-on
• Secure network communication
• Central access policies
• 2-factor authentication
• …
Code
vulnerabilities
Find
vulnerabilities
in customer
code
Threat
management
Detect cyber
crime attacks
based on user
behavior
SAP Identity
Management
SAP Access
Control SAP Single
Sign-On
SAP Cloud
Identity
SAP
NetWeaver AS,
add-on for
code
vulnerability
analysis
SAP
Enterprise
Threat
Detection

Key Capabilities
Enables the
efficient,
secure and
compliant
execution of business
processes
Holistic approach
Manage identities and
permissions
SAP Identity
Management
Ensures that the right
users have the
right access to the
right systems at the
right time
Consistent with user
roles and
privileges
Across
all systems
and applications

Business Drivers for Identity Management
Operational
costs
Changing
business
processes
Compliance
challenges
y Multiple sources of identity data
y Manual user provisioning
y Labor-intensive, paper-based approval systems
y Manual password reset processes
y Transactions involve multiple enterprises
y Partners participate in business processes
y Company-specific requirements for user provisioning solutions
y No record of who has access to which IT resources
y Inability to deprovision user access rights upon termination
y No complete audit trail available
y Prevention of unauthorized access in multi-enterprise
environments

Identity Lifecycle
How long does it take for new
employees to receive all
permissions and become
productive in their new job?
Are permissions automatically
adjusted if someone is
promoted to a new position?
How can you remove
permissions automatically if
employees change their
Who has adequate
position?
permissions to fill in for a co-worker?
co-How
long does it take to remove ALL
worker?
How permissions of an employee? And
how can you ensure that they were
properly removed?

Solution in a Nutshell
Central management of identities
throughout the system landscape
Rule-driven workflow and approval
process
Extensive audit trail, logging, and
reporting functionality
Governance through centralized and
auditable identity data
Compliance through integration with
SAP Access Control
Compliant and integrated identity
management solution to mitigate
segregation-of-duties risks
SAP Access
Control
SAP Identity
Management
SAP applications Non-SAP applications
SAP SCM
SAP ERP HCM
SAP ERP
Java
Portal
Database
Legacy
OS
E-mail
Web app
SuccessFactors …

A Holistic Approach to Compliant Identity Management
Example: On-boarding
Success
Factors
SAP ERP
HCM
Approval
workflows
Web-based single sign-on
and identity federation
Integration with
SAP Business Suite
and SuccessFactors
Password
management
Identity virtualization and
Central identity as a service
identity store
SAP Identity
Management
Provisioning to SAP
and non-SAP systems
SAP Access
Control
Compliance
checks
SAP BusinessObjects
Access Control (GRC)
Reporting
Rule-based assignment
of business roles

Solution in Detail
Role Management and Workflows

Role Definition and Provisioning
Role Definition (design, one-time task)
Read system access information (roles,
groups, authorizations, etc.) from target
systems
Define a business role hierarchy
Assign technical roles to business roles
Develop rules for role assignments
Provisioning (regularly)
Assign or remove roles to/from people
ƒ Through request/approval workflow
ƒ Manually (administrator)
ƒ Automatically, e.g. HR-driven
Automatic adjustment of master data and
assignments of technical authorizations in
target systems
Employee Accounting
Portal
role
Accounting
(ABAP role)
Manager
HR manager
AD
user
E-mail (ABAP role)
E-mail
system
Active
Directory
SAP
Portal
SAP
FI
SAP
HR
Technical roles Business roles

Context-Based Role Management: Reducing Complexity
Business Role
User
Position
Location
…
SAP NetWeaver Identity Management
Technical role A Technical role C
Technical role B
Managed System
User
Managed System
Technical role A
Technical role B
Context-based role management simplifies
the structure of roles through dynamic
role assignment based on user context
information.
Benefits
Reduced number of roles
Reduced complexity
Sufficient granularity
Improved data consistency
and governance
Example:
20 roles in 1000 factories
y Conventional method: 20.000 entries (roles)
y Context-based: 1.020 entries (roles + contexts)

Workflows
Approval
Notification
y Identity Center sends a
notification to user/manager
Provisioning
y Identity Center provisions
new roles and privileges to
respective systems
Request
y User sends a
role request
Processing
y Identity Center
processes request
– Sends alert to manager /
administrator
y Manager checks request
and approves/denies

Solution in Detail
Business-Driven Identity Management

Integration with SAP Business Applications
Success
Factors
Employee
Central
SAP Identity
Management
SAP Supply
Network
Collaboration
SAP Extended
Warehouse
Management
Transportation
Management
SAP ERP
Financials
SAP
SAP Portfolio
and Product
Management
SAP Customer
Relationship
Management
SAP Supplier
Relationship
Management
SAP Product
Lifecycle
Management
SAP HANA
SAP Service
Parts Planning
SAP ERP
Human Capital
Management

Business Process Driven Identity Management
On-Boarding
Kim Perkins joins the company as a marketing specialist.
From the first day with her new company, she is able to log on to all relevant systems,
including access to the employee self-services, and access to SAP CRM to track the
marketing activities she is responsible for.
Kim’s manager
approves the
assignment
2 3 4
Line Manager
Pre-hire phase
HR ensures that all necessary
employee data for Kim is
available, such as position and
entry date
1
Event-based extraction
of personnel data
First day at work
Based on the position in
HCM, IDM automatically
assigns the business
role “Marketing
Specialist”
SAP
ERP
HCM
Success
Factors
HR Operations
Provisioning of role and
authorization information to
relevant target systems
User created
“Employee”
Business Partner created
User created “Marketing
Professional”
User created
Access to SAP ESS
Access to SAP CRM
SAP
ERP
HCM
SAP
ERP
SAP
CRM
SAP
Portal
5

Position Change
After two years as a marketing specialist, Kim is promoted and takes over personnel and
budget responsibility for her marketing team.
On the first day in her new role, she has access to the manager self-services. In her new
position, she is responsible for budget approvals for all marketing campaigns - this requires
immediate access to SAP ERP to view the marketing costs.
HR ensures that all necessary
employee data for Kim is
available
Day of position change
recognizes the line manager
information for Kim and
automatically assigns the business
role “Marketing Manager”
3
4
Provisioning of role and
authorization information to
relevant target systems
SAP
ERP
HCM
SAP
ERP
SAP
CRM
SAP
Portal
User updated
“Employee”
“Line Manager”
User created
“Marketing Controller”
User updated
“Marketing Controller”
User updated
Access to SAP ESS
Access to SAP MSS
1
2
of personnel data
SAP
ERP
HCM
Success
Factors
HR Operations Access to SAP CRM

Termination
After eight years, Kim leaves the company.
The day after her official assignment with the company ends, she is no longer able to access
any corporate systems.
HR ensures that all data relevant
for the employment contract
termination is available, such as
last day of work
Day after termination of employment
recognizes the last day information
for Kim; it automatically takes away
all access rights and disables her
accounts
3
SAP
ERP
HCM
SAP
ERP
SAP
CRM
SAP
Portal
4
User disabled
User disabled
User disabled
User disabled
1
2
of personnel data
SAP
ERP
HCM
Success
Factors
HR Operations

Solution in Detail
Compliant Identity Management

Compliant Identity Management: Capabilities
Consistent view on current and historic access rights, approvals
and policy violations
Manage identities
and permissions
SAP Identity
Management
Identify and
mitigate risks
SAP Access
Control
Central
management of
heterogeneous
environments
Integration
based on standards
Compliance
checks
Business risk
controls and
mitigation
Compliant identity management across SAP and heterogeneous
landscapes in one integrated solution

Compliant Identity Management: Process View
4 Risk
analysis
SAP BusinessObjects
Access Control (GRC)
Request role
assignment 1
SAP
Identity Management
SAP Access Control
Forward
request for
risk analysis
3
6 Risk status
Manager
2 approval
Notification to
8 user and manager
Provisioning to
7 target systems
5 Risk
mitigation
SAP SCM
SAP ERP HCM
SAP ERP
Java
Portal
Database
Legacy
OS
E-mail
Web app
… …

Compliant, Business-Driven Identity Management
Solution:
Simplify and automate role assignment
Reduce risk through compliance checks and remediation
Automate manual processes through integration with SAP
Business Suite
Yes
Approve
assignments
No
Requirement:
Provide automated, position-based role management
while ensuring compliance
Calculate entitlements
based on position
Compliance check
Remediation
1
New Hire
SAP
ERP
HCM
SAP
ERP
HCM
SAP
ERP
FI
Portal
Non-
SAP
2 3 4
5
SAP ERP HCM SAP Identity Management SAP Access Control Line Manager Landscape

Reporting Options at a Glance
Basic Reporting
„ Focus: Static, printable reports
„ Report creation on database level
Extended Reporting with SAP Business Warehouse (SAP BW)*
„ Focus: Dynamic reports, offering more, highly detailed, and customizable reporting options
„ Data is extracted from SAP Identity Management on a regular basis (as per defined job)
„ Predefined report templates available, custom reports can be freely defined
„ filtering, sorting, export to MS Excel, CSV, PDF, send via e-mail, etc.
Reporting with SAP Lumira
„ Focus: Customer-specific reposts/analyses for identity management
„ Rich graphical capabilities for visualizing and utilizing reported data
„ Low integration and maintenance efforts
„ Easy extension
*SAP BW and SAP Lumira are not part of the SAP ID Mgmt license

Basic Reporting
Application/privilege-centric
Determination of system access
User-centric
Determination of user privileges
Entry data
Current data, historical data, time stamps,
modified by, audit flags
Approval data
Who approved what when?
Who had which privilege when?
Segregation of duties, Attestation
Task audit log
Determination of tasks run on
user / by user
General logs
Off-the-shelf reporting tools
can be used

Extended Reporting with SAP Business Warehouse
SAP BW report templates
Persons, privileges, roles and their assignments
over time and for specific dates
Content-based and time-based reporting
Advanced filtering and sorting options
Access control
Roles for reporting user
(administrator, manager, owner)
Basic audit data
Who changed what
Flexibility
BEX reports
Change history
up to the time of
last synchronization

Reporting with SAP Lumira
Customer-specific reposts/analyses for
identity management
Rich graphical capabilities for
visualizing and utilizing reported data
Low integration and maintenance efforts
Easy extension

Solution in Detail
Password Management

Password Management
Centralize and automate password management
SAP
ERP
HCM
SAP
ERP
FI
Portal
Non-
SAP
Solution:
SAP Identity Management Landscape
Requirement:
Reduce help desk calls related to password reset
inquiries
Enable password provisioning across heterogeneous
landscapes
Reset password
Recover lost password
Set new password
User Helpdesk

Solution in Detail
Connectivity

Connectivity Framework
On-Prem/Cloud Applications
„ SAP Business Suite
„ SuccessFactors
„ SAP Access Control
„ Lotus Domino / Notes
„ Microsoft Exchange
„ RSA ClearTrust
„ RSA SecurID
Technical
Other
Databases
„ Microsoft SQL Server
„ Microsoft Access
„ Oracle database
„ IBM UDB (DB2)
„ MySQL
„ Sybase
„ SAP HANA
Directory Servers
„ Microsoft Active Directory
„ IBM Tivoli Directory
„ Novell eDirectory
„ SunONE Java Directory
„ Oracle Internet Directory
„ Microsoft ADAM
„ Siemens DirX
„ OpenLDAP
„ eB2Bcom View500 Directory Server
„ CA eTrust Directory
„ SAP IDM Virtual Directory Server
„ Any LDAP v3 compliant directory srv
„ SPML
„ LDAP
„ ODBC/JDBC/OLE-DB
„ RFC
„ LDIF files
„ XML files
„ CSV files
SAP Identity
Management
„ SAP Application Server
„ Microsoft Windows NT
„ Unix/Linux
„ Shell execute
„ Custom Java connector API
„ Script-based connector API

Third Party Connector Certification
SAP ICC Integration Scenario NW-IDM-CON
SAP Identity Management Integration Scenario NW-IDM-CON
ƒ The SAP Integration and Certification Center (ICC) offers a certification for
the integration scenario NW-IDM-CON.
ƒ SAP partners as well as potential partners and independent software
vendors (ISVs) are invited to use the Connector Development Kit (CDK) to
create an SAP Identity Management connector for their application, and to
integrate the application into the identity management landscape. This
connector can then be certified by the SAP ICC.
For general information about third party certifications with SAP products, please
refer to http://www.sdn.sap.com/irj/sdn/interface-certifications, or contact the SAP
Integration and Certification Center (ICC) directly at icc@sap.com

Solution in Detail
Architecture

SAP Identity Management Architecture

Solution in Detail
Identity Virtualization

Virtual Directory Server
Virtual Directory Server (VDS) provides
„ Single consistent view and entry point for multiple
distributed identity data sources
„ Identity information as a service for applications
through standard protocols (LDAP, SPML)
„ Abstraction layer for underlying data stores
Consumer only sees one standard interface
„ Transform incoming LDAP requests, and connect
directly to the existing data repositories
„ Data stays within original data source
„ Efficient caching
Properties
„ Real-time access to data
„ No need to consolidate data sources
„ No extra data store
„ Quick LDAP deployment
„ Easier and cheaper maintenance
„ Attribute manipulation
„ Name space modifications
„ Complex operations on-the-fly
SPML
SPML LDAP
Virtual Directory Server
LDAP JDBC
Database
Directory Application
Server
Directory
Server

Summary & Additional
Information

Summary
SAP Identity Management is part of a comprehensive SAP security suite that includes
access control as well as secure programming and compliance aspects.
The solution covers the entire identity lifecycle and automation capabilities based on
business processes.
A strong integration with SAP Access Control creates a holistic identity and access
governance solution.
Extensive connectivity with SAP and non-SAP applications extends identity
management to all areas of the enterprise.

Find More Information
SAP Community Network
Visit the SAP Community Network (SCN) for comprehensive information on
SAP Identity Management, such as
ƒ Discussion forum,
product information,
documentation, training,
and support information
ƒ Articles, blogs, WIKI,
FAQs, and newsletters
ƒ Downloads
http://scn.sap.com/community/idm

Rapid deployment solution
Short project times and reduced TCO by simplifying
assignment and management of roles and privileges to
users
ƒ Implementation of best practice processes out of the
box with a fixed scope and most important and
common scenarios, e.g. defined set of customer
specific configuration, connection of source- and
target-systems, provisioning etc
ƒ Pre-configured functionality of SAP Identity
Management in a development system
ƒ Step-by-step guide, describing each activity during
deployment
ƒ Solution can be extended with additional add-on
options
Standard solution
Automatic
authorization
assignment
Mass user
administration
E-mail
notification
framework
Predefined
HTML based
reports
Add-On 1:
Connection of
1 source- and
2 target
systems
Approval
workflows
jobs
Support of
system specific
attributes
New Web UI
tasks
Connection to additional SAP systems
Add-On 2:
Additional Go-Live Support

© 2014 SAP SE or an SAP affiliate company.
All rights reserved.
No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP SE or an
SAP affiliate company.
SAP and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP SE
(or an SAP affiliate company) in Germany and other countries. Please see http://global12.sap.com/corporate-en/legal/copyright/index.epx for additional
trademark information and notices.
Some software products marketed by SAP SE and its distributors contain proprietary software components of other software vendors.
National product specifications may vary.
These materials are provided by SAP SE or an SAP affiliate company for informational purposes only, without representation or warranty of any kind,
and SAP SE or its affiliated companies shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP SE or
SAP affiliate company products and services are those that are set forth in the express warranty statements accompanying such products and
services, if any. Nothing herein should be construed as constituting an additional warranty.
In particular, SAP SE or its affiliated companies have no obligation to pursue any course of business outlined in this document or any related
presentation, or to develop or release any functionality mentioned therein. This document, or any related presentation, and SAP SE’s or its affiliated
companies’ strategy and possible future developments, products, and/or platform directions and functionality are all subject to change and may be
changed by SAP SE or its affiliated companies at any time for any reason without notice. The information in this document is not a commitment,
promise, or legal obligation to deliver any material, code, or functionality. All forward-looking statements are subject to various risks and uncertainties
that could cause actual results to differ materially from expectations. Readers are cautioned not to place undue reliance on these forward-looking
statements, which speak only as of their dates, and they should not be relied upon in making purchasing decisions.

SAP Identity Management Overview

More Related Content

What's hot (20)

Similar to SAP Identity Management Overview (20)

More from SAP Technology (20)

Recently uploaded (20)

SAP Identity Management Overview