As already mentioned in the short summary above the scenario used for this collaboration brief deals with two key components: Microsoft Active Directory and SAP Central User Administration. Active Directory, being the integrated, distributed directory service included with Microsoft Windows Server 2003 and Microsoft Windows 2000 Server, provides a central user repository used to centrally maintain user data, thus avoiding the redundant, error-prone maintenance of user information in several systems. Most organizations already use Active Directory to organize and manage information about all kinds of their different resources like users, computers, applications and so on.

While the user management engine (UME) used by SAP Enterprise Portal can use a central Active Directory as its user persistence store ABAP systems use their own database as user store. SAP’s central user administration (CUA) can be used to maintain SAP user master records in one central system and distribute this information in a consistent way to connected child systems. This provides a single point of administration of all SAP user data in the entire SAP system landscape in one central system.

This document describes the benefits of a synchronization of user data between an LDAP directory (e.g. Microsoft’s Active Directory) and SAP systems. In the outlined scenario MS Active Directory will become the leading system for storing common user data. As a result users newly created in the directory will be synchronized and created in the SAP CUA. For user data that has been updated in the directory this new information is also synchronized into the SAP system and updated there as well. The SAP CUA will be used to distribute all the user data that has been “imported” from the directory to all its connected child systems.

Download pdf Integration of SAP central user administration with Microsoft Active Directory