LDAP functions from ABAP

[Former Member]

Hi Everyone ,

We have a Active Directory structure here that replicates our org structure in SAP i.e. Each AD user

is in an OU in LDAP that is based on a SAP Org Unit, the structure is hierarchical.

This allows permissions to be allocated at an Org Unit level as well as a user level.

We are reviewing the current process to ensure its the best fit for what we require.

At the moment we extract HR data from SAP and use a third party tool to update certain AD

attributes. The process works well for many senarios....

Change of directorate

Change of org unit

Change of position - i'm assuming this is just an attribute

Change of job - as above - an attribute !

Change of name, building name, address, tel no, cost centre....etc - as above an attribute

Using the LDAP connector and associated LDAP Function Modules, is it possible to create

new LDAP org units, if a corresponding SAP HR Org Unit is created and remove them should the Org Unit stucture in SAP change.... ?

We know of one LDAP ABAP function module SPLDAP_RECEIVE_ATTRIBUTES, can you clarify if others exist ?

Is the LDAP connector mainly used for attribute changes with a flat AD structure.... ?

Regards

[Former Member]

Hi Everyone ,

We have a Active Directory structure here that replicates our org structure in SAP i.e. Each AD user

is in an OU in LDAP that is based on a SAP Org Unit, the structure is hierarchical.

This allows permissions to be allocated at an Org Unit level as well as a user level.

We are reviewing the current process to ensure its the best fit for what we require.

At the moment we extract HR data from SAP and use a third party tool to update certain AD

attributes. The process works well for many senarios....

Change of directorate

Change of org unit

Change of position - i'm assuming this is just an attribute

Change of job - as above - an attribute !

Change of name, building name, address, tel no, cost centre....etc - as above an attribute

Using the LDAP connector and associated LDAP Function Modules, is it possible to create

new LDAP org units, if a corresponding SAP HR Org Unit is created and remove them should the Org Unit stucture in SAP change.... ?

We know of one LDAP ABAP function module SPLDAP_RECEIVE_ATTRIBUTES, can you clarify if others exist ?

Is the LDAP connector mainly used for attribute changes with a flat AD structure.... ?

Regards

[Former Member]

Nick,

I'm not sure if this helps in any way, as I'm not really answering your question...

We've built an Identity Management suite with ABAP, and we write into AD via the LDAP connector. Since our OU structure is quite flat and static, we don't need to manipulate OUs; we do just about everything else, though, using function modules from function groups SLDAP and FSLDAP_EXT (LDAP_SYSTEMBIND, LDAP_UNBIND, LDAP_CREATE/READ/UPDATE/DELETE).

We manage > 50'000 users, and the connector is as fast and stable as you could wish.

But I never tried to create, delete or move OUs...

Best regards

Rainer

[Former Member]

Hi Rainer,

Thanks for responding....

It does sound like having a flat structure HELP's !

Are you using the connector in real-time ?

Regards

Nick

[Former Member]

Hi Nick,

We do real-time access for reading (e.g. to prevent duplicates when maintaining some critical attributes), but we update with an asynchronous process, with a little queue. We designed it that way, because we also provision other systems, and we handle them all the same way; theoretically, I think we could afford real-time, because it's so fast and reliable.

Rainer