user management in SAP web AS Java

[Former Member]

My company currently has a user management concept in place for BASIS. These concepts follow the segregation of duties principle. So for example a system administrator can grant rights to end-users but he can't change content himself. This concept was put in place to comply with SOX.

Now my company would like the same principles to be implemented in SAP web AS Java. I have searched the forums, blogs and notes, but i can't seem to find some best practices regarding the matter.

As I have difficulties finding these I am wondering if it is perhaps not needed from a SOX point of view, as the web AS Java doesn't directly access content, does this make sense?

Regardless of the SOX point of view I still believe the problem exists because anyone can mess up your portal environment if the user management is not handled correctly. So does sap have some best practices regarding user management in the web AS Java?

Any feedback on these 2 questions would be great!

[Former Member]

Hi,

In my company, we have decided to use the abap ECC6 system as the UME source for the SAP Portal.

Therefore we did not change anything for our users management : All is done in ECC6.

Regards,

Olivier

[mvoros]

Hi,

when I hear these types of requirements I always think of IdM. Any IdM (not only from SAP) allows you to easily satisfy all SOX requirements. I understand that implementing IdM solution is not an easy task but you might get additional benefits from it like reduction of service desk calls and so on, not only compliance.

Cheers

[arpan_paik]

In Web AS Java, as per my understanding there is no segregation for user management and role management. An admin role is required. However is this system cover under this segregation? I do not think so. As you won't be changing any portal role.

Regards,

Arpan Paik