How to set SU01 parameters

[Former Member]

Hi experts,

I have a idm 7.2 connected to SAP systems.

My users are created by uploading a csv file.

My users are created correctly in SAP system but now I have to set by default some SU01 parameters when creating only SAP users.

Should add constants to the SAP connector or should I create create script to set these values?

Any help how to do that?

Mia

[Steffi_Warnecke · Accepted solution]

Hello Mia,

thank you explaining a bit more.

Well, since you just want to add those parameters when a new account is created, I think it would be enough to go via the repository-constants. Since the users can't have parameters in the system set if they don't have an account, there is no need to mash existing and new (default) parameters into one string to provision it to the ABAP system.

That would mean, that you keep this in your CreateABAPUser"-pass:

parameter1           %$rep.ABAPATTRIBUTE_%$rep.$NAME%%

Since you give the value of a repository-constant, you have to write "$rep." up front.

And then you have to create a contant in every one of your repositories, that is named ABAPATTRIBUTE_<repositoryname>.

So you have ABAPATTRIBUTE_DEV, ABAPATTRIBUTE_QAS and ABAPATTRIBUTE_PRD in the end. And as a value for these constants you just give as a string e.g. "UGR= FD|MOLGA=02|PM=X XX|EFC=0".

I think this should work.

Regards,

Steffi.

[Former Member · Accepted solution]

Hi Steffi,

I appreciate your help, I will implement your suggestion, but is there any risk that the additonal SU01's parameter's will overwrite the existing one (added during the initial Load) ?

Mia

[Steffi_Warnecke · Accepted solution]

Hello Mia,

well, you wrote, that you just want to implement the setting of the default parameters for the create-pass. Users imported through the initial load already have an account and therefor the modify-pass would trigger for them and there you should keep the parameter-line commented out.

I'd say then the existing parameters wouldn't be overwritten, because for new accounts there is none and for existing accounts the create-pass won't be used.

, what do you think?

[terovirta · Accepted solution]

That sounds like a working solution.

[Former Member · Accepted solution]

Hi Steffi,

Here we are facing to 2 sources from where the SU01's parameters comes from:

1.  Initial Load --> the %ABAPATTRIBUTE_%$rep.$NAME%% Attribute is filled during the initial load.

--> userParameter table is getting some SU01's parameters

2. The need is how to set the additional SU01's parameters when creating a new ABAP users.

I appreciate your help Tero and Steffi,

Mia

[Steffi_Warnecke · Accepted solution]

Hello Mia,

but the existing %ABAPATTRIBUTE_%$rep.$NAME%% is the user specific ATTRIBUTE with a value for every user.

The new %$rep.ABAPATTRIBUTE_%$rep.$NAME%% is a CONSTANT in a repository that is only used for the create-pass to give a new account a default set of parameters.

I don't know what you mean by additional parameters, since new user accounts can't have any parameters yet.

[Former Member · Accepted solution]

Hi Steffi,

It's more clear for me and thank you for your help, just last point when you said:.....

Users imported through the initial load already have an account and therefor the modify-pass would trigger for them and there you should keep the parameter-line commented out.....

Should I comment the "parameter1" somewhere ?

Thanks,

Mia

[Steffi_Warnecke · Accepted solution]

Did you check the UpdateABAPUser-pass? There I have the line for the parameters, but in my case it's already commented out (see my first screenshot in this thread).

Just check, if the line is there in the update/modify-pass and if it's enabled, comment it out.

I'm just wondering:

How do you maintain parameters for existing users? You said, you had loaded the parameters through initial load into IdM. Are the parameters changed via IdM, too? Or do the users maintain them in the ABAP system?

I'm just curious how you keep up with the changes, since all we talked about is the setting of parameters for new accounts. If you also want to change the parameters through IdM, then you can't comment that line in the UpdateABAPUser-pass out, because it is needed for existing accounts.

[Former Member · Accepted solution]

Hi Steffi,

As I said I have 3 ABAP system(repositories): DEV, QAS and PRD

The users maintain the SU01's param in the ABAP system.

In the CreateABAPUser-pass and UpdateABAPUser-pass I have the attribute "parameter1" enabled with the value %$ABAPATTRIBUTE_%$rep.$NAME%%.

parameter1               %$ABAPATTRIBUTE_%$rep.$NAME%%.

As you explained clearly I create a new constant in the ABAP system repository: DEV

ZADDITIONALPARAM_DEV   with value   UGR= FD|MOLGA=02|PM=X XX|EFC=0

So in the CreateABAPUser-pass i modified :

parameter1               %$ABAPATTRIBUTE_%$rep.$NAME%%.

by

parameter1               %$rep.ZADDITIONALPARAM_%$rep.$NAME%%.

At the end when I try to create the user I got the error:

putNextEntry failed storing USRABC123

Exception from Add operation:com.sap.idm.ic.ToPassException: Parameter ID $rep.$NAME does not exist

Normally $rep.$NAME should be "DEV" and the constant exist in DEV repository.

Mia

[Steffi_Warnecke · Accepted solution]

Could you change the part of the CreateABAPUser-pass to %$rep.ZADDITIONALPARAM_DEV% (replacing the placeholder for the rep-name manually).

And then create a new account for a user in that system. This way we can test, whether the whole parameter-thing is working at least. After that we can concentrate on why it's not getting the repository-name.

At the moment it looks like it's taking "$rep.$NAME" as the value.

Could you show screenshot of that part of the pass and of the repository-constant, please?

[terovirta · Accepted solution]

Steffi Warnecke wrote:

Could you change the part of the CreateABAPUser-pass to %$rep.ZADDITIONALPARAM_DEV% (replacing the placeholder for the rep-name manually).

You probably should name all the repository constants as ZADDITIONALPARAM, so you can refer them always as %$rep.ZADDITIONALPARAM% in the CreateABAPUser regardless of the repository.

regards, Tero

[Steffi_Warnecke · Accepted solution]

What Tero wrote!

That's even better and not so confusing to read with all the placeholders.