Microsoft Active Directory Integration

[former_member397702]

Hi experts

We have two issue for our customer:

1-Integration of SAP User Administration into Microsoft Active Directory: Our customer wants to synchronize their SAP users and passwords with Microsoft Active Directory but they dont want to use Single Sign-on.

2-Creating and Synchronize Users in Active Directory from Employee Data Stored in SAP HR

We found two document related with this issue but their version is very old. Is there any new version of this document or we have to use different technology (for example Netweaver Identity Management)?

Related links are:

Best Regards....

[hynek_petrak]

Hi Hande,

I can imagine implementing a password hook on your domain controller: PasswordChangeNotify callback function (Windows)

which would then update the SAP password for a user on all defined SAP instances via RFC call to BAPI_USER_CHANGE.

All the above would require some 200-300 lines of code, however from a security standpoint, I strongly discourage you of implementing that. Your active directory passwords are safe as long as you keep them on the domain controller and you do not touch them. Any attempt like above leads to compromise of user credentials.

Either keep the authentication separate or go for SSO. Do not synchronize the passwords.

Hynek