Skip to Content

The HCM Use Case document (see http://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/f0ad23d3-3664-2a10-8aa7-e9c3c8616d48) provided for the SAP NW Identity Management component synchronizes employee data from the HCM system to the Identity Store using the LDAP connector as well as the Virtual Directory Server.

If one already uses a Middleware like SAP PI, transferring employee data as well as other relevant objects for rule based role assignment in the SAP NW Identity Management tool can also be done using the standard HR Master Data Distribution mechanisms based on ALE and IDOC by simply running the report RHALEINI with specific variants.

You will learn in this blog what has to be done in order to replicate “Organisational Unit” data from an HCM system to the SAP NW Identity Store into a custom entry type within the identity store which afterwards holds organizational data including parent/child relationships using SAP PI instead of LDAP Connector and VDS.

Part I (published in Calendar Week 9) explains the steps which have to be executed in SAP PI in order to transfer and transform the data from HCM to Identity Center using the standard HR Master Data Extraction.

How To synchronize data from SAP HCM to SAP NetWeaver Identity Center using SAP PI (Part II) (published in Calendar Week 10 2008) explains how to create a new entry type in the Identity Store, how to write the data from the staging area into the ID Store and finally how to create the parent / child relationships for having the hierarchy information available in the identity store.

How To synchronize data from SAP HCM to SAP NetWeaver Identity Center using SAP PI (Part III) (published in Calendar Week 12 2008) finally shows how to integrate the new entry type into the IDM workflow portal.

The following systems are required:

  • HR/HCM System (I am working with an IDES ECC 6.0 installation)
  • SAP XI 3.0 / SAP PI 7.0 installation (I am using SAP PI SPS 10)
  • SAP NW Identity Management 7.0 SP01 (I am using 7.0 SP01 Patch 1)

Knowledge / experience in the following area(s) is helpful:

  • ALE / IDOC Scenario Configuration
  • SAP XI / SAP PI experience
  • Basic SQL knowledge
  • Basic JScript knowledge
  • SAP NW Identity Management Knowledge

Download and Import of ESR Content (XI Content)

Download the following ESR Content (XI Content) packages from the Software Distribution Center in the appropriate version for your system landscape:

  • XI CONTENT HR

Therefore go to
SAP Software Distribution Center (http://service.sap.com/swdc)
   => Download
      => Support Packages and Patches
         => Entry by Application Group
            => SAP Content
                => ESR Content (XI Content)

image

Please follow the following SAP notes in order to import ESR Content (XI Content):

  • XI 3.0: SAP Note 705541 – XI 3.0 (SP1 and higher): Importing XI Content
  • PI 7.0: SAP Note 836200 – SAP NW 7.0: Importing Process Integration Content

After importing the specified components you should see the new software components in the SAP XI/PI Integration Repository.

image

The scenario, which we will setup uses the IDoc definition for the HRMD_A.HRMD_A07 IDoc. In case of older HR systems also other IDOC versions can be used.

Deploy the JDBC driver to access the Identity Center Database with the SAP PI JDBC adapter

Follow the instructions in the HowTo Guide “How to Install and Configure External Drivers for JDBC & JMS Adapters”.

You can download the HowTo Guide from the following location: http://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/f04ce027-934d-2a10-5a8f-fa0b1ed4d88f

You will also need a ZIP Package provided for the HowTo Guide: http://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/e00262f5-934d-2a10-b99c-9bc63c2a7768

In case the URLs have changed, go to http://www.sdn.sap.com/irj/sdn/howtoguides and navigate to the list of available HowTo Guides for the Exchange Infrastructure.

Basic infrastructure Setup for the scenario

Please execute the following tasks as preparation for the PI scenario configuration:

  • In the SLD …
    • Create your own Software Product and Software Component Version in the SLD. In the example, I am using the Software Component Version ISV_SAP_HCM_IDM_INTEGRATION, 1.0.
    • Register your HCM technical system using transaction RZ70 in the SLD
    • Create a technical system of type “Third-Party” or “Standalone Engine” for the system, where you installed your Identity Center components.
    • Create a business system of type “Web AS ABAP” for the HCM client.
    • Create a business system of type “Third-Party” or “Standalone Engine” for the Identity Center system.
  • In the SAP PI Integration Repository …
    • Import the created software component from the SLD version into the Integration Repository
    • Add a name space to the Software Component. In the following example I created the name space urn:ibsolution-de:idm:hcm
  • In the SAP PI Integration Directory …
    • Create an Integration Scenario. In the example I created the integration scenario ISV_ISM_HCMBlog
    • Import the Business Systems you created in the SLD for the HCM system as well as the IDM System
    • Assign the two business systems to the Integration Scenario
  • In the HCM system …
    • Setup a distribution model in order to distribute generated IDOCs of type HRMD_A07 to the SAP XI / SAP PI system. (Transactions: BD64, SM59, WE20, WE21)
  • In the SAP PI system …
    • Use transactions SM59, IDX1 and IDX2 to setup the basic IDOC connectivity to be able to receive IDOCs from the HCM system

After executing the tasks above, your SAP PI environment should look the following:

  • Software Component ISV_SAP_HCM_IDM_INTEGRATION, 1.0 in the Integration Repository
  • image
    image

  • Integration Scenario in the Integration Directory
    • Business system for HCM in the example: de_ibsolution_D04_800
    • Business system for IDM in the example: de_ibsolution_IDM_dev
  • image

For the replication of HR Organisational Unit Data from HCM to the Identity Store, we use a two step approach:

  • First Step is to transfer the data from the HCM system into a database table created for holding the organisational unit data from the HCM system. (Part I)
  • Second Step is to run Jobs and passes in the Identity Center, which transfers the OU data from the staging table to the Identity Store including delta handling. This approach is comparable with the mechanism, which is used during the initial load of Web AS ABAP technical roles and profiles into the identity store. (Part II and Part III)

Create a database table in the Identity Center Database for the HCM OU data

You can use the following SQL script to create the database table. Please make sure, that you use the correct database prefixes in case you created a Identity Center database with a custom prefix:

   USE [mxmc_db]
   GO

   SET ANSI_NULLS ON
   GO
   SET QUOTED_IDENTIFIER ON
   GO
   SET ANSI_PADDING ON
   GO
   CREATE TABLE [mxmc_rt_u].[ISV_HCM_ORG_DATA_FROM_SAPXI](
      [ORGOBJECTID] [varchar](255) COLLATE SQL_Latin1_General_CP1_CI_AS NULL,
      [ORGNAME] [varchar](255) COLLATE SQL_Latin1_General_CP1_CI_AS NULL,
      [ORGSPRACHE] [varchar](255) COLLATE SQL_Latin1_General_CP1_CI_AS NULL,
      [PARENT] [nchar](10) COLLATE SQL_Latin1_General_CP1_CI_AS NULL,
      [CHILD] [nvarchar](max) COLLATE SQL_Latin1_General_CP1_CI_AS NULL
   ) ON [PRIMARY]

   GO
   SET ANSI_PADDING OFF

Prepare the XI / PI Design Objects in the Integration Repository

Create the data type for the already created (see SQL script above) target database table ISV_HCM_ORG_DATA_FROM_SAPXI

image

Create a Message Type for the data type

image
image

Create the message map in the Integration Repository to map the appropriate Info Types from the HRMD_A07 IDOC to

image
image

The mapping specification is the following (Please contact me in SDN if you would like to get the complete software component version for this example):

/ns0:IDMHCMJDBCOrgInsertUpdate= /HRMD_A07/IDOC/E1PLOGI=

/ns0:IDMHCMJDBCOrgInsertUpdate/InsertUpdateStatement=
      removeContexts(/HRMD_A07/IDOC/E1PLOGI/E1PITYP/E1P1000= )

/ns0:IDMHCMJDBCOrgInsertUpdate/InsertUpdateStatement/HCMOrgFromXI/@action=
      const([value=UPDATE_INSERT])

/ns0:IDMHCMJDBCOrgInsertUpdate/InsertUpdateStatement/HCMOrgFromXI/table=
      const([value=ISV_HCM_ORG_DATA_FROM_SAPXI])

/ns0:IDMHCMJDBCOrgInsertUpdate/InsertUpdateStatement/HCMOrgFromXI/access/ORGOBJECTID=
      /HRMD_A07/IDOC/E1PLOGI/E1PITYP/E1P1000/OBJID=

/ns0:IDMHCMJDBCOrgInsertUpdate/InsertUpdateStatement/HCMOrgFromXI/access/ORGSPRACHE=
      /HRMD_A07/IDOC/E1PLOGI/E1PITYP/E1P1000/LANGU_ISO=

/ns0:IDMHCMJDBCOrgInsertUpdate/InsertUpdateStatement/HCMOrgFromXI/access/ORGNAME=
      mapWithDefault([default_value=Kein Langtext verfuegbar]
      /HRMD_A07/IDOC/E1PLOGI/E1PITYP/E1P1000/STEXT=)

/ns0:IDMHCMJDBCOrgInsertUpdate/InsertUpdateStatement/HCMOrgFromXI/access/PARENT=
      SplitByValue([type=Each value]concat([delimeter=]
      removeLeft(const([value=2]),
      removeSuppress(ifWithoutElse([keepss=true]and(and(stri ngEquals(toUpperCase(
      /HRMD_A07/IDOC/E1PLOGI/E1PITYP/E1P1001/RELAT=), const([value=002])),
      stringEquals(/HRMD_A07/IDOC/E1PLOGI/E1PITYP/E1P1001/RS IGN=, const([value=A]))),
      stringEquals(substring([start=0, count=1]toUpperCase(
      /HRMD_A07/IDOC/E1PLOGI/E1PITYP/E1P1001/VARYF=)),
      const([value=O]))), /HRMD_A07/IDOC/E1PLOGI/E1PITYP/E1P1001/VARYF=))),
       /HRMD_A07/IDOC/E1PLOGI/E1PITYP/E1P1000=))

/ns0:IDMHCMJDBCOrgInsertUpdate/InsertUpdateStatement/HCMOrgFromXI/access/CHILD=
      SplitByValue([type=Each value]concat([delimeter=]concatValues(
      removeSuppress(ifWithoutElse([keepss=false]and(and(str ingEquals(
      toUpperCase(/HRMD_A07/IDOC/E1PLOGI/E1PITYP/E1P1001/REL AT=), const([value=002])),
      stringEquals(/HRMD_A07/IDOC/E1PLOGI/E1PITYP/E1P1001/RS IGN=, const([value=B]))),
      stringEquals(substring([start=0, count=1]toUpperCase(
      /HRMD_A07/IDOC/E1PLOGI/E1PITYP/E1P1001/VARYF=)),
      const([value=O]))), removeLeft(const([value=2]),
       /HRMD_A07/IDOC/E1PLOGI/E1PITYP/E1P1001/VARYF=))),
      const([value=|])), /HRMD_A07/IDOC/E1PLOGI/E1PITYP/E1P1000=))

/ns0:IDMHCMJDBCOrgInsertUpdate/InsertUpdateStatement/HCMOrgFromXI/key=
      const([value=1])

/ns0:IDMHCMJDBCOrgInsertUpdate/InsertUpdateStatement/HCMOrgFromXI/key/ORGOBJECTID=
      /HRMD_A07/IDOC/E1PLOGI/E1PITYP/E1P1000/OBJID=

/ns0:IDMHCMJDBCOrgInsertUpdate/InsertUpdateStatement/HCMOrgFromXI/key/ORGSPRACHE=
      /HRMD_A07/IDOC/E1PLOGI/E1PITYP/E1P1000/LANGU_ISO=

Create the message Interface

image

Create the interface map

image

Activate the created objects

image

The setup in your Integration Repository should now be the following

image
image

Now the design objects for configuring the transfer of organization unit data from HCM to the Identity Center are in place. As a next step we have to setup the integration scenario in the SAP XI/PI Integration Directory.

Create the XI / PI Integration Scenario in the Integration Directory

Create a receiver communication channel of type JDBC for the Identity Center system

image
image
image

Please adjust the database settings according to your needs. In my environment, I used a database wirh prefix sbx. Therefore the database connection string is including sbx_db instead of mxmc_db in a standard installation. The same is true for the user name.

Create an appropriate receiver determination

image
image

Create the interface determination. I created two inbound interfaces. One is used to just put the message through without any transformation and use a file adapter to put it into a file system. The other one is the important one. It uses the created message and interface mappings in order to transform the IDOC into the XML format used for writing to the Identity Center database.

image

Since we only want to consider IDOCs which contain data for object type “O” (Organisations) we also include a condition.

image
image

image

Last but not least, create the receiver agreement, which references the created receiver communication channel.

image

The setup in your Integration Directory for this specific scenario should now be the following

image

Activate the changes.

Extract HR Organisational Data

Now login to your HCM system already which is already connected to PI. As mentioned in the beginning the assumption is, that you have a working ALE configuration and distribution model, which allows to send generated IDOCs of type HRMD_A07 to your SAP PI system.

Start transaction SE38 to execute the report RHALEINI.

image

Execute the report RHALEINI

image
image

Fill in an “O” for Object Type and the Logical System Name of your SAP PI system in the Receiver Partner Number field nearly at the bottom of the screen. Execute the report. You have to confirm, that you did not select an object so all objects of the specified type will be transferred. If the IDOC / ALE setup is correct, the HR master data objects are being selected, IDOCs are being generated and transferred to the SAP PI system. There the XML IDOC gets mapped into the target database table structure and written to the database.

Will be continued in How To synchronize data from SAP HCM to SAP NetWeaver Identity Center using SAP PI (Part II)

To report this post you need to login first.

3 Comments

You must be Logged on to comment or reply to a post.

  1. Hello Steffen, I am curious about which advantages there would be in using this scenario compared to using the VDS? In ERP Enhancement Pack 4 there are som event based solutions for the distribution of data from HCM to IdM. Can the solution you described provide something similar?

    Best regards,
    Anders

    (0) 

Leave a Reply