SAP Identity Management Overview SAP SE June 2019
Total Page:16
File Type:pdf, Size:1020Kb
SAP Identity Management Overview SAP SE June 2019 PUBLIC Agenda Introduction to SAP Identity Management Role Management and Workflows Business-Driven Identity Management Compliant Identity Management Reporting Password Management Connectivity Architecture Identity Virtualization Summary and Additional Information © 2019 SAP SE or an SAP affiliate company. All rights reserved. ǀ PUBLIC 2 Introduction to SAP Identity Management SAP Identity Management in SAP’s security products portfolio Security and threat intelligence: ▪ SAP Enterprise Threat Detection ▪ SAP Identity Management ▪ SAP Cloud Platform Identity Provisioning ▪ SAP Single Sign-On ▪ SAP Cloud Platform Identity Authentication ▪ SAP NetWeaver AS, add-on for code vulnerability analysis ▪ SAP Fortify by Micro Focus (formerly SAP Fortify by HPE) GRC portfolio: ▪ SAP Access Control ▪ SAP Cloud Identity Access Governance, access analysis service ▪ SAP Process Control ▪ SAP Audit Management ▪ SAP Business Integrity Screening (formerly SAP Fraud Management) ▪ SAP Risk Management ▪ SAP Identity Analytics ▪ SAP Business Partner Screening ▪ SAP Global Trade Services ▪ SAP Electronic Invoicing for Brazil (SAP Nota Fiscal Eletronica) GRC solution extensions: ▪ SAP Access Violation Management by Greenlight ▪ SAP Regulation Management by Greenlight, cyber governance solution ▪ SAP Dynamic Authorization Management by NextLabs ▪ SAP Enterprise Digital Rights Management by NextLabs © 2019 SAP SE or an SAP affiliate company. All rights reserved. ǀ PUBLIC 4 What are the key capabilities? Enables the Holistic approach Ensures that the right users have the right efficient, Manage identities and secure, and permissions access to the right compliant systems at the execution of business right time processes Consistent user Across roles and SAP Identity all systems Management privileges and applications © 2019 SAP SE or an SAP affiliate company. All rights reserved. ǀ PUBLIC 5 Business drivers for identity management Multiple sources of identity data Operational Manual user provisioning costs Labor-intensive, paper-based approval systems Manual password reset processes Changing Transactions involve multiple enterprises business Partners participate in business processes processes Company-specific requirements for user provisioning solutions Compliance No record of who has access to which IT resources challenges Inability to deprovision user access rights upon termination No complete audit trail available Prevention of unauthorized access in multi-enterprise environments © 2019 SAP SE or an SAP affiliate company. All rights reserved. ǀ PUBLIC 6 Covering the entire identity lifecycle How long does it take for new employees to receive all permissions and become productive in their new job? How can you remove permissions automatically if employees change their position? Are permissions automatically adjusted if someone is promoted to a new position? Who has adequate permissions How long does it take to remove to fill in for a co-worker? ALL permissions of an employee? And how can you ensure that they were properly removed? © 2019 SAP SE or an SAP affiliate company. All rights reserved. ǀ PUBLIC 7 Solution in a nutshell ▪ Central management of identities throughout the system landscape SAP Access ▪ Rule-driven workflow and approval process Control ▪ Extensive audit trail, logging, and reporting functionality SAP Identity Management ▪ Governance through centralized and auditable identity data ▪ Compliance through integration with SAP applications Non-SAP applications SAP Access Control SAP SCM Java Database Lotus Notes ▪ Compliant and integrated identity management SAP ERP HCM SuccessFactors Legacy MS Exchange solution to mitigate segregation-of-duties risks SAP ERP Portal OS Web Apps SAP HANA … Active Directory … © 2019 SAP SE or an SAP affiliate company. All rights reserved. ǀ PUBLIC 8 Beyond compliance: Functional Components in a Business-driven identity management Success- Factors Integration with SAP Business Suite SAP ERP and SuccessFactors HCM Example: On-boarding Central Identity virtualization identity store and identity as a service Compliance Approval checks workflows SAPSAP BusinessObjects Access Control SAP Identity Management Access Control (GRC) Password management Reporting Provisioning to SAP Rule-based assignment and non-SAP systems of business roles © 2019 SAP SE or an SAP affiliate company. All rights reserved. ǀ PUBLIC 9 Solution in detail Role management and workflows How to define and provision roles Role definition (design, one-time task) ▪ Read system access information (roles, groups, authorizations, etc.) from target systems ▪ Define a business role hierarchy Manager ▪ Assign technical roles to business roles Employee Accounting ▪ Develop rules for role assignments Business roles Business Provisioning (regularly) ▪ Assign or remove roles to/from people ▪ Through request/approval workflow Accounting HR manager ▪ Manually (administrator) E-mail AD user Portal role (ABAP role) (ABAP role) ▪ Automatically, e.g. HR-driven ▪ Automatic adjustment of master data and roles Technical assignments of technical authorizations in E-mail Active SAP SAP SAP target systems system Directory Portal FI HR © 2019 SAP SE or an SAP affiliate company. All rights reserved. ǀ PUBLIC 11 How to reduce complexity with context-based role management Context-based role management simplifies the structure of roles through dynamic role assignment based on user context information Benefits Reduced number of roles Reduced complexity SAP Identity Management Sufficient granularity Business Role UserSAP NetWeaver Identity Management Improved data consistency Position Technical role A Technical role C and governance Location Technical role B … Example: Managed System 20 roles in 1000 factories – Conventional method: 20.000 entries (roles) User ManagedTechnical System role A – Context-based: 1.020 entries (roles + contexts) Technical role B © 2019 SAP SE or an SAP affiliate company. All rights reserved. ǀ PUBLIC 12 It’s up to you: Defining workflows Notification Request Identity Center sends a User sends a notification to user/manager role request Provisioning Processing Identity Center Identity Center provisions new processes request roles and privileges to respective systems – Sends alert to manager/ administrator Approval Manager checks request and approves/denies © 2019 SAP SE or an SAP affiliate company. All rights reserved. ǀ PUBLIC 13 Solution in detail Business-driven identity management Integration with SAP business applications SAP Portfolio SAP Supply and Product Network Management Collaboration SuccessFactors Employee Central SAP Customer SAP Extended Relationship Warehouse Management Management SAP Supplier SAP Identity SAP Relationship Transportation Management Management Management SAP Product SAP ERP Lifecycle Financials Management SAP HANA SAP Service SAP ERP Parts Planning Human Capital Management © 2019 SAP SE or an SAP affiliate company. All rights reserved. ǀ PUBLIC 15 HR business processes as a basis: On-boarding Kim Perkins joins the company as a marketing specialist. From the first day with her new company, she is able to log on to all relevant systems, including access to the employee self-services, and access to SAP CRM to track the marketing activities she is responsible for. First day at work 1 Pre-hire phase 5 Provisioning of role and HR ensures that all necessary authorization information to relevant employee data for Kim is available, target systems such as position and entry date SAP User created ERP “Employee” 2 3 Based on the position in 4 Kim’s manager HCM HCM, IDM automatically approves the Event-based extraction SAP of personnel data assigns the business role assignment “Marketing Specialist” ERP SAP ERP Business Partner created HCM SAP User created “Marketing CRM Professional” Line Manager User created SAP Access to SAP ESS SAP Identity Management Portal HR Operations Access to SAP CRM © 2019 SAP SE or an SAP affiliate company. All rights reserved. ǀ PUBLIC 16 HR business processes as a basis: Position change After two years as a marketing specialist, Kim is promoted and takes over personnel and budget responsibility for her marketing team. On the first day in her new role, she has access to the manager self-services. In her new position, she is responsible for budget approvals for all marketing campaigns – this requires immediate access to SAP ERP to view the marketing costs. Day of position change 1 HR ensures that all necessary 4 Provisioning of role and employee data for Kim is available authorization information to relevant target systems SAP User updated ERP “Employee” 2 3 SAP Identity Management recognizes the HCM “Line Manager” line manager information for Kim and Event-based extraction SAP User created of personnel data automatically assigns the business role “Marketing Controller” “Marketing Manager” ERP SAP ERP HCM SAP User updated CRM “Marketing Controller” User updated SAP Access to SAP ESS SAP Identity Management Access to SAP MSS HR Operations Portal Access to SAP CRM © 2019 SAP SE or an SAP affiliate company. All rights reserved. ǀ PUBLIC 17 HR business processes as a basis: Termination After eight years, Kim leaves the company. The day after her official assignment with the company ends, she is no longer able to access any corporate systems. 1 HR ensures that all data relevant for 4 Day after termination of employment the employment contract termination is available, such as last day of work SAP ERP User disabled 2 3 SAP Identity Management recognizes