Access Control 10.0 Master Guide by SAP (Document Version 1.6)

Master GuideSAP Access Control 10.0Target Audience Technology Consultants System Administrators

PUBLICDocument version: 1.60 2012-06-18

Document History

CAUTIONBefore you start the implementation, make sure you have the latest version of this document. You can find the latest version posted on the SAP Service Marketplace at: http://service.sap.com/instguides SAP Business Suite Applications SAP Solutions for Governance, Risk, and Compliance (GRC) Access Control Release 10.0 .

The following table provides an overview of the most important changes that were made in the latest versions:Version Date Description1.00 2010-12-13 Initial version1.10 2011-01-31 Changed system landscape graphic to reflect updated product references.1.20 2011-04-18 Added SAP Note: 1580393 Documentation Updates for Access Control 10.0 to the

Important SAP Notes section.1.30 2011-07-25 Standardizing format. No technical information changed.1.40 2011-08-08 Replaced software components graphic with table. No other technical information

changed.1.50 2012-03-19 Changed terminology from Superuser Privilege Management (SPM) to

Emergency Access Management (EAM).1.55 2012-04-10 Updated the SAP Notes referenced for the Overall Implementation Sequence

sequence, Step 2.1.60 2012-06-18 Formerly known as SAP BusinessObjects Access Control, now known as SAP Access

Control

2/24 PUBLIC 2012-06-18

Table of Contents

Chapter 1 Getting Started . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51.1 About This Document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51.2 Related Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61.2.1 Planning Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61.2.2 Further Useful Links . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61.3 Important SAP Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

Chapter 2 Application Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92.1 Software Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92.2 System Landscape . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92.3 Overall Implementation Sequence . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

Chapter 3 Application Business Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

Chapter 4 Application Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

Chapter A Reference . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17A.1 The Main SAP Documentation Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

2012-06-18 PUBLIC 3/24

This page is left blank for documents that are printed on both sides.

1 Getting Started

SAP Access Control is an enterprise software application that enables organizations to control access and prevent fraud across the enterprise, while minimizing the time and cost of compliance. The application streamlines compliance processes, including access risk analysis and remediation, business role management, access request management, emergency access maintenance, and periodic compliance certifications. It delivers immediate visibility of the current risk situation with real-time data.

1.1 About This DocumentThis Master Guide is the central starting point for the technical implementation of the application. You can find cross-scenario implementation information as well as scenario-specific information in this guide. You use the Master Guide for an overview of the application, its software units, and its scenarios from a technical perspective. The Master Guide is a planning tool that helps you to design your system landscape.The Master Guide consists of the following main sections: Getting Started

This section contains information about using this document, reference documentation, and related information (SAP Notes) crucial to the installation.

Application OverviewThis section contains information about the technical system landscape, software components, and implementation steps.

Application Business ScenariosThis section summarizes the main business scenarios for the application

Content Lifecycle ManagementThis section provides a general overview of this software component.

Application DocumentationThis section lists all the pieces of documentation that support the application.

Reference: The Main SAP Documentation TypesThis section provides a general overview of the available SAP documentation.

NOTECurrent information about implementation of SAP Access Control and the latest guides are posted on SAP Service Marketplace at http://help.sap.com/grc

1 Getting Started1.1 About This Document

2012-06-18 PUBLIC 5/24

ConstraintsThis Master Guide primarily discusses the overall technical implementation of the application rather than its subordinate components. Additional software dependencies may exist without being mentioned explicitly in this document.

CAUTIONVerify that you have the latest documentation by visiting the SAP Service Marketplace before beginning implementation.

1.2 Related Information1.2.1 Planning InformationFor more information about planning topics not covered in this guide, see the following content posted on SAP Service Marketplace that is listed in the following table:Content Location on SAP Service MarketplaceLatest versions of installation and upgrade guides http://help.sap.com/grcGeneral information about SAP Access Control http://help.sap.com/grcSAP Business Maps information about applications/solutions and business scenarios

http://www.service.sap.com/businessmaps

Sizing, calculation of hardware requirements such as CPU, disk, and memory resource with the Quick Sizer tool

http://service.sap.com/quicksizer

Released platforms and technology-related topics such as maintenance strategies and language support

http://service.sap.com/platformsTo access the Platform Availability Matrix directly, enter http://service.sap.com/pam.

Network security http://service.sap.com/securityguide SAP BusinessObjects

High Availability http://www.sdn.sap.com/irj/sdn/haPerformance http://service.sap.com/performanceInformation about Support Package Stacks, latest software versions and patch level requirements

http://service.sap.com/sp-stacks

Information about Unicode technology http://www.sdn.sap.com/irj/sdn/i18n

1.2.2 Further Useful LinksThe following table lists further useful links on SAP Service Marketplace:Content Location on SAP Service MarketplaceSAP Message WizardProvides information about creating product error messages

http://service.sap.com/message

SAP Notes search http://service.sap.com/notesSAP Software Download Center http://service.sap.com/swdc

1 Getting Started1.2 Related Information

6/24 PUBLIC 2012-06-18

Content Location on SAP Service MarketplaceYou can download and order softwareSAP Online Knowledge Products (OKPs) role-specific Learning Maps http://service.sap.com/rktSAP Release Notes http://help.sap.com/grc

1.3 Important SAP NotesYou must read the following SAP Notes before you start the installation. These SAP Notes contain the most recent information on the installation as well as corrections to the installation documentation. Make sure that you have the latest version of each SAP Note, which you can find on SAP Service Marketplace at http://service.sap.com/notes.SAP Note Number Title Description1490996 GRCFND_A Install SAP BusinessObjects Access Control

10.0 on SAP NW7.021504131 GRCFND_A Upgrade SAP BusinessObjects Access Control

10.0 on SAP NW7.021503749 GRCPINW Install SAP BusinessObjects Access Control

10.0 Plug-in on SAP BASIS 710 NW1503750 GRCPINW Upgrade SAP BusinessObjects Access Control

10.0 Plug-in on SAP BASIS 710 NW1500689 GRCPINW Install SAP BusinessObjects Access Control

10.0 Plug-in on SAP BASIS 700 NW1500691 GRCPINW Install SAP BusinessObjects Access Control

10.0 Plug-in on SAP BASIS 700 NW1500690 GRCPIERP Install SAP BusinessObjects Access Control

10.0 Plug-in on SAP BASIS 700 ERP1500692 GRCPIERP Upgrade SAP BusinessObjects Access Control

10.0 Plug-in on SAP BASIS 700 ERP1501882 GRCPINW Install SAP G BusinessObjects RC Access

Control 10.0 Plug-in on SAP BASIS 640 NW1501881 GRCPINW Upgrade SAP BusinessObjects Access Control


10.0 Plug-in on SAP BASIS 640 ERP1501879 GRCPIERP Upgrade SAP BusinessObjects Access Control

10.0 Plug-in on SAP BASIS 640 ERP1497971 GRCPINW Install SAP BusinessObjects Access Control

10.0 Plug-in on SAP BASIS 620 NW1498033 GRCPINW Upgrade SAP BusinessObjects Access Control


10.0 Plug-in on SAP BASIS 620 ERP

1 Getting Started1.3 Important SAP Notes

2012-06-18 PUBLIC 7/24

SAP Note Number Title Description1498034 GRCPIERP Upgrade SAP BusinessObjects Access Control

10.0 Plug-in on SAP BASIS 620 ERP1500168 GRCPINW Install SAP BusinessObjects Access Control

10.0 Plug-in on SAP BASIS 46C NW1500169 GRCPIERP Install SAP BusinessObjects Access Control

10.0 Plug-in on SAP BASIS 46C ERP1580393 Documentation Updates for Access Control

10.0Documentation updates for Access Control 10.0

1536525 GRC Access/Process Control Upgrade Add-on Handling

This note provides information about upgrading.

1 Getting Started1.3 Important SAP Notes

8/24 PUBLIC 2012-06-18

2 Application Overview

2.1 Software ComponentsThe following table illustrates the software component matrix for the application:Required or Optional Component/Version CommentRequired SAP NetWeaver 7.0 EHP2 SP06 Application ServerRequired SAP Access Control 10.0 Access Control ServerOptional SAP NetWeaver Enterprise Portal 7.02 SP06

The following table lists the software components for other systems in the customer's landscape that are integrated with GR.Required or Optional Component Version CommentOptional GRC 10.0 Java Components SAP GRC AC Portal Plug-in Back end systemsOptional GRCPIERP V1000_46C SAP GRC 10.0 Plug-in ERP 4.6COptional GRCPIERP V1000_620 SAP GRC 10.0 Plug-in ERP 6.20Optional GRCPIERP V1000_640 SAP GRC 10.0 Plug-in ERP 6.40Optional GRCPIERP V1000_700 SAP GRC 10.0 Plug-in ERP 7.00Optional GRCPINW V1000_620 SAP GRC 10.0 Plug-in NW 6.20Optional GRCPINW V1000_640 SAP GRC 10.0 Plug-in NW 6.40Optional GRCPINW V1000_700 SAP GRC 10.0 Plug-in NW 7.00Optional GRCPINW V1000_710 SAP GRC 10.0 Plug-in NW 7.10

Integration of Access Control with ERP uses the following plug-ins: GRCPIERP for AC and PC HR Functions (formerly AC 5.3 VIRSAHR RTA) GRCPINW for Access Control non-HR Functions (formerly AC 5.3 VIRSANH RTA)

2.2 System LandscapeThe following figure illustrates the technical landscape for the access control application as part of the 10.0 release of the SAP solutions for governance, risk, and compliance (GRC):

2 Application Overview2.1 Software Components

2012-06-18 PUBLIC 9/24

Figure 1:

RECOMMENDATIONAs a best practice, we recommend implementing SAP solutions for GRC in three phases, with separate systems for each: Development Testing ProductionFor more information about three-tier landscapes, see the SAP NetWeaver Master Guide, located at http://help.sap.com/grc.

CAUTIONWe strongly recommend that you use a minimal system landscape for test and demonstration purposes only. For performance, high availability, and security reasons, do not use a minimal system landscape as your production landscape.

2.3 Overall Implementation SequenceThis section describes the sequential implementation steps required to install the application. It includes references to the relevant installation documentation and SAP Notes.The following table lists all the software components that you need for the installation. To implement a specific access control scenario, you may need only a subset of the software components.SAP Access Control supports all the operating and database software systems that are supported by SAP NetWeaver.

2 Application Overview2.3 Overall Implementation Sequence

10/24 PUBLIC 2012-06-18

NOTEFor more information, see the product availability matrix posted on the SAP Service Marketplace at http://service.sap.com/pam.

ProcedureTo install the application, use the steps described below.

StepRequired/Optional Action Reference

1 Required Install NetWeaver 7.02 SP06 http://service.sap.com2 Required Install SAP Access Control 10.0 Plug-In

(RTA)At least one Plug-in connection is required (GRCPINW or GRCPIERP) depending on whether or not you have SAP_HR installed.

NOTEFor more information, see: SAP Note 1504243 - Release

strategy for the ABAP add-on GRCPIERP

SAP Note 1504132 - Release strategy for the ABAP add-on GRCPINW

3 Optional Install second SAPAccess Control PlugIn (RTA)

If SAP_HR is installed, you must install GRCPCERP.

NOTEFor more information about when to use GRCPINW or GRCPIERP Plug-in, see SAP Note 1511486.

4 Required Install SAP NetWeaver Enterprise Portal 7.02 (min. SP06)

http://service.sap.com/instguides

2 Application Overview2.3 Overall Implementation Sequence

2012-06-18 PUBLIC 11/24

3 Application Business Scenarios

The following table provides information about SAP Access Control scenarios:Content LocationScenario Description For more information about Solution Manager, see the note below.Configuration Documentation For more information about Solution Manager, see the note below.Scenario Security Guide For more information, see http://help.sap.com/grc.

NOTEFor more information, see The Main SAP Documentation Types Implementation Configuration Documentation in SAP Solution Manager

CAUTIONSAP NetWeaver shared services are required to run Solution Manager and System Landscape Directory.

NOTEFor more information, see the current SAP NetWeaver Master Guide posted on SAP Service Marketplace at http://help.sap.com/nw.

3 Application Business Scenarios

2012-06-18 PUBLIC 13/24

4 Application Documentation

SAP Access Control provides the following documentation including this guide at http://help.sap.com/grc: SAP Access Control 10.0 Master Guide SAP Access Control 10.0 Installation Guide SAP Access Control 10.0 Operations Guide SAP Access Control 10.0 / Process Control 10.0 / Risk Management 10.0 Security Guide SAP Access Control 10.0 SAP Library

4 Application Documentation

2012-06-18 PUBLIC 15/24

A Reference

A.1 The Main SAP Documentation TypesThe following is an overview of the most important documentation types that you need in the various phases in the life cycle of SAP software.

Cross-Phase DocumentationSAPterm is SAPs terminology database. It contains SAP-specific vocabulary in over 30 languages, as well as many glossary entries in English and German. Target group:

Relevant for all target groups Current version:

On SAP Help Portal at http://help.sap.com Glossary In the SAP system in transaction STERM

SAP Library is a collection of documentation for SAP software covering functions and processes. Target group:

Consultants System administrators Project teams for implementations or upgrades

Current version: On SAP Help Portal at http://help.sap.com (also available as documentation DVD)

The security guide describes the settings for a medium security level and offers suggestions for raising security levels. A collective security guide is available for SAP NetWeaver. This document contains general guidelines and suggestions. SAP applications have a security guide of their own. Target group:

System administrators Technology consultants Solution consultants

Current version: On SAP Service Marketplace at http://service.sap.com/securityguide

ImplementationThe master guide is the starting point for implementing an SAP solution. It lists the required installable units for each business or IT scenario. It provides scenario-specific descriptions of preparation,

A ReferenceA.1 The Main SAP Documentation Types

2012-06-18 PUBLIC 17/24

execution, and follow-up of an implementation. It also provides references to other documents, such as installation guides, the technical infrastructure guide and SAP Notes. Target group:

Technology consultants Project teams for implementations

Current version: On SAP Service Marketplace at http://service.sap.com/instguides

The installation guide describes the technical implementation of an installable unit, taking into account the combinations of operating systems and databases. It does not describe any business-related configuration. Target group:

Technology consultants Project teams for implementations


Configuration Documentation in SAP Solution Manager SAP Solution Manager is a life-cycle platform. One of its main functions is the configuration of business scenarios, business processes, and implementable steps. It contains Customizing activities, transactions, and so on, as well as documentation. Target group:

Technology consultants Solution consultants Project teams for implementations

Current version: In SAP Solution Manager

The Implementation Guide (IMG) is a tool for configuring (Customizing) a single SAP system. The Customizing activities and their documentation are structured from a functional perspective. (In order to configure a whole system landscape from a process-oriented perspective, SAP Solution Manager, which refers to the relevant Customizing activities in the individual SAP systems, is used.) Target group:

Solution consultants Project teams for implementations or upgrades

Current version: In the SAP menu of the SAP system under Tools Customizing IMG

Production OperationThe technical operations manual is the starting point for operating a system that runs on SAP NetWeaver, and precedes the application operations guides of SAP Business Suite. The manual refers


18/24 PUBLIC 2012-06-18

users to the tools and documentation that are needed to carry out various tasks, such as monitoring, backup/ restore, master data maintenance, transports, and tests. Target group:

System administrators Current version:

On SAP Service Marketplace at http://service.sap.com/instguidesThe application operations guide is used for operating an SAP application once all tasks in the technical operations manual have been completed. It refers users to the tools and documentation that are needed to carry out the various operations-related tasks. Target group:

System administrators Technology consultants Solution consultants


UpgradeThe upgrade master guide is the starting point for upgrading the business scenarios and processes of an SAP solution. It provides scenario-specific descriptions of preparation, execution, and follow-up of an upgrade. It also refers to other documents, such as upgrade guides and SAP Notes. Target group:

Technology consultants Project teams for upgrades


The upgrade guide describes the technical upgrade of an installable unit, taking into account the combinations of operating systems and databases. It does not describe any business-related configuration. Target group:

Technology consultants Project teams for upgrades


Release notes are documents that contain short descriptions of new features in a particular release or changes to existing features since the previous release. Release notes about ABAP developments are the technical prerequisite for generating delta and upgrade Customizing in the Implementation Guide (IMG). Target group:


2012-06-18 PUBLIC 19/24

Consultants Project teams for upgrades

Current version: On SAP Service Marketplace at http://service.sap.com/releasenotes In the SAP menu of the SAP system under Help Release Notes (only ABAP developments)


20/24 PUBLIC 2012-06-18

Typographic Conventions

Example Description Angle brackets indicate that you replace these words or characters with appropriate

entries to make entries in the system, for example, Enter your .ExampleExample

Arrows separating the parts of a navigation path, for example, menu options

Example Emphasized words or expressionsExample Words or characters that you enter in the system exactly as they appear in the

documentationhttp://www.sap.com Textual cross-references to an internet address/example Quicklinks added to the internet address of a homepage to enable quick access to specific

content on the Web123456 Hyperlink to an SAP Note, for example, SAP Note 123456Example Words or characters quoted from the screen. These include field labels, screen titles,

pushbutton labels, menu names, and menu options. Cross-references to other documentation or published works

Example Output on the screen following a user action, for example, messages Source code or syntax quoted directly from a program File and directory names and their paths, names of variables and parameters, and

names of installation, upgrade, and database toolsEXAMPLE Technical names of system objects. These include report names, program names,

transaction codes, database table names, and key concepts of a programming language when they are surrounded by body text, for example, SELECT and INCLUDE

EXAMPLE Keys on the keyboard

2012-06-18 PUBLIC 21/24

SAP AGDietmar-Hopp-Allee 16

69190 WalldorfGermany

T +49/18 05/34 34 34F +49/18 05/34 34 20

www.sap.com

Copyright 2012 SAP AG. All rights reserved.No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice.Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors.Microsoft, Windows, Excel, Outlook, PowerPoint, Silverlight, and Visual Studio are registered trademarks of Microsoft Corporation.IBM, DB2, DB2 Universal Database, System i, System i5, System p, System p5, System x, System z, System z10, z10, z/VM, z/OS, OS/390, zEnterprise, PowerVM, Power Architecture, Power Systems, POWER7, POWER6+, POWER6, POWER, PowerHA, pureScale, PowerPC, BladeCenter, System Storage, Storwize, XIV, GPFS, HACMP, RETAIN, DB2 Connect, RACF, Redbooks, OS/2, AIX, Intelligent Miner, WebSphere, Tivoli, Informix, and Smarter Planet are trademarks or registered trademarks of IBM Corporation.Linux is the registered trademark of Linus Torvalds in the United States and other countries.Adobe, the Adobe logo, Acrobat, PostScript, and Reader are trademarks or registered trademarks of Adobe Systems Incorporated in the United States and other countries.Oracle and Java are registered trademarks of Oracle and its affiliates.UNIX, X/Open, OSF/1, and Motif are registered trademarks of the Open Group.Citrix, ICA, Program Neighborhood, MetaFrame, WinFrame, VideoFrame, and MultiWin are trademarks or registered trademarks of Citrix Systems Inc.HTML, XML, XHTML, and W3C are trademarks or registered trademarks of W3C, World Wide Web Consortium, Massachusetts Institute of Technology.Apple, App Store, iBooks, iPad, iPhone, iPhoto, iPod, iTunes, Multi-Touch, Objective-C, Retina, Safari, Siri, and Xcode are trademarks or registered trademarks of Apple Inc.IOS is a registered trademark of Cisco Systems Inc.RIM, BlackBerry, BBM, BlackBerry Curve, BlackBerry Bold, BlackBerry Pearl, BlackBerry Torch, BlackBerry Storm, BlackBerry Storm2, BlackBerry PlayBook, and BlackBerry App World are trademarks or registered trademarks of Research in Motion Limited.Google App Engine, Google Apps, Google Checkout, Google Data API, Google Maps, Google Mobile Ads, Google Mobile Updater, Google Mobile, Google Store, Google Sync, Google Updater, Google Voice, Google Mail, Gmail, YouTube, Dalvik and Android are trademarks or registered trademarks of Google Inc.INTERMEC is a registered trademark of Intermec Technologies Corporation.Wi-Fi is a registered trademark of Wi-Fi Alliance.Bluetooth is a registered trademark of Bluetooth SIG Inc.Motorola is a registered trademark of Motorola Trademark Holdings LLC.Computop is a registered trademark of Computop Wirtschaftsinformatik GmbH.SAP, R/3, SAP NetWeaver, Duet, PartnerEdge, ByDesign, SAP BusinessObjects Explorer, StreamWork, SAP HANA, and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and other countries.Business Objects and the Business Objects logo, BusinessObjects, Crystal Reports, Crystal Decisions, Web Intelligence, Xcelsius, and other Business Objects products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of Business Objects Software Ltd. Business Objects is an SAP company.Sybase and Adaptive Server, iAnywhere, Sybase 365, SQL Anywhere, and other Sybase products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of Sybase Inc. Sybase is an SAP company.

22/24 PUBLIC 2012-06-18

Crossgate, m@gic EDDY, B2B 360, and B2B 360 Services are registered trademarks of Crossgate AG in Germany and other countries. Crossgate is an SAP company.All other product and service names mentioned are the trademarks of their respective companies. Data contained in this document serves informational purposes only. National product specifications may vary.These materials are subject to change without notice. These materials are provided by SAP AG and its affiliated companies (SAP Group) for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty.

DisclaimerSome components of this product are based on Java. Any code change in these components may cause unpredictable and severe malfunctions and is therefore expressly prohibited, as is any decompilation of these components.Any Java Source Code delivered with this product is only to be used by SAPs Support Services and may not be modified or altered in any way.

Documentation in the SAP Service MarketplaceYou can find this document at the following address: http://service.sap.com/instguides

2012-06-18 PUBLIC 23/24

SAP AGDietmar-Hopp-Allee 1669190 WalldorfGermanyT +49/18 05/34 34 34F +49/18 05/34 34 20www.sap.com

Copyright 2012 SAP AG. All rights reserved.No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice.

SAP Access Control 10.0Table of Contents1 Getting Started1.1 About This Document1.2 Related Information1.2.1 Planning Information1.2.2 Further Useful Links

1.3 Important SAP Notes

2 Application Overview2.1 Software Components2.2 System Landscape2.3 Overall Implementation Sequence

3 Application Business Scenarios4 Application DocumentationA ReferenceA.1 The Main SAP Documentation Types

Copyright and trademarks

Access Control 10.0 Master Guide by SAP (Document Version 1.6)

Documents

Transcript of Access Control 10.0 Master Guide by SAP (Document Version 1.6)