Skip to main content

​
After this article

You will be able to connect SAP ECC 6.0 to Lumos through the Lumos on-premise agent to sync users, PFCG composite roles, and SAP user groups, and to create users, lock and unlock them, and grant and remove composite roles from Lumos.

​
Capabilities

Notes:
  • Deleting users is not available. Deprovisioning in Lumos locks the user instead.
  • Lumos syncs composite roles only. Single roles and authorization profiles are not synced or assigned, so a single role assigned directly to a user does not appear in Lumos.
  • Only role assignments that are valid today (by the UTC date) appear in Lumos. Assignments with a start date in the future or an end date in the past are left out.
  • SAP User Groups are read-only. Lumos builds the group list from the groups it finds on your users, so a group with no members does not appear.
  • Changing an existing user’s details (name, email, validity dates) is not available.
  • Removing a role in Lumos removes every assignment of that role, including future-dated ones. A role whose only assignment starts in the future isn’t shown in Lumos and can’t be removed from Lumos until it starts.
  • Unlocking a user does not change their Valid From/Valid To dates. A user outside those dates stays suspended until an SAP administrator updates them in SU01.

​
Required plan and roles

  • SAP version: SAP ECC 6.0 (SAP ERP 6.0) on SAP NetWeaver AS ABAP. One Lumos connection covers one SAP client (MANDT).
  • On-premise agent: this integration requires the Lumos on-premise agent, installed on a host in your network that can reach your SAP NetWeaver server over HTTPS. See On-Premise Agent for the agent’s host requirements and setup.
  • SAP access: an SAP Basis administrator with access to SU01, PFCG, SE37 (or SE80), and SOAMANAGER. The administrator who activates the web services needs SOAMANAGER administration authorization, such as role SAP_BC_WEBSERVICE_ADMIN_TEC.
  • HTTPS on NetWeaver: SSL must be enabled on the server that hosts the web services, and the SICF node /sap/bc/srt must be active.
  • Eight SOAP web services: one per function module in the table in Phase 2. All eight endpoint fields are required in the connection form.
  • Credentials: the username and password of a dedicated SAP user of type System.
  • Not supported: Central User Administration (CUA). If your ECC client is a CUA child system, contact your Lumos account team before connecting.

​
Read-only access vs provisioning

Is read-only possible? Yes. Lumos only calls the write services when you create a user, lock or unlock a user, or grant or remove a role. You control which of those the integration user can do through its PFCG role. What read-only requires. Create all eight web services, because the connection form requires all eight endpoint paths. In the integration user’s PFCG role, add the web service authorization defaults for the four read services only (BAPI_USER_GETLIST, BAPI_USER_GET_DETAIL, PRGN_GET_ROLES, SUSR_GET_ADMIN_USER_LOGIN_INFO), and give S_USER_GRP and S_USER_AGR display access (activity 03) only. Then don’t enable provisioning for SAP ECC in Lumos.

​
Instructions

Phase 1: Deploy the on-premise agent
  1. Find the SAP ECC card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Follow the steps in the pop-up to run the agent and download the SAP ECC connector package. For full agent installation details, see On-Premise Agent.
  3. Confirm the agent host can reach your NetWeaver server’s HTTPS port (for example 44300). A host firewall on the SAP server may need to allow the agent host’s IP.
Phase 2: Create the eight web services Lumos needs one SOAP web service per function module: Use the service definition names exactly as listed. Lumos sends requests in the format of these service definitions, so other names are not supported. The name for SUSR_GET_ADMIN_USER_LOGIN_INFO is shortened because service definition names are limited to 30 characters. Repeat these steps for each function module:
  1. Open transaction code SE37 and enter the function module name.
  2. Go to Utilities → More Utilities → Create Web Service, choose From the Function Module, and start the wizard.
  3. Under Service, enter the Service Definition name from the table above and a description.
  4. Under Endpoint Function Module, confirm the function module is selected.
  5. Under Configure Service, set Profile to Authentication with User and Password and Transport Guarantee.
  6. Under Transport, enter a package (for example Z_LUMOS, or $TMP for a local object) and a transport request if prompted.
  7. Click Complete, then click Activate. The service definition starts out inactive and doesn’t appear in SOAMANAGER until it’s activated.
Phase 3: Activate a binding for each web service Repeat these steps for each of the eight service definitions:
  1. Open transaction code SOAMANAGER and go to Service Administration → Web Service Configuration.
  2. Search for the service definition and open it.
  3. Under Configurations, click Create Service. Enter a service name and a binding name.
  4. Under Provider Security, set Transport Level Security to SSL (https), set Message Level Security to None, and select User ID/Password under Transport Channel Authentication.
  5. Under SOAP Protocol, leave Make Local Call set to No Call in Local System.
  6. Confirm the operation is selected and click Finish.
  7. Click Display binding (the glasses icon). In Transport Settings, copy the Calculated Access URL. It looks like /sap/bc/srt/rfc/sap/zws_bapi_user_getlist/100/zsrv_bapi_user_getlist/zsrv_bapi_user_getlist_binding. Note which function module it belongs to.
Use the Calculated Access URL, not the WSDL URL. The path includes your client number and the names you chose, so it differs on every system. Phase 4: Create a PFCG role for the integration user
  1. Open transaction code PFCG, enter a role name such as Z_LUMOS_INTEGRATION, and click Single Role.
  2. On the Menu tab, open the dropdown next to Transaction, choose Authorization Default, and set Authorization Default to WebService.
  3. Add the eight service definitions from Phase 2 (for a read-only connection, add only the four read services). Click Copy. This adds S_SERVICE for those services to the role.
  4. On the Authorizations tab, click Change Authorization Data. SAP proposes authorization objects for the services you added. Open each node with an orange triangle and fill in or confirm its values until each turns green.
  5. Before you generate the role, check that it covers the authorization objects below. SAP may have proposed some of them already. The exact objects SAP checks depend on your release and settings, so confirm the final role with your SAP security team. Restrict the CLASS field of S_USER_GRP to the user groups Lumos should manage if you don’t want it to cover every user. If your system checks role assignment with S_USER_SAS instead (profile parameter CHECK_S_USER_SAS), grant the equivalent values there.
  6. Click Generate, then Save.
Phase 5: Create a dedicated user in SAP
  1. Open transaction code SU01 and create a user, for example LUMOS.
  2. On the Logon Data tab, set User Type to System and set a secure password. System users are not subject to password expiry, so the integration won’t stop when a password ages out.
  3. On the Roles tab, assign the role from Phase 4.
  4. Click Save.
Use this account only for the Lumos integration. Phase 6: Connect in Lumos
  1. Back in the SAP ECC connection form in Lumos, fill in the fields:
    • Account ID: any name that identifies this SAP ECC client, for example ECC-PRD-100.
    • Host: the hostname of your NetWeaver server as the agent host resolves it (for example sap-server.example.com). Use the name on the server’s TLS certificate.
    • Port: the HTTPS port of your NetWeaver server (for example 44300).
    • BAPI_USER_CREATE1 Endpoint Path through SUSR_GET_ADMIN_USER_LOGIN_INFO Endpoint Path: the Calculated Access URL path from Phase 3 for each matching service. Enter only the path, starting with /sap/bc/srt/, with no https://, host, or port.
    • Username and Password: the user from Phase 5.
  2. Click Connect. Lumos tests the connection by listing one user through BAPI_USER_GETLIST.
Phase 7: Test provisioning in a non-production client first If you plan to provision, connect a sandbox or test client first and run one of each action against a test user: create, grant a role, remove a role, lock, and unlock. After each action, open the user in SU01 and confirm the change was saved.

​
API Endpoints Used

​
Troubleshooting

Can’t connect the integration. First confirm the on-premise agent is running and can reach the Host and Port over HTTPS. Then check that the BAPI_USER_GETLIST Endpoint Path holds only the Calculated Access URL path for that service, that its binding is active in SOAMANAGER, and that the integration user’s role includes that service. If the agent reaches SAP but the request is rejected, check the username and password, and that the role includes S_SERVICE for that service. TLS or certificate errors. The agent connects over HTTPS and checks the server’s certificate. Enter the Host exactly as it appears on the certificate, and make sure the agent host trusts the certificate authority that issued it, which is often an internal CA for SAP servers. A user shows as Suspended but isn’t locked by an administrator. Lumos marks a user Suspended if any lock flag is set (administrator lock, too many failed logons, global lock, or no password) or if today falls outside the user’s Valid From/Valid To dates on the Logon Data tab. A role a user has in SAP doesn’t appear in Lumos. Lumos shows composite roles only, and only assignments valid today (by the UTC date). Check whether the role is a single role, or whether the assignment’s start date is in the future or its end date has passed. A user group is missing. Lumos lists only user groups that at least one user belongs to. A user is still suspended after you activate them in Lumos. Activation unlocks the user but doesn’t change the validity dates. If today falls outside the user’s Valid From/Valid To dates, an SAP administrator must update them on the Logon Data tab in SU01. Last login is empty for a user. Users who have never logged on to the connected client have no last logon date. Granting a role removed other roles, or a grant or removal fails. BAPI_USER_ACTGROUPS_ASSIGN replaces the user’s whole role list, so Lumos reads the current roles first and sends them back with the change. A new grant starts today with no end date. If the user already has the role with a future start date, Lumos moves the start to today and keeps the original end date. An expired assignment is replaced with a new one that has no end date. If the call fails, check that the integration user’s role includes the provisioning values for S_USER_AGR and S_USER_GRP from Phase 4. Avoid editing the same user’s roles in SU01 while a Lumos request is running. A provisioning action reports success but the change isn’t in SAP. Open the user in SU01 to check. If the change didn’t save, contact Lumos support with the function module and time of the request. Creating a user fails. SAP usernames are limited to 12 characters. If the username already exists, Lumos makes no change and reports the existing user. If SAP rejects the request because of a required field or your password policy, the error from SAP is shown on the request.