> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SAP ECC

> Connect on-premise SAP ECC 6.0 through the Lumos on-premise agent and eight SOAP web services to sync users, composite roles, and user groups, and to create, lock, and unlock users and assign roles.

## After this article

You will be able to connect SAP ECC 6.0 to Lumos through the Lumos on-premise agent to sync users, PFCG composite roles, and SAP user groups, and to create users, lock and unlock them, and grant and remove composite roles from Lumos.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | Yes | SAP user master records in the connected client. Lumos can create, lock, and unlock users |
| PFCG Composite Roles | Permission | Yes | Yes | Composite roles in the connected client, granted and removed by rewriting the user's role list |
| SAP User Groups | Permission | Yes | No | User groups for authorization checks, from each user's Logon Data and Groups tabs |
| Last login | Usage | Yes | No | The user's last logon date in the connected client |

Notes:

* Deleting users is not available. Deprovisioning in Lumos locks the user instead.
* Lumos syncs composite roles only. Single roles and authorization profiles are not synced or assigned, so a single role assigned directly to a user does not appear in Lumos.
* Only role assignments that are valid today (by the UTC date) appear in Lumos. Assignments with a start date in the future or an end date in the past are left out.
* SAP User Groups are read-only. Lumos builds the group list from the groups it finds on your users, so a group with no members does not appear.
* Changing an existing user's details (name, email, validity dates) is not available.
* Removing a role in Lumos removes every assignment of that role, including future-dated ones. A role whose only assignment starts in the future isn't shown in Lumos and can't be removed from Lumos until it starts.
* Unlocking a user does not change their **Valid From**/**Valid To** dates. A user outside those dates stays suspended until an SAP administrator updates them in `SU01`.

## Required plan and roles

* **SAP version:** SAP ECC 6.0 (SAP ERP 6.0) on SAP NetWeaver AS ABAP. One Lumos connection covers one SAP client (`MANDT`).
* **On-premise agent:** this integration requires the Lumos on-premise agent, installed on a host in your network that can reach your SAP NetWeaver server over HTTPS. See [On-Premise Agent](https://docs.lumos.com/integrations/on-premise-agent/on-premise-agent-1.md) for the agent's host requirements and setup.
* **SAP access:** an SAP Basis administrator with access to `SU01`, `PFCG`, `SE37` (or `SE80`), and `SOAMANAGER`. The administrator who activates the web services needs SOAMANAGER administration authorization, such as role `SAP_BC_WEBSERVICE_ADMIN_TEC`.
* **HTTPS on NetWeaver:** SSL must be enabled on the server that hosts the web services, and the `SICF` node `/sap/bc/srt` must be active.
* **Eight SOAP web services:** one per function module in the table in Phase 2. All eight endpoint fields are required in the connection form.
* **Credentials:** the **username** and **password** of a dedicated SAP user of type **System**.
* **Not supported:** Central User Administration (CUA). If your ECC client is a CUA child system, contact your Lumos account team before connecting.

## Read-only access vs provisioning

**Is read-only possible?** Yes. Lumos only calls the write services when you create a user, lock or unlock a user, or grant or remove a role. You control which of those the integration user can do through its PFCG role.

**What read-only requires.** Create all eight web services, because the connection form requires all eight endpoint paths. In the integration user's PFCG role, add the web service authorization defaults for the four read services only (`BAPI_USER_GETLIST`, `BAPI_USER_GET_DETAIL`, `PRGN_GET_ROLES`, `SUSR_GET_ADMIN_USER_LOGIN_INFO`), and give `S_USER_GRP` and `S_USER_AGR` display access (activity `03`) only. Then don't enable provisioning for SAP ECC in Lumos.

## Instructions

**Phase 1: Deploy the on-premise agent**

1. Find the SAP ECC card in your Lumos integrations ([reconnect](https://app.lumosidentity.com/integrations?tab=connected) an existing card or [add a new one](https://app.lumosidentity.com/integrations?tab=can_integrate)).
2. Follow the steps in the pop-up to run the agent and download the SAP ECC connector package. For full agent installation details, see [On-Premise Agent](https://docs.lumos.com/integrations/on-premise-agent/on-premise-agent-1.md).
3. Confirm the agent host can reach your NetWeaver server's HTTPS port (for example `44300`). A host firewall on the SAP server may need to allow the agent host's IP.

**Phase 2: Create the eight web services**

Lumos needs one SOAP web service per function module:

| Function module | Service definition name | Used for |
| - | - | - |
| `BAPI_USER_GETLIST` | `ZWS_BAPI_USER_GETLIST` | Testing the connection and listing users |
| `BAPI_USER_GET_DETAIL` | `ZWS_BAPI_USER_GET_DETAIL` | User email, lock status, validity dates, user groups, and role assignments |
| `PRGN_GET_ROLES` | `ZWS_PRGN_GET_ROLES` | Listing composite roles |
| `SUSR_GET_ADMIN_USER_LOGIN_INFO` | `ZWS_SUSR_GET_ADMIN_USER_LOGIN` | Last logon date |
| `BAPI_USER_CREATE1` | `ZWS_BAPI_USER_CREATE1` | Creating users |
| `BAPI_USER_LOCK` | `ZWS_BAPI_USER_LOCK` | Locking (deactivating) users |
| `BAPI_USER_UNLOCK` | `ZWS_BAPI_USER_UNLOCK` | Unlocking (activating) users |
| `BAPI_USER_ACTGROUPS_ASSIGN` | `ZWS_BAPI_USER_ACTGROUPS_ASSIGN` | Granting and removing roles |

Use the service definition names exactly as listed. Lumos sends requests in the format of these service definitions, so other names are not supported. The name for `SUSR_GET_ADMIN_USER_LOGIN_INFO` is shortened because service definition names are limited to 30 characters.

Repeat these steps for each function module:

1. Open transaction code **SE37** and enter the function module name.
2. Go to **Utilities → More Utilities → Create Web Service**, choose **From the Function Module**, and start the wizard.
3. Under **Service**, enter the **Service Definition** name from the table above and a description.
4. Under **Endpoint Function Module**, confirm the function module is selected.
5. Under **Configure Service**, set **Profile** to **Authentication with User and Password and Transport Guarantee**.
6. Under **Transport**, enter a package (for example `Z_LUMOS`, or `$TMP` for a local object) and a transport request if prompted.
7. Click **Complete**, then click **Activate**. The service definition starts out inactive and doesn't appear in SOAMANAGER until it's activated.

**Phase 3: Activate a binding for each web service**

Repeat these steps for each of the eight service definitions:

1. Open transaction code **SOAMANAGER** and go to **Service Administration → Web Service Configuration**.
2. Search for the service definition and open it.
3. Under **Configurations**, click **Create Service**. Enter a service name and a binding name.
4. Under **Provider Security**, set **Transport Level Security** to **SSL (https)**, set **Message Level Security** to **None**, and select **User ID/Password** under **Transport Channel Authentication**.
5. Under **SOAP Protocol**, leave **Make Local Call** set to **No Call in Local System**.
6. Confirm the operation is selected and click **Finish**.
7. Click **Display binding** (the glasses icon). In **Transport Settings**, copy the **Calculated Access URL**. It looks like `/sap/bc/srt/rfc/sap/zws_bapi_user_getlist/100/zsrv_bapi_user_getlist/zsrv_bapi_user_getlist_binding`. Note which function module it belongs to.

Use the Calculated Access URL, not the WSDL URL. The path includes your client number and the names you chose, so it differs on every system.

**Phase 4: Create a PFCG role for the integration user**

1. Open transaction code **PFCG**, enter a role name such as `Z_LUMOS_INTEGRATION`, and click **Single Role**.
2. On the **Menu** tab, open the dropdown next to **Transaction**, choose **Authorization Default**, and set **Authorization Default** to **WebService**.
3. Add the eight service definitions from Phase 2 (for a read-only connection, add only the four read services). Click **Copy**. This adds `S_SERVICE` for those services to the role.
4. On the **Authorizations** tab, click **Change Authorization Data**. SAP proposes authorization objects for the services you added. Open each node with an orange triangle and fill in or confirm its values until each turns green.
5. Before you generate the role, check that it covers the authorization objects below. SAP may have proposed some of them already. The exact objects SAP checks depend on your release and settings, so confirm the final role with your SAP security team.

   | Authorization object | Values | Purpose |
   | - | - | - |
   | `S_SERVICE` | The services added on the **Menu** tab | Calling the web services |
   | `S_RFC` | Function groups of the eight function modules (including `SU_USER`), activity `16` | Running the function modules behind the services |
   | `S_USER_GRP` | `03` (display); for provisioning, also `01` (create), `02` (change), `05` (lock/unlock), and `22` (assign) | Reading and maintaining user master records |
   | `S_USER_AGR` | `03` (display); for provisioning, also `22` (assign) | Reading role assignments, and granting and removing roles |

   Restrict the `CLASS` field of `S_USER_GRP` to the user groups Lumos should manage if you don't want it to cover every user. If your system checks role assignment with `S_USER_SAS` instead (profile parameter `CHECK_S_USER_SAS`), grant the equivalent values there.
6. Click **Generate**, then **Save**.

**Phase 5: Create a dedicated user in SAP**

1. Open transaction code **SU01** and create a user, for example `LUMOS`.
2. On the **Logon Data** tab, set **User Type** to **System** and set a secure password. System users are not subject to password expiry, so the integration won't stop when a password ages out.
3. On the **Roles** tab, assign the role from Phase 4.
4. Click **Save**.

Use this account only for the Lumos integration.

**Phase 6: Connect in Lumos**

1. Back in the SAP ECC connection form in Lumos, fill in the fields:
   * **Account ID**: any name that identifies this SAP ECC client, for example `ECC-PRD-100`.
   * **Host**: the hostname of your NetWeaver server as the agent host resolves it (for example `sap-server.example.com`). Use the name on the server's TLS certificate.
   * **Port**: the HTTPS port of your NetWeaver server (for example `44300`).
   * **BAPI\_USER\_CREATE1 Endpoint Path** through **SUSR\_GET\_ADMIN\_USER\_LOGIN\_INFO Endpoint Path**: the Calculated Access URL path from Phase 3 for each matching service. Enter only the path, starting with `/sap/bc/srt/`, with no `https://`, host, or port.
   * **Username** and **Password**: the user from Phase 5.
2. Click **Connect**. Lumos tests the connection by listing one user through `BAPI_USER_GETLIST`.

**Phase 7: Test provisioning in a non-production client first**

If you plan to provision, connect a sandbox or test client first and run one of each action against a test user: create, grant a role, remove a role, lock, and unlock. After each action, open the user in `SU01` and confirm the change was saved.

## API Endpoints Used

> [!NOTE]
>
> The API endpoints this integration uses are available to logged-in Lumos customers. Log in to view them.

## Troubleshooting

**Can't connect the integration.** First confirm the on-premise agent is running and can reach the Host and Port over HTTPS. Then check that the **BAPI\_USER\_GETLIST Endpoint Path** holds only the Calculated Access URL path for that service, that its binding is active in SOAMANAGER, and that the integration user's role includes that service. If the agent reaches SAP but the request is rejected, check the username and password, and that the role includes `S_SERVICE` for that service.

**TLS or certificate errors.** The agent connects over HTTPS and checks the server's certificate. Enter the Host exactly as it appears on the certificate, and make sure the agent host trusts the certificate authority that issued it, which is often an internal CA for SAP servers.

**A user shows as Suspended but isn't locked by an administrator.** Lumos marks a user Suspended if any lock flag is set (administrator lock, too many failed logons, global lock, or no password) or if today falls outside the user's **Valid From**/**Valid To** dates on the **Logon Data** tab.

**A role a user has in SAP doesn't appear in Lumos.** Lumos shows composite roles only, and only assignments valid today (by the UTC date). Check whether the role is a single role, or whether the assignment's start date is in the future or its end date has passed.

**A user group is missing.** Lumos lists only user groups that at least one user belongs to.

**A user is still suspended after you activate them in Lumos.** Activation unlocks the user but doesn't change the validity dates. If today falls outside the user's **Valid From**/**Valid To** dates, an SAP administrator must update them on the **Logon Data** tab in `SU01`.

**Last login is empty for a user.** Users who have never logged on to the connected client have no last logon date.

**Granting a role removed other roles, or a grant or removal fails.** `BAPI_USER_ACTGROUPS_ASSIGN` replaces the user's whole role list, so Lumos reads the current roles first and sends them back with the change. A new grant starts today with no end date. If the user already has the role with a future start date, Lumos moves the start to today and keeps the original end date. An expired assignment is replaced with a new one that has no end date. If the call fails, check that the integration user's role includes the provisioning values for `S_USER_AGR` and `S_USER_GRP` from Phase 4. Avoid editing the same user's roles in `SU01` while a Lumos request is running.

**A provisioning action reports success but the change isn't in SAP.** Open the user in `SU01` to check. If the change didn't save, contact Lumos support with the function module and time of the request.

**Creating a user fails.** SAP usernames are limited to 12 characters. If the username already exists, Lumos makes no change and reports the existing user. If SAP rejects the request because of a required field or your password policy, the error from SAP is shown on the request.