Integrate SAP HR and Active Directory using Forefront Identity Manager (FIM) SAP Connector for WS

I implemented an integration flow that involves SAP HR ECC6 as source system and Microsoft Active Directory as target system. As you know, I love working with BizTalk but this time I decided to use FIM. Therefore, I used the new SAP Connector for WebServices to access SAP system.

I followed the instructions reported in the MS document named “Connector for SAP.docx” available at http://www.microsoft.com/en-us/download/details.aspx?id=29943 address, and I managed to complete the procedure on SAP side.

Once the procedure has completed, you may discover that the BAPI required by the SAP accelerator workflow are not available. This because the needed BAPI belong on different function group on SAP system and by default you cannot group into a single web service.

 

My lab environment includes a SAP server, a FIM server and an Active Directory server with the following characteristics:

 

SAP System:

 

Version: ECC6 EHP4

Kernel: 720/500

Operating System: HP-UX 11.23

Database: Oracle 10.2

 

 

FIM Server:

 

Operating System: Windows 2008 R2 SP1

FIM Version: 2010 R2 with SP1

Database: SQL Server 2012 SP1

 

Active Directory Server:

 

Operating System: Windows 2008 R2 SP1

 

Customization

 

First of all, I asked the SAP team to split BAPI web method in different web services, I subsequently modified the workflow of the accelerator to make sure that the calls were referring to the new addresses.

The customizations have been made in order to run the “full import” task and to execute test during initial agent setup. Other workflows have been ignored because they are not needed for my project.

Of the available BAPI I reconfigured only the following one:

 

·         BAPI_EMPLYEE_GETDATA

·         BAPI_ADRESSEMPGETDETAILEDLIST

·         BAPI_PERSDATA_GETDETAILEDLIST

 

Customization

 

Configuring BAPI web service calls

Following the screenshot taken during web service configuration.

 

BAPI_EMPLYEE_GETDATA

 

 

 

 

 

 

BAPI_ADRESSEMPGETDETAILEDLIST

 

 

 

 

 

 

 

BAPI_PERSDATA_GETDETAILEDLIST

 

 

 

 

 

Check configuration

When the procedure is completed, you should have a situation like the one shown in the following figure:

 

 

Variable Settings

The steps taken above has determined a change to the data types and attribute names.

I then had to re-map the variables to refer to the new namespace and new data types by searching “Sequence” task, checking the variables and changing the reference to the new namespace if necessary.

For example, in the following picture you can see the old definition.

 

 

I have selected the variable and used the properties window and changed the references.

 

 

Add the following variable:

 

 

Following the result:

 

 

BAPI Call

 

BAPI_EMPLYEE_GETDATA

Before the configuration

 

After the configuration

 

Note: during replacement, you may lose the arguments specification so you have to resubmit them. In addition, some attribute names are different, typically in the new call there are no underscore characters (FSTNAME_M -> FstnameM).

 

BAPI_ADRESSEMPGETDETAILEDLIST

Before the configuration

 

After the configuration

 

BAPI_PERSDATA_GETDETAILEDLIST

Before the configuration

 

After the configuration

 

Other changes

After the reconfiguration of the calls, you need to modify the names of the changed attributes, add or change the namespace to variables that refer to the return structure of the BAPI and object types that refers to the old namespace.

 

Test workflow

The workflow for the test is much simpler, but the same principle should be applied.

 

Before the configuration

 

After the configuration

 

As final step, you have only to configure the connection to Active Directory, but this is a different and simpler story.