Disabling Companies for an ABAP Data Source

Use

By configuring an SAP NetWeaver Application Server (AS) ABAP as the data source, the user management engine (UME) automatically retrieves the list of user groups from the ABAP system. This enables the AS Java to use the delegated user administration of the AS ABAP. If you do not want to use delegated user administration on the AS Java, you can disable the creation of companies from the ABAP user groups.

Reasons for disabling companies include the following:

You do not want to make your delegated user administrators in the AS ABAP members of the groups for which they are responsible.
You simply do not want to use delegated user administration in the AS Java.

Note

The ABAP system still checks the user (either the system user for UME-ABAP communication or the actual user logged in) for the required authorizations needed for any user groups, even if this information is not used by the AS Java. We recommend that you configure your AS ABAP and AS Java to use the same delegated user administration configuration as much as possible. Otherwise the AS ABAP or the AS Java may deny actions that the other AS allows.

More Information:

Prerequisites

This procedure requires you to restart the AS Java, so you should plan for the required downtime.

Procedure

Configure the required UME properties.
For more information about editing UME properties, see Editing UME Properties .
1. Set the UME Property ume.tpd.companies= 0 .
2. Set the UME Property ume.tpd.imp.class .
  You can use one of the following two assignments:
  - ume.tpd.imp.class=com.sap.security.core.tpd.SimpleTPD – this value is updated to com.sap.security.core.tpd.abap.R3GroupTPD after a restart of the system;
  - ume.tpd.imp.class=com.sap.security.core.tpd.abap.R3GroupTPD.
Restart the AS Java.

Note

After the restart, the system automatically sets the property ume.tpd.imp.class=com.sap.security.core.tpd.abap.R3GroupTPD because ume.tpd.companies= 0.