If you use an SAP NetWeaver Application Server (AS) ABAP Central User Administration (CUA) system as the data source of your user management engine (UME), note the following constraints, depending on whether you connect to the central system or a child system.
The UME can view all users present in any system managed by the central system of a CUA; however, the AS ABAP users can only log on to the UME if they have a system assignment in the central system. When you create new users in the UME, the system creates this assignment automatically.
The UME can view only the roles that are present in the central system, that is, roles that are available in the transaction PFCG. Roles known to the central system in the value help for user/role-assignment for managed systems are not visible to the UME. From the UME, you can only view those user-to-group assignments made for the central system.
To add users to the child system of a CUA to which the UME is connected, you must first use the transaction SCUM in the central system of the CUA. There you must set the user attributes you want to be able to add from the UME to any value other than global.
You must set the field attribute Initial password in transaction SCUM to a value other than global. If the value is set to global, you create users who cannot log on, because the user password is empty.