Identifying the Structure and Configuration of the User Management Engine (UME)

AS Java provides an open architecture supported by service providers for the storage of user and group data. AS Java is supplied with the following service providers which are also referred to as a "user store":

• DBMS provider: storage in the system database

• UDDI provider: storage via external service providers (Universal Description, Discovery and Integration)

• UME provider: Connection of the integrated User Management Engine

The DBMS and UDDI providers implement standards and therefore ensure that AS Java is EE-compliant. When AS Java is installed, SAP's own User Management Engine (UME) is always set up as the user store and is the correct choice for most SAP customers. The UME is the only way to flexibly set up and operate user and authorization concepts.

Some of the important features of the UME are:

• The UME has its own identity management for administering users formally known as UME Administration Console. It allows the administrator to perform the routine tasks of user administration, such as creating users and groups, role assignment, and other actions.

• Security settings can be used to define password policies, such as minimum password length and the number of incorrect logon attempts before a user is locked.

• The UME provides different self-service scenarios that can be used by applications. For example, a user can change his or her data, or register as a new user. Newly-created users can be approved using a workflow.

• User data can be exchanged with other (AS Java or external) systems using an export/import mechanism.

• The UME logs important security events, such as a user's successful logon or incorrect logon attempts, and changes to user data, groups, and roles.

The UME supports a variety of data sources where user data can be stored:

• System database

• Directory service (LDAP server)

• ABAP-based SAP system (as of SAP Web AS 6.20)

The illustration below shows the architecture of the UME:

The UME is a Java application which runs on AS Java and which covers the following functional areas:

• UME Core Layer: Provides persistence managers between the application programming interface and the user management data sources - these control where user data such as users, user accounts, groups, roles and their assignments are read from or written to, with the result that applications which use the API do not have to know where the user management data is stored.

• UME API Layer: This layer provides programming interfaces (APIs) not just for UME developers but also for customers and partners. This means that you can access the UME functions with the Java programs which you develop yourself.

• UME services: The UME provides the following services to higher-level software layers:

  • Log-on procedure and single sign-on (log-on to AS Java is taken over for other systems and vice versa)

  • Provisioning processes via user master data

  • Authorization Concept

• UME UI: The UME is responsible for the user interface which, in some log-on procedures, appears in the Web browser, as well as for the UME Identity Management. This user interface is also known as the UME Administration Console.

The SAP NetWeaver usage types, which are based on AS Java (such as SAP Enterprise Portal), are based on the UME and perform a number of specific functions on this basis (such as self-registration with approval workflow).

As described in the previous section, the UME Persistence manager offers the option of storing user data in different data sources. The UME Persistence manager also supports data partitioning. This means in practice that, for example, user data for different user types can be stored in different data sources.

In practice, you often work with a combination of the data sourcesdatabase + directory service or database + ABAP user management. When this is done, certain user attributes are to be stored in a different data source, for example, or users are separated by their categories (internal or self-registered users).

• Attribute-based data partitioning: A user in the UME has certain attributes, some of which are classified as global attributes (user ID, telephone number, and so on) ) and others of which are application-specific. Global information would be particularly suited to being stored in a directory service, and application-specific information in the database.

• User-based data partitioning:With this type of partitioning, the data source in which users are stored is decided depending on the category of the user (self-registered or internal users). For example, users that register by self-service can be stored in the database, and internal users in the directory service.

• Type-based data partitioning:With type-based data partitioning, different object types can be distributed to different data sources. The types are, for example, users, groups, roles, user accounts. For example, users can be stored in the directory service, and roles in the database.

SAP delivers preconfigured data source combinations (more information will be provided in the next section), which you should only change in special cases. For example, if you are using a directory service as a data source, you may need to perform attribute mapping. You usually use the delivered preconfigured data source combinations without additional changes:

This section deals with the configuration of the data source(s) stored in the AS Java database in the form of configuration files (in XML format). In most cases, the installation option is retained or the data sources are configured immediately after AS Java installation.

The installation determines the data source for the User Management Engine (UME). After installation you may want to change the data source for a number or reasons. For example:

• You are upgrading your system landscape to include new user repositories.

• The data source you want to use for the UME is not available during installation

When you add an AS Java to your system landscape, you must decide whether to do the following:

• Use an LDAP directory as the data source for user data.
• Use an AS ABAP as the data source for user data.

You cannot configure the AS Java to access an LDAP directory and an AS ABAP as the data source simultaneously. The AS Java can also use its own database as the data source.

Use an LDAP directory as the data source for the User Management Engine (UME) of your AS Java if you want to manage your user passwords in the LDAP directory. This is ideal if, for example, you want to re-use Windows integrated authentication to log on to a portal as well. Use this configuration to access non-SAP systems that share access to the LDAP directory. TheLDAP directory may or may not synchronize with other AS ABAP systems.

Use an AS ABAP as the data source if your Java applications access the services and user data of the ABAP system(s). If not you could also leave the Database as data source. Let's imagine a SAP Enterprise Portal or AS Java as a development platform on the left hand side and a SAP Solution Manager on the right hand side:

If your system landscape contains a large number of ABAP systems and these systems are managed by Central User Administration (CUA), you must choose between either using a child system of the CUA or the CUA central system as the data source

• Use the CUA central system as the data source if all users in the CUA landscape need to access the AS Java, for example, through a Portal. In this configuration the AS Java can have read-write access to the user master data records. This enables an administrator to use the UME to manage user data.
• Use a child system of the CUA as the data source if only some of the users need to access the AS Java, for example, through usage type PI of SAP NetWeaver Exchange Infrastructure (SAP NetWeaver XI). In this configuration the AS Java should be restricted to read-only access for user master records.

The ABAP system may or may not synchronize with an LDAP directory.

Modifying data sources can result in inconsistencies. Restrictions therefore apply to the modification of UME data sources.

The following changes are supported:

• System database (dataSourceConfiguration_database_only.xml):You can switch to any required LDAP configuration file (dataSourceConfiguration_[ldap description]_db.xml) or an ABAP system (dataSourceConfiguration_abap.xml). In this case, you must make sure that the new data source does not contain any users and groups with the same unique attributes as the database (i.e. the new data source must not contain any users or groups with the same unique name or ID as the users or groups in the database).

• ABAP system (dataSourceConfiguration_abap.xml):No change is possible.

• Directory service (dataSourceConfiguration_[ldap description]_db.xml): If you have selected an LDAP directory as the user data source, you can modify the structure of the LDAP directory or switch to a different LDAP if this does not modify any unique user IDs.

In SAP Identity Management (SAP IDM), SAP provides integrated, business process-driven Identity Management functions for a heterogeneous system landscape. SAP Identity Management uses a central identity store to consolidate and save data from various source systems, for example, SAP ERP Human Capital Management (SAP ERP HCM). This information is distributed to connected target systems. User accounts and role assignments for SAP and non-SAP applications are distributed.

Role assignments can be automated using rule definitions. A very important function of SAP Identity Management is the option of making the authorization assignment workflow-controlled. The integration with SAP ERP HCM as one of the possible source systems for identity information is a key function for business process-driven Identity Management.

User management configuration or UME configuration is a Web Dynpro application for configuring the UME. It is integrated in SAP NetWeaver Administrator (NWA) and in the System Administration role of SAP Enterprise Portal. You can also start this tool as a stand-alone console. Use the method most appropriate to your environment.

• SAP NetWeaver Administrator of AS Java.  Enter the following in your Web browser: <http/https>://<AS_Java_hostname>:<AS_Java_HTTP_port>/nwa/identity. Then Choose User Management Configuration.).

• SAP Enterprise Portal: Enter the following in your Web browser:<http/https>://<AS_Java_hostname>:<AS_Java_HTTP_port>/irj). Choose  System Administration → System Configuration → UME Configuration 

• Identity Management of AS Java: Enter the following in your Web browser:<http/https>://<AS_Java_hostname>:<AS_Java_HTTP_port>/useradmin.  Choose User Management Configuration.

If you are not able to start the AS Java because of an ume configuration mismatch you could use the Config Tool to correct this issue:

Open the Config Tool, then choose the Configuration Editor mode Here you able to access all the UME settings (path: cluster_config → system → custom_global → cfg → services → com.sap.security.core.ume.service → Propertysheet properties).

By way of an example, the next figure shows how you can find out the currently active data source in Offline Configuration Editor mode.

software only available in English

Service provider in AS Java which saves user administration data such as user and group data.

User Management Engine: A Java-based user administration component with central user administration, a single sign-on (SSO), and secure access to distributed applications.

After you have selected and precisely configured a data source, there are many other parameters with which you can influence the behavior of the UME. The following figure provides an overview of the relevant areas:

The following list presents a number of important, selected parameters:

Date source(s)

ume.persistence.data_source_configuration Name of the UME configuration file (depending on the data source, other parameters may be relevant for connecting the data source)

Security Policy

• ume.logon.security_policy.auto_unlock_time Number of minutes after which a user locked because of invalid login attempts is unlocked again (if the value is 0 then the user remains locked)

• ume.logon.security_policy.lock_after_invalid_attempts Number of invalid login attempts after which a user is locked (automatically set to 0 in an AS ABAP+Java)

• ume.logon.security_policy.password_special_char_required Determines the minimum number of special characters that the password must contain

• ume.logon.security_policy.password_alpha_numeric_required Specifies the minimum number of numeric and alpahetical characters that the password must contain (if the number is 3 then the password must contain at least 3 numbers and 3 letters)

• ume.logon.security_policy.password_expire_days Number of days before the password expires

• ume.logon.security_policy.password_max_length or ume.logon.security_policy.password_min_length Maximum or minimum length of the password

• ume.logon.security_policy.useridmaxlength or ume.logon.security_policy.useridminlength Maximum or minimum length of the user ID

There are different security policy profiles, e.g. Default and Technical User. The properties for the profile Technical User is hard coded and can not be changed. The properties can be viewed in the useradmin → Configuration → Securtiy Policy by selecting the profile. Changes of the Default security profile properties affects the properties mentioned above and vice versa. You can create your own security policy profiles where you can maintain property settings different to the Default security policy profile. These settings can only viewed and maintained in this "simple" mode and is not accessible via expert mode or the configuration editor mode of the config tool.

In the UME Configuration you can maintain user and assign them a security policy profiles, so you can have user with different values of the security policy properties. By default, the Default security policy profile is assigned.

Notification E-Mails

The UME can be configured in such a way that in certain situations (e.g. after locking a user), e-mails are sent via an external SMTP server. For this to be possible, of course, valid e-mail addresses must be stored in the user master records.

User Admin UI

• ume.admin.addattrs Makes it possible to add customer-specific attributes to the user master record

• ume.admin.search_maxhits Maximum number of search hits displayed in the Administration Console (default 1000)

• ume.admin.search_maxhits_warninglevel Number of hits as of which a warning is issued in the Administration Console (default 200)

• ume.admin.wd.url.help URL to the online documentation (may, for example, point to the customer's local help system)

• ume.admin.wd.table.size.<name> Specifies the number of rows for output in the Administration Console (for <name>, there are small, medium and large)

Adding Customizing Attributes to User Profile

• ume.supergroups.anonymous_group.displayname ID of the group of anonymous users (default Anonymous Users)

• ume.supergroups.authenticated_group.displayname ID of the group of logged on users (default Authenticated Users)

• ume.supergroups.everyone.displayname ID of the group of all users (default Everyone)

• ume.virtual_groups.names IDs of virtual groups (formed on the basis of certain user properties)

Logon Screen Customization

• ume.logon.branding_image Path to the image displayed in the logon screen

• ume.logoff.redirect.url Address that is called following logoff (only for the SAP Enterprise Portal)