In the UME environment, the umbrella term Principle is used for the following central "objects"- User, User Account, Group and Role.
Principles in the UME Environment:
| Principle | Meaning |
|---|---|
| User | General properties of a user (such as name, e-mail, telephone number etc.) |
| User Account | Logon-related properties of a user (such as password, validity, lock indicator and so on) |
| Group | Set of user and/or groups |
| Role | Set of (Java) authorizations |
For historical reasons, users and user accounts are different principles which are typically associated. When the term user is employed below, then, more precisely, it is the associated principles user and user account that are intended.
Note
Depending on the SAP NetWeaver usage type, the principles have an additional meaning (thus in a SAP Enterprise Portal there are portal roles that are also handled in the same way as a UME principle).
The following figure shows how you can assign principles.
Users are usually assigned to groups to which roles are then assigned. However, it is also possible to assign roles to users directly. The Principle group supports hierarchies of groups. A group may also possess higher and lower-level groups. Users actually possess the roles which
are directly assigned to them
are assigned to the groups to which they belong
are assigned to the higher-level groups of the groups to which they belong
When performing a search in the Identity Management, you must always check the field Search Recursively if you want to see indirectly assigned principles.
