In complex system landscapes with multiple systems and clients, the administration effort required to compare and update user master records is very high. Employees join the company, leave, or change jobs within the company. Individual users usually need to access various systems and clients to perform their work, and therefore require multiple users.
Since user master records are client-specific, they must be administered in each client of each and every system. For example, if you want to create a new user, you must create it manually in all the clients of all the SAP systems in which it should be valid.
User master records can be managed centrally in one client of a system. If a new client is built as a copy of another client, the new client can initially be filled with the user master records of that client. During this copy, the roles of the original client are copied together with the user master records. However, you cannot copy individual users selectively. Also, the user master records cannot be automatically synchronized sequentially.
The essential feature of the Central User Administration is the definition of a central client in a selected system. It can be used to manage the user master records for all the clients of the system landscape. For example, you can define which roles should be assigned to which users in which systems. This greatly reduces the administrative cost for authorization administration.
Hint
You can decide individually for each user which systems that user should be able to log on to.
Caution
Central User Administration does not mean that every user must exist in each system of the system landscape. In particular, users of child systems do not necessarily need to exist in the central system.
Which user master record data is administered centrally or only locally can be individually set. Local administration by a user or by an administrator could be useful for certain data of the user master record.
The authorization data is exchanged based on the ALE concept. ALE means Application Link Enabling and permits you to build and operate distributed SAP links. It includes a business-controlled message exchange between loosely linked SAP systems. The application is integrated with asynchronous communication.
Hint
In the rest of this lesson, the central client will be referred to as the "central system". A "child system" is a client of an SAP system included in Central User Administration.
The following data can be distributed with Central User Administration.
Data Distributable Using Central User Administration
User master record data, such as the address, logon data, user defaults, and user parameters.
The assignment of the user to roles or profiles for each child system. The advantage of administering assignments centrally is that you no longer need to log on to each system to make system-specific assignments of roles and profiles; it is all managed at one location in the central system.
The initial password. When you create a new user, the initial password is distributed to the child systems as a default value. The passwords are distributed in coded form.
The lock status of a user. In addition to the locks caused by incorrect logon that already existed in previous releases or those set manually by the local administrator, there is now also a new "global lock". This applies to all of the child systems in which the user is defined and can be canceled in the central system or locally if required.
Hint
Although roles and authorization profiles can be transported, they are normally managed in the child systems and not centrally. Different Customizing settings and releases in the child systems normally make it necessary to adjust the roles individually. Therefore, Central User Administration transfers only an assignment of the users to roles and profiles, but not the authorization values that are contained in the authorization profiles.
