1.Business Scenario
As part of business requirement, a user might have to go through some training while requiring access to operate certain critical transactions. To cater to this requirement, CUP has the functionality for configuring Training and Verification systems. It enables the customers to write their own implementation of the verification process for assigning a role.
2.Background Information
The solution proposed enables users to configure Integration of CUP and the corresponding Training and Verification systems. Customers can write a custom webservice implementation wrapper over their training system to enable the Compliant User Provisioning application to communicate and verify if the User who is requesting the role has attended that training or not and we have the BADI implementation for this too.
Training verification can be configured at role level for multiple training systems. These training and verification systems validate if a user has gone through certain trainings and based on that it provisions roles to users.
3.Prerequisites
3.1 Connector needs to be created with Connector Type as Training/Verification System and associate Training connectors to the roles that require training verification.
3.1.1 Prerequisites can be defined under Role Management in SPRO as shown below.
3.1.2 Prerequisite Type Should be of type Training for training and verification.
3.1.3 Role Prerequisite can be set from the following screen.
3.1.4 After Defining the Role Prerequisite , they need to be configured at Role Level and verify on Request parameter should be set as 'Yes' as shown below.
3.2 Detour Configuration: If training and verification fails. (In SPRO under Maintain MSMP Workflows)
4.Key Features and Configurations
While creation of the request, training and verification will be checked for the roles available in the request. If the Prerequisite is set for a role and the type of the prerequisite is ‘Training’ then the training/verification for that particular role will be checked(If it is available in the request). If the prerequisite is active , an error message will be shown to the user and if is not active then user will get a warning popup and user will be able to move forward as shown below.
BADI and WS details for training/verification—
GRAC_TRG_VERIF (BADI definition)
ZCL_BADI_TRG_VERIF (Class)
IF_GRAC_TRG_VERIF (Interface)
(In the BADI we checked training/verification for all the roles starting with sap* for testing at implementation time.It can be changed as per the requirement.)
Web Service Details
Once the web service for training and verification system is in place, create a connector for Training and Verification system.
1) As part of web service/BADI implementation, the training and verification check will be performed during Request Submission and a detour will be configured for it.
2) While creation of request, roles are requested for which training and verification is required.
3) If web service/BADI fails then detour will be followed.
We have provided a Configuration Parameter in SPRO which will determine that whether the BADI will be called or the Web service will be called for the training and verification as in GRC 5.3 , training and verification was possible only through Web Service.
The detail of this parameter is as below.
