SoD Function Objects

[Miha]

Hello,

We are working to configure SoD for SAP S4 Hana.

The roles in S4 are configured as follows:

• There are composite roles, e.g., ZC:Accountant_Example. This entitlement type in Saviynt is SAP Role.
• Each composite role contains multiple single roles, e.g., ZS_Cross_Finance_Example.  This entitlement type in Saviynt is SAP Role.
• Each single role contains transactions, e.g., SU3. This entitlement type in Saviynt is TCODE.

I defined a function in SoD, in which I want to add an object. In the object I want to add a SAP Role, not the TCODE. Is this supported in Saviynt?

Can I have role-based SoD, instead of transaction (TCODE) based SoD?

I tried to add a SAP Role, e.g., ZC:Accountant_Example, but it is not found. If I try to add the TCODE that is inside the SAP Role, I am able to find it.

Thanks in advance for your help.

Mihaela

[Dhruv_S]

Hi @Miha 

• Non-SAP ruleset allows you to perform SOD evaluation based on entitlements.

• SAP ruleset allows you to perform SOD evaluation for SAP systems based on SAP entitlements (Tcodes).

For SAP functions, you have to select Tcode only.

Regards,
Dhruv Sharma
If this reply answered your question, please accept it as Solution to help others who may have a similar problem.

[Miha]

Hey @Dhruv_S ,

Thanks for the quick answer!

So if I use Saviynt Function Type SAP, I can only use TCODES in the function objects.

If I want to use SAP Roles (entitlements), instead of TCODES, I need to select non-SAP Saviynt Function Type, I understand correctly?

Thank you,

Mihaela

[SumathiSomala]

@Miha You have to use Saviynt function type as SAP as you are using SAP s4 Hana application.

SAProles also TCODES.

To perform SOD evalution we use entitlements in Non-SAP system.

To perform SOD evalution we use TCODES in SAP or SAP GROUP system.

Creating Functions (saviyntcloud.com)

[rushikeshvartak]

Functions are logical grouping of entitlements (access) that defines a user’s ability to perform business tasks. EIC enables you to manage the business function definition as a conditioned group with multiple entitlements. Entitlements can be logically grouped within a function by using conditional operators.

• For SAP Type, allowed conditions are AND/OR

• For Non SAP type, allowed conditions are AND/OR/NOT

• For SAPGROUP type allowed conditions are AND/OR

For SAPGROUP rulesets, following are the prerequisites:

• Associate the relevant endpoint to an organization.

• Upload the appropriate SAPGROUP ruleset.

• Request for an application role to view the violations of an associated ruleset.

After uploading a ruleset, if you add or remove any endpoints associated to an organization, you must upload the ruleset again for the changes to reflect.

https://docs.saviyntcloud.com/bundle/EIC-Admin-v23x/page/Content/Chapter16-Segregation-of-Duties/Man... 

https://docs.saviyntcloud.com/bundle/EIC-Admin-v23x/page/Content/Chapter16-Segregation-of-Duties/SOD... 

https://docs.saviyntcloud.com/bundle/EIC-Admin-v23x/page/Content/Chapter16-Segregation-of-Duties/SOD... 

[Dhruv_S]

Hi @Miha 

You have to use T codes for SAP/SAPGroup functions. Since your application is SAP S4HANA application, you should not use Non-SAP function also.

Regards,
Dhruv Sharma
If this reply answered your question, please accept it as Solution to help others who may have a similar problem.

[Miha]

@Dhruv_S  thanks for the answer.

I am using SAP Function, as my application is SAP S4 Hana, but i want to add SAP Roles, not T codes in the objects... I want the SoD to be evaluated on parent entitlement, which are SAP roles, instead of T codes. Is that possible or not? Is some additional license required?

Thanks,

Miha

[Dhruv_S]

Hi @Miha 

We will check and confirm on this.

Regards,

Dhruv Sharma

[Dhruv_S]

Hi @Miha 

Thanks for your patience. We checked internally with our team on this issue and got the below solution.

If you want to use the SAP Roles instead of T codes, you can use the non-sap function type and add the sap roles as entitlements. It is supported by Saviynt.

Please test the scenario with Non-SAP function and let us know if you have any further questions on this.

Regards,
Dhruv Sharma
If this reply answered your question, please accept it as Solution to help others who may have a similar problem.