SAP Admin Module and SAP IdM – Architecture

The SAP Admin module can be connected to IdM through Virtual Directory Server (VDS). After VDS has been correctly configured, the SAP Admin module can send requests (using the LDAP protocol) to change specific user data to IdM. Depending on its configuration, IdM then sends changes to the SAP target systems.

VDS is used in the context of IdM to provide connectors to various SAP and non-SAP systems. VDS also functions as an entry point to the IdM database (the Identity Center [IC]). The SAP Admin module accesses the IdM database via an LDAP connector. LDAP requests from the SAP Admin module are transformed and a connection to the IdM database is made.

The LDAP requests are executed centrally within IdM according to its configuration. This means, that the settings that are configured in IdM take priority over those configured in the SAP Admin module. After the SAP Admin module has sent a request to IdM, the IdM database is updated with the new values, and the IdM configuration determines, for example, which changes to user details are propagated into which SAP systems.