Mapping SAP Control Center Roles to LDAP or OS Groups

To grant SAP Control Center privileges to users who are authenticated through LDAP or the operating system, associate roles used in SAP Control Center with groups in LDAP or the operating system.

Prerequisites

Required for LDAP and UNIX: Configure an authentication module.
Optional: Create these groups in the system providing SCC authentication (LDAP or the OS) and assign SAP Control Center users to them:
- sybase – confers sccUserRole. Assign all SCC users to the sybase group.
- SCC Administrator – confers sccAdminRole. Assign only SCC administrators to this group.

Task

You can configure SAP Control Center to enable users to authenticate through their local operating system or through an LDAP server. To make this type of authentication work, SCC roles must be mapped to groups that exist in the system providing authentication (LDAP or the operating system).

The sybase and SCC Administrator groups are convenient because they are predefined in role-mapping.xml. If you add sybase and SCC Administrator groups to your LDAP system and populate them with SCC users and administrators, you can skip to the next task—you do not need to complete the steps below.

The table lists default mappings of LDAP and OS groups to SCC roles. Login modules are defined in csi_config.xml.

Login Module	OS Group	SAP Control Center Roles
UNIX Proxy	root	uaAnonymous, uaAgentAdmin, uaOSAdmin
	sybase	uaAnonymous, uaPluginAdmin, sccUserRole
	user	uaAnonymous
	guest	uaAnonymous
NT Proxy	Administrators	uaAnonymous, uaAgentAdmin, uaOSAdmin
	sybase	uaAnonymous, uaPluginAdmin, sccUserRole
	Users	uaAnonymous
	Guests	uaAnonymous
LDAP	sybase	uaAnonymous, uaPluginAdmin, sccUserRole
LDAP	SCC Administrator	uaAnonymous, sccAdminRole

There are two ways to accomplish the mapping:

(Recommended) Add a “sybase” group and an “SCC Administrator” group to the operating system or LDAP server SAP Control Center is using to authenticate users, and add all users who need to access SAP Control Center to one or both groups.
Configure SAP Control Center to use existing groups in LDAP or the operating system by editing the role-mapping.xml file. This option is described here.

If SAP Control Center is running, shut it down.
In a text editor, open:

<SCC-install-directory>/conf/role-mapping.xml

Locate the sccUserRole section of the file:

<Mapping>
    <LogicalName>sccUserRole</LogicalName>
    <MappedName>SCC Administrator</MappedName>
    <MappedName>SCC Agent Administrator</MappedName>
    <MappedName>sybase</MappedName>
</Mapping>

Add a MappedName line for the LDAP or OS group you are using to authenticate SCC users. The sccUserRole section should look similar to this:

<Mapping>
    <LogicalName>sccUserRole</LogicalName>
    <MappedName>SCC Administrator</MappedName>
    <MappedName>SCC Agent Administrator</MappedName>
    <MappedName>sybase</MappedName>
    <MappedName>my_SCC_group</MappedName>
</Mapping>

Locate the sccAdminRole section of the file:

<Mapping>
    <LogicalName>sccAdminRole</LogicalName>
    <MappedName>SCC Administrator</MappedName>
</Mapping>

Add a MappedName line for the LDAP or OS group you are using to authenticate SCC administrators. The sccAdminRole section should look similar to this:
```
<Mapping>
    <LogicalName>sccAdminRole</LogicalName>
    <MappedName>SCC Administrator</MappedName>
    <MappedName>my_SCC_admin_group</MappedName>
</Mapping>    
```
Save the file and exit.
(LDAP only) Ensure that the roles defined in the LDAP repository match the roles defined in role-mapping.xml.
In the <SCC-install-dir>\conf\csi_config.xml file, set the BindPassword and ProviderURL properties with values used in your deployment.
Sybase recommends that you encrypt sensitive values before saving them in csi_config.xml.
Start SAP Control Center.