Dominic Yow-Sin-Cheung SAP GRC Regional Implementation Group (RIG) elearning Series Part 5 of 5

Transcription

1 SAP BusinessObjects Risk Management & Process Control 3.0 Post-Installation Tasks Java Dominic Yow-Sin-Cheung SAP GRC Regional Implementation Group (RIG) elearning Series Part 5 of 5

2 Document Header Applies to: SAP BusinessObjects Process Control 3.0 and SAP BusinessObjects Risk Management 3.0 Summary This elearning goes thru the configuration steps to be performed on the App. Server Java where PC/RM 3.0 was installed. Author(s): Dominic Yow-Sin-Cheung Company: Regional Implementation Group Governance, Risk, and Compliance SAP BusinessObjects Division Created on: September 2 nd, 2009 Version 1.0 SAP 2009 Page 2

3 Author SAP GRC RIG Team Dominic Yow-Sin-Cheung, SAP GRC RIG, EMEA Region We belong to the GRC Regional Implementation Group (RIG) located in USA, Germany and India As recognized experts, our mission is to enable others to successfully implement SAP GRC solutions. We are committed to the continuous improvement of GRC products and services, taking the product from validation to customer deployment. We ensure o o o Field readiness, high customer satisfaction, and customer references. SAP 2009 Page 3

4 elearning Series 1. Technical Overview and Requirements 2. Available Documentation and Install Preparation 3. Installation Steps Java and ABAP 4. Post-install Tasks ABAP 5. Post-install Tasks Java Note: this is a series of elearnings this is part 5 of 5! SAP 2009 / Page 4

5 Contents NetWeaver Portal Settings Change PCD Permissions Create Portal System Object(s) Application Server Java Settings Check SLD Create JCo Connections for Crystal Reporting Check IGS Status User Management Settings Assign PC/RM Role(s) to End-Users SAP 2009 Page 5

6 Prerequisites GRCFND_A add-on installed on ABAP backend GRC* Business Packages deployed on AS Java Valid SSO setup between AS Java and AS ABAP hosting the PC/RM install(s) AS ABAP created as technical system in the SLD UME user(s) or group(s) created who should have access to PC/RM SAP 2009 Page 6

7 Portal Settings: PCD Permissions (1) For an initial setup the user permissions need to be defined for the Portal Content (iviews, Pages etc.) From a Portal content perspective there are two types permission categories/folders o PC/RM o Reporting SAP 2009 Page 8

8 Portal Settings: PCD Permissions (2) In the Portal open the Content Administration Portal Content, expand the folder Content Provided by SAP and right-click on GRC Risk Management or GRC Process Control Then select Open Permissions SAP 2009 Page 9

9 Portal Settings: PCD Permissions (3) Search for a user/group ("Go" button) and add him/her to the list ("Add" button) SAP 2009 Page 10

10 Portal Settings: PCD Permissions (4) Select "end-user" and deselect all other permissions Reset the child node permissions, confirm with "Yes" SAP 2009 Page 11

11 Portal Settings: PCD Permissions (5) Now save your settings by clicking the "Save" button This breaks inherited permissions and is intended, i.e. confirm with "Yes" SAP 2009 Page 12

12 Portal Settings: PCD Permissions (6) Now proceed likewise for the Reporting Framework permissions Select user/group who should get access to PC/RM Add user/group to the list Enable end-user permission Disable Role Assigner & Administrator Reset child permission And Save (breaking inheritance again) See also next slide SAP 2009 Page 13

13 Portal Settings: PCD Permissions (7) Same settings (can be different user) for Reporting framework in folder "GRC Reporting Framework" SAP 2009 Page 14

14 Portal Settings: System Object (1) Create a new system object from template SAP 2009 Page 15

15 Portal Settings: System Object (2) Usually we use the "dedicated application server" to connect to the PC/RM ABAP backend (can be load-balanced, too) SAP 2009 Page 16

16 Portal Settings: System Object (3) Enter a system name and ID (should be the same and match the alias which is defined later) SAP 2009 Page 17

17 Portal Settings: System Object (4) Click "Finish" and then "Open for editing" SAP 2009 Page 18

18 Portal Settings: System Object (5) In the Property Category select "Connector" For value details see next slide SAP 2009 Page 19

19 Portal Settings: System Object (6) Parameter Details: Application host: the host where the PC/RM add-on is installed Logical System Name: <SID>CLNT<CLIENT NR>, e.g. "ASACLNT001" (no spaces!) Remote Host Type: "3" for R/3, ERP etc. SAP Client, SID, SAP System No, Server Port: settings for AS ABAP where PC/RM add-on is installed System Type: "SAP_R3" for R/3, ERP etc. SAP 2009 Page 20

20 Portal Settings: System Object (7) In the Property Category select "User Management" Select "SAP Logon Ticket" for the Authentication Ticket Type Choose "SAPLOGONTICKET" for the Logon Method Please note this requires SSO between Portal and the PC/RM backend! SAP 2009 Page 21

21 Portal Settings: System Object (8) In the Property Category select "Web AS Properties" Enter the Web AS ABAP Host name Choose the according protocol (http or https) SAP 2009 Page 22

22 Portal Settings: System Object (9) Save & Choose "System Aliases" from drop-down Enter "SAP_GRM" for RM and click "Add" Add "SAP_GRCSPC" for PC Note: it is irrelevant which alias (PC or RM) is the default one Save the settings SAP 2009 Page 23

23 Portal Settings: System Object (10) Test the Connector It is sufficient that the "Connection Test for Connector" works SAP 2009 Page 24

24 Portal Settings: System Object (11) Assign end-user permissions to your PC/RM users or groups SAP 2009 Page 25

25 AS Java: Check SLD (1) Open on the AS Java where the PC/RM Business Package is deployed Click on Administration SAP 2009 Page 26

26 AS Java: Check SLD (2) Status should be running If not click the Start button SAP 2009 Page 27

27 AS Java: Create JCo Connection (1) These JCo connections are used for Crystal Reporting Open on the AS Java where the PC/RM Business Package ist deployed Click on "Content Administrator" SAP 2009 Page 28

28 AS Java: Create JCo Connection (2) In the tree on the left-hand side choose "sap.com/grc~crmodel" SAP 2009 Page 29

29 AS Java: Create JCo Connection (3) Click on the tab "JCo Connections" SAP 2009 Page 30

30 AS Java: Create JCo Connection (4) Click on "Create" for GRCFN_CR_DATA and fill in the first screen Enter the client number you are using for the PC/RM backend Use the suggested JCo Pool Configuration values as below SAP 2009 Page 31

31 AS Java: Create JCo Connection (5) Select the appropriate J2EE Cluster Note: This shows a local J2EE but you may also use a different one SAP 2009 Page 32

32 AS Java: Create JCo Connection (6) Choose "Application Data" on the left Select the applicable "Destination Type" on the right SAP 2009 Page 33

33 AS Java: Create JCo Connection (7) Select the Application Server from the drop-down or enter the values manually Note: This drop-down is only populated with data once you create a system landscape in SLD! SAP 2009 Page 34

34 AS Java: Create JCo Connection (8) Note: Step 4.2 "Msg. Server Connection" not applicable in this case Choose "Ticket" for "User Authentication", your language and "Off" for "SNC" Note: This uses SSO and requires a valid SSO setup between AS Java and AS ABAP! SAP 2009 Page 35

35 AS Java: Create JCo Connection (9) Test your connection using the "Test" link You should get a message telling you that the connection is ok SAP 2009 Page 36

36 AS Java: Create JCo Connection (10) Now configure the meta-data connection SAP 2009 Page 37

37 AS Java: Create JCo Connection (11) Select a J2EE cluster SAP 2009 Page 38

38 AS Java: Create JCo Connection (12) Select "Dictionary Meta Data" SAP 2009 Page 39

39 AS Java: Create JCo Connection (13) Note: Step 4.1 Appl. Server Connection does not apply Select the message server or create it manually SAP 2009 Page 40

40 AS Java: Create JCo Connection (14) Enter a backend communication user for logon Note: SSO not possible for meta-data Also note that this communication user needs the PC/RM ABAP Role(s) as well as the S_RFC authorization see also PC/RM 3.0 Security Guide SAP 2009 Page 41

41 AS Java: Create JCo Connection (15) Test the connection SAP 2009 Page 42

42 Settings AS Java: IGS Check that IGS is running Access the AS Java URL no>80 In case IGS is not running or in case of an error please refer to SAP Note SAP 2009 Page 43

43 User Management Settings (1) Assign users or groups to the "GRC Risk Management" and/or "GRC Process Control " Role(s) SAP 2009 Page 44

44 User Management Settings (2) There are a few standard Roles shipped with PC/RM One RM Portal Role: GRC Risk Management Four PC Portal Roles o GRC Process Control - All o GRC Process Control - Global o GRC Process Control - SOX o GRC Process Control - FDA One Crystal Role: Crystal Admin. Role (only assigned to Administrators) For details please also see PC/RM install guide and the PC/RM security guide As with any Portal Roles, these Roles can be copied to a customer s name space and edited there SAP 2009 Page 45

45 Thank you for attending this elearning! Note also following available elearnings: 1. Technical Overview and Requirements 2. Available Documentation and Install Preparation 3. Installation Steps Java and ABAP 4. Post-install Tasks ABAP 5. Post-install Tasks Java SAP 2009 / Page 46