UME – Groups

Last but not the least of the UME Objects are Groups. Again we follow the same process for creating groups as for creating roles or users. We start by selecting Groups from the dropdown and click the “Create Group” button.

We start by adding a name and description for the new group. Groups don’t carry any permissions themselves but can be mapped to any number of roles. A user assigned to a UME group will inherit all the roles and the permissions contained in them. Groups also can be a part of a hierarchy of parent and chid groups.

Groups serve a special purpose when the UME uses an ABAP system as its data source. In this case, any new role created in ABAP is available in AS Java as a user group. Also assigning the backend role would assign the UME group and any role mapped to it in the java system. Many a time, a UME role contains java applications accessing backend SAP data. This is specially the case when an Enterprise Portal is installed on the AS Java system. A case in point are ESS and MSS applications used in SAP HCM. For these applications, we can create a backend role and assign the needed java role(s), either UME or portal roles, to the corresponding group. Any user getting the backend role would automatically get the correct Java access.

So for a AS Java system with an ABAP datasource, the entire user-role administration can be carried out from the ABAP backend. For a UME with Active Directory server as its user source, groups can be mapped to a AD group such that a user getting a AD group automatically gets the UME group and all roles mapped to it.