Mail Address Derivation

The table controls show how the SAP user ID is matched to the corresponding Active Directory identity (and ultimately to the user's authoritative e-mail address, which is used for the encryption and decryption processes). It is critical to choose a mechanism that is protected against tampering by the user. To configure Mail Address Derivation, follow the below steps:

1. Call transaction /n/SECUDESD/MAIL_DRV - Directory Mapping of SAP User Master.

2. Click Display −> Change icon to edit the table.

3. Enter the name of the User Group as given in User Master maintenance for authorization check.

4. Enter a brief description of the authorizations in the Text.

5. Select the mail derivation method you require from the Derivation method list. The following options are available:

   1. Mail address in user master: The mail address is retrieved from the SAP user master field (E-Mail Address on the Address tab).

   2. Login name = SAP user ID: The mail address is read from AD, by querying against the sAMAccountName with the SAP user ID. You should use this option only if a match between the SAP user ID and the sAMAccountName can be reliably established.

   3. Login name in Alias field: The mail address is read from AD, by querying against the sAMAccountName with the content of the Alias field (Alias on tab LogonData).

   4. UPN in Alias field: The mail address is read from AD, by querying against the userPrincipalName with the content of the Alias field (Alias on tab LogonData).

   5. Mail address in Alias field: The mail address is read from the Alias field (Alias on tab Logon Data).

   6. UPN in SNC name: The mail address is read from AD, by querying against the userPrincipalName with the content of the SNC name field (SNC name on tab SNC); as the SNC name is often prefixed by an identifier to specify the name type, always indicate this prefix in the table.

   7. DN in SNC name: The mail address is read from AD, by querying against the distinguishedName with the content of the SNC name field (SNC name on tab SNC); as the SNC name is often prefixed by an identifier to specify the name type, you will also have to indicate this prefix in the table.

   8. Own implementation of BAdI: If you prefer to use a different mechanism, you may implement the BAdI/SECUDESD/BADI_DERIVE_MAIL.

6. Specify the prefix (e.g., name type) of the SNC name in SNC Prefix.

   

   Directory mapping of SAP user master

7. Click Save to save your settings.

8. The below table lists the allowed Mail Address Derivation method based on the selected Active Directory.

Mail Address Derivation