Can I use SAP HR to drive ESS Portal user creation?

Question

Hello
We are implementing a new instance of SAP HR and Portal for ESS and MSS and I am not sure of all the steps that need to be completed so any guidance / tips would be greatly appreciated.
Company currently has an LDAP - but not used extensively. Not all employees currently in LDAP as not all have network ids. All employees will have a SAP account to enable ESS (via Kiosks etc).  ESS iViews in Portal will call SAP HR and possibly SAP BW.  We have an instance of SAP already and user admin maintained via CUA - this will continue.
Scenario:
My initial thoughts are that we try to use SAP HR as the leading system to drive the ESS Portal users and access.  Basically I want to create the user in SAP and assign them an ESS SAP role... then through syncronization have the user created in the Portal and have the correct ESS Portal assigned (in the Portal)
My thinking so far is to go the following way;
1) Create User Master Record in SAP (SU01)
2) Hire employee into the org structure (via HR processes)
3) Populate Infotype 0105 with SAP username
4) Populate Infortype 1016 - with SAP role to be assigned to allow ESS access (not sure about this aspect) or role could be assigned in 1) above
I am not sure of the next steps - I think there must be a way in an SAP table to map the ESS SAP role to the ESS Portal Role (is this via WP3R?)
then I am hoping that a standard job can be run (is this RSLDAPSYNC_USER) that will create the user in the Portal (UME?) and assign the correct Portal role ?
(obviously configuration needed)
For MSS and HR Power users - we would continue to assign SAP roles via SU01.
Can anyone assist with;
- Is my thinking correct in terms of how this should / could work?
- in SAP how can I map SAP Roles to Portal Roles ?
- will syncronization in SAP create the user in Portal and assign the role ? what do I need to configure?
Thanks in advance

Answer 1

Dear Michale,
I just dont know if this can throw some light on your prob.'
In our Orgn we had around 250 ess users and 200 sapr/3 users. Some of the r/3 users also logon to ess via their r/3 uname and password.
What we have done is like follows:
1. Created a role for only the ess users ZHRESS. For this i asked the HR functional people with sap_all profile to do all the job which the ESS users are supposed to do and tracer the authorization via tcode st01. We created the role on the basis of this trace report.
2. For the purely ESS users we created the users via tcode HRUSER and assigned then with the above role.
3. For the R/3 users who are supposed to avail the ess facility we assigned them with the role ZHRESS role in addition to the other roles assigned to them to carry out their normal R/3 transactions. Then we mapped their R/3 uname to their employee no via PA30 infotype 105.
4. Tcode HRUSER saved time  which would have consumed had we done it via su01 and moreover it picked Name etc data from the HR master table. In HRUSER tcode , setting the user attributes helps to define what roles the users are to be assigned, what should be their initial password etc.
Pl let me know if it satisfies you querry.
Regards