E-Recruiting Security Landscape (Different Clients)

Question

Hi,
Our customer is discussing about E-Recruiting Security Landscape and now they are asking me if we can have the following landscape: One ERP having one client for HCM and another one for E-Recruiting.
They are asking me this because the application (we still don't know if will be the BSP or WDA)will be on the internet and they don't like the idea to have the ERP client (on the background) on the internet.
As far as I know we have just these scenarios to implement:
- E-Recruiting integrated with the ERP
- E-Recruiting and ERP with separated servers exchanging data trough ALE
- E-Recruiting integrated with the ERP but with the frontend for the External Candidate on a different server.
Here we are on ERP 6.0 and Enhancement Package 4.
I think that the customer scenario isnt't supported.
Also, has anyone used the scenario with the frontend for the External candidate(Constellation III with WDA) separated from the E-Recruiting system?
Thanks,
Daniel Kiel
HCM Consultant

Answer 1

Hello Daniel,
the two server scenario using a frontend server as a kind of additional proxy is a quite common, if you use web dynpro for candidates. Even for the standalone installations where e-recruiting is not on the hr server it is used very often due to security issues.
As said before I only know one e-recruiting 600 integrated installation which i rolled out on my own. The customer also uses the frontend server. I still would not recommend the integrated solution although it brings a lot of possibilities for contacs with the walldorf guys ;o).
For EhP4 it is a documented way to setup a sap e-recruiting standalone system on an ERP installation (erp installed but just e-recruiting run). This scenario is called I2B. It should be possible to implement it on a server which runs HR in another client but just as it might be possible it does not mean it is a good idea. I bet I could even run a standalone like e-recruiting setting within the HR server itself with EhP4 by using some kind of self ALE with broad renumbering of objects - my server admin just refuses to give me a server to prove it.
Even if you use another client the server is still open to the internet. Most security teams will not care that it is another client as it is the same server. Already the standalone installation is too open for some of my customers. As it uses some direct pull accesses to the hr server in standard. As this is a call from a less secure to a more secure network region this is a no go for some of them. One had all of these pull functions changed to a push system where HR server sends the information to e-recruiting otherwise security had not allowed the system. Bringing the HR server anywhere near Internet is completely out of imagination.
Best Regrads
Roman
Best regards
Roman