Issue with User Creation in AS ABAP

Question

Hi Experts,
We are implementing IDM 7.2 SP8. We have successfully performed initial load from CRM systems and also created Business Roles in CRM containing privelleges from CRM system. We can successfully assign roles from IDM to users in CRM for users loaded in IDM after initial load.
However, we are not able to create users in CRM backend system. Please find below details on the same:
Creating user from IDM UI and also assigning role:
1) We try to create user using the standard SAP Provisioning Task - "Display Identity". We maintain the user details like - first name, last name, validity etc and also the
2) We select the Business Role to be assigned to user and click on save. Workflow is triggered for the same and after approval from role owner, the correspodning tasks get executed.
3) The user gets created in IDM UI and also the desired role is assigned to user. However, no changes occur in backend CRM system.
4) Job logs and found that the job "SETABAPROLES&PROFILESFORUSER"(from standard sap framework) fails with error -
putNextEntry failed storing
Exception from Modify operation:com.sap.idm.ic.ToPassException: User 1 does not exist
Creating User from IDM UI without assigning any role:
1) We create a user using "Create Identity Task", maintain the attribute "ACCOUNT<repository name>" for the user, maintain the validity dates and click on save.
2) User is created in IDM UI but nothing happens in backend CRM system.
I followed thread 3331868 and understand that "Account Privilege PRIV:<Repository>:ONLY" should be assigned to user for creation in backend system. However, i am not able to find the privellege in IDM UI for assignment while user creation.
Kindly help me with steps on how to assign this privelege while creation of new user in IDM UI so that user can be created in backend system.
Thanks and regards,
Nitin

Answer 1

The repository:ONLY privilege should be created when you do the initial load if you use one of the SAP templates.  If not, you can manually create it.
On the repository, set the master privilege to be SAP:repository:ONLY (note, it can be anything but changing it would make life hard for anyone following you).
Create a task called 'Assign Master Privilege' which has:
MSKEYVALUE     %mskeyvalue%
MXREF_MX_PRIVILEGE  PRIV:$rep.$Name:ONLY
Ensure that the repository is set to 'inherited'
Assign your new task as the 'No Master Task' on all repositories.
When a user gets a privilege in a back end system, it will check to see if they have an 'ONLY' priv for that repository.  If not, it triggers the 'No Master Task' which assigns it and then it will assign the backend privilege.
Peter