The purpose of this page is only to provide some inputs so that you can find the best approach for your upgrade from CUA-point of view. Also, but not only if your Central system resides on a Solution Manager System.
This is not a cookbook!
1. Points to consider in general
What to consider for an Upgrade of a system where a CUA central system resides…
If you run your CUA central system on a 7.1 Solution Manager System, you currently have the following limitations in comparison to a CUA central systems having SAP_BASIS 7.40 or higher:
- Salted password hashes
- Documentation tab in SU01 not available
- SAP Note 2108938 - CUA: Analysis of existing CUA landscape
- SAP Note 1902038 - CUA: Change documents for the CUA landscape
- SAP Note 2028678 - CUA: USERCLONE enhancement for user texts and DBMS user
With the Upgrade to Solution Manager 7.2 you will get the (almost) actual Basis version 7.40.
Although we (ABAP User Management) never recommended running a CUA on a Solution Manager System, there are many such installations out there. Please consider seriously to take the opportunity, to move the CUA to a system having a short Update/Upgrade interval. In case of a Solution Manager, this is not the case, because of its Update and Upgrade limitations.
E.g., the most recent SAP_Basis Release currently is 7.50 - therefore the ‘new’ Solution manager is already not up to date anymore…..
Please keep in mind, that the recommendation for the CUA central system is still (copied from help.sap.com):
“Use the most up-to-date system in your system landscape as your central system. In this way, the newest functions in CUA are available to you.”
Therefore, as soon you want to connect a 7.50 client system to your CUA, the CUA central system should be on 7.50 as well to be able to provide the actual functionality for that child system.
As consequence, we (ABAP User Management), do not recommend to run a CUA central system on a Solution Manager System !
2. Points for the Upgrade itself
For the upgrade please consider 2 possible approaches:
a) With deactivation of the CUA
b) With keeping the CUA active
Thoughts regarding option a):
- During the downtime users still can be administered direct within the (former) child systems
- The deletion of the CUA is comfortable and fast (RSDELCUA)
- The re-setup is not hard, as the technical setup/settings still exist. So only 2 steps are necessary (SCUA, SCUG)
- Possibility to move the central system to another system/client, e.g. if you took the opportunity to move to a new hardware during upgrade
Thoughts regarding option b):
- No user administration possible during downtime without further steps (meaning: local disconnecting the child system, SCUG after reconnect)
- Testing after Upgrade could be critical in case productive systems are connected
3. Steps after the technical Upgrade finished successfully
- Check SCUM: are all tabs available / filled?
- Check password parameter settings according to your requirements/security policy and landscape (see SAP Note 1300104 - CUA|new password hash procedures: Background information)
- Enabling the CUA Central system to use the most recent USERCLONE-type (supporting the new fields) you just need to update the CUA landscape once. Therefore, it is sufficient to save the landscape in SCUA.
- The old password hashes still exist afterwards. The new hashes are created only upon the first change of the existing password (‘initial’ by the administrator/’productive’ by the user). In CUA central systems where the CUA managed users mostly do not have system assignment to, the hashes will only be updated if you use the functionality to reset the users passwords to a new initial one in SU01 or SU10.
- As soon users have new hash values, it is recommended to clean up the old hashes using report CLEANUP_PASSWORD_HASH_VALUES (SAP Note 1458262 - ABAP: recommended settings for password hash algorithms)
- In case a client copy has been used, make sure all user buffers are up to date (SAP Note 2324378 - No Authorizations after client copy ) and that table USZBVSYS has still its content
SAP Note 2108938 - CUA: Analysis of existing CUA landscape
SAP Note 1902038 - CUA: Change documents for the CUA landscape
SAP Note 2028678 - CUA: USERCLONE enhancement for user texts and DBMS user
SAP Note 1300104 - CUA|new password hash procedures: Background information
SAP Note 1458262 - ABAP: recommended settings for password hash algorithms
SAP Note 2324378 - No Authorizations after client copy
SAP Note 399917 - CUA: Moving of a CUA via Client or System Copy