With the roles created for active employees and the finance clerk, you can use the Role Mapping Administrator to map the corresponding roles from SAP to these role. For instructions, see Section 3.0, Managing Roles.
With the mapping in place when a user object is created and the employStatus attribute equals Active, the user is provisioned to the SAP Portal environment the SAP client that contains the finance application. When users log into the User Application, they can request access to the SAP Portal and it is automatically granted. They can also request access to the finance group. The manager receives notification of this request and either grants or denies the request.