Hi Navin -- We got similar situation, curious to understand the solution,
We got an ugly setup to bypass this problem, backend user is segregated from ESS/MSS, meaning every user has two ID's in SAP, one for ESS/MSS for supporting portal SSO(enterprise AD ID) and other for SAP backend HR access. Users are not aware of their enterprise AD ID's existing in backend. they use only SAP backend ID's to login. Its because our SAP license gives this flexibility and some one has jus put this easy bypass solution.
I'm working to eliminate this mess now, its impacting us in all cases like GRC tools & Identity management tools especially in auto provision setup's.
I was thinking of structural restrictions with Contex objects, but it seems a lot of effort now that we got 40000 ESS users and 2500 SAP users, with a complex HR org and also I'm worried about the performance impact it will have.
Thanks,
Sridhar.