The user name that connects to Access Control must be assigned to a role that can access the SAP users.