Integrating SailPoint with SAP GRC

• The SAP GRC integration now supports provisioning and deprovisioning of Fire Fighter IDs (FFID) as user entitlements in SAP GRC.

This integration is used to leverage SAP GRC's ability to perform SOD (Separation of Duties) checks and take remediation or mitigation decisions within the SAP GRC. The mitigation decision must be taken in SAP GRC so that SAP GRC is aware of the mitigation controls, which are applied on risks, and would not report these risks until the time mitigation is applicable.

The SAP GRC connector enables checking for risk in the request placed in IdentityIQ (containing SAP Direct Roles and Profiles) using the following method:

1. Request is sent to SAP GRC for proactive check.

2. ARA Web Service checks for risk present in the request, if no risk is returned then IdentityIQ continues provisioning the request.

3. If ARA Web Service returns a risk in the request, then a corresponding request is created in SAP GRC using the ARM Web Service.

4. IdentityIQ continues polling the request until a response issued by SAP GRC.

5. On the basis of the response returned in the previous step (approval or rejection by SAP GRC), IdentityIQ continues with provisioning or rejects the request.

This integration is used to aggregate all the Users and Roles from the systems (SAP SCM, JAVA, SAP ERP HCM, and so on) connected to SAP GRC and facilitates their provisioning by creating requests in GRC irrespective if there is risk present or not, as illustrated in the following figure:

The figure explains the following methods:

1. User Aggregated from the GRC connected system.

2. Roles Aggregated from the GRC connected system.

3. Request sent for adding or removing access to the connected system.

4. Access Request ID created in GRC.

5. Requests wait and are queued until a response is issued by SAP GRC.

6. On the basis of the response returned from SAP GRC (approval or rejection in GRC ), SAP GRC provisions or rejects the request and the corresponding status is maintained in the SAP GRC source.

The Risk Management Integration performs risk analysis which helps to find whether the requested access has violations on IdentityIQ. When a Risk Management mode is selected, only the Access Risk Analysis (ARA) module is required as compared to the Risk Analysis mode, where both the Access Risk Analysis(ARA) and the Access Request Management (ARM) modules were required. In the Access Risk Analysis and Access Request Management modules integration, when the end user requests access from IdentityIQ the request goes though IdentityIQ approvals. Once it is approved on the IdentityIQ side, it goes to SAP GRC for a risk analysis check. If a violation is shown, the integration creates a request in the SAP GRC ARM for further processing. If no risk is found, the request goes ahead for provisioning the access. In the Risk Management Integration, whenever a new access request is raised it goes to the SAP GRC ARA module for risk analysis. If the requested access has any violations, a policy violation message is raised on IdentityIQ before creating the access request ticket in IdentityIQ . The requester will receive an option to remove risky entitlements, and the approver can also view the violations before approving or denying the access.

Note
SAP GRC IAG Bridge is an additional optional feature provided in the existing SailPoint SAP GRC connector. An existing SailPoint SAP GRC connector set up is a prerequisite for this feature.

SAP GRC IAG Bridge is an additional setup on top of an existing SAP Access Control (GRC) on-premise solution, which communicates with SAP Cloud Identity Access Governance (IAG). This feature extends access governance functionality to cloud systems in a hybrid landscape.

IAG Bridge is a SAP suggested approach for the customers who have invested heavily in SAP GRC access control, but now want to provide support for cloud applications as well. This configuration helps to perform risk analysis of user requests in IAG for connected SAP cloud systems using the SAP GRC system as a bridge.

The major benefit for this integration is that the source of truth for access requests and risk analysis remains to be SAP GRC, and IAG acts as secondary system to communicate with cloud applications. Separate licenses must be procured from SAP for both GRC and IAG systems to use this feature.