# Integrating SailPoint with SAP Ariba SaaS > [!NOTE] > > **Integration** > > This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager. SAP Ariba is a cloud-based procurement solution that enables organizations to streamline their procurement processes. It provides a platform for buying, selling, and managing cash flow for goods and services. SAP Ariba Identity Governance is a new SailPoint SAP Cloud integration that will aggregate and provision users, roles, and groups under parent and child realms of the buyer. > [!NOTE] > > The SAP Ariba Integration has been built using SAP Identity Provisioning Services (IPS). The credentials used to connect to SAP Ariba are SAP Cloud Identity Services Technical User credentials. For more information, refer to [Required Permissions](<#required-permissions>). > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features SailPoint's SAP Ariba SaaS connector supports the following features for accounts: - Aggregation - Account - Groups > **Important** > > The SailPoint platform supports case-insensitive native identity. It may cause data overwriting in aggregated accounts if the same User ID (irrespective of upper/lower/mixed case) exists for the same type (enterprise or third party) of user. - Add/Remove Entitlement - Groups - Account Provisioning - Create User - Update User (Attributes) - Disable (Lock account in Ariba portal) - Enable (Unlock account in Ariba portal) > **Note** > > - SAP Ariba doesn’t allow updating the general information of user accounts in the Child Realms synced from Parent Realm. > - The following are the recommendations by SailPoint to avoid failures in provisioning operations: > > 1. During user creation, use the unique user name (irrespective of upper/lower/mixed case) for all types of users (enterprise or third party) to avoid data overwriting in the SailPoint platform. > 2. If a duplicate user names exist in SAP Ariba realms, you must update the user names to be unique and avoid overwriting in the SailPoint Platform. For more information on features, refer to [Source Features](). ### Privilege Classification SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements. | Privilege Level | Description | | --- | --- | | High | Administrative level access to accounts | | Medium | Administrative level access for a specific role or function | | Low | Only basic access of data | > [!NOTE] > > To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin. For more information, refer to [Managing Privilege Classification](). > [!NOTE] > > **Example** > > [![Privilege Level - High]()]() > > [![Privilege Level - Medium]()]() ## Supported Managed Systems - SAP Ariba Cloud Solutions (Buyer Module) ## Required Permissions - SAP Ariba Developer Portal (to configure the OAuth Client) - The OAuth client must be created to use Ariba APIs. It can be created by the system user using [Developer Ariba](). - The following APIs must be used by two separate OAuth clients. - SCIM API for User and Group Master Data (for Parent and all Child Realms together) - SAP Identity Provisioning Service (to configure the technical user) - The technical user is required to be created by the tenant administrator. Select the **Access Proxy System API** permission in **Configure Authorizations**. ## Prerequisites - The following set of credentials must be created to configure the IPS Proxy of SAP Ariba and connect to SailPoint to allow it to handle associated identity governance use cases. - Obtain a Bundle Tenant. To get identity provisioning services, refer to [Initial Setup of Bundle Tenants]() in the SAP Help Portal. ### Configure the OAuth Client and APIs #### OAuth Client 1. Sign in to the [SAP Ariba Developer Portal](). 2. Create an app for each relevant API. Allow 12 hours for Ariba to auto-approve API access. - SCIM API for User and Group Master Data for Parent and Child realms in a single application 3. Generate the secret key for the API. #### SCIM API for User and Group Master Data 1. Sign in to the [SAP Ariba Developer Portal](), select **Data Center**, and then select **SAP ID Service SSO**. 2. On the **Create a New Application** page, enter a user friendly **Application Name** and **Description**, then select **Submit**. > **Screenshot** > > [![Create a New Application]()]() 3. Select **Actions \> Request API Access \> SCIM API for User and Group Master Data**. > **Screenshot** > > [![Request API Access]()]() > **Note** > > SCIM API for user and group master data is not made available by SAP directly. After creating the application you must raise an SAP support case to get the API configured for Parent and Child realms in a single application. 4. Once created, go to **Actions \> Generate OAuth Secret**, and copy the OAuth Client Secret. Make note of the **OAuth Client Id**, **Application Key**, and **OAuth Client Secret**. You will enter these into the Proxy Properties to create an IPS proxy application. Next, copy the **AN-ID**, which is required for configuring the SCIM API for aggregation. This can be found in the **Realm(s) used by this Application** section. > **Screenshot** > > [![Copy Client Secret]()]() > **Note** > > In the Realms field under an application, add all the Buyers' Realms in the same configuration to enable IPS Proxy set up per realm. 5. Go to the **Discover** tab and select **Procurement \> SCIM API for User and Group Master Data**. Copy the value of the OAuth Server URL Prefix and append `v2/oauth/token` to it. The OAuth2TokenServiceURL(IPS) will be: `https://{url}/v2/oauth/token` The URL(IPS) will be: `https://{url}` > **Note** > > Don't include `api/mds/v1/prod` in the URL. Make a note of both the OAuth2TokenServiceURL and the URL to use in the IPS configuration. > **Screenshot** > > [![SCIM API]()]() ### Configure the Technical User in SAP Identity Provisioning Service (IPS) 1. To enable basic authentication, sign in to the SAP Cloud Identity Services admin console, and go to **Users and Authorizations \> Administrators**. 2. Add an administrator user of the type `System`, and then provide the name of the user. 3. In **Configure Authorizations**, select the **Access Proxy System API** permission, and then **Save**. 4. Go to **Configure System Authentication \> Secrets \> Add**, and copy the **Client Secret** and **Client ID**. These are the technical user credentials that you will use to communicate with SAP Ariba. ### Configure the SAP Identity Provisioning Service (IPS) Proxy System Use one of the following options to configure the proxy system. It is recommended to use the import file [template](). > [!NOTE] > > Create separate IPS Proxy systems for each of the Buyer Realms. These proxies are required to be used later to setup the connection for target realms. #### Option 1 - Use the import file template 1. Sign in to the SAP Cloud Identity Services admin console. Go to **Identity Provisioning \> Proxy Settings**, and select the **\+Add** button. 2. Download the provided [template](), edit the placeholders with the appropriate property values, and **Save** the changes. 3. Select **Import File**, and browse to the downloaded file. #### Option 2 - Use the manual process 1. Sign in to the SAP Cloud Identity Services admin console. Go to **Identity Provisioning \> Proxy Settings**, and select the **\+Add** button. 2. Enter the following values on the configuration details page. - Type: `SAP Ariba` - System Name: `User defined name` - Description: `User defined description` 3. Select **Save**. 4. Set the read transform to exchange data with the target system in the SCIM2 compliant format. > **Screenshot** > > [![Read Transform]()]() 1. Select **Read Transformation**, and switch to the JSON editor. 2. Select **Edit link**, and replace the transformation content with the provided [data](). 3. Select **Save**. 5. Set the write transform to exchange data with the target system in the SCIM2 compliant format. > **Screenshot** > > [![Write Transform]()]() 1. Select **Write Transformation**, and switch to the JSON editor. 2. Select **Edit link**, and replace the transformation content with the provided [data](). 3. Select **Save**. 6. Select **Properties**. It is mandatory to set properties to configure the proxy connection to target systems. > **Screenshot** > > [![Properties]()]() 7. The following table contains the properties for the SAP Ariba system. Enter the values, and then select **Save**.
Property Name Description and Value
Type Enter HTTP
URL Enter the SCIM API URL for your SAP Ariba application (refer to Configure the OAuth Client and APIs).
ProxyType Enter Internet
Authentication Enter BasicAuthentication
User Enter the OAuth Client ID (refer to Configure the OAuth Client and APIs).
Password (Credential) Enter the OAuth Client Secret (refer to Configure the OAuth Client and APIs).
OAuth2TokenServiceURL Enter the OAuth 2.0 Token Service URL (refer to Configure the OAuth Client and APIs).
ariba.applications.api.key (Credential) Enter your application key (refer to Configure the OAuth Client and APIs).
ariba.applications.realm.id Enter your AN-ID (refer to Configure the OAuth Client and APIs).
(Optional) ariba.applications.group.flatten This property allows or forbids reading nested groups (group structures) from SAP Ariba applications. If enabled (true), group members of type group will be ignored during read in order not to be provisioned to target systems that do not support nested groups. Thus, set it to false only if you are sure that the target system supports nested groups.
  • Default value: false
  • Predefined value (during system creation): true
Important: Set it to false only if you are sure that the target system supports nested groups.
ariba.applications.support.patch.operation This property is automatically added to the system. Default value: true