# SailPoint SAP BTP Cockpit Cloud Foundry SaaS Connector Documentation > SAP BTP Cockpit Cloud Foundry SaaS Connector Documentation # Documentation # Connecting SailPoint and SAP BTP Cockpit Cloud Foundry SaaS To connect SailPoint with SAP BTP, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. > [!IMPORTANT] > > By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration. **To configure a new source:** 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Actions**. 5. In the **Actions** dropdown list, select the setup method: - [**Express Setup**](<#configuring-a-source-using-express-setup>) - Quickly create a read-only connection to your target system by providing minimal configurations and authentication. On completion, aggregation is automatically started. > **Note** > > Express Setup supports Credential Providers. For information on supported credential providers and configuration, refer to [Credential Providers](). For more information, contact your SailPoint Customer Service Manager. - [**Standard Setup**](<#configuring-a-source-using-standard-setup>) - Provide detailed basic configuration to create the source. Once the source is created, continue with source setup. ### Configuring a Source Using Express Setup Express Setup minimizes the initial configuration process so you can quickly connect the application and immediately begin aggregating user account and entitlement data. 1. Review the directions and select **Start Express Setup**. 2. Review the pre-populated **Source Name**, **Source Owner**, and **Description**. To update, select **Edit**. > **Note** > > The source name must be unique. You can change these settings later in the source configuration. 3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 4. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** section. 5. Select **Finish**. After a successful test connection, the system creates your source and prompts you to run an aggregation. - If you want to aggregate now, select **Aggregate**. - To see the latest account aggregation history, go to **Account Management \> Account Aggregation**. - To see the list of aggregated source accounts, go to **Account Management \> Accounts**. - If you want to aggregate later, select **Exit**. This returns you to the **Sources** page. Your new source is listed, but contains no accounts or aggregation history yet. ### Configuring a Source Using Standard Setup Use Standard Setup to configure the connector for full feature support. 1. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 2. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 3. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 4. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 5. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 6. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 4. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 5. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 6. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 7. Select **Save**. ## Connection Settings To configure SAP BTP Cockpit Cloud Foundry SaaS, complete the following: > [!NOTE] > > **Screenshot** > > [![Connection Settings]()]() 1. Select the **Account Type** with the desired BTP layer for identity management. For example, `Global Account` / `Directory` / `Subaccount`. 2. Enter the host URL (API URL) of the SAP BTP Cockpit in the **Host URL**. 3. Enter the **Token URL** depending on the selected account type in Step-1 . 4. By default, **Authentication Type** is `Oauth2.0` and the **Grant Type** is `Client Credentials`. 5. Enter the **Client ID** depending on selected account type in Step-1 for authentication. 6. Enter the **Client Secret** depending on selected account type in Step-1 for authentication. 7. Select **Save**. > [!NOTE] > > For more information on creating credentials for the targeted layer of the SAP BTP managed system, refer to [Prerequisites](). ### Manage Cloud Foundry Organization & Spaces for Platform Users > [!NOTE] > > For proper entitlement mapping and provisioning of platform users in organizations and spaces, ensure that the Cloud Foundry Organization details are correctly mapped to the associated Subaccount. To configure organization & spaces for platform users, ensure the **Account Type** is selected as Subaccount. And then, complete the following: > [!NOTE] > > **Screenshot** > > [![Orgs and Spaces Settings]()]() 1. Enable the **Manage Org and Spaces for Platform Users** to configure additional details. 2. Enter the host URL (API URL) of the Cloud Foundry Org in **Cloud Foundry Host URL**. 3. Enter the User Account and Authentication (UAA) Token URL for the selected Cloud Foundry Org in **UAA Token URL**. The UAA Token URL is used to obtain authentication tokens required for accessing the Cloud Foundry API. 4. Enter the name of the Cloud Foundry Org associated with the correct Subaccount in **Org Name**. This name should match the actual Org name in the Cloud Foundry environment. 5. Enter the ID of the Cloud Foundry Org associated with the correct Subaccount in **Org ID**. The Org ID is used to establish the connection between the Subaccount and the corresponding Cloud Foundry Org. 6. Select the **Authentication Type** to authenticate Cloud Foundry REST APIs. The default authentication type is Oauth2.0. 7. Select the **Grant Type** to authenticate Cloud Foundry REST APIs. The default grant type is password. 8. Enter the **Username** of the S-user with the necessary permissions to manage organizations and spaces. This user should have the required roles and privileges to perform the desired actions within the Cloud Foundry environment. For more information, refer to [Required Permissions](). 9. Enter the **Password** of the S-user with the necessary permissions to manage organizations and spaces. 10. Select **Save**. ## Aggregation Settings Provide the following settings requirement for aggregation: For more information about aggregation, refer to [Loading Account Data](). ### Page Size Settings > [!NOTE] > > **Screenshot** > > [![Aggregation Settings]()]() 1. Enter the number of records in the **Page Size** to aggregate in a single page when iterating over large datasets. You can set it from 10 to 500. The default is 100 records. 2. Select **Save**. ### Filter Settings > [!NOTE] > > **Screenshot** > > [![Filter Settings]()]() 1. Enter the query expressions for filtering users based on status or parameters before they are aggregated in SailPoint. For example, `userName sw "A" or active eq true` > **Note** > > For multiple and complex query expression, you can use `AND` and `OR`. 2. Select **Save**. > [!NOTE] > > **List of Supported Operators for Filtering Users** > > | Supported Operator | Definition | > | --- | --- | > | eq | Equal to | > | co | Contains | > | ge | Greater than or equal | > | sw | Starts with | > | gt | Greater than | > | pr | Present or has a value | > | le | Less than or equal | > | lt | Less than | > | and | Returns a match only if both expressions evaluate to true | > | or | Returns a match if either expression evaluates to true | For more information on supported user search attributes, refer to [User Search Attributes](<#user-search-attributes>). ### User Search Attributes The following lists the supported user search attributes: - id - userName - active - verified > **Note** > > The operators like `co` and `sw` are not supported for the `verified` attribute. - origin - familyName - givenName > [!NOTE] > > Above listed attributes are supported by default for filtering users. In addition to these attributes, SAP supports filtering on other attributes when they are added to the account schema in SailPoint. For more details on these additional attributes and their implementation, reach out to SAP support. ## Provisioning Settings > [!NOTE] > > **Screenshot** > > [![Provisioning Settings]()]() 1. Select **Delete Org and Space Users during Update** to delete users from the associated Cloud Foundry Organization and Space if their last entitlement is revoked during an update operation. This ensures that users who no longer have any entitlements are automatically removed from the respective Org and Space. 2. Select **Save**. > [!CAUTION] > > Selecting this setting will result in the automatic deletion of users from the Cloud Foundry Organization and Space based on their entitlement changes. Ensure that this behavior aligns with your organization's policies and requirements for user management. ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation. # Frequently Asked Questions This Frequently Asked Questions (FAQs) section provides answers to the most commonly asked questions for ServiceNow Catalog for SailPoint. ## Why BTP user creation fails when selecting Org and Space entitlements with an unsupported origin for platform users? **Answer**: Platform users need a specific user origin (like sap.default or ending with -platform) to be valid for platform access. If an entitlement has an unsupported origin, the system can't create the user as it doesn't recognize the source as a valid platform access origin. ## When creating a platform user using an external identity provider and selecting only Org and Space entitlements, why is the user also created in the Subaccount? **Answer**: Even though only Org and Space entitlements are selected, the user must exist in the Subaccount to be linked to these entitlements. This ensures proper identity and permission management. ## Why cannot the last Org or Space role be removed directly without explicit confirmation? **Answer**: Removing the last Org or Space role would revoke the user's membership, potentially resulting in their removal from the respective Org or Space. To prevent unintentional deletion, the system requires explicit confirmation before proceeding with this action. # Integrating SailPoint with SAP BTP Cockpit Cloud Foundry SaaS > [!NOTE] > > **Integration** > > This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager. The SailPoint integration for the SAP BTP Cockpit Cloud Foundry SaaS connector enhances security and compliance for SAP BTP applications and services. It achieves this by effectively managing user access and entitlements across BTP Global Account, Directories, and Subaccounts. It also provides the ability to view and manage platform users and their associated entitlements across various levels of the platform hierarchy, including subaccounts, organizations, and spaces. This document is designed to give specific information about the requirements and field definitions needed to get a working instance of a SAP BTP Cockpit Cloud Foundry SaaS connector. > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features In SAP BTP Cloud Foundry environment, an organization user must be created with a single org role only. If additional org roles needs to be assigned then this can be achieved using the update operation. > [!NOTE] > > The **Organisation\_user** role is mandatory to provision Cloud Foundry spaces. The SAP BTP Cockpit Cloud Foundry SaaS connector supports the following features: **Aggregation** - Account - Groups (Role Collections, Cloud Foundry Entitlements(Org & Spaces Roles)) > **Important** > > The connector aggregates only platform users (Cloud Foundry Orgs and Spaces) who are members of both the SAP BTP Subaccount and the corresponding Cloud Foundry Org/Space. **Account Provisioning** - Create User - Update User (Attributes & Entitlements) - Enable/Disable User > **Important** > > During entitlement updates of Cloud Foundry Orgs and Spaces, the connector uses the latest Org/Space data to prevent unintentional user deletions. User deletions are blocked unless explicitly allowed by you in the provisioning settings. For more information, refer to [Provisioning Settings](). - Delete User > [!NOTE] > > - Updates for `tenant ID` & `origin` are not supported by SAP. > - In aggregated Role Collections, the indirectly or dynamically mapped entitlements from the SAP Indentity Directory with `'ondemand.com'` or `'sap.com'` domains are displayed as `'/SAP Identity Directory ()'`. ## Privilege Classification SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements. | Privilege Level | Description | | --- | --- | | High | Administrative level access to accounts | | Medium | Administrative level access for a specific role or function | | Low | Only basic access of data | > [!NOTE] > > To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin. For more information, refer to [Managing Privilege Classification](). ## Supported Managed Systems The SAP BTP Cockpit Cloud Foundry SaaS connector facilitates governance of platform and business (application) accounts across the following layers: - Global Account - Directory - Subaccount - Cloud Foundry Organization (Platform Users only) - Cloud Foundry Spaces (Platform Users only) ## Prerequisites The following are the prerequisites to use the SailPoint SAP BTP Cockpit Cloud Foundry SaaS connector for the desired BTP license types: > [!NOTE] > > The S-User associated with the SAP BTP Global account (with required permissions) should create credentials for individual target layers (Global account/ Directory/ Subaccounts) for further governance operations. For more information, refer to [Required Permissions](<#required-permissions>). SailPoint supports identity governance for SAP BTP Cockpit using the XSUAA service of Cloud Foundry. To access the XSUAA API service, you can choose one of the following methods: - Using BTP command line interface (CLI) (applicable for Global account/ Directories/ Subaccounts) - Using BTP user-interface (UI) (applicable for Subaccounts only) > [!NOTE] > > **Steps for creating credentials using BTP CLI for the targeted BTP account** > > 1. Download BTP CLI from [here](), and extract the client file from the downloaded archive. > 2. Copy the client executable from the unpacked folder to the designated directory as shown below: > > - For Linux: `/usr/local/bin` > - For macOS: `/usr/local/bin` > - For Windows: `C:/Users/` > 3. Log in to the global account from a browser with S-User, who has Global Account Administrator Role collection entitlement. > > > **Important** > > > > Ensure you clear the browser cache before logging in to avoid incorrect SSO login issues caused by a previous session with another user. > 4. Run the command in the terminal using the sequence below: > > 1. Log in to BTP CLI via SSO using: > > `btp login --sso` > 2. The above command prompts for the following inputs: > > `CLI server URL [https://cli.btp.cloud.sap]>` > > Make sure to enter `https://cli.btp.cloud.sap` string as a CLI server URL input. This should open a new browser tab for SSO approval. > > Select Yes to log in to SAP BTP. > > [![SAP BTP login page]()]() > > After approval, you may be prompted to select a global account from multiple options. Select the appropriate global account. > 3. Create credentials using the following command: > > `btp create security/api-credential --name ` > > Use a name `` that can serve as user-friendly identifier to store the credentials - `Client ID`, `Client Secret`, `Token URL`, and `API URL`. These credentials are necessary for configuring the SailPoint source with the targeted BTP layer. > > Steps for creating credentials for any targeted layer (Global account/ Directory/ Subaccount) within the BTP Cockpit is as follows: > > 1. Open CLI. > 2. Use the following command to change the target layer: > > `btp target` > > 1. Select the appropriate options to choose your desired target layer. For example, you can select '…' to switch to the global account. > > [![BTP layer choice]()]() > 3. Once the target is changed, create new credentials using the command mentioned in previous step. > [!NOTE] > > **Steps for creating credentials using BTP subaccount UI for the targeted BTP account** > > 1. Log in to BTP Cockpit and go to the desired subaccount: > > 1. Log in to the SAP Business Technology Platform (BTP) Cockpit. > 2. Go to the subaccount (with 'Subaccount Administrator' rights) for which you want to manage identities. > 2. Create the authorization and trust management service: > > 1. In the left navigation pane, go to **Services** and search for **Authorization and Trust Management Service**. > 2. Select **Create** to create a service with the following settings: > > - **Plan**: `apiaccess` > - **Runtime Environment**: `Cloud Foundry` > - **Space**: `ABAP_space (or your desired space)` > - **Instance Name**: `` > 3. Select **Next**. > 3. Configure **Service Parameters**. On the Parameters screen, select **Next**. > 4. Review and Confirm page: > > 1. On the Review screen, select **Create**. > > > **Note** > > > > Ensure that under the **Instances & Subscriptions** tab, the **Authorization and Trust Management Service** is listed. > 5. Create a Service Key: > > 1. Select the ellipses(...) next to the listed service. > 2. Select **Create Service Key**. > 3. Enter an appropriate **Service Key Name** and select **Create** to create a new service key. > 6. Retrieve Credentials: > > 1. Once the service key is created, select the ellipses (...) again. > 2. Select either **View** or **Download** to retrieve the following credentials: > > - Client ID > - Client Secret > - Token URL > - API URL > > These credentials are necessary for configuring the SailPoint source with the targeted BTP layer. > > > **Note** > > > > Here, the `url` corresponds to the `Token URL`, and `apiurl` corresponds to the `API URL`. > [!IMPORTANT] > > The individual set of credentials generated using either of the methods mentioned above applies to each SailPoint BTP Cockpit Cloud Foundry connector. The mapping of these credentials for setting up the connection is as follows: > > - `Token URL` corresponds to the `Token URL`. > - `API URL` corresponds to the `Host URL`. > - `Client ID` corresponds to the `Client ID`. > - `Client Secret` corresponds to the `Client Secret`. ## Required Permissions To use the SAP BTP command line interface (CLI) or user-interface (UI) to create credentials for the SAP BTP Cockpit Cloud Foundry SaaS, the S-user account must have the following permissions: - The S-user account must be associated with the SAP BTP global account. - The S-user must be entitled with the "Global Account Administrator" role collection. To manage Cloud Foundry organizations and spaces using the Cloud Foundry V3 APIs, the S-user account must have the following roles in addition to the permissions mentioned earlier: - Subaccount Administrator - Organization Manager - Space Manager # Machine Account Attributes Machine account attributes are used in provisioning configurations for machine accounts. After you have [created the required machine account subtypes](), you can use the machine account attributes to provision machine accounts in your SailPoint tenant. Refer to [Machine Identity Security Overview]() for more information. ## Machine Account Provisioning Attributes # Provisioning The SAP BTP Cockpit Cloud Foundry SaaS connector supports provisioning, allowing you to create and manage accounts and entitlements in SAP BTP directly from SailPoint. **Prerequisite:** Your system is configured for provisioning. When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*. When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment. For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account. > [!IMPORTANT] > > This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail. > [!IMPORTANT] > > Account attributes marked with an asterisk(\*) are mandatory attributes for account creation. ## Default Create Account Attributes | Account Attribute | Type | Generator | Description | | --- | --- | --- | --- | | \*User Name | String | Identity Attribute - Username | The user's username | | \*First Name | String | Identity Attribute - Given Name | The user's first name | | \*Last Name | String | Identity Attribute - Family Name | The user's last name | | \*Email | String | Identity Attribute - Work Email | The user's email address | | \*Origin | String | Identity Attribute - origin | The user's identity provider origin key (from Trust Configuration) | | Tenant ID | String | Identity Attribute - zoneId | The user's Tenant (zone) ID | # Schema Reference The application schema is used to configure the objects returned from a connector. > [!NOTE] > > - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas]() for more information. > - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified. The SAP BTP Cockpit Cloud Foundry SaaS connector uses the following default correlation and object configurations. ## Default Correlation Configuration Before you aggregate accounts from this source, you can map account attributes with their corresponding identity attributes based on your requirements. You can customize the correlation configuration. Refer to [Assigning Source Accounts to Identities]() for more information. When you first create the SAP BTP Cockpit Cloud Foundry SaaS source, the default correlation mapping is: | Account Attribute | Operation | Identity Attribute | | --- | --- | --- | | ID | Equals | Username | | Email | Equals | Work Email | ## Default Account Schema Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location. The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas]() for more information. ### Default Account ID SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*. > [!CAUTION] > > Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts. > > To resolve issues caused by changing account IDs, reconfigure them to their default values. The following table lists the default account IDs for this connector: | Account ID | Schema Object Type | | --- | --- | | ID | Account | | ID | Group | ### Default Account Attributes The SAP BTP Cockpit Cloud Foundry SaaS connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified. | Attribute Name | Description | | --- | --- | | ID | A unique identifier for the user. | | User Name | The user's login name or user name. | | First Name | The user's first name. | | Last Name | The user's last name. | | Email | The user's email address. | | Verified | The user's email verification status. | | Origin | The user's identity provider origin key (from Trust Configuration). | | Active | The user's active status. | | Tenant ID | The user's tenant (zone) ID. | | Version | The user's record version. | | Created On | The user's record creation date and time. | | Last Updated | The user's record last modified date and time. | ## Default Entitlement Attributes Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements]() for more information. > [!CAUTION] > > Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations. ### Default Group Attributes The SAP BTP Cockpit Cloud Foundry SaaS connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups. | Attribute Name | Description | | --- | --- | | ID | A unique identifier for role collection. This is an Entitlement ID which must not be changed. | | Display Name | The name of the role collection, suitable for display. | | Description | The description of the role collection. | | Members | The count of user membership. | | Role Reference | The list of roles associated to the role collection. | | Mapped Entitlements | The entitlement from external sources mapped with the role collection. | ### Cloud Foundry Entitlement Attributes | Attribute Name | Description | | --- | --- | | ID | The native ID of the Org or Space role. | | Cloud Foundry Role Name | The display name of Org/Space role. | | Cloud Foundry Object GUID | The globally unique identifier (GUID) of the Org or Space this role belongs to. | | Cloud Foundry Object Name | Name of the parent Org or Space. | ## Machine Account Attributes Machine account attributes are used in provisioning configurations for machine accounts. After you have [created the required machine account subtypes](), you can use the machine account attributes to provision machine accounts in your SailPoint tenant. Refer to [Machine Identity Security Overview]() for more information. # Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Debug Logs For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](). ## 404 error during test connection The following error message appears during test connection: `[ ConnectorException ] [ Error details ] Error while performing operation : Test Connection Error code : 404 .....` **Resolution**: Ensure to enter the the correct BTP Host URL in the [Connection Settings](). ## Exception while generating access token The following error message appears when incorrect access token is entered: `[ ConnectorException ] [ Error details ] Exception occurred while generating access token: Unable to generate access token. ........` **Resolution**: Ensure to enter the correct SAP BTP Token URL, Client ID & Client Secret in [Connection Settings](). > [!NOTE] > > - If response returned is 302 , that implies Token URL is incorrect. > - If response returned is `{"error":"invalid_client","error_description":"Bad credentials"}`, that implies the Client ID & Client Secret are incorrect. ## Resource not found during read, update, enable or disable operation The following error message appears when the resource is not found during read, update, enable or disable operation: `[ ConnectorException ] [ Error details ] {"error_description":"User xxxxx does not exist","error":"scim_resource_not_found.......` **Resolution**: Perform account aggregation first, and then attempt the desired operation. This issue may occur if the identity deleted from the managed system is not synced with SailPoint. ## Illegal State Exception while performing aggregation The following Illegal State Exception error message appears during aggregation: ```text java.lang.RuntimeException - java.lang.IllegalStateException: [ConnectorError] {ExceptionType=java.lang.RuntimeException, LocalizedMessage=agg failed} (requestId: xxxxxx) - java.lang.RuntimeException: java.lang.IllegalStateException: [ConnectorError] {ExceptionType=java.lang.RuntimeException, LocalizedMessage=agg failed} ``` **Resolution**: Ensure to enter the correct Host URL and Token URL in [Connection Settings](). ## SSL Handshake Exception while performing Org & Spaces operation The following SSLHandshakeException error message appears during Org & Spaces operation: `javax.net.ssl.SSLHandshakeException: Received fatal alert: unrecognized_name` **Resolution**: Ensure the Cloud Foundry Host and Token URLs are correct. ## Class cast exception while updating Org & Space entitlements The following error message appears while updating Org & Space entitlements: `Exception occurred while validating update request: Source JSON is not a Map. class java.lang.String cannot be cast to class java.util.Map (java.lang.String and java.util.Map are in module java.base of loader 'bootstrap')` **Resolution**: Ensure the native ID for the Org/Space entitlement is accurate and associated with the correct organization or space. ## Exception occurred while generating access token The following error message appears while generating access token: `Unable to generate access token. Response returned: {"error":"invalid_client","error_description":"{\"error\":\"invalid_grant\",\"error_description\":\"User authentication failed.\"}"}` **Resolution**: Ensure the service user credentials are valid and the user has all required permissions for this operation.