Skip to content

Integrating SailPoint with SAP Cloud Identity Access Governance (IAG) SaaS

Integration

This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

The SaaS integration for SAP IAG can aggregate and provision business users and entitlements for SAP IAG connected systems. SailPoint recommends using SAP Cloud Identity services along with IAG setup as a centralized user database for provisioning users and entitlements to the downstream systems.

This guide is designed to give specific information about the requirements and field definitions needed to get a working instance of a SAP IAG connector in SailPoint.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The SAP Cloud Identity Access Governance (IAG) SaaS connector supports the following features:

  • Aggregation

    • Account
    • Groups

  • Add/Remove Entitlement

    • Provisioning of Group (Add/Remove Entitlement)

    Note

    As a part of this feature capability, you can add/remove a system as an entitlement. For example, if an entitlement of "accessType":"SYS" is assigned to an account, an account will be created without an entitlement.

Note

Some connected systems within IAG tenant might require additional parameters (custom fields) for provisioning. You can use Before Provisioning Rule to provision such systems. For more information, refer to the Managing Custom Fields for Provisioning.

Note

SAP Cloud IAG has no API to enable/disable users. For more information, refer to Managing Leaver Process.

Supported Managed Systems

The connector supports the SAP IAG standard edition.

Prerequisites

  • Administrator permissions to configure SAP IAG connector.

    Steps for getting IAG subaccount details from SAP IAG managed system
    1. Go to your BTP Global account and open the relevant IAG subaccount.
    2. Go to Instances and Subscriptions and select the Instances tab.
    3. Locate the IAG instance and select the arrow icon to view details.
    4. Go to the Service Keys tab and select View from the Action menu for the relevant service key that was generated for your SAP IAG tenant.

    5. Copy the following values to configure the connector:

      • clientid
      • clientsecret
      • ARQAPI (Host URL)
      • url (Token URL)

    6. To get the IAG domain name, go to the Overview section in your IAG subaccount in the SAP BTP Cockpit and check the subdomain value.

  • Access Request configuration details required from the SAP IAG managed system.

    Steps for getting the access request reason code and access request priority from SAP IAG managed system

    Access Request Priority:

    1. Log in to your SAP IAG tenant.
    2. Go to the Administration tab.
    3. Select the Access Request Priority tile.
    4. Locate and copy the required priority ID value.

    Access Request Reason Code:

    1. Log in to your SAP IAG tenant.
    2. Go to the Administration tab.
    3. Select the Request Reason tile.
    4. Locate and copy the required reason code value.

Required Permissions

A Client ID and Client Secret from any active instance on your SAP BTP subaccount with an Identity Authentication (IAG) service subscription.

The technical name for the IAG service is grc-iag-api.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.