Integrating SailPoint with SAP Commerce Cloud SaaS

Integration

This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

The SAP Commerce Cloud SaaS connector offers access management of SAP Commerce 'Employees' type users, group entitlements, and rich attribute collection as supported by SAP.

This guide is designed to give specific information about the requirements and field definitions needed to get a working instance of a source in SailPoint.

Note

This integration of the SAP Commerce Cloud SaaS connector has been built using SAP Identity Provisioning Services (IPS). The credentials used to connect to SAP Commerce Cloud are the same for SAP Identity Provisioning Services.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The SAP Commerce Cloud SaaS connector supports the following features:

Important

Before you can use any of the following items marked with an asterisk (*), SailPoint must activate the feature for your site.

Aggregation
- Account Aggregation for User Type "Employee"
- Groups Aggregation for User Group Type "Scim"
Add/Remove Entitlement (Group)
Account Provisioning
- Create User
- Update User
- Enable/Disable User
- Delete User

For more information on features, refer to Source Features.

Supported Managed System

SAP Commerce Cloud standard edition.

Prerequisites

The following set of credentials must be created to configure the IPS Proxy of the SAP Commerce Cloud SaaS connector and connect to SailPoint to allow it to handle associated identity governance use cases.
Obtain a Bundle Tenant. To get identity provisioning services, refer to Initial Setup of Bundle Tenants in the SAP Help Portal.

Configure OAuth Client for SAP Commerce Cloud SaaS

The necessary permissions are required to create the OAuth client.

Sign in to the SAP Commerce Cloud system and from the side navigation menu, go to System > OAuth tab.
Under Configured Clients, select Add a New OAuth Client. In the dialog, provide the following details:
- OAuth Client ID: Specify an ID for the OAuth client. For example: my300xxx
- OAuth authorities: Specify value as ROLE_SCIM_CLIENT.
- OAuth authorized grant types: Specify value as OAuth authorized grant types.
- Scopes: Specify value as basic and extended.
- Select Save.

Configure the Technical User in SAP Identity Provisioning Service (IPS)

To enable basic authentication, sign in to the SAP Cloud Identity Services admin console, and go to Users and Authorizations > Administrators.
Add an administrator user of the type System, and then provide the name of the user.
In Configure Authorizations, select the Access Proxy System API permission, and then Save.
Go to Configure System Authentication > Secrets > Add, and copy the Client Secret and Client ID. These are the technical user credentials that you will use to communicate with SAP Commerce Cloud.

Configure the SAP Identity Provisioning Service Proxy System

Use one of the following options to configure the proxy system. SailPoint recommends using the import file template.

Option 1 - Use the import file template

Sign in to the SAP Cloud Identity Services admin console. Go to Identity Provisioning > Proxy Settings, and select the +Add button.

Download the provided template, edit the placeholders with the appropriate property values, and save the changes.

{
  "id": "a8887106-dec8-4ffa-80e7-fc5b978838c5",
  "connectorTypeString": "SAP_COMMERCE_CLOUD",
  "accessMode": "PROXY",
  "destinationName": "",
  "gitAllowedExpressions": [],
  "gitDisallowedExpressions": [],
  "emailSubscribers": [],
  "name": "ANANDTESTNG",
  "tenantId": "avbxg9a02",
  "state": "ENABLED",
  "systemManagementType": "CUSTOMER_MANAGED",
  "properties": {
    "Authentication": "BasicAuthentication",
    "ips.trace.failed.entity.content": "false",
    "OAuth2TokenServiceURL": "https://backoffice.cpisimpxeb-sailpoint1-d1-public.model-t.cc.commerce.ondemand.com/authorizationserver/oauth/token",
    "ProxyType": "Internet",
    "Type": "HTTP",
    "URL": "https://backoffice.cpisimpxeb-sailpoint1-d1-public.model-t.cc.commerce.ondemand.com",
    "User": "anand"
  },
  "encryptedProperties": {
    "Password": null
  },
  "automaticOutboundCertificateRenew": false,
  "transformationChanged": false,
  "readTransformationChanged": true,
  "writeTransformationChanged": false,
  "fromImport": false,
  "readTransformation": {
    "user": {
      "mappings": [
        {
          "sourcePath": "$.id",
          "targetPath": "$.id",
          "targetVariable": "entityIdSourceSystem"
        },
        {
          "sourcePath": "$.userName",
          "optional": true,
          "targetPath": "$.userName"
        },
        {
          "sourceVariable": "entityBaseLocation",
          "targetPath": "$.meta.location",
          "targetVariable": "entityLocationSourceSystem",
          "functions": [
            {
              "function": "concatString",
              "suffix": "${entityIdSourceSystem}"
            }
          ]
        },
        {
          "sourcePath": "$.schemas",
          "preserveArrayWithSingleElement": true,
          "targetPath": "$.schemas"
        },
        {
          "sourcePath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']",
          "optional": true,
          "targetPath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']"
        },
        {
          "sourcePath": "$.externalId",
          "optional": true,
          "targetPath": "$.externalId"
        },
        {
          "sourcePath": "$.displayName",
          "optional": true,
          "targetPath": "$.displayName"
        },
        {
          "sourcePath": "$.nickName",
          "optional": true,
          "targetPath": "$.nickName"
        },
        {
          "sourcePath": "$.name.familyName",
          "optional": true,
          "targetPath": "$.name.familyName"
        },
        {
          "sourcePath": "$.name.middleName",
          "optional": true,
          "targetPath": "$.name.middleName"
        },
        {
          "sourcePath": "$.name.givenName",
          "optional": true,
          "targetPath": "$.name.givenName"
        },
        {
          "sourcePath": "$.name.honorificSuffix",
          "optional": true,
          "targetPath": "$.name.honorificSuffix"
        },
        {
          "sourcePath": "$.addresses",
          "preserveArrayWithSingleElement": true,
          "optional": true,
          "targetPath": "$.addresses"
        },
        {
          "sourcePath": "$.userType",
          "optional": true,
          "targetPath": "$.userType"
        },
        {
          "sourcePath": "$.active",
          "optional": true,
          "targetPath": "$.active"
        },
        {
          "sourcePath": "$.emails",
          "preserveArrayWithSingleElement": true,
          "optional": true,
          "targetPath": "$.emails"
        },
        {
          "sourcePath": "$.groups",
          "preserveArrayWithSingleElement": true,
          "optional": true,
          "targetPath": "$.groups"
        }
      ],
      "scimEntityEndpoint": "Users"
    },
    "group": {
      "mappings": [
        {
          "sourcePath": "$.id",
          "targetPath": "$.id",
          "targetVariable": "entityIdSourceSystem",
          "correlationAttribute": true
        },
        {
          "sourceVariable": "entityBaseLocation",
          "targetPath": "$.meta.location",
          "targetVariable": "entityLocationSourceSystem",
          "functions": [
            {
              "function": "concatString",
              "suffix": "${entityIdSourceSystem}"
            }
          ]
        },
        {
          "sourcePath": "$.schemas",
          "preserveArrayWithSingleElement": true,
          "targetPath": "$.schemas"
        },
        {
          "sourcePath": "$.displayName",
          "targetPath": "$.displayName"
        },
        {
          "sourcePath": "$.members",
          "preserveArrayWithSingleElement": true,
          "optional": true,
          "targetPath": "$.members"
        }
      ],
      "scimEntityEndpoint": "Groups"
    }
  },
  "writeTransformation": {
    "user": {
      "mappings": [
        {
          "sourceVariable": "entityIdTargetSystem",
          "targetPath": "$.id"
        },
        {
          "sourcePath": "$.userName",
          "targetPath": "$.userName"
        },
        {
          "sourcePath": "$.schemas",
          "preserveArrayWithSingleElement": true,
          "targetPath": "$.schemas"
        },
        {
          "sourcePath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']",
          "optional": true,
          "targetPath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']"
        },
        {
          "sourcePath": "$.externalId",
          "optional": true,
          "targetPath": "$.externalId"
        },
        {
          "sourcePath": "$.displayName",
          "optional": true,
          "targetPath": "$.displayName"
        },
        {
          "sourcePath": "$.nickName",
          "optional": true,
          "targetPath": "$.nickName"
        },
        {
          "sourcePath": "$.name.familyName",
          "optional": true,
          "targetPath": "$.name.familyName"
        },
        {
          "sourcePath": "$.name.middleName",
          "optional": true,
          "targetPath": "$.name.middleName"
        },
        {
          "sourcePath": "$.name.givenName",
          "optional": true,
          "targetPath": "$.name.givenName"
        },
        {
          "sourcePath": "$.name.honorificSuffix",
          "optional": true,
          "targetPath": "$.name.honorificSuffix"
        },
        {
          "condition": "($.addresses[*].region EMPTY false) && ($.addresses[*].country EMPTY false)",
          "sourcePath": "$.addresses",
          "preserveArrayWithSingleElement": true,
          "optional": true,
          "targetPath": "$.addresses",
          "functions": [
            {
              "type": "convertCountryRegion",
              "outputFormat": "alpha2",
              "inputAttributes": [
                "region",
                "country"
              ],
              "outputAttribute": "region"
            }
          ]
        },
        {
          "sourcePath": "$.userType",
          "optional": true,
          "targetPath": "$.userType"
        },
        {
          "sourcePath": "$.active",
          "optional": true,
          "targetPath": "$.active"
        },
        {
          "sourcePath": "$.emails",
          "preserveArrayWithSingleElement": true,
          "optional": true,
          "targetPath": "$.emails"
        },
        {
          "sourcePath": "$.groups[*].value",
          "preserveArrayWithSingleElement": true,
          "optional": true,
          "targetPath": "$.groups[?(@.value)]"
        },
        {
          "constant": "urn:ietf:params:scim:api:messages:2.0:PatchOp",
          "targetPath": "$.schemas[0]",
          "scope": "patchEntity"
        },
        {
          "sourcePath": "$.Operations",
          "preserveArrayWithSingleElement": true,
          "targetPath": "$.Operations",
          "scope": "patchEntity"
        }
      ],
      "scimEntityEndpoint": "Users"
    },
    "group": {
      "mappings": [
        {
          "sourceVariable": "entityIdTargetSystem",
          "targetPath": "$.id"
        },
        {
          "sourcePath": "$.displayName",
          "optional": true,
          "targetPath": "$.displayName"
        },
        {
          "constant": "urn:ietf:params:scim:schemas:core:2.0:User",
          "targetPath": "$.schemas[0]"
        },
        {
          "sourcePath": "$.Operations",
          "preserveArrayWithSingleElement": true,
          "targetPath": "$.Operations",
          "scope": "patchEntity"
        },
        {
          "sourcePath": "$.schemas",
          "preserveArrayWithSingleElement": true,
          "targetPath": "$.schemas",
          "scope": "patchEntity"
        },
        {
          "sourcePath": "$.members[*].value",
          "preserveArrayWithSingleElement": true,
          "optional": true,
          "targetPath": "$.members[?(@.value)]"
        }
      ],
      "scimEntityEndpoint": "Groups"
    }
  },
  "gitFetchAllowed": false
}

Select Import File, and browse to the downloaded file.

Option 2 - Use the manual process

Follow the manual process provided on SAP Help Portal.

Required Permissions

The following permissions are required for the OAuth client and Technical user (IPS):

SAP Commerce Cloud (to configure the OAuth client)
- OAuth client can be created by the system user
SAP Identity Provisioning Service (to configure technical user)
- The technical user is required to be created by the tenant administrator. Select the Access Proxy System API permission in Configure Authorizations.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.