# Integrating SailPoint with SAP Commerce Cloud SaaS

> [!NOTE]
>
> **Integration**
>
> This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

The SAP Commerce Cloud SaaS connector offers access management of SAP Commerce 'Employees' type users, group entitlements, and rich attribute collection as supported by SAP.

This guide is designed to give specific information about the requirements and field definitions needed to get a working instance of a source in SailPoint.

> [!NOTE]
>
> This integration of the SAP Commerce Cloud SaaS connector has been built using SAP Identity Provisioning Services (IPS). The credentials used to connect to SAP Commerce Cloud are the same for SAP Identity Provisioning Services.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The SAP Commerce Cloud SaaS connector supports the following features:

> [!IMPORTANT]
>
> Before you can use any of the following items marked with an asterisk (\*), SailPoint must activate the feature for your site.

- Aggregation

  - Account Aggregation for User Type "Employee"
  - Groups Aggregation for User Group Type "Scim"
- Add/Remove Entitlement (Group)
- Account Provisioning

  - Create User
  - Update User
  - Enable/Disable User
  - Delete User

For more information on features, refer to [Source Features](<https://community.sailpoint.com/knowledge/Identity-Security-Cloud-Source-Features>).

## Supported Managed System

- SAP Commerce Cloud standard edition.

## Prerequisites

- The following set of credentials must be created to configure the IPS Proxy of the SAP Commerce Cloud SaaS connector and connect to SailPoint to allow it to handle associated identity governance use cases.
- Obtain a Bundle Tenant. To get identity provisioning services, refer to [Initial Setup of Bundle Tenants](<https://help.sap.com/docs/identity-provisioning/identity-provisioning/initial-setup-of-bundle-tenants>) in the SAP Help Portal.

### Configure OAuth Client for SAP Commerce Cloud SaaS

The necessary permissions are required to create the OAuth client.

1. Sign in to the SAP Commerce Cloud system and from the side navigation menu, go to **System \> OAuth** tab.
2. Under **Configured Clients**, select **Add a New OAuth Client**. In the dialog, provide the following details:

   - **OAuth Client ID**: Specify an ID for the OAuth client. For example: `my300xxx`
   - **OAuth authorities**: Specify value as `ROLE_SCIM_CLIENT`.
   - **OAuth authorized grant types**: Specify value as `OAuth authorized grant types`.
   - **Scopes**: Specify value as basic and extended.
   - Select **Save**.

### Configure the Technical User in SAP Identity Provisioning Service (IPS)

1. To enable basic authentication, sign in to the SAP Cloud Identity Services admin console, and go to **Users and Authorizations \> Administrators**.
2. Add an administrator user of the type `System`, and then provide the name of the user.
3. In **Configure Authorizations**, select the **Access Proxy System API** permission, and then **Save**.
4. Go to **Configure System Authentication \> Secrets \> Add**, and copy the **Client Secret** and **Client ID**. These are the technical user credentials that you will use to communicate with SAP Commerce Cloud.

### Configure the SAP Identity Provisioning Service Proxy System

Use one of the following options to configure the proxy system. SailPoint recommends using the import file template.

> [!NOTE]
>
> **Option 1 - Use the import file template**
>
> 1. Sign in to the SAP Cloud Identity Services admin console. Go to **Identity Provisioning \> Proxy Settings**, and select the **\+Add** button.
> 2. Download the provided template, edit the placeholders with the appropriate property values, and save the changes.
>
>    ```json
>    {
>      "id": "a8887106-dec8-4ffa-80e7-fc5b978838c5",
>      "connectorTypeString": "SAP_COMMERCE_CLOUD",
>      "accessMode": "PROXY",
>      "destinationName": "",
>      "gitAllowedExpressions": [],
>      "gitDisallowedExpressions": [],
>      "emailSubscribers": [],
>      "name": "ANANDTESTNG",
>      "tenantId": "avbxg9a02",
>      "state": "ENABLED",
>      "systemManagementType": "CUSTOMER_MANAGED",
>      "properties": {
>        "Authentication": "BasicAuthentication",
>        "ips.trace.failed.entity.content": "false",
>        "OAuth2TokenServiceURL": "https://backoffice.cpisimpxeb-sailpoint1-d1-public.model-t.cc.commerce.ondemand.com/authorizationserver/oauth/token",
>        "ProxyType": "Internet",
>        "Type": "HTTP",
>        "URL": "https://backoffice.cpisimpxeb-sailpoint1-d1-public.model-t.cc.commerce.ondemand.com",
>        "User": "anand"
>      },
>      "encryptedProperties": {
>        "Password": null
>      },
>      "automaticOutboundCertificateRenew": false,
>      "transformationChanged": false,
>      "readTransformationChanged": true,
>      "writeTransformationChanged": false,
>      "fromImport": false,
>      "readTransformation": {
>        "user": {
>          "mappings": [
>            {
>              "sourcePath": "$.id",
>              "targetPath": "$.id",
>              "targetVariable": "entityIdSourceSystem"
>            },
>            {
>              "sourcePath": "$.userName",
>              "optional": true,
>              "targetPath": "$.userName"
>            },
>            {
>              "sourceVariable": "entityBaseLocation",
>              "targetPath": "$.meta.location",
>              "targetVariable": "entityLocationSourceSystem",
>              "functions": [
>                {
>                  "function": "concatString",
>                  "suffix": "${entityIdSourceSystem}"
>                }
>              ]
>            },
>            {
>              "sourcePath": "$.schemas",
>              "preserveArrayWithSingleElement": true,
>              "targetPath": "$.schemas"
>            },
>            {
>              "sourcePath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']",
>              "optional": true,
>              "targetPath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']"
>            },
>            {
>              "sourcePath": "$.externalId",
>              "optional": true,
>              "targetPath": "$.externalId"
>            },
>            {
>              "sourcePath": "$.displayName",
>              "optional": true,
>              "targetPath": "$.displayName"
>            },
>            {
>              "sourcePath": "$.nickName",
>              "optional": true,
>              "targetPath": "$.nickName"
>            },
>            {
>              "sourcePath": "$.name.familyName",
>              "optional": true,
>              "targetPath": "$.name.familyName"
>            },
>            {
>              "sourcePath": "$.name.middleName",
>              "optional": true,
>              "targetPath": "$.name.middleName"
>            },
>            {
>              "sourcePath": "$.name.givenName",
>              "optional": true,
>              "targetPath": "$.name.givenName"
>            },
>            {
>              "sourcePath": "$.name.honorificSuffix",
>              "optional": true,
>              "targetPath": "$.name.honorificSuffix"
>            },
>            {
>              "sourcePath": "$.addresses",
>              "preserveArrayWithSingleElement": true,
>              "optional": true,
>              "targetPath": "$.addresses"
>            },
>            {
>              "sourcePath": "$.userType",
>              "optional": true,
>              "targetPath": "$.userType"
>            },
>            {
>              "sourcePath": "$.active",
>              "optional": true,
>              "targetPath": "$.active"
>            },
>            {
>              "sourcePath": "$.emails",
>              "preserveArrayWithSingleElement": true,
>              "optional": true,
>              "targetPath": "$.emails"
>            },
>            {
>              "sourcePath": "$.groups",
>              "preserveArrayWithSingleElement": true,
>              "optional": true,
>              "targetPath": "$.groups"
>            }
>          ],
>          "scimEntityEndpoint": "Users"
>        },
>        "group": {
>          "mappings": [
>            {
>              "sourcePath": "$.id",
>              "targetPath": "$.id",
>              "targetVariable": "entityIdSourceSystem",
>              "correlationAttribute": true
>            },
>            {
>              "sourceVariable": "entityBaseLocation",
>              "targetPath": "$.meta.location",
>              "targetVariable": "entityLocationSourceSystem",
>              "functions": [
>                {
>                  "function": "concatString",
>                  "suffix": "${entityIdSourceSystem}"
>                }
>              ]
>            },
>            {
>              "sourcePath": "$.schemas",
>              "preserveArrayWithSingleElement": true,
>              "targetPath": "$.schemas"
>            },
>            {
>              "sourcePath": "$.displayName",
>              "targetPath": "$.displayName"
>            },
>            {
>              "sourcePath": "$.members",
>              "preserveArrayWithSingleElement": true,
>              "optional": true,
>              "targetPath": "$.members"
>            }
>          ],
>          "scimEntityEndpoint": "Groups"
>        }
>      },
>      "writeTransformation": {
>        "user": {
>          "mappings": [
>            {
>              "sourceVariable": "entityIdTargetSystem",
>              "targetPath": "$.id"
>            },
>            {
>              "sourcePath": "$.userName",
>              "targetPath": "$.userName"
>            },
>            {
>              "sourcePath": "$.schemas",
>              "preserveArrayWithSingleElement": true,
>              "targetPath": "$.schemas"
>            },
>            {
>              "sourcePath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']",
>              "optional": true,
>              "targetPath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']"
>            },
>            {
>              "sourcePath": "$.externalId",
>              "optional": true,
>              "targetPath": "$.externalId"
>            },
>            {
>              "sourcePath": "$.displayName",
>              "optional": true,
>              "targetPath": "$.displayName"
>            },
>            {
>              "sourcePath": "$.nickName",
>              "optional": true,
>              "targetPath": "$.nickName"
>            },
>            {
>              "sourcePath": "$.name.familyName",
>              "optional": true,
>              "targetPath": "$.name.familyName"
>            },
>            {
>              "sourcePath": "$.name.middleName",
>              "optional": true,
>              "targetPath": "$.name.middleName"
>            },
>            {
>              "sourcePath": "$.name.givenName",
>              "optional": true,
>              "targetPath": "$.name.givenName"
>            },
>            {
>              "sourcePath": "$.name.honorificSuffix",
>              "optional": true,
>              "targetPath": "$.name.honorificSuffix"
>            },
>            {
>              "condition": "($.addresses[*].region EMPTY false) && ($.addresses[*].country EMPTY false)",
>              "sourcePath": "$.addresses",
>              "preserveArrayWithSingleElement": true,
>              "optional": true,
>              "targetPath": "$.addresses",
>              "functions": [
>                {
>                  "type": "convertCountryRegion",
>                  "outputFormat": "alpha2",
>                  "inputAttributes": [
>                    "region",
>                    "country"
>                  ],
>                  "outputAttribute": "region"
>                }
>              ]
>            },
>            {
>              "sourcePath": "$.userType",
>              "optional": true,
>              "targetPath": "$.userType"
>            },
>            {
>              "sourcePath": "$.active",
>              "optional": true,
>              "targetPath": "$.active"
>            },
>            {
>              "sourcePath": "$.emails",
>              "preserveArrayWithSingleElement": true,
>              "optional": true,
>              "targetPath": "$.emails"
>            },
>            {
>              "sourcePath": "$.groups[*].value",
>              "preserveArrayWithSingleElement": true,
>              "optional": true,
>              "targetPath": "$.groups[?(@.value)]"
>            },
>            {
>              "constant": "urn:ietf:params:scim:api:messages:2.0:PatchOp",
>              "targetPath": "$.schemas[0]",
>              "scope": "patchEntity"
>            },
>            {
>              "sourcePath": "$.Operations",
>              "preserveArrayWithSingleElement": true,
>              "targetPath": "$.Operations",
>              "scope": "patchEntity"
>            }
>          ],
>          "scimEntityEndpoint": "Users"
>        },
>        "group": {
>          "mappings": [
>            {
>              "sourceVariable": "entityIdTargetSystem",
>              "targetPath": "$.id"
>            },
>            {
>              "sourcePath": "$.displayName",
>              "optional": true,
>              "targetPath": "$.displayName"
>            },
>            {
>              "constant": "urn:ietf:params:scim:schemas:core:2.0:User",
>              "targetPath": "$.schemas[0]"
>            },
>            {
>              "sourcePath": "$.Operations",
>              "preserveArrayWithSingleElement": true,
>              "targetPath": "$.Operations",
>              "scope": "patchEntity"
>            },
>            {
>              "sourcePath": "$.schemas",
>              "preserveArrayWithSingleElement": true,
>              "targetPath": "$.schemas",
>              "scope": "patchEntity"
>            },
>            {
>              "sourcePath": "$.members[*].value",
>              "preserveArrayWithSingleElement": true,
>              "optional": true,
>              "targetPath": "$.members[?(@.value)]"
>            }
>          ],
>          "scimEntityEndpoint": "Groups"
>        }
>      },
>      "gitFetchAllowed": false
>    }
>    ```
> 3. Select **Import File**, and browse to the downloaded file.

> [!NOTE]
>
> **Option 2 - Use the manual process**
>
> Follow the manual process provided on [SAP Help Portal](<https://help.sap.com/docs/identity-provisioning/identity-provisioning/proxy-sap-commerce-cloud>).

## Required Permissions

The following permissions are required for the OAuth client and Technical user (IPS):

- SAP Commerce Cloud (to configure the OAuth client)

  - OAuth client can be created by the system user
- SAP Identity Provisioning Service (to configure technical user)

  - The technical user is required to be created by the tenant administrator. Select the **Access Proxy System API** permission in **Configure Authorizations**.