Configuring Indirect Role Assignment

The SailPoint SAP Direct connector can indirectly manage the roles assigned to an account. This feature is only supported with SailPoint's function modules: /SAILPOIN/SAIL_READ_TABLE_LEG and /SAILPOIN/SAIL_READ_TABLE.

The following topics are discussed:

• Required Permissions for Indirect Role Management
• Account Attributes for Organization Data
• Group Attributes for Organization Data
• How Indirect Role Assignment During Provisioning Works

The following steps help illustrate this process:

1. The connector aggregates the relationship between the SailPoint account and the SAP employee. It fetches the EmployeeID assigned to an employee in the SAP system and associates it with the SailPoint account for that employee in the SailPoint system.

   The connector also aggregates Organization Data assigned to an employee within the SAP system. The Organization Data consists of the employee's position, job, or organization unit. The connector also aggregates roles assigned to the Organization Data.

2. Using the EmployeeID and Organization Data with its assigned roles, SailPoint can fetch the roles assigned to an employee in the SAP system using the effective transitive relationship (Employee-Organization Data-Roles).

3. Within SailPoint, the SAP employee's roles are indirectly assigned to the SailPoint account based on the SAP employee's associated Organization Data.

The connector also enables SailPoint to assign a role indirectly to an account using the transitive relationship between the account and the SAP employee. It does so by assigning the SAP employee's EmployeeID to the account. This update can then be provisioned to the SAP system. For more information, refer to Indirect Role Assignment During Provisioning.

For more general information, refer to Schema Extension and Custom Attributes and Provisioning Policy Attributes.

Required Permissions for Indirect Role Management

Expand the table below to view a list of permissions required to support the management of indirect roles. For information on all permissions required for all connector features, including indirect role management, refer to Required Permissions.

Required Service Account Permissions for Organization Data

Expand the tables below to view the permissions required for the service account to process Organization Data, which is required for indirect role management. For more information on service account permissions, refer to Configuration Table for SAP Direct.

Account Attributes for Organization Data

The connector uses the attributes listed below to fetch a user's Organization Data.

Customizing the Organization Data Fetched for Accounts

By default, the connector fetches all positions, jobs, and organization units for each user during group aggregation processes. You can configure this by adding the orgData entry key with the data you want to fetch via REST API.

<entry key="orgData">
    <value>
        <List>
            <String>orgunit</String>
            <String>position</String>
            <String>job</String>
        </List>
    </value>
</entry>

Group Attributes for Organization Data

The connector uses the attributes listed below to fetch Organization Data and the roles associated it. The Group Object type is organizationdata.

To fetch Organization Data and its roles, add the Organization Data group object to the application XML as exemplified below:

<Schema aggregationType="group" descriptionAttribute="" displayAttribute="Name" identityAttribute="ID" instanceAttribute="" nativeObjectType="Organization Data" objectType="organizationdata">
      <AttributeDefinition name="ID" type="string">
        <Description>ID of the Position, Job, or Organization Unit</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Name" type="string">
        <Description>Name of the Position, Job, or Organization Unit </Description>
      </AttributeDefinition>
      <AttributeDefinition name="Type" type="string">
        <Description>Organization data type</Description>
      </AttributeDefinition>
      <AttributeDefinition entitlement="true" multi="true" name="Roles" schemaObjectType="role" type="string">
        <Description>Roles associated with the Position, Job, or Organization unit</Description>
      </AttributeDefinition>
</Schema>

Customizing Fetched Organization Data

By default, the connector fetches all positions, jobs, and organization units during group aggregation processes. You can configure this by adding the orgData entry key with the data you want to fetch via REST API.

<entry key="orgData">
    <value>
        <List>
            <String>orgunit</String>
            <String>position</String>
            <String>job</String>
        </List>
    </value>
</entry>

How Indirect Role Assignment During Provisioning Works

SailPoint does not directly assign positions to SAP users within the SAP system. The relationship between the SAP HR Employee and the valid position assigned to them (as well as roles assigned to the valid position) need to be configured in the SAP system. The valid position also must be assigned to the SAP HR Employee.

SailPoint links a valid EmployeeID received during provisioning to a SAP User ID with the 0105 infotype. SailPoint then links SAP users with SailPoint accounts using the EmployeeID common between them. With this EmployeeID correlation established, any roles assigned via Organization Data to SAP HR Employees are automatically assigned to the SAP user within the SAP system following a provisioning operation.

EmployeeID: The SAP HR Employee ID that the SAP user is linked to.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.