# SailPoint SAP Direct Connector Documentation

> SAP Direct Connector Documentation

# Documentation

# Aggregate User Groups and User Group as an Entitlement

Aggregating the User Group and User Groups entitlements provides native support for user group attributes during account aggregation and provisioning. For newly created sources, these entitlements are managed by default using the User Group ID.

## How to Enable the Feature for an Existing Source

If you are using an existing source, you must manually update the source configuration using the REST API to enable this feature and apply the required schemas.

1. Add the User Group Schema

   Ensure the source includes the following usergroup schema configuration:

   ```json
   {
     "aggregationType": "group",
     "displayAttribute": "User Group",
     "identityAttribute": "User Group",
     "nativeObjectType": "UserGroup",
     "objectType": "usergroup",
     "attributeDefinitions": [
       {
         "name": "User Group Auth",
         "type": "string",
         "description": "User Group Id"
       },
       {
         "name": "Language",
         "type": "string",
         "description": "Language of the group"
       },
       {
         "name": "Description",
         "type": "string",
         "description": "Description of the user group auth"
       }
     ]
   }
   ```
2. Add the User Groups Schema

   ```json
   {
     "aggregationType": "group",
     "displayAttribute": "User Groups",
     "identityAttribute": "User Group",
     "nativeObjectType": "UserGroups",
     "objectType": "usergroups",
     "attributeDefinitions": [
       {
         "name": "User Group",
         "type": "string",
         "description": "User Group Id"
       },
       {
         "name": "Language",
         "type": "string",
         "description": "Language of the group"
       },
       {
         "name": "Description",
         "type": "string",
         "description": "Description of the user group assigned"
       }
     ]
   }
   ```

## Updating Account Schema Attribute Types

After you add the `UserGroup` and `UserGroups` entitlement schemas to an existing source, update the corresponding account schema attributes so their types match the entitlement schemas.

> [!NOTE]
>
> New sources created with User Group entitlements enabled use the correct attribute types by default. Verify the account schema before making changes.

**To update account schema attribute types:**

```xml
<AttributeDefinition entitlement="true" managed="true" multi="true" name="User Group" schemaObjectType="usergroup" type="string">
        <Description>User Group Auth assignment</Description>
</AttributeDefinition>
<AttributeDefinition entitlement="true" managed="true" multi="true" name="User Groups" schemaObjectType="usergroups" type="string">
        <Description>User Group Assignments of the user</Description>
</AttributeDefinition>
```

1. Log in to SailPoint.
2. Select the **Admin** tab and provide the necessary credentials if prompted.
3. Go to **Connections \> Sources**.
4. Select the SAP Direct source.
5. Go to **Account Schema**.
6. Select the **User Group** attribute.
7. Set **Type** to `usergroup`.

   [![Set Type to usergroup](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/user_group.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/user_group.png>)
8. Save the attribute.
9. Select the **User Groups** attribute.
10. Set **Type** to `usergroups`.

    [![Set Type to usergroups](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/user_groups.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/user_groups.png>)
11. Save the attribute.

# Aggregation of Contractual User Type ID

## Aggregation of Contractual User Type ID in Configured Language

The SAP Direct connector supports the aggregation and provisioning of the Contractual User Type ID in the language configured in the SAP managed system. The SAP Direct connector no longer fails when provisioning a Contractual User Type ID using the same language it was aggregated in. The `useClientLanguageForLicense` attribute is supported, by default, for new sources.

For existing sources, add the `useClientLanguageForLicense` attribute using the REST API:

```text
POST <url>/api/source/update/<sourceID>
```

- `<url>` is the URL for the customer's SailPoint tenant
- `<sourceID>` is the Source ID (number) obtained through the UI

In the body of the POST, use form-data as follows:

- Key: `connector_useClientLanguageForLicense`
- Value: `true`

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Aggregation of Contractual User Type ID As ContractualUserType Entitlements

Aggregating the Contractual User Type ID as `ContractualUserType` entitlements allows management of SAP Licenses based on license ID rather than license description. Licenses are managed using license ID, by default, for new sources.

> [!NOTE]
>
> This feature is supported for non CUA sources only. For new CUA sources, remove the `ContractualUserType` schema and `entitlement`, `managed`, and `schemaObjectType` attributes of the `Contractual User Type ID` attribute using the REST API.

### How to Enable the Feature for an Existing Source

For existing sources, make the following changes to the source using the REST API:

- Add the `entitlement`, `managed`, and `schemaObjectType` attributes to the attribute definition of the `Contractual User Type ID`:

  ```json
  {
      "AttributeDefinition": {
          "description": "Contractual user types associated with user",
          "multi": "true",
          "name": "Contractual User Type ID",
          "type": "string",
          "entitlement": "true",
          "schemaObjectType": "contractualusertype",
          "managed": "true"
      }
  }
  ```
- Add the `ContractualUserType` schema:

  ```json
  {
      "Schema": {
          "AttributeDefinition": [
              {
                  "description": "User Type Id or License ID",
                  "name": "User Type Id",
                  "type": "string"
              },
              {
                  "description": "License Description",
                  "name": "Name",
                  "type": "string"
              }
          ],
          "aggregationType": "group",
          "displayAttribute": "Name",
          "identityAttribute": "User Type Id",
          "nativeObjectType": "ContractualUserType",
          "objectType": "contractualusertype"
      }
  }
  ```

# Configuring Indirect Role Assignment

The SailPoint SAP Direct connector can indirectly manage the roles assigned to an account. This feature is only supported with SailPoint's function modules: `/SAILPOIN/SAIL_READ_TABLE_LEG` and `/SAILPOIN/SAIL_READ_TABLE`.

The following topics are discussed:

- [Required Permissions for Indirect Role Management](<#required-permissions-for-indirect-role-management>)
- [Account Attributes for Organization Data](<#account-attributes-for-organization-data>)
- [Group Attributes for Organization Data](<#group-attributes-for-organization-data>)
- [How Indirect Role Assignment During Provisioning Works](<#how-indirect-role-assignment-during-provisioning-works>)

The following steps help illustrate this process:

1. The connector aggregates the relationship between the SailPoint account and the SAP employee. It fetches the EmployeeID assigned to an employee in the SAP system and associates it with the SailPoint account for that employee in the SailPoint system.

   The connector also aggregates Organization Data assigned to an employee within the SAP system. The Organization Data consists of the employee's position, job, or organization unit. The connector also aggregates roles assigned to the Organization Data.
2. Using the EmployeeID and Organization Data with its assigned roles, SailPoint can fetch the roles assigned to an employee in the SAP system using the effective transitive relationship (Employee-Organization Data-Roles).
3. Within SailPoint, the SAP employee's roles are indirectly assigned to the SailPoint account based on the SAP employee's associated Organization Data.

The connector also enables SailPoint to assign a role indirectly to an account using the transitive relationship between the account and the SAP employee. It does so by assigning the SAP employee's EmployeeID to the account. This update can then be provisioned to the SAP system. For more information, refer to [Indirect Role Assignment During Provisioning](<#how-indirect-role-assignment-during-provisioning-works>).

> [!NOTE]
>
> Indirect role assignment requires a relationship between roles and HR objects. This should be established and synchronized on a regular basis in the SAP system.

For more general information, refer to [Schema Extension and Custom Attributes](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/schema.html#schema-extension>) and [Provisioning Policy Attributes](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/provisioning.html#provisioning-policy-attributes>).

## Required Permissions for Indirect Role Management

Expand the table below to view a list of permissions required to support the management of indirect roles. For information on all permissions required for all connector features, including indirect role management, refer to [Required Permissions](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/index.html#required-permissions>).

> [!NOTE]
>
> **Indirect Role Assignment Permissions**
>
> | Connector Feature | Authorization Objects | Field Name | Field Description | Field Value |
> | --- | --- | --- | --- | --- |
> | Account Aggregation | S\_RFC (To aggregate Organization Data) | Activity: 16, RFC\_NAME | Name of RFC object | `BAPI_EMPLOYEE_GETDATA`, `RFC_METADATA` |
> | Account Aggregation | S\_TABU\_NAM (To aggregate Organization Data) | Activity: 03, Table Name | Table affected by the operation | `PA0105` |
> | Account Aggregation | P\_Orgin (To aggregate Organization Data) | AUTH | Authorization Level | R |
> | Account Aggregation | P\_Orgin (To aggregate Organization Data) | INFTY | INFOTYPE | 0001 |
> | Account Aggregation | P\_Orgin (To aggregate Organization Data) | PERSA | Personal area | \* |
> | Account Aggregation | P\_Orgin (To aggregate Organization Data) | PERSG | Employee group | \* |
> | Account Aggregation | P\_Orgin (To aggregate Organization Data) | SUBTYPE | SUBTY | \* |
> | Account Aggregation | P\_Orgin (To aggregate Organization Data) | PERSK | Employee subgroup | \* |
> | Account Aggregation | P\_Orgin (To aggregate Organization Data) | VDSK1 | Organization Key | \* |
> | Group Aggregation | S\_TABU\_NAM | Activity: 03, Table Name | Table affected by the operation | Add the following: `HRP1000`, `HRP1001` |
> | Provision EmployeeID (Link username with the System user name for SAP HR. For more information on table-level permissions, refer to [Configuration Table for SAP Direct](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/sailpoint_add_on.html#configuration-table-for-sap-direct>).) | S\_RFC | ACTVT | Activity | `16-Execute` |
> | Provision EmployeeID | S\_RFC | RFC\_NAME | Name of RFC object | Add the following: `BAPI_EMPLCOMM_CHANGE`, `BAPI_EMPLCOMM_CREATE`, `BAPI_EMPLOYEE_ENQUEUE`, `BAPI_EMPLOYEE_DEQUEUE`, `BAPI_EMPLOYEE_GETDATA`, `BAPI_EMPLOYEE_CHECKEXISTENCE`, `BAPI_EMPLCOMM_GETDETAILEDLIST` |
> | Provision EmployeeID | S\_USER\_GROUP | AUTHC | Authorization Level | Add the following: `E`, `S`, `W` |
> | Provision EmployeeID | S\_USER\_GROUP | INFTY | INFOTYPE | `0105` |
> | Provision EmployeeID | S\_USER\_GROUP | PERSA | Personal area | \* |
> | Provision EmployeeID | S\_USER\_GROUP | PERSG | Employee group | \* |
> | Provision EmployeeID | S\_USER\_GROUP | SUBTYPE | SUBTY | \* |
> | Provision EmployeeID | S\_USER\_GROUP | PERSK | Employee subgroup | \* |
> | Provision EmployeeID | S\_USER\_GROUP | VDSK1 | Organization Key | \* |
> | Provision EmployeeID | S\_RFC | ACTIVITY | Activity | `03` |
> | Provision EmployeeID | S\_RFC | CLASS | User group in user master maintenance | \* |

## Required Service Account Permissions for Organization Data

Expand the tables below to view the permissions required for the service account to process Organization Data, which is required for indirect role management. For more information on service account permissions, refer to [Configuration Table for SAP Direct](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/sailpoint_add_on.html#configuration-table-for-sap-direct>).

> [!NOTE]
>
> **Account Aggregation and Provisioning**
>
> | SERVICE\_ACCOUNT | NAME | COLUMNNAME | ENTITY\_TYPE | COLUMN\_DNAME | COLUMN\_DTYPE | COLUMN\_LENGTH |
> | --- | --- | --- | --- | --- | --- | --- |
> | \\\<your-service-account-name\> | PA0105 | PERNR | TABLE | PERSNO | N | 8 |
> | \\\<your-service-account-name\> | PA0105 | SUBTY | TABLE | SUBTY | C | 4 |
> | \\\<your-service-account-name\> | PA0105 | USRID | TABLE | SYSID | C | 30 |

> [!NOTE]
>
> **Group Aggregation**
>
> | SERVICE\_ACCOUNT | NAME | COLUMNNAME | ENTITY\_TYPE | COLUMN\_DNAME | COLUMN\_DTYPE | COLUMN\_LENGTH |
> | --- | --- | --- | --- | --- | --- | --- |
> | \\\<your-service-account-name\> | HRP1001 | ENDDA | TABLE | ENDDATUM | D | 8 |
> | \\\<your-service-account-name\> | HRP1001 | ISTAT | TABLE | ISTAT\_D | C | 1 |
> | \\\<your-service-account-name\> | HRP1001 | OBJID | TABLE | HROBJID | N | 8 |
> | \\\<your-service-account-name\> | HRP1001 | OTYPE | TABLE | OTYPE | C | 2 |
> | \\\<your-service-account-name\> | HRP1001 | PLVAR | TABLE | PLVAR | C | 2 |
> | \\\<your-service-account-name\> | HRP1001 | SCLAS | TABLE | SCLAS | C | 2 |
> | \\\<your-service-account-name\> | HRP1001 | SOBID | TABLE | SOBID | C | 5 |
> | \\\<your-service-account-name\> | HRP1000 | ENDDA | TABLE | ENDDATUM | D | 8 |
> | \\\<your-service-account-name\> | HRP1000 | LANGU | TABLE | LANGU | C | 2 |
> | \\\<your-service-account-name\> | HRP1000 | OBJID | TABLE | HROBJID | N | 8 |
> | \\\<your-service-account-name\> | HRP1000 | OTYPE | TABLE | OTYPE | C | 2 |
> | \\\<your-service-account-name\> | HRP1000 | PLVAR | TABLE | PLVAR | C | 2 |
> | \\\<your-service-account-name\> | HRP1000 | STEXT | TABLE | STEXT | C | 40 |
>
> For Group Aggregation in CUA systems, additional permissions are required as follows:
>
> | SERVICE\_ACCOUNT | NAME | COLUMNNAME | ENTITY\_TYPE | COLUMN\_DNAME | COLUMN\_DTYPE | COLUMN\_LENGTH |
> | --- | --- | --- | --- | --- | --- | --- |
> | \\\<your-service-account-name\> | USRSYSPRF | SUBSYSTEM | TABLE | RFCRCVSYS | C | 10 |
> | \\\<your-service-account-name\> | USRSYSPRF | PROFN | TABLE | XUPROFNAME | C | 12 |

## Account Attributes for Organization Data

The connector uses the attributes listed below to fetch a user's Organization Data.

| Attribute Name | Description |
| --- | --- |
| EmployeeID | Employee ID associated with the user |
| Organization Data | Position, Job, and Organization Units associated with the user. Mark this attribute as follows: `entitlement="true" managed="true" multi="true" schemaObjectType="organizationdata"` |

## Customizing the Organization Data Fetched for Accounts

By default, the connector fetches all positions, jobs, and organization units for each user during group aggregation processes. You can configure this by adding the `orgData` entry key with the data you want to fetch via REST API.

```xml
<entry key="orgData">
    <value>
        <List>
            <String>orgunit</String>
            <String>position</String>
            <String>job</String>
        </List>
    </value>
</entry>
```

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Group Attributes for Organization Data

The connector uses the attributes listed below to fetch Organization Data and the roles associated it. The Group Object type is `organizationdata`.

> [!NOTE]
>
> These attributes are not provided by default, and must be configured manually.

| Attribute Name | Description |
| --- | --- |
| ID | ID of the position, job, or organization unit |
| Name | Name of the position, job, or organization unit |
| Type | Organization Data type |
| Roles | Roles associated with the position, job, or organization unit |

To fetch Organization Data and its roles, add the Organization Data group object to the application XML as exemplified below:

```xml
<Schema aggregationType="group" descriptionAttribute="" displayAttribute="Name" identityAttribute="ID" instanceAttribute="" nativeObjectType="Organization Data" objectType="organizationdata">
      <AttributeDefinition name="ID" type="string">
        <Description>ID of the Position, Job, or Organization Unit</Description>
      </AttributeDefinition>
      <AttributeDefinition name="Name" type="string">
        <Description>Name of the Position, Job, or Organization Unit </Description>
      </AttributeDefinition>
      <AttributeDefinition name="Type" type="string">
        <Description>Organization data type</Description>
      </AttributeDefinition>
      <AttributeDefinition entitlement="true" multi="true" name="Roles" schemaObjectType="role" type="string">
        <Description>Roles associated with the Position, Job, or Organization unit</Description>
      </AttributeDefinition>
</Schema>
```

## Customizing Fetched Organization Data

By default, the connector fetches all positions, jobs, and organization units during group aggregation processes. You can configure this by adding the `orgData` entry key with the data you want to fetch via REST API.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

```xml
<entry key="orgData">
    <value>
        <List>
            <String>orgunit</String>
            <String>position</String>
            <String>job</String>
        </List>
    </value>
</entry>
```

## How Indirect Role Assignment During Provisioning Works

SailPoint does not directly assign positions to SAP users within the SAP system. The relationship between the SAP HR Employee and the valid position assigned to them (as well as roles assigned to the valid position) need to be configured in the SAP system. The valid position also must be assigned to the SAP HR Employee.

SailPoint links a valid EmployeeID received during provisioning to a SAP User ID with the 0105 infotype. SailPoint then links SAP users with SailPoint accounts using the EmployeeID common between them. With this EmployeeID correlation established, any roles assigned via Organization Data to SAP HR Employees are automatically assigned to the SAP user within the SAP system following a provisioning operation.

> [!NOTE]
>
> To further help link SAP users and SAP employees within SailPoint, SailPoint provides a dummy position called a Provisional Position. The Provisional Position triggers a joiner flow if there are no direct roles available in the SAP Direct access profile. The Provisional Position is not required to link the SAP user and the SAP HR Employee, however the EmployeeID is still required.

**EmployeeID**: The SAP HR Employee ID that the SAP user is linked to.

# Connecting SailPoint and SAP Direct

To connect SailPoint and SAP Direct, perform the following tasks:

To connect SailPoint with SAP Direct, perform the following tasks:

## Adding the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

> [!IMPORTANT]
>
> By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration.

**To configure a new source:**

1. Sign in to SailPoint.
2. Go to **Admin \> Connections \> Sources**.
3. Select **Create New**.
4. Search for the connector by entering the name in the search box, and then select **Configure**.
5. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
6. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
7. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](<https://documentation.sailpoint.com/saas/help/sources/index.html#assigning-a-source-owner>).
8. Under **Connection Type**, select **Direct Connection** or **Flat File**.

   - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
   - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable.
9. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source.
10. (Optional) Select a governance group to grant its members [source](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#source-sub-admin-user-level>) or [role](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#role-sub-admin-user-level>) sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html>).
11. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](<https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html>).
12. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there.

## Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a unique name and description for the source.
2. In the **Source Owner** dropdown list, select the identity that owns this source.

   - To find a source owner, begin entering their name.
3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](<https://documentation.sailpoint.com/saas/help/va/index.html>).
4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information.
6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html#associating-a-governance-group-with-a-source>).
7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default.

   - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system.
   - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source.
8. Drag and drop the required files into the **Upload Files** box, or upload them from your computer.

   > **Warning**
   >
   > Ensure that the file you upload is not vulnerable or malicious.

   Upload the `sapjco3.jar` and `libsapjco3.so` files. Download the JCO libraries (JCO Release 3.1.x) from the SAP customer service marketplace.
9. Select **Save**.

## Connection Settings

Configure a direct connection between the SAP Direct source and SailPoint.

> [!NOTE]
>
> **Screenshot**
>
> [![Connection Settings](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/connection_settings.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/connection_settings.png>) [![Connection Settings](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/connection_settings_2.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/connection_settings_2.png>)

1. Select **Connection Settings** from the menu.
2. Enter the SAP Direct service account's user name in **Service Account**.
3. Enter the SAP Direct service account's password in **Password**.
4. Enter the SAP Direct host server's URL in **Host**.
5. Enter the SAP Direct's two-digit system number in **System Number**. For example, `00`.
6. Enter the SAP client's three-digit client number in **Client Number**. For example, `001`.
7. Enter a language code for the SAP client's display language in **Client Language**. For example, `EN` displays the client in English. If SAP has been patched to SP 17 or later, change the client language to a single character. For example, if the client language is `EN`, change it to `E`. For more information on the One Character Code for Language, refer to the [SAP KB article](<https://userapps.support.sap.com/sap/support/knowledge/en/2633548>).
8. Select the **Name** of the **Function Module Configuration** as per your SAP Basis version.
9. Select **Save**.

## Advanced Settings

Enable and Configure Secure Network Communications (SNC) and load balancing. When you enable either feature, additional settings display to complete the configuration.

> [!NOTE]
>
> **Screenshot**
>
> [![Advanced Settings](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/advanced_settings.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/advanced_settings.png>)

### Configure Secure Network Communications

Secure Network Communications (SNC) improve the security for the connection between the source and SailPoint. For more information, refer to [SAP Secure Network Communication (SNC) For SAP Source](<https://community.sailpoint.com/knowledge/SAP-Secure-Network-Communication-SNC-For-SAP-Source-in>).

> [!NOTE]
>
> **Screenshot**
>
> [![Configure Secure Network Communications](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/snc_settings.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/snc_settings.png>)

1. Select **Advanced Settings** from the menu.
2. Select a **Level of Security**. Each level sets the Quality of Protection (QOP) level. In SAP, it relates to `jco.client.snc_qop`.
3. Enter the name that internally identifies in **SNC Name**. In SAP, it relates to `jco.client.snc_myname`.
4. Enter the SNC partner's name in **SNC Name of SAP Application Server**. If SNC is configured in SAP, it relates to `jco.client.snc_partnername`.

   For example, provide input as `p:CN=R3, O=XYZ-INC, C=EN` in SAP.
5. Enter the path to the library that provides the SNC service in **SNC Library Path**. In SAP it relates to `jco.client.snc_lib`.
6. Select a requirement in **Set Password in Productive Mode**. By default, a password is required which means the source requires a password while in Productive Mode.
7. Select **Save**.

### Configure Load Balancing

Enable and set up load balancing between the source and the SAP direct server.

> [!NOTE]
>
> **Screenshot**
>
> [![Configure Load Balancing](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/load_balancing_settings.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/load_balancing_settings.png>)

1. Enter the SAP message server host value in **Host**.
2. Enter the SAP application server Logon group name in **Client Group**.
3. Enter the SAP message server port number in **Port Number**.
4. Select **Save**.

## Additional Settings

> [!NOTE]
>
> **Screenshot**
>
> [![Additional Settings](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/additional_settings.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/additional_settings.png>)

1. Select **Additional Settings** from the menu.
2. Select **Delta Aggregation** to enable delta aggregation.

   > **Note**
   >
   > For more information on configuring delta aggregation, refer to [Delta Aggregation](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/delta_aggregation.html>).
3. Select **CUA System** to enable CUA. CUA enables you to maintain master user records centrally in one SAP system. Provisioned changes in SailPoint are then automatically distributed to the respective SAP child systems.

   > **Note**
   >
   > To use this feature, Central User Administration must be enabled on your SAP source. For more information, refer to [Setting Up Central User Administration](<https://help.sap.com/docs/SAP_NETWEAVER_702/ff4a624c6c551014b115b3f0358548b0/fa0ec43b5d091b3de10000000a114084.html>) in SAP documentation.
4. Select **Unlock On Change Password Operation** to enable unlocking SAP accounts when the password is changed.

   > **Note**
   >
   > The account is unlocked when the password is set only if the account is locked by too many incorrect logon attempts.
5. Enter specific errors that should be retried during Provisioning in **Retryable Error String**.
6. Select **Save**.

## Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to **Review and Test**.
2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.
3. Select **Test Connection**.

## SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface.

For more information, refer to [Application Onboarding](<https://documentation.sailpoint.com/saas/help/ai/app_onboarding/index.html>) in the SailPoint SaaS documentation.

# Delta Aggregation

If you want your SAP Direct connector to support delta aggregation, which can speed up aggregation time by aggregating only new information, you can make certain changes on that system.

For more information about aggregation, refer to [Loading Account Data](<https://documentation.sailpoint.com/saas/help/accounts/loading_data.html>).

A prerequisite to this process, as described in this document, is to copy the API Transport files to SAP. Select the link [here](<https://files.accessiq.sailpoint.com/integrations/sapdirect/ImportSAPDirect.TAR?_gl=1*yho916*_ga*MTE5NDgyNDE1MS4xNjQ5NjkyNjQx*_ga_SS72Z4HXJM*MTY1MjQ2MzY2Ny45Ni4xLjE2NTI0NjQ0MjUuNjA.&amp;_ga=2.27815413.877006562.1652098275-1194824151.1649692641>) to download the files.

> [!NOTE]
>
> SAP Direct must complete a full account aggregation before delta aggregation can be enabled.

## Supported Attributes

The SAP Direct connector supports Delta Aggregation for the following attributes:

- User created
- User deleted
- Password
- User Type
- Administrator lock set / IdentityIQ Disabled
- Administrator lock released / IdentityIQ Enabled
- Incorrect logon lock set / IdentityIQ Locked
- Incorrect logon lock released / IdentityIQ Unlocked
- Validity Period
- Account Number
- User Group
- SAP Profile(s) Assigned
- SAP Profile(s) Deleted
- Security Policy

## Configure Delta Aggregation

Use the following tasks to configure Delta Aggregation on your system.

### Importing the BAPIs

This section describes how to import the transport request that contains the non-certified function modules used by SAP Direct connector to achieve the delta aggregation functionality.

Function modules are imported using one of the following methods:

- Using the Transport Control program manually
- Using the menu-driven administration of Transport Requests via SAP GUI

#### Prerequisites

Copy the API Transport files to SAP. Use the following procedure to unpack and import the transport files function modules:

1. Copy the transport files.

   Transport request is contained in the `ImportSAPDirect.TAR` compressed file. Download the `ImportSAPDirect.TAR` file from the [Configuring Delta Aggregation TAR File](<https://community.sailpoint.com/knowledge/SAP-Direct-Connector-Configuring-Delta-Aggregation-TAR-File>) page.

   The compressed file for each release contains the following files:

   - `RrequestNumber.sapId`
   - `KrequestNumber.sapId`

   Using WinZip or a similar utility, extract and copy each file from the appropriate compressed file to the subdirectory of the local transport directory of the target SAP system as follows:

   - Copy the `RrequestNumber.sapId` file to the `sapHomeDir\trans\data\RrequestNumber.sapId` directory.
   - Copy the `KrequestNumber.sapId` file to the `sapHomeDir\trans\cofiles\KrequestNumber.sapId` directory.

> [!NOTE]
>
> Note the values of *requestNumber* and *sapId*. These values are required during the configuration of the Transport Control Program.

#### Using the Transport Control Program Manually

1. At the command prompt (for both Microsoft Windows or UNIX systems), enter the following command to register the transport with the buffer:

   ```text
   os prompt> tp addtobuffer sapIdKrequestNumber yourSid
   ```

   In the preceding command line, *sapId* and *requestNumber* were determined in *Prerequisites*.
2. Enter the following command to import the above transport request in to your SAP Solutions system:

   ```text
   os prompt>tp import sapIdKrequestNumber yourSid client=yourClient U126
   ```

   After executing the `tp` import command, the system issues a return code, indicating the status of the import. The most common return codes are described in the table below:

   | Return Code | Description |
   | --- | --- |
   | 0 | Successful import. The Transport imported successfully. |
   | 4 | Warning status. Minor version differences were detected.<br>The Transport Imported successfully. (No action is required.) |

#### Importing the Transport Via SAP GUI

If you are running SAP GUI, use the following procedure for importing the function modules:

1. Log in to SAP GUI with administrator permissions.
2. Perform one of the following:

   - From the Command field, run transaction `STMS`
   - From the menu, select **Tools \> Administration \> Transports \> Transport management system**.
3. In the **Transport Management System** window, press **F5**.
4. In the **Import Overview** window, double-click your system queue.

   The requests list for the system is displayed.
5. From the menu bar in the **Import Queue** window, select **Extras \> Other requests \> Add**.
6. Enter the request number and select **Yes**.
7. In the Attach to import queue message box, select **Yes**.
8. In the **Import Queue** window, select the new line, and then press **Ctrl + F11** to import the request.
9. In the **Import Transport Request** dialog box, perform the following:

   1. In the **Target** client field, enter the name of the SAP client to which you want to import the transport.
   2. On the **Date** tab, under **Start Date**, set the your required values.
   3. On the **Execution** tab, under **Import**, ensure that **Synchronous** is selected.
   4. On the **Options** tab, under **Import options**, ensure that all of the checkboxes are selected.
10. In the **Start Import** dialog box, select **Yes**.

### Verification

All non-validated function modules are transported as a function group whose name starts with SailPoint's unique namespace (`"/SAILPOIN"`)

To verify that the required function modules have been imported in to the SAP system, perform the following:

1. In the SAP system, execute **SE37** transaction.
2. Enter: `/SAILPOIN/*` in the Function Module field.
3. Press the **F4** key.

   This displays the Repository Info System window that lists all the imported functional modules currently available on the SAP system as follows:

   ```text
   SAILPOIN/USR_CHANGE_DOC_ROLES
   SAILPOIN/USR_CHANGE_DOC_USERS
   ```

# Integrating SailPoint with SAP Direct

> [!NOTE]
>
> **Integration**
>
> This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

This document is designed to give specific information about the requirements and field definitions needed to get a working instance of a SAP Direct connector in SailPoint.

SAP Enterprise Resource Planning software solution is an integrated software solution that incorporates the key business functions of the organization.

SailPoint for SAP ERP aggregates and provisions all the users along with their roles/profiles of the SAP system.

SailPoint for SAP ERP supports provisioning to a standalone SAP system as well as SAP Central User Administration (CUA) system.

> [!NOTE]
>
> The RFC\_READ\_TABLE integration function module has been deprecated, and replaced with the ABAP Function module. For more information on configuration, refer to [SailPoint Add-On to replace the use of RFC\_READ\_TABLE](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/sailpoint_add_on.html>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The SAP Direct connector supports the following features:

> [!NOTE]
>
> Before you can use any item marked with an asterisk (\*), SailPoint must activate the feature for your site.

- Manages SAP users as Accounts
- Aggregation, Delta Aggregation (to sync changes from SAP Direct), Refresh Accounts
- Create, Update, and Delete
- Enable, Disable, and Unlock
- \*Password Management
- Add and Remove Entitlements

  - Entitlements are Roles (for user), Profiles (for user), ContractualUserType (Licenses of the use)., UserGroup (User group of the user), and User Groups (for user).
- Add and Remove Contractual User Type ID
- Read and update the [SAP UUID (Global User ID)](<#sap-uuid-global-user-id>) associated with SAP Direct Accounts.
- Add and Remove the EmployeeID assigned to an Account
- Manage the Indirect Roles assigned to the accounts via Organization Data.

  For more information, refer to [Configuring Indirect Role Assignment](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/configure_indirect_role_assignment.html>).

> [!NOTE]
>
> - UserGroup (User group of the user) is managed as an entitlement account attribute only.
> - SAP recommends to assign only one user group in single request.

For more information on features, refer to [Source Features](<https://community.sailpoint.com/knowledge/Identity-Security-Cloud-Source-Features>).

The SAP Direct connector supports following group and entitlement objects:

| SAP Direct Source Object | Supported Operation |
| --- | --- |
| Roles as group object | Read |
| ContractualUserType (Licenses for user) | Add and Remove Entitlement |
| Entitlement objects<br>\- Roles (for user)<br>\- Profiles (for user) | Add and Remove Entitlements |

The SAP Direct connector displays the parent child relationship between composite role and child roles on the connector UI as Parent and Child Entitlements.

> [!NOTE]
>
> When performing group aggregation in a SAP Central User Administration (CUA) environment, the connector does not fetch `child roles` or `child profiles` of any composite role or profile. This is due to the fact that the CUA system does not maintain child level roles or profile details for child subsystems. This works in a similar way, where the attribute `ID` does not fetch attributes like `TCodes assigned through Menus`, `TCodes assigned directly` and `Other Menu Items` or `Generated Profiles` for the group object type.

The following lists the details of the supported features:

| Feature | Users |
| --- | --- |
| Create | ✔ |
| Aggregate | ✔ |
| Enable and Disable | ✔ |
| Delta Aggregation | ✔ |
| Password Management | ✔ |
| Group Entitlements (Read, Request, Revoke, and Access Certifications) | ✔ Roles |
| Entitlements (Read, Request, Revoke, and Access Certifications) | ✔ (Profiles, UserGroups, and ContractualUserType) |

### Group Entitlements

Group entitlements are the entitlement types for which SailPoint provides the ability to aggregate additional details of these entitlement types from the managed system. These objects have a separate schema defining list of attributes that the aggregation task fetches as additional details when aggregation is run for that group entitlement type.

| Feature | Groups |
| --- | --- |
| Aggregation | ✔ |
| Read group hierarchy | ✔ |

### Notes

The following table lists the special considerations of certain supported features:

| Supported Features | Notes |
| --- | --- |
| Pass Through Authentication | If Pass-Through authentication is enabled, the user can login through SailPoint using the user name and password without any authorization required. |
| Aggregation | SailPoint for SAP Direct aggregates Generated Profile associated to Role as a part of Account-Group Aggregation. |
| Change Password | \- For "Change password in Permanent Mode" ensure that the SNC is configured on SAP server. The log on session during which a productive password is set must be secured using Secure Network Communications (SNC).<br>\- SAP recommends that setting of productive passwords is more risky than setting an initial one, therefore additional security checks must be applied as follows:<br>\- The log on session during which a productive password is set must be secured using Secure Network Communications (SNC).<br>\- The user needs an additional authorization to set a productive password (authorization object: S\_USER\_GRP, activity: 'PP' - Set Productive)<br><br>For more information, refer to SAP note [https://service.sap.com/sap/support/notes/1287410](<https://service.sap.com/sap/support/notes/1287410>) (SAP Service marketplace login required). |
| Manages SAP Profiles as Account-Groups | A few system composite profiles might have child profiles which are not present in SAP system. For example, for each release composite profile `SAP_NEW` contains a single profile `SAP_NEW_<rel>`, (for example, `SAP_NEW_21D`). This profiles holds its release status. Profiles like `SAP_NEW_<rel>` may not be aggregated. |
| Account - Group Aggregation | In Account-Group aggregation for SAP Central User Administration (CUA) environment, the connector does not fetch `child roles` or `child profiles` of any composite role or profile. This is due to the fact that the CUA system does not maintain child level roles or profile details for child subsystems. This works in a similar way, where the attribute `ID` does not fetch attributes like `TCodes assigned through Menus`, `TCodes assigned directly` and `Other Menu Items` or `Generated Profiles` for the group object type. |

### SAP UUID (Global User ID)

In order to enable this functionality, following attributes needs to be added manually in account schema:

- SAP User UUID
- SAP User UUID History

> [!NOTE]
>
> SAP User UUID History attribute has read only support.

#### Additional Permission for UUID (Global User ID)

| Authorization Objects | Field Name | Field Description | Field Value |
| --- | --- | --- | --- |
| S\_USER\_UID | ACTVT | Activity | Display |
| S\_USER\_UID | CLASS | User group | Specify the Group you want to assign for the user.<br>For example: `SUPER` |
| S\_USER\_UID | EXTUID\_TYP | Type of the External User ID (UID) | Global User ID |

#### Additional Permission for Adding and Removing UUID (Global User ID)

| Authorization Objects | Field Name | Field Description | Field Value |
| --- | --- | --- | --- |
| S\_USER\_UID | ACTVT | Activity | Enter, Include, and Assign |
| S\_USER\_UID | CLASS | User group | Specify the Group you want to assign for the user.<br>For example: `SUPER` |
| S\_USER\_UID | EXTUID\_TYP | Type of the External User ID (UID) | Global User ID |

### Enabling PD Profiles

This topic describes how to use the PD Profile functionality for SAP Direct connector by adding required attributes to the account/entitlement schema and configuring necessary permissions.

#### Fetching Directly Assigned PD Profiles

##### Adding Attributes

To fetch PD Profiles assigned directly to users, manually add the following attributes to the Account Schema:

- `PDProfiles`

  This attribute stores the PD profiles assigned directly to the user.
- `PDProfile Details`

  This attribute stores the associated PD profiles with their start and end dates. PD profile details are displayed in the following format:

  `PDProfileName#Startdate(YYYYMMDD)#EndDate(YYYYMMDD)`

##### Configuring Direct Assignment Permissions

To fetch PD Profiles assigned directly to users, ensure to provide following permissions for T77UA table. T77UA table stores the PD profile assignments for users.

| Authorization Objects | Field Name | Field Description | Field Value |
| --- | --- | --- | --- |
| S\_TABU\_NAM (To aggregate PD Profiles directly assigned to User) | Activity: 03, Table Name | Table affected by the operation | T77UA |

The tables below list the permissions required for the service account. For more information on service account permissions, refer to [Configuration Table for SAP Direct](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/sailpoint_add_on.html#configuration-table-for-sap-direct>).

| SERVICE\_ACCOUNT | NAME | COLUMNNAME | ENTITY\_TYPE | COLUMN\_DNAME | COLUMN\_DTYPE | COLUMN\_LENGTH |
| --- | --- | --- | --- | --- | --- | --- |
| \\\<service-account-name\> | T77UA | BEGDA | TABLE | PD\_BEGDA | D | 8 |
| \\\<service-account-name\> | T77UA | ENDDA | TABLE | PD\_ENDDA | D | 8 |
| \\\<service-account-name\> | T77UA | GEN\_FLAG | TABLE | FLAG | C | 1 |
| \\\<service-account-name\> | T77UA | PROFL | TABLE | PROFL | C | 12 |
| \\\<service-account-name\> | T77UA | UNAME | TABLE | USRNAME | C | 12 |

#### Fetching Indirectly Assigned PD Profiles

##### Adding Attributes

To fetch PD Profiles assigned indirectly to users via jobs, positions, or orgainizational units, manually add the following attributes:

- Add a new schema attribute `PDProfiles` under the `organizationdata` ([Group Attributes for Organization Data](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/configure_indirect_role_assignment.html#group-attributes-for-organization-data>)) in the Entitlement Schema.
- Add a new schema attribute `Organization Data` in the Account Schema ([Account Attributes for Organization Data](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/configure_indirect_role_assignment.html#account-attributes-for-organization-data>)).

##### Configuring Indirect Assignment Permissions

To fetch PD Profiles assigned indirectly to users via jobs, positions, or orgainizational units, ensure to provide following permissions for HRP1000 and HRV1017A table. HRP1000 stores object types (such as, organizational units, positions, jobs), whereas HRV1017A provides information about PD profiles.

| Authorization Objects | Field Name | Field Description | Field Value |
| --- | --- | --- | --- |
| S\_TABU\_NAM (To aggregate PD Profiles directly assigned to User) | Activity: 03, Table Name | Table affected by the operation | HRP1000, HRV1017A |

The tables below list the permissions required for the service account. For more information on service account permissions, refer to [Configuration Table for SAP Direct](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/sailpoint_add_on.html#configuration-table-for-sap-direct>).

| SERVICE\_ACCOUNT | NAME | COLUMNNAME | ENTITY\_TYPE | COLUMN\_DNAME | COLUMN\_DTYPE | COLUMN\_LENGTH |
| --- | --- | --- | --- | --- | --- | --- |
| \\\<your-service-account-name\> | HRP1000 | ENDDA | TABLE | ENDDATUM | D | 8 |
| \\\<your-service-account-name\> | HRP1000 | LANGU | TABLE | LANGU | C | 2 |
| \\\<your-service-account-name\> | HRP1000 | OBJID | TABLE | HROBJID | N | 8 |
| \\\<your-service-account-name\> | HRP1000 | OTYPE | TABLE | OTYPE | C | 2 |
| \\\<your-service-account-name\> | HRP1000 | PLVAR | TABLE | PLVAR | C | 2 |
| \\\<your-service-account-name\> | HRV1017A | OBJID | TABLE | OBJID | N | 8 |
| \\\<your-service-account-name\> | HRV1017A | PROFL | TABLE | PROFL | C | 12 |

> [!NOTE]
>
> PD Profile assigned via a Role in the SAP Direct managed system can be viewed under the `Authorization Objects` attribute of the group in the Entitlement Schema.

### Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

| Privilege Level | Description |
| --- | --- |
| High | Administrative level access to accounts |
| Medium | Administrative level access for a specific role or function |
| Low | Only basic access of data |

> [!NOTE]
>
> To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.

For more information, refer to [Managing Privilege Classification](<https://documentation.sailpoint.com/saas/help/loading_entitlements/privilege_classification.html>).

> [!NOTE]
>
> **Example**
>
> [![Privilege Classification example](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/privilege_high.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/privilege_high.png>)

## Supported Managed Systems

The SailPoint SAP Direct connector supports the managed system versions listed on this page.

> [!NOTE]
>
> SailPoint for SAP ERP manages ABAP users. For more information, refer to [Supported Features](<#supported-features>).

- SAP NetWeaver 7.51 and above
- SAP Enterprise Resource Planning (ERP) Central Component (ECC) 6.0 with EHP8 (Enhancement package 8)
- SAP S/4HANA (On-premises)

  - Version 2021 up to FP/SP Stack 05
  - Version 2022 up to FP/SP Stack 04
  - Version 2023 up to FP/SP Stack 03
  - Version 2025 Initial Shipment Stack
- SAP Business Warehouse
- SAP Customer Relationship Management (CRM)
- SAP Process Integration (PI)
- SAP Supply Chain Management (SCM)
- SAP Advanced Planning and Optimization (SAP APO)
- SAP\_MARKETING (Hybris Marketing)

> [!NOTE]
>
> SAP GRC connector works with SAP private cloud environments and supports SAP RISE solutions.

## Prerequisites

> [!IMPORTANT]
>
> SailPoint strongly recommends installing the SAP-certified add-on in the SAP environment and then using /SAILPOIN/SAIL\_READ\_TABLE instead of RFC\_READ\_TABLE.

- Configure at least one virtual appliance cluster and successfully test the connection. For instructions, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
- The JCO libraries (JCO Release 3.1.X) must be downloaded from the SAP website by going to the customer service marketplace and downloading the Java Integration Module.

  SAP JCO version 3.1.X libraries, `libsapjco3.so` (on UNIX), must be present in the `java.library.path` (*WEB-INF/lib*) directory on the VA host. Upload these `.jar` and `.so` files on the Basic Configuration page.

  For more information on downloading the `.jar` files, refer to [Obtaining the Custom Connector Files](<https://community.sailpoint.com/knowledge/Obtaining-the-Custom-Connector-Files-Required-for-SAP-and-SAP-HR>). Ensure these jar files are compatible with the VA.
- The following ports must be open on the SAP system:

  > **Note**
  >
  > "" represents the system number.

  | Port Name | Service in `etc/services` | Default | Range | Rule |
  | --- | --- | --- | --- | --- |
  | SAP Dispatcher | sapdp | 3200 | 3200-3299 | 32 |
  | Gateway | sapgw | 3300 | 3300-3399 | 33 |
  | Gateway secured | sapgws | 4800 | 4800-4899 | 48 |

## Required Permissions

This document describes the permissions required for users to perform operations on the SAP Direct source.

For the SAP Direct source, the service account is an administrative account. The following tables list the permissions associated with different operations on SAP authorization objects. The tables include the SAP fields used to specify the permissions.

> [!NOTE]
>
> The RFC\_READ\_TABLE integration function module has been deprecated, and replaced with the ABAP Function module. For more information on configuration, refer to [SailPoint Add-On to replace the use of RFC\_READ\_TABLE](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/sailpoint_add_on.html>).

The following table lists the required permissions for specific operations:

> [!NOTE]
>
> There are additional permissions for change password with Secure Network Communication (SNC) below.

| Operation | Required Permissions |
| --- | --- |
| Test Connection | Test Connection |
| Account Aggregation | Test Connection and Account Aggregation. For Account Aggregation of CUA systems, additional permissions must be executed as specified in the Account Aggregation section.<br><br>For information on Additional Permissions for SAP UUID (Global User ID) and Additional Permissions to update the SAP UUID (Global User ID) for a user, refer to [SAP UUID (Global User ID)](<#sap-uuid-global-user-id>). |
| Entitlement Aggregation | Test Connection and Entitlement Aggregation. For Group Aggregation in CUA systems, additional permissions must be executed as specified in the Entitlement Aggregation section. |
| Delta Aggregation | Test Connection, Account Aggregation and Delta Aggregation |
| Create Account | Test Connection, Account Aggregation and Create Account. For Create Account in CUA systems or a SNC network, additional permissions must be executed as specified in the Create Account section. |
| Enable/Disable/Unlock Account | Enable/Disable/Unlock Account, Account Aggregation and Enable/Disable/Unlock Account |
| Delete Account | Test Connection, Account Aggregation and Delete Account |
| Add/Remove Entitlement | Test Connection, Account Aggregation and Add/Remove Entitlements |
| Change Password | Test Connection, Account Aggregation and Change Password. For Change Password in a SNC network, additional permissions must be executed as specified in the Add/Remove Entitlements and Change Password sections. |

> [!NOTE]
>
> **Test Connection**
>
> | Authorization Object | Field Name | Field Description | Field Value |
> | --- | --- | --- | --- |
> | S\_RFC | ACTVT | Activity | `16 - Execute` |
> | S\_RFC | RFC\_NAME | Name of RFC object | RFCPING |
> | S\_RFC | RFC\_TYPE | Type of RFC object | FUGR, FUNC |

> [!NOTE]
>
> **Account Aggregation**
>
> > **Note**
> >
> > To open a profile object with blank text when aggregating accounts from SAP Direct version 750 and earlier, you can use the new `USR11` admin permission field value in the Table Name field of the S\_TABU\_NAM Authorization Object.
>
> | Authorization Objects | Field Name | Field Description | Field Value |
> | --- | --- | --- | --- |
> | S\_RFC | Activity: 16, RFC\_NAME | Name of RFC object | Add the following:<br>**Function Modules (FUNC):**<br>`BAPI_USER_GETLIST`<br>`BAPI_USER_GET_DETAIL`<br>`DDIF_FIELDINFO_GET`<br>`RFC_METADATA_GET`<br>**Function Groups (FUGR):**<br>`SDTX`<br>`SMSSDATA1`<br>`SU_USER`<br>Based on the options configured in the UI, select one of the three options below:<br>\- Add this permission: `RFC_READ_TABLE`. Note: SailPoint will continue to support the RFC\_READ\_TABLE in accordance with our depreciation policies. SailPoint recommends that you start planning to move to use SailPoint's Function Module.<br>\- Add this permission to use SailPoint's Function Module instead of RFC\_READ\_TABLE if your SAP\_BASIS version is 740, Support Package 08, up to BASIS 750: `/SAILPOIN/SAIL_READ_TABLE_LEG`<br>\- Add this permission to use SailPoint's Function Module instead of `RFC_READ_TABLE` if your SAP\_BASIS version is 751 and later: `/SAILPOIN/SAIL_READ_TABLE`. Note: If you configure the permissions for SailPoint's function module then remove RFC\_READ\_TABLE value from S\_RFC authorization object.<br><br>To aggregate Organization Data, add the following:<br>**For FUNC:** `BAPI_EMPLOYEE_GETDATA`<br>**For FUGR:** `RFC_METADATA` |
> | S\_TABU\_NAM | ACTVT | Activity | `03 - Display` |
> | S\_TABU\_NAM | Activity: 03, Table Name | Table affected by the operation | Add the following:<br>`USR11`, `USR06`, `USR02`, `TUTYP`, `TUTYPA`, `CVERS`, `PRDVERS`<br><br>To aggregate Organization Data, add the following:<br>`PA0105` |
> | S\_USER\_GRP | ACTVT | Activity | `03 - Display` |
> | S\_USER\_GRP | CLASS | User group in user master maintenance | \* or specify the Group you want to assign for the user. For example: `SUPER` |
> | P\_Orgin (To aggregate Organization data) | AUTH | Authorization Level | R |
> | P\_Orgin (To aggregate Organization data) | INFTY | INFOTYPE | 0001 |
> | P\_Orgin (To aggregate Organization data) | PERSA | Personal area | \* |
> | P\_Orgin (To aggregate Organization data) | PERSG | Employee group | \* |
> | P\_Orgin (To aggregate Organization data) | SUBTYPE | SUBTY | \* |
> | P\_Orgin (To aggregate Organization data) | PERSK | Employee subgroup | \* |
> | P\_Orgin (To aggregate Organization data) | VDSK1 | Organization Key | \* |

> [!NOTE]
>
> **Additional Permissions for Central User Administration (CUA) Systems**
>
> | Authorization Objects | Field Name | Field Description | Field Value |
> | --- | --- | --- | --- |
> | S\_RFC | RFC\_NAME | Name of RFC object | Add the following:<br>**Function Modules (FUNC):**<br>`BAPI_USER_LOCACTGROUPS_READ`<br>`BAPI_USER_LOCPROFILES_READ` |

> [!NOTE]
>
> **Entitlement Aggregation**
>
> | Authorization Objects | Field Name | Field Description | Field Value |
> | --- | --- | --- | --- |
> | S\_RFC | ACTVT | Activity | `16-Execute` |
> | S\_RFC | Activity: 16, RFC\_NAME | Name of RFC object | Add the following:<br>**Function Modules (FUNC):**<br>`BAPI_HELPVALUES_GET`<br>`PRGN_ACTIVITY_GROUPS_LOAD_RFC`<br>`PRGN_EXCHANGE`<br>`COLL_ACTGROUPS_GET_ACTGROUPS`<br>`DDIF_FIELDINFO_GET`<br>`MSS_GET_SY_DATE_TIME`<br>`RFC_GET_FUNCTION_INTERFACE`<br>**Function Groups (FUGR):**<br>`PRGN_COLLECTIVE_ACTGROUPS`<br>`SDTX`<br>`SMSSDATA1`<br>Based on the options configured in the UI, select one of the three options below:<br>\- Add this permission: `RFC_READ_TABLE`. Note: SailPoint will continue to support the `RFC_READ_TABLE` in accordance with our deprecation policies. SailPoint recommends that you start planning to move to use SailPoint's Function Module.<br>\- Add this permission if your SAP\_BASIS version is 740 Support Package 08 or later: `/SAILPOIN/SAIL_READ_TABLE_LEG`<br>\- Add this permission to use SailPoint's Function Module instead of `RFC_READ_TABLE` if your SAP\_BASIS version is 751 and later: `/SAILPOIN/SAIL_READ_TABLE`. Note: If you configure the permissions for SailPoint's Function Module, then remove the `RFC_READ_TABLE` value from the S\_RFC authorization object. |
> | S\_TABU\_NAM | Table Name | Table | Roles: `AGR_FLAGS, AGR_PROF, AGR_TCODES, AGR_TEXTS,USGRP,USGRPT`<br>Profiles: `AGR_DEFINE, USR11, UST10C, UST10S`<br><br>To aggregate Authorization Objects associated with a role: `AGR_1251, AGR_1252`. Note: If you do not want to aggregate Authorization Objects AGR\_1251 and AGR\_1252, omit the permissions and remove them from schema.<br><br>To aggregate Organization Data and Indirect Roles, add the following: `HRP1000`, `HRP1001` |
>
> > **Note**
> >
> > Group aggregation specific to Authorization Objects are not supported for the SAP CUA system.

> [!NOTE]
>
> **Additional Permissions for CUA Systems**
>
> | Authorization Objects | Field Name | Field Description | Field Value |
> | --- | --- | --- | --- |
> | S\_TABU\_NAM | Table Name | Table | Profiles<br>`USRSYSPRF`<br>`USRSYSPRFT`<br>Roles<br>`USRSYSACTT`<br>`USRSYSACT` |

> [!NOTE]
>
> **Delta Aggregation**
>
> | Authorization Objects | Field Name | Field Description | Field Value |
> | --- | --- | --- | --- |
> | S\_RFC | RFC\_NAME | Name of RFC object | Add the following: `/SAILPOIN/USR_CHANGE_DOC_USERS`, `/SAILPOIN/IDENTITYIQ_FUGR`, `/SAILPOIN/USR_CHANGE_DOC_ROLES` |
> | S\_TABU\_NAM | Table Name | Table affected by the operation | `USBAPILINK` |
> | S\_USER\_GRP | ACTVT | Activity | `08 - Display change document` |

> [!NOTE]
>
> **Create Account**
>
> Create user with assigned role and profiles.
>
> | Authorization Objects | Field Name | Field Description | Field Value |
> | --- | --- | --- | --- |
> | S\_USER\_GRP | ACTVT | Activity | `01 - Create or generate` |
> | S\_RFC | RFC\_NAME | Name of RFC object | **Function Modules (FUNC):**<br>`BAPI_USER_ACTGROUPS_ASSIGN`<br>**Function Groups (FUGR):**<br>`SDIFRUNTIME` |
> | S\_USER\_SAS | ACTVT | Activity | Add the following: `22 - Enter`, `Include`, `Assign`, `01 - Create` |
> | S\_USER\_SAS | ACT\_GROUP | Role name | \* or you can specify role name for which you have assigned |
> | S\_USER\_SAS | CLASS | User group in user master maintenance | \* or specify the Group you want to assign for the user. For example `SUPER` |
> | S\_USER\_SAS | PROFILE | Auth. profile in user master maintenance | \* or you can specify Profile for which you have assigned |
> | S\_USER\_SAS | SUBSYSTEM | Receiving system for central user administration | \* or specify the system you are targeting |

> [!NOTE]
>
> **Enable/Disable/Unlock Account**
>
> | Authorization Objects | Field Name | Field Description | Field Value |
> | --- | --- | --- | --- |
> | S\_USER\_GRP | ACTVT | Activity | `05 - Lock` |

> [!NOTE]
>
> **Delete Account**
>
> | Authorization Objects | Field Name | Field Description | Field Value |
> | --- | --- | --- | --- |
> | S\_USER\_GRP | ACTVT | Activity | `06 - Delete` |

> [!NOTE]
>
> **Add/Remove Entitlements**
>
> | Authorization Objects | Field Name | Field Description | Field Value |
> | --- | --- | --- | --- |
> | S\_RFC | RFC\_NAME | Name of RFC object | **Function Groups (FUGR):** `SDIFRUNTIME` |
> | S\_USER\_SAS | ACTVT | Activity | Add the following: `22 - Enter`, `Include`, `Assign` |
> | S\_USER\_SAS | ACT\_GROUP | Role name | \* or you can specify role name for which you have assigned |
> | S\_USER\_SAS | CLASS | User group in user master maintenance | \* or specify the Group you want to assign for the user. For example: `SUPER` |
> | S\_USER\_SAS | PROFILE | Authentication profile in user master maintenance | \* or you can specify Profile for which you have assigned |
> | S\_USER\_SAS | SUBSYSTEM | Receiving system for central user administration | \* or specify the system you are targeting |
> | S\_USER\_AGR | ACTVT | Activity | `02-change` |
> | S\_USER\_AGR | ACT\_GROUP | Role Name | \* or you can specify role name for which you want to provide access |
> | S\_USER\_PRO | ACTVT | Activity | Add the following: `22 - Enter`, `Include`, `Assign` |
> | S\_USER\_PRO | PROFILE | Auth. profile | \* or you can specify profile name for which you want to provide access |
> | S\_USER\_GRP | ACTVT | Activity | Add the following: `22 - Enter`, `Include`, `Assign`, `78 - Assign` |
> | S\_USER\_GRP | CLASS | User group in user master maintenance | \* or specify the group you want to assign or remove for the user |

> [!NOTE]
>
> **Change Password**
>
> | Authorization Objects | Field Name | Field Description | Field Value |
> | --- | --- | --- | --- |
> | S\_USER\_GRP | ACTVT | Activity | Add the following: `02 - Change`, `05 - Lock`, `78 - Assign` |

> [!NOTE]
>
> **(For Change Password only) For SNC (Secure Network Communication)**
>
> | Authorization Objects | Field Name | Field Description | Field Value |
> | --- | --- | --- | --- |
> | S\_USER\_GRP | ACTVT | Activity | `PP - Set Productive` |

> [!NOTE]
>
> **Provision EmployeeID (Link username with the System user name for SAP HR)**
>
> For more information on table-level permissions, refer to [Configuration Table for SAP Direct](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/sailpoint_add_on.html#configuration-table-for-sap-direct>).
>
> | Authorization Objects | Field Name | Field Description | Field Value |
> | --- | --- | --- | --- |
> | S\_RFC | ACTVT | Activity | `16-Execute` |
> | S\_RFC | RFC\_NAME | Name of RFC object | Add the following:<br>**Function Modules (FUNC):**<br>`BAPI_EMPLCOMM_CHANGE`<br>`BAPI_EMPLCOMM_CREATE`<br>`BAPI_EMPLOYEE_ENQUEUE`<br>`BAPI_EMPLOYEE_DEQUEUE`<br>`BAPI_EMPLOYEE_GETDATA`<br>`BAPI_EMPLOYEE_CHECKEXISTENCE`<br>`BAPI_EMPLCOMM_GETDETAILEDLIST` |
> | P\_Orgin | AUTHC | Authorization Level | Add the following: `E`, `S`, `W` |
> | P\_Orgin | INFTY | INFOTYPE | `0105` |
> | P\_Orgin | PERSA | Personal area | \* |
> | P\_Orgin | PERSG | Employee group | \* |
> | P\_Orgin | SUBTYPE | SUBTY | \* |
> | P\_Orgin | PERSK | Employee subgroup | \* |
> | P\_Orgin | VDSK1 | Organization Key | \* |
> | S\_USER\_GROUP | ACTIVITY | Activity | `03` |
> | S\_USER\_GROUP | CLASS | User group in user master maintenance | \* |

> [!NOTE]
>
> **Permissions for Organization Data Aggregation**
>
> Refer to the following for information about configuring permissions to aggregate Organization Data:
>
> - Account Aggregation
> - Entitlement Aggregation
> - [Required Service Account Permissions for Organization Data](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/configure_indirect_role_assignment.html#required-service-account-permissions-for-organization-data>)

# Machine Account Attributes

Machine account creation uses the same source attributes as standard account creation. For the complete list of supported attributes and their descriptions, refer to [Create Account](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/provisioning.html#provisioning-policy-attributes>).

## Classification

The Classification attribute is used to identify and categorize the account as a Machine Account.

- Attribute name: `UserType`
- Value: Communication, Reference, Service, System.

For more information, refer to [Machine Identity Security Overview](<https://documentation.sailpoint.com/saas/help/machine/index.html#implementing-without-application-data>).

# Provisioning

The SAP Direct connector supports provisioning, allowing you to create and manage accounts and entitlements in SAP Direct directly from SailPoint.

**Prerequisite:** Your system is configured for provisioning.

When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*.

When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.

For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.

> [!IMPORTANT]
>
> This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.

## Provisioning Policy Attributes

The following generators create required information for a new SAP Direct account. You may need to edit the contents.

Some of the values needed to create a SAP Direct account require a generator which compiles the appropriate attribute value based on a variety of information.

> [!NOTE]
>
> To add user-friendly definitions for entitlements on direct connect sources, refer to [Managing Entitlements](<https://documentation.sailpoint.com/saas/help/access/entitlements.html>).

| Account Attribute | Generator | Description |
| --- | --- | --- |
| User name | Create Unique Account ID | This generator uses the value in the **Pattern Used** field to generate a unique user name for the new account. |
| password | Create Password | This generator creates an initial password for the new account that matches the password policy assigned to the associated SAP Direct source. |
| Last name | Identity Attribute | Last name of the user. |

The following list contains the provisioning policy attributes for Create/Modify Account:

> [!NOTE]
>
> The attributes marked with an asterisk (\*) are required attributes.

| Attribute Name | Description |
| --- | --- |
| User Name\* | Name of the user to create |
| password | Password for the user |
| Last Name\* | Last name of the user |

## Entitlement Validity Period

The user can be assigned a SAP Role with Start Date and an End Date. The ability to select or specify the same, while requesting an entitlement for an account, is available in SAP Direct by creating a custom Provisioning Plan.

Following is the Sample attribute request when assignment dates are in Date format:

```json
[
  {
   "AttributeRequest": {
        "name": "Roles",
        "op": "Add",
        "value": "SAP_AUDITOR_SA",
        "attributes": {
            "assignment": true,
            "startDate": 1441195751000,
            "endDate": 1441449381000
            }
        }
  },
  {
  "AttributeRequest": {
        "name": "Roles",
        "op": "Set",
        "value": "SAP_AUDITOR_SA",
        "attributes": {
            "assignment": true,
            "startDate": 1441195751000,
            "endDate": 1441449381000
         }
    }
 }  
]
```

Following is the Sample attribute request when assignment dates are in String format:

```json
[
  {
    "AttributeRequest": {
      "name": "Roles",
      "op": "Add",
      "value": "SAP_BC_DB_ADMIN",
      "Attributes": {
        "Map": {
          "assignment": "true",
          "startDate": "2014-1-1",
          "endDate": "2015-2-2"
        }
      }
    }
  },
  {
    "AttributeRequest": {
      "name": "Roles",
      "op": "Set",
      "value": "SAP_BC_DB_ADMIN",
      "Attributes": {
        "Map": {
          "assignment": "true",
          "startDate": "2014-1-1",
          "endDate": "2015-2-2"
        }
      }
    }
  }
]
```

## Password Management

If Password Management is enabled for your organization, you can change the password for a user of the source. After enabling password management on the source, be aware of the following:

- The password policy defined in SailPoint applies to accounts on this source.
- If you change the password for an application connected to this source, the change will automatically be made to the source itself.

For more information on configuring password management, refer to [Password Management Overview](<https://documentation.sailpoint.com/saas/help/pwd/index.html>).

# SailPoint Add-On to replace the use of RFC\_READ\_TABLE

SailPoint's ABAP Integration is designed to replace the functionality of SAP's RFC\_READ\_TABLE to securely access the information in the SAP system required for deeper governance.

> [!IMPORTANT]
>
> SailPoint strongly recommends installing the SAP-certified add-on in the SAP environment and then using /SAILPOIN/SAIL\_READ\_TABLE instead of RFC\_READ\_TABLE.

This integration needs to be deployed on the SAP Direct system for querying the SAP Direct tables. For the deployment process follow these instructions in order:

1. [Installation of SAILPOIN Add-On](<#installation-of-sailpoin-add-on>)
2. [Configuring SailPoint's Function Module](<#configuring-sailpoints-function-module>)
3. Configuration Table for SAP Direct (see the connector-specific configuration table section below)

## Prerequisites

To install the Add-On and support packages using the SAINT transaction code (t-code), follow these steps:

1. Log into client 000.
2. Ensure that you have installed at least **SPAM/SAINT** version 0053 to be able to uninstall Add-Ons using the **SAINT** t-code.
3. Deselect the digital signature setting in **SAINT** t-code:

   1. Go to **SAINT** t-code.
   2. Select **Extras**.
   3. Choose **Setting**.
   4. Deselect the **Check for digital signature of to be imported OCS Packages**.
4. Proceed with installing the Add-On and support packages using the **SAINT** t-code.

> [!NOTE]
>
> **Screenshot**
>
> [![SAINT t-code](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/sap_saint.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/sap_saint.png>) [![Add-On prerequisites](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/add_on_prereq.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/add_on_prereq.png>)

## Installation of SAILPOIN Add-On

> [!NOTE]
>
> If Add-on is already installed, reference [Importing Support Packages for Add-On SAILPOIN](<#importing-support-packages-for-add-on-sailpoin>).

1. Download the PAT file(s) for the Add-On and all the required support packages from the [Package Download Matrix](<#package-download-matrix>).

   > **Note**
   >
   > The PAT file is a special file used to package the SAP Add-on. If you install the add-on using SPAM/SAINT, the contents of the PAT file will be extracted (disassembled) to your transport directory.
2. Copy the .PAT file on your server location for the Add-On **and** all the required support packages:

   Server Location: (Windows : `<DRIVE>:\usr\sap\trans\EPS\in` ; Linux/Unix : `/usr/sap/trans/EPS/in`).
3. Login to SAP GUI, and then execute the Tcode **SAINT**.

   > **Screenshot**
   >
   > [![SAINT t-code](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/sap_saint.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/sap_saint.png>)
4. Go to **Installation Package \> Load Packages \> EPS Files From Application Server**.

   > **Screenshot**
   >
   > [![Load Packages](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/load_packages.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/load_packages.png>)
5. Ensure the following PAT file(s) uploaded successfully:

   > **Screenshot**
   >
   > [![Uploaded PAT files](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/uploaded_pat_files.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/uploaded_pat_files.png>)
6. Select **Start**.
7. Select **SAILPOIN** from the **Installable Add-on Package packages for your system** grid.

   > **Screenshot**
   >
   > [![SAILPOIN package](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/select_sailpoin_package.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/select_sailpoin_package.png>)
8. Select **Continue**.
9. To install the Add-On and support package(s), perform the following:

   1. Select the highest version from the available support package(s) under the **Target Support Package** drop down of the component **SAILPOIN**.

      > **Screenshot**
      >
      > [![Target Support Package](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/target_support_package.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/target_support_package.png>)
   2. The column **Level** should indicate the chosen target support package.

      > **Screenshot**
      >
      > [![Support package level](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/support_package_level.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/support_package_level.png>)
10. Select **Continue**.
11. On the **Add Modification Adjustment Transports to the Queue** dialog, select **No**.

    > **Screenshot**
    >
    > [![Modification Adjustment Transports](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/modification_adjustment_transports.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/modification_adjustment_transports.png>)
12. If prompted on the **Start Options** dialog box, select **Continue**.

    > **Screenshot**
    >
    > [![Start Options](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/start_options.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/start_options.png>)

    > **Note**
    >
    > The Add-on and the support package(s) will begin installing, and the progress can be seen at the bottom of the window.
13. Select **Finish**. If prompted to send Runtime Analysis, select **Do not send**.
14. Go to **System \> Status \> Details \> Installed Software Component Versions** to confirm the following:

    1. The Add-On **and** the support packages have been added in the system component.

       > **Screenshot**
       >
       > [![Installed Software Component Versions](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/installed_software_components.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/installed_software_components.png>)

## Configuring SailPoint's Function Module

> [!NOTE]
>
> Configure any one function module based on your SAP\_BASIS version.

Use the /SAILPOIN/SAIL\_READ\_TABLE function module to support systems whose SAP BASIS version is 751 and later.

This is a SAP-certified function module provided by SailPoint to replace the use of SAP's RFC\_READ\_TABLE function module, according to SAP recommendations, for reading data from SAP tables required for governance.

The /SAILPOIN/SAIL\_READ\_TABLE provides enhanced security, support for pagination, and performance improvements over the RFC\_READ\_TABLE. For more information on the deployment process, refer to [Installation of SAILPOIN Add-On](<#installation-of-sailpoin-add-on>).

> [!IMPORTANT]
>
> - SailPoint recommends having SAP BASIS version 751 and above for seamless functionality of the ABAP add-on. However, for lower BASIS versions, /SAILPOIN/SAIL\_READ\_TABLE\_LEG can be tried with limited support from SailPoint.
> - RFC\_READ\_TABLE-based connections are deprecated, and it is recommended to use the SAP-certified add-on instead.

## Configuration Table for SAP Direct

Insert the below data into the `/SAILPOIN/CONF` table:

| Attribute | Description |
| --- | --- |
| SERVICE\_ACCOUNT | This is the allowed service account to be used for accessing FM. |
| NAME | Name of entity from which data is fetched. For now we can consider it as a table name. |
| COLUMN\_NAME | Column allowed for fetching data |
| ENTITY\_TYPE | Type of entity such as table, join, or any other. This is for future purposes. |
| COLUMN\_DTYPE | Data type of the column that is allowed. |
| COLUMN\_DENAME | Data element type of the column. **Data element type** can be found by using t-code `SE11` when viewing the table details under the **Fields** tab. |
| COLUMN\_LENGTH | Length of the allowed column. The Length can be found by using t-code `SE11` when viewing the table's details, under the **Fields** tab. |

> [!NOTE]
>
> Validate that the values for `COLUMN_DENAME` and `COLUMN_LENGTH` are correct as per your system. These can be validated through the t-code `SE11` while viewing the table details under the **Fields** tab.

### Inserting Data with a Script

#### Setting Up the Script

- Enter t-code `SE38` and then create program `Z_CONFIGURE_SERVICEACCOUNT` in the local object package and type as an executable program.
- Copy and paste the [SailPoint SAP ABAP Add-on Table Configuration script](<https://community.sailpoint.com/knowledge/SailPoint-SAP-ABAP-Add-on-Table-Configuration>) and activate the program.
- For better readability of the input parameters edit the selection text from **Go to \> Text Element \> Selection Text** and update it as shown in the following image.

> [!NOTE]
>
> **Screenshot**
>
> [![Selection text](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/config_table_script_1.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/config_table_script_1.png>)

- Save and activate the program.

#### Running the Script

- Enter t-code `SE38` and then search for program `Z_CONFIGURE_SERVICEACCOUNT`. Select **execute**.
- Enter the service account and integration module to be populated respectively.

> [!NOTE]
>
> **Screenshot**
>
> [![Enter service account](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/config_table_script_3.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/config_table_script_3.png>)

- Once you have entered the details correctly, select **execute** and you will see a success message.

> [!NOTE]
>
> **Screenshot**
>
> [![Success message](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/config_table_script_2.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/config_table_script_2.png>)

### Inserting Data with Transaction SE16

Enter **SE16 \> Table Name: /SAILPOIN/CONF \> Create Entries**.

> [!NOTE]
>
> **Screenshot**
>
> [![SE16 table entry](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/config_table_se16_1.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/config_table_se16_1.png>)

The option to enter the data into the table will appear.

> [!NOTE]
>
> **Screenshot**
>
> [![SE16 data entry](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/config_table_se16_2.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/config_table_se16_2.png>)

| SERVICE\_ACCOUNT | NAME | COLUMNNAME | ENTITY\_TYPE | COLUMN\_DNAME | COLUMN\_DTYPE | COLUMN\_LENGTH |
| --- | --- | --- | --- | --- | --- | --- |
| \<your-service-account-name\> | AGR\_1251 | AGR\_NAME | TABLE | AGR\_NAME | C | 10 |
| \<your-service-account-name\> | AGR\_1251 | DELETED | TABLE | TPR\_ST\_DEL | C | 40 |
| \<your-service-account-name\> | AGR\_1251 | FIELD | TABLE | AGRFIELD | C | 40 |
| \<your-service-account-name\> | AGR\_1251 | HIGH | TABLE | AGVAL | C | 40 |
| \<your-service-account-name\> | AGR\_1251 | LOW | TABLE | AGVAL | C | 30 |
| \<your-service-account-name\> | AGR\_1251 | OBJECT | TABLE | AGOBJECT | C | 40 |
| \<your-service-account-name\> | AGR\_1252 | AGR\_NAME | TABLE | AGR\_NAME | C | 40 |
| \<your-service-account-name\> | AGR\_1252 | HIGH | TABLE | AGVAL | C | 40 |
| \<your-service-account-name\> | AGR\_1252 | LOW | TABLE | AGVAL | C | 30 |
| \<your-service-account-name\> | AGR\_1252 | VARBL | TABLE | AGRORGVAR | C | 30 |
| \<your-service-account-name\> | AGR\_DEFINE | AGR\_NAME | TABLE | AGR\_NAME | C | 10 |
| \<your-service-account-name\> | AGR\_FLAGS | AGR\_NAME | TABLE | AGR\_NAME | C | 30 |
| \<your-service-account-name\> | AGR\_FLAGS | FLAG\_TYPE | TABLE | FLAG\_TYPE | C | 30 |
| \<your-service-account-name\> | AGR\_FLAGS | FLAG\_VALUE | TABLE | AGR\_ATT2 | C | 12 |
| \<your-service-account-name\> | AGR\_PROF | AGR\_NAME | TABLE | AGR\_NAME | C | 30 |
| \<your-service-account-name\> | AGR\_PROF | PROFILE | TABLE | XUPROFILE | C | 48 |
| \<your-service-account-name\> | AGR\_TCODES | AGR\_NAME | TABLE | AGR\_NAME | C | 01 |
| \<your-service-account-name\> | AGR\_TCODES | TCODE | TABLE | AGXREPORT | C | 02 |
| \<your-service-account-name\> | AGR\_TCODES | TYPE | TABLE | REPORTTYPE | C | 02 |
| \<your-service-account-name\> | TUTYP | LANGU | TABLE | SPRAS | C | 01 |
| \<your-service-account-name\> | TUTYP | USERTYP | TABLE | USERTYPEN | C | 02 |
| \<your-service-account-name\> | TUTYP | UTYPLONGTEXT | TABLE | SLIM\_LONG\_TEXT55 | C | 55 |
| \<your-service-account-name\> | TUTYP | UTYPTEXT | TABLE | UTYPTEXT | C | 30 |
| \<your-service-account-name\> | TUTYPA | ACTIVE | TABLE | RSUVMFLAG | C | 01 |
| \<your-service-account-name\> | TUTYPA | USERTYP | TABLE | USERTYPEN | C | 02 |
| \<your-service-account-name\> | USR02 | BNAME | TABLE | XUBNAME | C | 12 |
| \<your-service-account-name\> | USR02 | LTIME | TABLE | XULTIME | T | 06 |
| \<your-service-account-name\> | USR02 | PWDSTATE | TABLE | PWDCHGSTATE | B | 03 |
| \<your-service-account-name\> | USR02 | TRDAT | TABLE | XULDATE | D | 08 |
| \<your-service-account-name\> | USR11 | LANGU | TABLE | SPRAS | C | 02 |
| \<your-service-account-name\> | USR11 | PROFN | TABLE | XUPROFNAME | C | 12 |
| \<your-service-account-name\> | USR11 | PTEXT | TABLE | XUTEXT | C | 60 |
| \<your-service-account-name\> | USR11 | TRDAT | TABLE | SPRAS | C | 01 |
| \<your-service-account-name\> | USRSYSACTT | AGR\_NAME | TABLE | F\_AGR\_NAME | C | 30 |
| \<your-service-account-name\> | USRSYSACTT | LANGU | TABLE | LANGU | C | 01 |
| \<your-service-account-name\> | USRSYSACTT | SUBSYSTEM | TABLE | RFCRCVSYS | C | 10 |
| \<your-service-account-name\> | USRSYSACTT | TEXT | TABLE | AGR\_TITLE | C | 80 |
| \<your-service-account-name\> | USRSYSPRF | TYP | TABLE | XUTYP | C | 01 |
| \<your-service-account-name\> | USRSYSPRFT | LANGU | TABLE | LANGU | C | 01 |
| \<your-service-account-name\> | USRSYSPRFT | PROFN | TABLE | XUPROFNAME | C | 12 |
| \<your-service-account-name\> | USRSYSPRFT | PTEXT | TABLE | XUTEXT | C | 60 |
| \<your-service-account-name\> | UST10C | PROFN | TABLE | XUPROFILE | C | 12 |
| \<your-service-account-name\> | UST10C | SUBPROF | TABLE | XUPROFILE | C | 12 |
| \<your-service-account-name\> | UST10S | PROFN | TABLE | XUPROFILE | C | 12 |
| \<your-service-account-name\> | USRSYSACT | SUBSYSTEM | TABLE | RFCRCVSYS | C | 10 |
| \<your-service-account-name\> | USRSYSACT | AGR\_NAME | TABLE | F\_AGR\_NAME | C | 30 |
| \<your-service-account-name\> | USRSYSACT | COL\_AGR | TABLE | XUFLAG | C | 4 |
| \<your-service-account-name\> | AGR\_TEXTS | AGR\_NAME | TABLE | AGR\_NAME | C | 30 |
| \<your-service-account-name\> | AGR\_TEXTS | LINE | TABLE | MENU\_NUM\_S | N | 5 |
| \<your-service-account-name\> | AGR\_TEXTS | SPRAS | TABLE | MENU\_SPRAS | C | 1 |
| \<your-service-account-name\> | AGR\_TEXTS | TEXT | TABLE | AGR\_TITLE | C | 80 |
| \<your-service-account-name\> | USGRP | USERGROUP | TABLE | XUCLASS | C | 12 |
| \<your-service-account-name\> | USGRPT | USERGROUP | TABLE | XUCLASS | C | 12 |
| \<your-service-account-name\> | USGRPT | SPRSL | TABLE | SPRAS | L | 1 |
| \<your-service-account-name\> | USGRPT | TEXT | TABLE | XUTEXT | C | 60 |

For Group Aggregation in CUA systems, additional permissions are required as follows:

| SERVICE\_ACCOUNT | NAME | COLUMNNAME | ENTITY\_TYPE | COLUMN\_DNAME | COLUMN\_DTYPE | COLUMN\_LENGTH |
| --- | --- | --- | --- | --- | --- | --- |
| \<your-service-account-name\> | USRSYSPRF | SUBSYSTEM | TABLE | RFCRCVSYS | C | 10 |
| \<your-service-account-name\> | USRSYSPRF | PROFN | TABLE | XUPROFNAME | C | 12 |

## Importing Support Packages for Add-On SAILPOIN

### Prerequisites

- Add-On "SAILPOIN" is already installed in your SAP SAP Direct system.
- You are logged into client 000.
- You can import support packages using SPAM t-code.

### Installation

1. Download the PAT file(s) for the support packages from the [Package Download Matrix](<#package-download-matrix>).
2. Copy the PAT file(s) on your server location:

   (Windows : `<DRIVE>:\usr\sap\trans\EPS\in` ; Linux/Unix : `/usr/sap/trans/EPS/in`).
3. Sign in to the SAP GUI and execute the SPAM t-code. The status of the queue for importing support package should be green as shown in the following figure.

   > **Screenshot**
   >
   > [![SPAM t-code](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_0.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_0.png>)
4. Go to **Installation Package \> Load Packages \> EPS Files From Application Server**.

   > **Screenshot**
   >
   > [![Load Packages](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_1.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_1.png>)
5. When prompted to upload OCS packages from the EPS inbox, select **Yes**.

   > **Screenshot**
   >
   > [![Upload OCS packages](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_2.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_2.png>)
6. Verify that the upload was successful.

   > **Screenshot**
   >
   > [![Upload verification](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_3.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_3.png>)
7. Select **Display/Define** to **choose** the software component for which you want to import Support Packages.

   > **Screenshot**
   >
   > [![Display/Define](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_4.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_4.png>)
8. Select the **SAILPOIN** component.

   > **Screenshot**
   >
   > [![Select SAILPOIN component](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_5.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_5.png>)
9. Confirm the queue by selecting **Continue**.

   > **Note**
   >
   > The queue in the image below shows the number of support packages that can be installed based on the PAT files placed on your server location. The below example shows importing 2 support packages.

   > **Screenshot**
   >
   > [![Confirm queue](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_6.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_6.png>)
10. When prompted to add the Modification Adjustment Transports to the queue, select **No**.

    > **Screenshot**
    >
    > [![Modification Adjustment Transports](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_7.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_7.png>)
11. Verify that the queue contains the intended support packages for import that were added/defined in the queue in the previous steps.

    > **Screenshot**
    >
    > [![Import queue](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_8.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_8.png>)
12. Go to **Support Package \> Import Queue**.

    > **Screenshot**
    >
    > [![Import Queue](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_9.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_9.png>)
13. Select **Continue** to import the queue.

    > **Screenshot**
    >
    > [![Continue import](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_10.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_10.png>)

    > **Note**
    >
    > The support package begins installing, and you can view the progress at the bottom of the window.
14. After the support package(s) are successfully imported, the below prompt should display. Select **Continue** to proceed with the import.

    > **Screenshot**
    >
    > [![Continue prompt](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_11.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_11.png>)
15. Confirm the queue by going to **Support Package \> Confirm**.

    > **Screenshot**
    >
    > [![Confirm queue](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_12.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_12.png>)
16. When prompted to send Runtime Analysis, select **Do not send**.
17. Go to **System \> Status \> Details \> Installed Software Component Versions** to confirm that the Add-on's support package is now set to the desired support package level. For example, **0002**.

    > **Screenshot**
    >
    > [![Installed Software Component Versions](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_13.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/importing_support_packages_13.png>)

## Package Download Matrix

### Overview

Use this page to identify and download the correct PAT files for the SailPoint SAP ABAP Add-on (SAILPOIN) before installation in your SAP system.

All PAT files are available from the SailPoint community download page: [SailPoint SAP ABAP Add-on PAT Files](<https://community.sailpoint.com/knowledge/SailPoint-SAP-ABAP-Add-on-PAT-Files>).

After you download the files, copy the PAT files to your SAP transport directory and install them using transaction `SAINT`. For step-by-step installation instructions, refer to [Installation of SAILPOIN Add-On](<#installation-of-sailpoin-add-on>).

### Package Types

| Package Type | Full Name | When to Use |
| --- | --- | --- |
| **AOI** | Add-On Installation Package | First-time installation of the SAILPOIN add-on on a new SAP system |
| **CSP** | Component Support Package | Updates to an already installed SAILPOIN add-on (support package level 0001, 0002, and so on) |
| **ACP** | Attribute Change Package | Dependency resolution only - use when SAINT reports dependency errors during add-on installation |

> [!NOTE]
>
> A PAT file is SAP's packaging format for add-ons and support packages. When you load a PAT file in SAINT, SAP extracts its contents into your transport directory.

### Selecting the Correct PAT File

#### Installing SAILPOIN for the First Time

1. Download the base AOI file.
2. Download the latest CSP file available for your release (currently SP-Level 0002).
3. If SAINT reports dependency errors, download the applicable ACP files from [Dependency Resolution Packages](<#dependency-resolution-packages>).

#### Updating an Installed SAILPOIN Add-On

1. Download only the CSP file for the target support package level.
2. Do not re-download the base AOI unless you are performing a fresh installation.

#### Resolving SAINT Dependency Errors

Download the ACP file that matches your installed SAP software components. Refer to [Dependency Resolution Packages](<#dependency-resolution-packages>).

### Release 100\_2022 Downloadable Packages

| Your Situation | Package Type | Support Package | PAT File Name |
| --- | --- | --- | --- |
| New installation (base add-on) | AOI (Add-On Installation Package) | Base component | `G750020862508_0000028.PAT` |
| Update to support package level 0001 | CSP (Component Support Package) | `SAPK-12201INSAILPOIN` | `G750020862508_0000032.PAT` |
| Update to support package level 0002 | CSP (Component Support Package) | `SAPK-12202INSAILPOIN` | `G750020862508_0000033.PAT` |

**Download link (all files):** [SailPoint SAP ABAP Add-on PAT Files](<https://community.sailpoint.com/knowledge/SailPoint-SAP-ABAP-Add-on-PAT-Files>)

### Dependency Resolution Packages

If installation fails with dependency errors, download and install the ACP file that matches the SAP software components already present in your system.

| If Your System Has These Installed Components | Download This ACP PAT File |
| --- | --- |
| DW4CORE, S4CORE, SAP\_GWFND | `G750020862508_0000076.PAT` |
| S4FND, MDG\_FND, SAP\_GWFND | `G750020862508_0000077.PAT` |

Install the ACP file before retrying the add-on or support package installation.

### Gathering Information for Support

If installation or support package import still fails after you use the correct PAT files, gather the information below before contacting SailPoint Support or your implementation partner. Complete details help SailPoint Support diagnose dependency, version, or transport issues faster.

#### Providing System Details

Provide:

| Field | What to Enter |
| --- | --- |
| **SAP module / landscape** | On-prem ECC, S/4HANA, SAP Cloud, or other - include environment (DEV, QA, PROD) |
| **System version** | SAP release and support package level, if known (for example, ECC 6.0 EHP8, S/4HANA 2022) |
| **Connector context** | Which SailPoint SAP connector you are integrating (Direct, HR/HCM, GRC, etc.) |

#### Exporting Installed Software Versions

Export both tabs from SAP and attach the spreadsheet and a screenshot.

**To export installed software versions:**

1. Connect to your SAP system.
2. Go to **System \> Status**.
3. On **System Status**, open **SAP System Data** details (Component Information).
4. In the **Installed Software** window, open both tabs:

   - **Installed Software Component Versions**
   - **Installed Product Versions**
5. Right-click the window and select **Spreadsheet**.
6. Choose your export format and select **OK**.
7. Attach the exported file and screenshots of both tabs.

#### Checking SAILPOIN Package Status from SAP Tables

Run the following in transaction `SE16` and attach screenshots of the results.

| Table | Field | Input Value | Action |
| --- | --- | --- | --- |
| `PAT07` | `PATCH` | `*SAILPOIN*` | Execute |
| `PAT07_ACP` | `ACP_PATCH` | `*SAILPOIN*` | Execute |

These results show which SAILPOIN packages and ACP files are present in the system.

#### Describing the Error

Include:

- A clear description of the issue (what you were doing, what failed, and when).
- Screenshots of the exact error message from SAINT/SPAM or related SAP transactions.
- The step where the failure occurred (load PAT, select support package, start installation, and so on).

#### Providing PAT File Details

List every PAT file you used, including files that failed:

| Item | Example |
| --- | --- |
| **PAT file name** | `G750020862508_0000033.PAT` |
| **Package type** | AOI, CSP, or ACP |
| **Support package** | `SAPK-12202INSAILPOIN` (if applicable) |
| **Outcome** | Loaded successfully / installation failed with error |

#### (Optional) Providing Additional Information

- Whether this is a new installation or an update to an existing SAILPOIN add-on.
- Dependency or ACP errors seen during SAINT.
- Whether other SAP add-ons or support packages were installed at the same time.
- Recent SAP Basis or kernel changes.
- Other context that might be relevant.

## Uninstallation of SAILPOIN Add-On

1. In the SAP GUI, execute the Tcode **SAINT**.
2. Ensure that the Add-on **SAILPOIN** was successfully installed by confirming that it is visible in the **Installed Components** list.

   > **Screenshot**
   >
   > [![Installed Components](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/installed_components_list.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/installed_components_list.png>)
3. Select **Uninstallable Components**. The Add-on **SAILPOIN** should be visible.

   > **Screenshot**
   >
   > [![Uninstallable Components](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/uninstallable_components_list.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/uninstallable_components_list.png>)
4. Select **SAILPOIN** from the grid, and then select **Start**.
5. Select **Continue** when prompted on the **Start Options** dialog box.

   > **Screenshot**
   >
   > [![Start Options](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/uninstall_start_options.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/uninstall_start_options.png>)

   > **Note**
   >
   > If there are any specific preferences for any of the start options, those can be selected as per requirement.
6. Select **Finish**.
7. When prompted to send Runtime Analysis, select **Do not send**.

   > **Screenshot**
   >
   > [![Do not send Runtime Analysis](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/uninstall_do_not_send.png>)](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/img/uninstall_do_not_send.png>)
8. Perform the following to confirm that the Add-on **SAILPOIN** was uninstalled:

   1. Select **Installable Components** and scroll through the list to ensure **SAILPOIN** is not found.
   2. Select **Uninstallable Components** and scroll through the list to ensure **SAILPOIN** is not found.
   3. Go to **System \> Status**. Under SAP System data go to **Product Version \> Details \> Installed Software Component Versions** and ensure Add-on **SAILPOIN** is not found.

# Schema Reference

The application schema is used to configure the objects returned from a connector.

> [!NOTE]
>
> - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.
> - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified.

The SAP Direct connector uses the following default correlation and object configurations.

## Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.

### Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*.

> [!CAUTION]
>
> Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.
>
> To resolve issues caused by changing account IDs, reconfigure them to their default values.

The following table lists the default account IDs for this connector:

| Account ID | Schema Object Type |
| --- | --- |
| User Name | Account |
| Name | Group |
| ID | Profile |

### Default Account Attributes

The SAP Direct connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

| Attribute Name | Description |
| --- | --- |
| Academic Title (Address) | Academic title of the user. |
| Academic Title 2 (Address) | Second Academic title of the user. |
| Addr Number (Address) | Address number of the user. |
| Alias (Logon Data) | Alias name. |
| Birth Name (Address) | Name at birth. |
| Building (Address) | Name of the building. |
| Building 2 (Address) | Second name of the building. |
| Building Long (Address) | Long name of the building. |
| Care of (Address) | Care of name. |
| Check Status (Address) | Check status for the user. |
| City (Address) | Name of the city. |
| City Number (Address) | Number of the city. |
| Code (Address) | Signature initials. |
| Communication Language (Address) | Communication language of the user. The different values to be set for this attribute are mentioned in [Logon and Communication Language Attributes](<#logon-and-communication-language-attributes>). |
| Communication type (Address) | Communication method for the user. |
| Company (Address) | Name of the company. |
| Company Address (Address) | Address of the company. |
| Company Address 2 (Address) | Second address of the company. |
| Company Address 3 (Address) | Third address of the company. |
| Company Address 4 (Address) | Fourth address of the company. |
| Contractual User Type ID | Contractual user types associated with user. |
| Country (Address) | Name of the country. |
| Country ISO (Address) | ISO name of the country. |
| Date Format | Date format must be in MM-DD-YYYY. |
| Decimal Notation | Decimal format should be similar to 1,234,567.89. |
| Delete After Printing | Delete spool requests immediately after printing. |
| Delivery District (Address) | Delivery district name. |
| Department (Address) | Department name. |
| District (Address) | District name. |
| District Number (Address) | District number for the user. |
| Documentation Description | Description of the documentation. |
| E-Mail (Address) | Email address. |
| E-Mail List (Address) | Email address list. |
| Employee Number (Address) | Employee number of the user. |
| Fax (Address) | Fax number. |
| Fax Extension (Address) | Fax extension number. |
| Fax List (Address) | Fax number list. |
| First name (Address) | First name of the user. |
| Floor (Address) | Floor number. |
| Floor 2 (Address) | A second floor number. |
| Format (Address) | Format name. |
| Full Name (Address) | Full name of the user. |
| Full Name 2 (Address) | Full name 2 of the user. |
| Function (Address) | Function of the user. |
| GUI Flag | Unsecured communication permitted. |
| House Number 2 (Address) | House number 2 of the user. |
| House Number (Address) | House number of the user. |
| House Number 3 (Address) | House number 3 of the user. |
| Inhouse ML (Address) | Inhouse mail of the user. |
| Initials (Address) | Initials of the user. |
| Language CR P (Address) | CR P language of the user. |
| Language ISO (Address) | ISO language of the user. |
| Language UCP ISO (Address) | CP ISO language of the user. |
| Language UP ISO (Address) | P ISO language of the user. |
| Last Name (Address) | Last name of the user. |
| Location (Address) | Location name. |
| Logon Language (Defaults) | Logon language for the user. The different values to be set for this attribute are mentioned in [Logon and Communication Language Attributes](<#logon-and-communication-language-attributes>). |
| Middle Name (Address) | Middle name of the user. |
| Mobile Number | Mobile number of the user. Only one mobile number is supported. For example, `US:9999999999` |
| Name Country (Address) | Name of the country. |
| Nickname (Address) | Nickname of the user. |
| Notes (Address) | Notes for the user. |
| Other City (Address) | Name of the other city. |
| Other City Number (Address) | Number of the other city. |
| Output Device | Printer name assigned to the user. |
| Pager SMS List (Address) | Pager or SMS number list in the format: `pager_type#pager_number` |
| Parameters | Parameter list in the format: `parameter_ID=parameter_value` |
| Pboxcity Number (Address) | Pbox number of the city. |
| PCODE 1 Ext (Address) | Postal code 1 extension. |
| PCODE 2 Ext (Address) | Postal code 2 extension. |
| PCODE 3 Ext (Address) | Postal code 3 extension. |
| Person Responsible | Person responsible for documentation. |
| PO Box (Address) | PO box number. |
| PO Box City (Address) | PO box number of the city. |
| PO Box City ISO (Address) | PO box number of the ISO city. |
| PO Box Country (Address) | PO box number of the country. |
| PO Box Region (Address) | PO box number of the region. |
| PO Box Without Number (Address) | PO box without number. |
| Postal Code (Address) | Postal code of the user. |
| Postal Code 2 (Address) | 2<sup>nd</sup> postal code of the user. |
| Postal Code 3 (Address) | 3<sup>rd</sup> postal code of the user. |
| Prefix 1 (Address) | First prefix. |
| Prefix 2 (Address) | Second prefix. |
| Print Immediately (Defaults) | Print immediately flag for the user. |
| Printer List (Address) | Print destination list. |
| Profiles | Profiles for the user. |
| Region (Address) | Name of the region. |
| Region Group (Address) | Group name of the region. |
| Remote Communication List (Address) | Communication notes list. |
| Remote Function Call List (Address) | Remote function call destination list. |
| Remote Mail List (Address) | Remote mail list of the user. |
| Room Number (Address) | Room number of the user. |
| Room Number 2 (Address) | Second room number of the user. |
| Reference User | Reference user name. |
| Roles | Roles for user.<br><br>The Account Aggregation fetches the active roles (composite /simple) assigned directly to the user. |
| Role Details | Role Details of the user. |
| Search Term 2 P (Address) | Second search term P for the user. |
| Search Term P (Address) | Search term P for the user. |
| Search Term 1 (Address) | First search term for the user. |
| Search Term 2 (Address) | Second search term for the user. |
| Second Name (Address) | Second name of the user. |
| Street Abbreviation (Address) | Street abbreviation for the user. |
| Street Address (Address) | Street address of the user. |
| Street Address 2 (Address) | Street address 2 of the user. |
| Street Address 3 (Address) | Street address 3 of the user. |
| Street Address 4 (Address) | Street address 4 of the user. |
| Street Number (Address) | Street number of the user. |
| SNC Name | SNC name. |
| Systems | Systems list. |
| Tax Jurisdiction Code (Address) | Tax jurisdiction code of the user. |
| Telephone (Address) | Telephone number. |
| Telephone Extension (Address) | Telephone extension number. |
| Telephone List (Address) | Telephone number list. |
| Teletex List (Address) | Teletex number list. |
| Telex List (Address) | Telex number list. |
| Time Format (Defaults) | Time format of the user. |
| Time Zone (Address) | System time zone. |
| Title (Address) | Title of the user. |
| Title SPPL (Address) | Title SPPL of the user. |
| Transportation Zone (Address) | Transportation zone of the user. |
| TZone (Defaults) | Personal time zone. |
| URL (Homepage) List (Address) | URL (Homepage) address list in the format: `URI_type#URI_name` |
| User Last Logon Time | User last log in time. |
| User Last Logon Date | User last log in date. |
| Logon Data Time Zone | User last log time zone. |
| Productive Password | User password set in permanent mode. |
| Password Deactivated | Password Deactivated Flag. |
| User Name | User Name. |
| User Title (Address) | Title of the user. |
| User Type (Logon Data) | Type of the user. |
| User Valid From (Logon Data) | Valid from date for the user. |
| User Valid To (Logon Data) | Valid to date for the user. |
| User Group (Groups) | User Group Assignments of the user. |
| X.400 List (Address) | Organization name list. |
| User Group | User Group Auth assignment. |

## Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements](<https://documentation.sailpoint.com/saas/help/access/entitlements.html>) for more information.

> [!CAUTION]
>
> Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

### Default Role Attributes

The SAP Direct connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

| Attribute Name | Description |
| --- | --- |
| Name | Role name |
| Type | Role type |
| Description | A description of the role. If the description field contains a null character, the connector will remove that character and then trim any leading or trailing whitespace. |
| Child Roles | Child Role list<br><br>The child roles list displays the child roles of composite roles in the Group object properties of Entitlement Catalog.<br><br>When upgrading existing applications, mark **Entitlement** as `true` to display the child roles in the Group object properties Entitlement grid. |
| Long Description | A long description of the role. If the long description field contains a null character, the connector will remove that character and then trim any leading or trailing whitespace. |
| Subsystem | System name for CUA System Aggregation |
| Generated Profile | System generated profile associated to Role that has authorizations. |
| TCodes assigned through Menu | Transaction Codes added through Role Menu. |
| TCodes assigned directly | Transaction Codes assigned directly and not through the Role menu. |
| Other Menu Items | Non transactional items added through the Role menu. |
| Authorization Objects | Authorization objects associated with role. |

> [!NOTE]
>
> When performing group aggregation in a SAP Central User Administration (CUA) environment, the connector does not fetch `child roles` or `child profiles` of any composite role or profile. This is due to the fact that the CUA system does not maintain child level roles or profile details for child subsystems. This works in a similar way, where the attribute `ID` does not fetch attributes like `TCodes assigned through Menus`, `TCodes assigned directly` and `Other Menu Items` or `Generated Profiles` for the group object type.

To fetch the TCodes assigned through menu, TCodes assigned directly, and Other Menu Items attributes, add the following attribute definitions to the account schema:

```json
{
    "name": "TCodes assigned through menu",
    "type": "STRING",
    "schema": null,
    "description": "Transaction Codes added through Role Menu",
    "isMulti": true,
    "isEntitlement": true,
    "isGroup": false
},
{
    "name": "TCodes assigned directly",
    "type": "STRING",
    "schema": null,
    "description": "TCodes assigned directly, and not through the Role menu",
    "isMulti": true,
    "isEntitlement": true,
    "isGroup": false
},
{
    "name": "Other Menu Items",
    "type": "STRING",
    "schema": null,
    "description": "Non transactional items added through the Role menu",
    "isMulti": true,
    "isEntitlement": true,
    "isGroup": false
},
```

### Default ContractualUserType Attributes

| Attribute Name | Description |
| --- | --- |
| User Type ID | The type of ID or license ID. |
| Name | The license description. |

### Default Profile Attributes

| Attribute Name | Description |
| --- | --- |
| ID | Profile name along with the description. |
| Name | Profile name |
| Type | Profile type |
| Description | Profile description |
| Subsystem | System name for CUA System Aggregation |
| Child Profiles | Sub profile list |

### Default Usergroup Attributes

| Attribute Name | Description |
| --- | --- |
| User Group Auth | User Group Id |
| Language | Language of the group |
| Description | Description of the user group auth |

### Default Usergroups Attributes

| Attribute Name | Description |
| --- | --- |
| User Group | User Group Id |
| Language | Language of the group |
| Description | Description of the user group assigned |

## Schema Extension

The schema can extend to include the fields within the structures provisioned by the SAP standard BAPI. The fields in the following structures are provisioned:

- ADDRESS
- ALIAS
- COMPANY
- DEFAULTS
- LOGONDATA
- PASSWORD

> [!NOTE]
>
> No custom attributes are supported during provisioning.

## Additional Attributes

The SAP Direct connector supports updating the following SAP attributes (variables) as per their names in the schema:

- Telephone List
- EMail List
- X.400 List
- Teletex List
- Fax List
- Pager SMS List

  > **Note**
  >
  > The Pager SMS List value must be in the `<Pagerservice>#<PagerNumber>` format.
- Printer List
- Remote Function Call List
- Remote Mail List
- URL Homepage List

  > **Note**
  >
  > The URL Homepage List value must be in the `<URl Type> #<urlvalue>` format.

## Logon and Communication Language Attributes

To set logon and communication Language in SAP Direct, use the required string literal as shown in the following table:

| Language | String Literal |
| --- | --- |
| Afrikaans | a |
| Arabic | A |
| Bulgarian | W |
| Catalan | c |
| Chinese | 1 |
| Chinese traditional | M |
| Croatian | 6 |
| Customer reserve | Z |
| Czech | C |
| Danish | K |
| Dutch | N |
| English | E |
| Estonian | 9 |
| Finnish | U |
| French | F |
| German | D |
| Greek | G |
| Hebrew | B |
| Hungarian | H |
| Icelandic | b |
| Indonesian | i |
| Italian | I |
| Japanese | J |
| Korean | 3 |
| Latvian | Y |
| Lithuanian | X |
| Malay | 7 |
| Norwegian | O |
| Polish | L |
| Portuguese | P |
| Romanian | 4 |
| Russian | R |
| Serbian | 0 |
| Serbian (Latin) | d |
| Slovak | Q |
| Slovenian | 5 |
| Spanish | S |
| Swedish | V |
| Thai | 2 |
| Turkish | T |
| Ukrainian | 8 |

## Entitlement Data

The aggregated entitlement data consists of the following:

- SAP Roles (Simple and Composite)
- SAP Profiles (Simple and Composite)
- SAP Contractual User Type (Active SAP Licenses)

# Enable Connector Logging

This topic provides the steps needed to enable logging on SailPoint using REST APIs.

> [!NOTE]
>
> This topic only applies to VA-based integrations.

> [!NOTE]
>
> The examples provided might not match your configuration. Use the logging levels and logging classes reference at the bottom of the topic to configure your API responses to match your connector.

This process is broken up into four steps:

1. Identify the Virtual Appliance (VA) cluster on which you want to enable logging.
2. Get the logging configuration for the existing VA cluster.
3. Update the VA cluster to enable logging levels.
4. Observe logging changes to the logging levels.

### Identify the Virtual Appliance Cluster

Select the VA on which you need to enable logging using REST API. If you already know the VA application's `id`, proceed to [Get the Logging Configuration](<#get-the-logging-configuration>).

1. Make the following call to the REST API to return a list of available VA clusters:

   GET /v3/managed-clusters

   The REST API returns a response that looks similar to the following:

   ```json
   [
       {
           "id": "2c9180866166b5b0016167c32ef31a66",
           "name": "Development Cluster",
           "description": "Development Cluster",
           "clientType": "CCG",
           "ccgVersion": "373_535_70.2.0",
           "pinnedConfig": true,
           "logConfiguration": null
       },
       {
           "id": "2c9180846a93ce60016ab29f039944de",
           "name": "Cloud Cluster",
           "description": "Cloud Cluster",
           "clientType": "CCG",
           "ccgVersion": "373_535_70.2.0",
           "pinnedConfig": true,
           "logConfiguration": {
               "clientId": null,
               "durationMinutes": 60,
               "expiration": "2020-12-15T19:13:36.079Z",
               "rootLevel": "DEBUG",
               "logLevels": {
                   "sailpoint.connector.ADLDAPConnector": "DEBUG"
               }
           }
       }
   ]
   ```

   > **Note**
   >
   > The previous example code shows two VA clusters. One VA cluster has a log configuration and the other does not (refer to the `logConfiguration` value in each returned VA cluster). This is because one of the clusters already has logging enabled. This is just an example configuration, and your environment may not have logging enabled on a cluster.
2. Identify the VA cluster that you want to enable logging on by its name or description and record its `id` attribute.

### Get the Logging Configuration

Get your selected VA's cluster logging configuration and identify the values you need to update.

1. Make the following call to the REST API to return the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier.

   GET /v3/managed-clusters/{id}/log-config

   - If the VA doesn't have a logging configuration currently set, it returns `204 No Content` as a response.
   - If the VA has an existing logging configuration, it returns something similar to the following:

     ```json
     {
         "clientId": null,
         "durationMinutes": 60,
         "expiration": "2020-12-15T19:13:36.079Z",
         "rootLevel": "DEBUG",
         "logLevels": {
             "sailpoint.connector.ADLDAPConnector": "DEBUG"
         }
     }
     ```

     You'll need to configure the following information in the response:

     - `durationMinutes` is the number of minutes logging should remain enabled.
     - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>).
     - `logLevels` is a map object with logging classes as keys and logging levels as values.

       - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes.
       - For a list of available values, refer to [Logging Levels](<#logging-levels>).

### Update Logging Configuration

Update the VA cluster configuration returned by the REST API to update the logging settings as needed.

1. Make the following call to the REST API to update the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier.

   PUT /v3/managed-clusters/{id}/log-config
2. Submit your configuration changes to the REST API in a JSON body.

   - If the VA cluster did not already have a logging configuration and you received a `204 No Content` response, you can create a new one.
   - If the VA returned a configuration, you can edit it to include the changes.

   The JSON body should be as follows:

   ```json
   {
       "durationMinutes": 60,
       "rootLevel": "DEBUG",
       "logLevels": {
           "sailpoint.connector.ADLDAPConnector": "DEBUG"
       }
   }
   ```

   Consider the following as you edit the JSON:

   - `durationMinutes` is the number of minutes logging should remain enabled.
   - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>).
   - `logLevels` is a map object with logging classes as keys and logging levels as values.

     - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes.
     - For a list of available values, refer to [Logging Levels](<#logging-levels>).

   If the update was successful, the REST API should return a response similar to the following:

   ```json
   {
       "clientId": null,
       "durationMinutes": 60,
       "expiration": "2020-12-15T19:13:36.079Z",
       "rootLevel": "DEBUG",
       "logLevels": {
           "sailpoint.connector.ADLDAPConnector": "DEBUG"
       }
   }
   ```

### Observe Logging Changes

Approximately five minutes after you update the configuration, the VA cluster starts generating log files you can review. You can view the log files in **ccg.log**.

### References

The tables in this reference section list information that can be helpful when creating the JSON body you'll use to configure the VA cluster's configuration file.

#### Logging Levels

| Logging Level | Description |
| --- | --- |
| ERROR | Designates error events that might still allow the connector to continue. |
| WARN | Designates potentially harmful situations. |
| INFO | Designates information messages that highlight process at a coarse-grain level. |
| DEBUG | Very verbose. Fine grain logging levels used for development and debugging. |
| TRACE | Most verbose. Finer grain logging levels than debugging. |

#### Logging Classes

| Connector | Logging Class |
| --- | --- |
| Active Directory | sailpoint.connector.ADLDAPConnector sailpoint.connector.LDAPConnector |
| AIX | openconnector.connector.unix.AIXConnector openconnector.connector.unix.UnixConnector |
| Amazon Web Services | logger.aws.name=openconnector.connector.aws logger.aws.level=trace logger.aws.additivity = false logger.aws.appenderRef.rolling.ref = STDOUT |
| Atlassian Suite Cloud | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianConnector |
| Atlassian Data Center | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianDataCenterConnector |
| Microsoft Entra ID | sailpoint.connector.AzureADConnector |
| Box | openconnector.connector.BoxNetConnector sailpoint.connector.OpenConnectorAdapter |
| Cerner | openconnector.connector.CernerConnector sailpoint.connector.OpenConnectorAdapter |
| Delimited File | logger.DelimitedFileConnector.name = sailpoint.connector.DelimitedFileConnector logger.DelimitedFileConnector.level = debug logger.DelimitedFileConnector.additivity = false logger.DelimitedFileConnector.appenderRef.rolling.ref = STDOUT |
| Dropbox | openconnector.connector.DropBoxConnector sailpoint.connector.OpenConnectorAdapter |
| Epic | openconnector.connector.EPICConnector sailpoint.connector.OpenConnectorAdapter |
| GE Centricity | openconnector.connector.GECentricity sailpoint.connector.OpenConnectorAdapter |
| Google Apps / G Suite | openconnector.connector.GoogleAppsDirect sailpoint.connector.OpenConnectorAdapter |
| IBM i | openconnector.connector.IBMiConnector |
| Lotus Domino | sailpoint.connector.LotusDomino |
| JDBC | sailpoint.connector.JDBCConnector |
| Sun One LDAP | sailpoint.connector.LDAPConnector |
| Linux | openconnector.connector.unix.LinuxConnector sailpoint.connector.OpenConnectorAdapter sailpoint.connector.UnixConnector |
| Microsoft Office365 | sailpoint.connector.Office365Connector |
| Microsoft SQL Server | sailpoint.connector.mssql.serviceimpl.MSSQLServerConnectorV2 |
| Okta | logger.openconnector.name = openconnector.connector.okta.OktaConnector logger.openconnector.level = debug logger.openconnector.additivity = false logger.openconnector.appenderRef.rolling.ref = STDOUT |
| Oracle Database | sailpoint.connector.OracleDBConnector sailpoint.connector.JDBCConnector |
| Oracle E-Business | sailpoint.connector.OracleEBSConnector sailpoint.connector.JDBCConnector |
| Oracle Fusion HCM | openconnector.connector.oraclefusionhcm.OracleFusionHCMConnector sailpoint.connector.OpenConnectorAdapter |
| Oracle HCM Cloud | sailpoint.connector.oraclehcmcloud.OracleHCMCloudConnector |
| Oracle HRMS | sailpoint.connector.OracleAppsHRMSConnector sailpoint.connector.JDBCConnector |
| Oracle Netsuite | openconnector.connector.netsuite.NetsuiteConnector |
| PeopleSoft ERP | openconnector.connector.PeopleSoftConnector sailpoint.connector.OpenConnectorAdapter |
| PeopleSoft HRMS | sailpoint.connector.PeopleSoftHRMSConnector |
| RemedyForce | sailpoint.connector.ForceConnector |
| RSA Authentication Manager | openconnector.connector.RSAConnector openconnector.connector.rsa.RSAHTTPClient sailpoint.connector.OpenConnectorAdapter |
| Salesforce | sailpoint.connector.ForceConnector |
| SAP Concur | openconnector.connector.sapconcur.SAPConcurConnector |
| SAP - Direct | sailpoint.connector.SAPConnector sailpoint.connector.SAPInternalConnector |
| SAP GRC | logger.SAPGRCConnector.name = sailpoint.connector.sapgrc logger.SAPGRCConnector.level = debug logger.SAPGRCConnector.additivity = false logger.SAPGRCConnector.appenderRef.rolling.ref = STDOUT |
| SAP HR/HCM | sailpoint.connector.SAPHRInternalConnector |
| SCIM 1.1 | openconnector.connector.SCIMConnector sailpoint.connector.OpenConnectorAdapter |
| SCIM 2.0 | openconnector.connector.scim2.SCIM2Connector sailpoint.connector.OpenConnectorAdapter |
| ServiceNow | openconnector.connector.servicenow.ServiceNowConnector openconnector.connector.servicenow.ServiceNowRestClient sailpoint.connector.OpenConnectorAdapter |
| ServiceNow Service Desk Integration | openconnector.connector.servicedesk.ServiceNowServiceDeskConnector sailpoint.connector.OpenConnectorAdapter |
| Siebel | openconnector.connector.SiebelConnector sailpoint.connector.OpenConnectorAdapter |
| Snowflake | openconnector.connector.snowflake.SnowflakeConnector sailpoint.connector.OpenConnectorAdapter |
| Solaris | openconnector.connector.unix.SolarisConnector openconnector.connector.unix.UnixConnector sailpoint.connector.OpenConnectorAdapter |
| SuccessFactors | sailpoint.connector.SuccessFactorsConnector |
| Sybase | sailpoint.connector.SybaseDirectConnector sailpoint.connector.JDBCConnector |
| Webex | openconnector.connector.Webex sailpoint.connector.OpenConnectorAdapter |
| Workday | openconnector.connector.WorkDay sailpoint.connector.OpenConnectorAdapter |
| Workday Accounts | openconnector.connector.workdayaccounts openconnector.connector.workdayaccounts.WorkdayAccountsConnector sailpoint.connector.OpenConnectorAdapter |
| Web Services | sailpoint.connector.WebServices |
| XML | openconnector.connector.XMLConnector sailpoint.connector.OpenConnectorAdapter |
| Yammer | openconnector.connector.YammerConnector sailpoint.connector.OpenConnectorAdapter |
| Zoom | openconnector.connector.zoom.ZoomConnector sailpoint.connector.OpenConnectorAdapter |

# Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

- [SailPoint Identity Services Documentation](<https://documentation.sailpoint.com/saas/help/index.html>)
- [SailPoint Support Knowledge Base](<https://support.sailpoint.com/csm?id=kb_view2&amp;kb_id=05ff44289f011200550bf7b6077fcfa3>)
- [SailPoint Developer Community](<https://developer.sailpoint.com/>)

## SAP connector using the /SAILPOINT/SAIL\_READ\_TABLE function module fails with an error caused by class during aggregation.

Error message:

```text
com.sap.conn.jco.JCoException: (104). Data is lost while copying a value. Message 341 of class 00 type X: SAPSQL_DATA_LOSS. SAP_QUERY_TABLE_NAME:TUTYP”
```

**Resolution:** Update the client language in the source XML from `<entry key="clientLanguage" value="EN"/>` to `<entry key="clientLanguage" value="E"/>` value and retry aggregation.

## Adding a new role overwrites the existing list of role assignments

This is the BAPI behavior when the **Role Details** attribute is missing from account schema.

**Resolution**: Add the **Role Details** attribute in account schema to resolve the issue.

```xml
<AttributeDefinition name="Role Details" type="string">
<Description>Role Details of the User</Description>
</AttributeDefinition>
```

## The connector does not fetch the User Group account attribute information during aggregation

**Resolution**: Go into the groups tab of the account and ensure that the User Group has been assigned.

## The password is not deactivated during account creation

When creating a new account, the password is not deactivated even when the correct parameters are passed.

**Resolution**: Add CODVN in the create account provisioning form. If you need the password to be deactivated, then the password should not be sent from the plan. When the provisioning form is displayed, clear out the password field. The password deactivated field should be set as X/true.

## Account aggregation logs a WARN-level error

```text
Exception while getting system info from CVERS and PRDVERS tables
sailpoint.connector.ConnectorException: Caused by class com.sap.conn.jco.AbapException: (126) TABLE_ACCESS_NOT_ALLOWED: Message 000 of class null type : . SAP_QUERY_TABLE_NAME:CVERS
```

**Resolution**: Provide the correct permissions to the service account user on the CVERS and PRDVERS tables. Additionally, ensure both of the following additions have been made:

1. CVERS/PRDVERS is added in S\_TABU\_NAME authorization object.
2. CVERS/PRDVERS is added in SAILPOIN/CONF table.

## ASSIGN\_TYPE\_CONFLICT exception occurs in UI during connector operations

An Error message is displayed when using Function Module /SAILPOIN/SAIL\_READ\_TABLE and /SAILPOIN /SAIL\_READ\_TABLE\_LEG

```text
Exception during aggregation. Reason: java.lang.RuntimeException: ASSIGN_TYPE_CONFLICT while querying table *Table_Name*. One of the fields queried (field1,field2,field3… ) may have incorrect COLUMN_LENGTH set in /SAILPOIN/CONF table. Please refer ASSIGN_TYPE_CONFLICT in troubleshooting section of documentation for more details.
```

**Resolution:** Ensure COLUMN\_LENGTH is correctly configured for the fields of *Table\_Name* in /SAILPOIN/CONF table . This can be validated through the t-code "SE11" while viewing the table details under the **Fields** tab.

## Data was lost while copying a value error and aggregation fails

```text
Data was lost while copying a valuePOST
```

**Resolution**: If SAP has been patched to SP 17 or later, change the client language to a single character. For example, if the client language is `EN`, change it to `E`. For more information on the One Character Code for Language, refer to the [SAP KB article](<https://userapps.support.sap.com/sap/support/knowledge/en/2633548>).

## Could not initialize class com.sap.conn.jco.rt.JCoRuntimeFactory error on test connection and aggregations in SailPoint

```text
Could not initialize class com.sap.conn.jco.rt.JCoRuntimeFactory
```

**Resolution**: The host value must be updated on VA with the FQDN of the SAP server. Re-upload the `sapjco` and `libsapjco` JARs on the UI.

> [!NOTE]
>
> Ensure that all SAP sources pointing to the same VA cluster have the latest and identical versions of SAP JARs uploaded.

## Initialization of repository destination SAP - PMP failed error on test connection

```text
[ ConnectorException ] [ Error details ] Exception occurred while test configuration operation, refer logs for more details. Initialization of repository destination SAP - PMP failed: Logon data incomplete.
```

**Resolution**: Ensure the Flag for "Entry for RFC activated " is unchecked and not selected in SAP server.

## Distribution of a user to SAP CUA Subsystem

In a SAP CUA landscape, a SAP role or profile requires a SUBSYSTEM to distribute the user to. The facility to select or specify the same, while requesting an entitlement for an account, is absent.

**Resolution**: The subsystem name is prepended to the Account-Group while aggregating account-groups from a SAP CUA system. As a result, only a limited subset of subsystem and account-group combinations are available while requesting entitlements, and thus distributing users, in a SAP CUA landscape.

## Entitlement description isn't populated correctly. Entitlements aren't added to access profile

```text
Invalid Entitlement. managedAttribute is missing.
```

**Resolution**: In Account Schema, update the schemaObjectType value of the Roles and Child Roles attributes to Group.

## Removed Entitlements are present in Current access page

Even after the execution of **Refresh Entitlement Correlation** the entitlements are not getting deleted from the current access page.

**Resolution**: Execute the **Perform Identity Request Maintenance** task to remove those entitlements. Ensure that the **Verify provisioning for requests** option is selected for this task.

## Change password is not working with SNC when PRODUCTIVE\_PWD attribute is X

The change password feature is not working with SNC, when PRODUCTIVE\_PWD attribute is X.

**Resolution**:

```text
POST
```

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

Where:

- `<url>` is the URL for the customer's SailPoint tenant.
- `<sourceID>` is the Source ID (number) obtained through the UI.

In the body of the POST, set form-data values as follows:

- **Key**: `connector_productivePasswordValue`
- **Value**: Value for example, 1. By default the value is X.

**Resolution 2**: Check the following jco parameters and add them in the source xml as per your environment requirements:

```xml
<entry key="jco.client.snc_mode">
 <value>
 <Boolean>true</Boolean>
</value>
```

```xml
<entry key="jco.client.snc_qop" value="X"/>
```

The possible values of X are:

- 1: Authentication only
- 2: Integrity protection
- 3: Privacy protection
- 8: Use the value from `snc/data_protection/use` on the SAP Application Server.

```xml
<entry key="jco.client.snc_qop" value="X"/>
```

The possible values of X are:

- 0: Single Sign-On protocol disabled
- 1: Single Sign-On protocol enabled

Set the value to 0 as of JCo 3.0.9

**Resolution 3**: Ensure the SNC name in table SNCSYSACL (transaction SNC0), is not maintained. If it is present, remove the entry from the table.

## Aggregation fails with error 'NOT AUTHORIZATION'

Aggregation fails with the following error due to not having proper authorization of authorization object 'S\_TABU\_DIS (Activities: All Activities)'.

**Resolution**: Provide the authorization of authorization object **S\_TABU\_DIS (Activities: All Activities)**

```text
Activities-All
Table Authorization Group-* (means all)
```

Or skip aggregation of license data of the user by adding the following entry key using the REST API as follows:

```text
POST <url>/api/source/update/<sourceID>
```

Where:

- `<url>` is the URL for the customer's SailPoint tenant
- `<sourceID>` is the Source ID (number) obtained through the UI

In the body of the POST, set form-data values as follows:

- **Key**: `connector_skipLicenseData`
- **Value**: `true`

## com.sap.conn.rfc.driver.CpicDirver error on test connection

Test connection fails with the following error message:

```text
com.sap.conn.rfc.driver.CpicDirver
```

**Resolution**: Download the latest `SAPJCO.jar` and `SAPJCO.dll` files from SAP Marketplace and then use that SAPJCO Jar file with the latest downloaded SAPJCO dll file.

## Role and Profile description in a language other than English

**Resolution**: In Account-Group Aggregation, if the Role and Profile Description is required in a language other than English, add the `descriptionLanguage` parameter with the correct value.

```text
POST <url>/api/source/update/<sourceID>
```

Where:

- `<url>` is the URL for the customer's SailPoint tenant
- `<sourceID>` is the Source ID (number) obtained through the UI

In the body of the POST, set form-data values as follows:

- **Key**: descriptionLanguage
- **Value**: The language code. For example, D.
- **Key**: `descriptionAttribute`
- **Value**: `Description`

In the above example, the value `D` is the language code for Dutch language supported by SAP.

If the `descriptionLanguage` parameter is not provided, the descriptions displayed are in English language.

## Bad username or password. com.sap.conn.jco.JCoException on test connection

Test connection /aggregation fails with the following error message:

```text
Bad username or password. com.sap.conn.jco.JCoException: (109)
RFC_ERROR_CANCELLED: Handle close pending
```

**Resolution**: Ensure that the administrator user specified in application has sufficient rights on the SAP systems as mentioned in the [Required Permissions](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/index.html#required-permissions>) section.

## Test connection or aggregation fails if user name or password contains a UTF-8 character

**Resolution**: Use the REST API to add an entry for `jco.client.pcs` attribute

```text
POST <url>/api/source/update/<sourceID>
```

Where:

- `<url>` is the URL for the customer's SailPoint tenant
- `<sourceID>` is the Source ID (number) obtained through the UI

In the body of the POST, set form-data values as follows:

- **Key**: `connector_jco.client.pcs`
- **Value**: 2

## The SAP connector does not cause the following error after using the after-provisioning rule to assign an entitlement.

```text
"RfcGetException: Name or password is incorrect (repeat logon)"
```

## Entitlement aggregation fails with OutOfMemory error

```text
Exception: java.lang.OutOfMemoryError: Java heap space
Exception during aggregation of Object Type group on Application
```

**Resolution**: One of the possible reasons for this failure is that a role contains a large number of Authorization Objects. To resolve this error, set the `splitAuthObjectValues` attribute using the REST API and use the body of :

```text
[
{
"op": "add",
"path": "/connectorAttributes/splitAuthObjectValues",
"value": true
}
]
```

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Provisioning fails with an error message when trying to configure SNC using SAP JCO version 3.1

Provisioning fails with the following error message when trying to configure SNC using SAP JCO version 3.1 and when the `client.snc_sso` parameter is set to `0` in the application debug page:

```text
"WARN: Warning from SAP while executing function [BAPI_USER_CHANGE]Password for user XXXX changed, but not set as productive"
```

**Resolution**: The value of `client.snc_sso` parameter must be set to 1 (that is, `client.snc_sso = 1`) or not defined (default is 1) in the SAP application. On the SAP managed system, JCO (SNC Name) value must not be specified in JCO ACL, that is JCO entry must be deleted from `SNC0` tcode (table `SNCSYSACL`). Refer to SAP Note \# 3016480 as recommended by SAP and only specific to SAP JCO 3.1.x.

## SAP source config test connection fails when the VA is configured with secure tunnel, or when the VA and manage system are on a different network

```text
"sailpoint.connector.ConnectionFailedException: Server is DOWN or Connection parameters are incorrect.
```

OR

```text
ERROR       hostname 'sailpoint-va' unknown\nTIME
```

OR

```text
JCO_ERROR_COMMUNICATION: Connect to SAP gateway failed
```

**Resolution**: There are three possible options to solve this error.

**Option 1**: One of the reasons for the issue to occur is the IP address of the VA is not recognized by the connector. To resolve this, you must make an entry in hosts.yaml with the IP address of the VA as well as the managed source (SAP server).

> [!NOTE]
>
> For information on creating a hosts.yaml file, refer to [Configuring a Hosts.yaml File](<https://documentation.sailpoint.com/saas/help/va/config_va.html#configuring-a-hostsyaml-file>).

For example:

```text
hosts:
10.200.80.60: -SAPSER4
10.22.131.14: -sailpoint-va
```

Where `10.200.80.60` is the IP and `SAPSER4` is the hostname of the SAP server, and `10.22.131.14` is the IP of the VA and `sailpoint-va` is the default name of the VA. Ensure that SAP is installed with JCO enabled.

Similarly, add the IP and hostname of the VA being used in the file. Restart CCG/ Reboot VA after the update.

**Option 2**: Add Route entry in static.network file to persist routing table entry of the VA hostname. To do so, perform the following steps:

1. In your VA, go to ../etc/systemd/network/static.network
2. Add the following entry:

   ```text
   [Route]
   Gateway=<10.0.0.1>
   Destination=<public_ip>/<netmask>
   ```
3. Run `sudo systemctl restart systemd-networkd` to apply the configuration.
4. Run `route -n` to show routes.
5. Restart CCG/ Reboot VA and check if the entry still persisted.

**Option 3**: Update DNS entries for VAs on your network so that FQDN resolves for each VA. To do so, perform the following steps:

1. Run `sudo hostnamectl set-hostname <hostname of your choice>` to set the VA hostname.
2. Run the `hostname` command to validate.
3. Run `sudo reboot` to reboot the VA.

The VA should reflect the new hostname.

## SAP connector throws "Unencrypted communication is rejected by this system" error when snc/only\_encrypted\_rfc is set to 1 on SAP server

```text
[ ConnectorException ] [ Error details ] Exception occurred while test configuration operation, refer logs for more details. Initialization of repository destination SAP FS failed: Unencrypted communication is rejected by this system.
```

**Resolution:** Please check the 'snc/only\_encrypted\_rfc' parameter on SAP server, if set to 1, SAP server expects encrypted connections to it. We need to either set the value for this parameter to 0 or setup SNC connection both on SailPoint UI and SAP server to communicate.

## Provisioning operation is failing due to a "Locked by user" error

When parallel requests are sent from the SailPoint platform to SAP for provisioning entitlements or attributes associated with the same identity, the provisioning request may fail with a following error-

```text
"Locked by user <user id>"
```

**Resolution:** The restriction to not update any user with multiple consecutive requests has been implemented by SAP. This is a common practice built with most of the ERP systems to avoid conflicting changes to be made to any record. If the user id is already being edited by any request, the system stops the other requests to perform further updates on it until the previous request is complete.

The workaround to resolve this situation could be to implement re-tries and introduce delay conditions between consecutive requests or when this specific error is observed.

## The retry mechanism fails to provision

Provisioning fails with either a `Locked by user` error or a `connection reset` error.

**Resolution**: To configure retry mechanism in the SAP Direct connector, ensure to add the following entry key using the REST API:

In the body of the POST, set form-data values as follows:

```text
Key:retryWaitTime Value:30
Key:maxRetryCount Value:3
Key:retryableErrors Value:[error messages]
```

where, `retryWaitTime` is in seconds. The default value of `retryWaitTime` is 5 sec. The default value of `maxRetryCount` is 3.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Account aggregation is not returning any records

**Resolution**: Change the language on the managed system to a single letter (that is, from EN to E) and then, run aggregation.

## Provisioning Fails Due to Missing RFC Authorization for SYSTEM\_RESET\_RFC\_SERVER Function Module

**Issue**: A runtime error occurs in the SAP system during provisioning activities.

```text
The user "**" in client "*" attempted to execute the function module SYSTEM_RESET_RFC_SERVER from function group "**", but does not have the required RFC authorization.
```

**Resolution**: Ensure that the service account used by the connector is granted all required authorizations as specified in the Connector Guide under the [Required Permissions](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/index.html#required-permissions>) section.

Once the correct authorizations are in place, the connector will be able to execute SYSTEM\_RESET\_RFC\_SERVER and recover from RFC communication issues as expected.

## Group aggregation fails during execution.

**Resolution**: Add the aggregateTimeout key to the app.xml file as shown below:

```text
<entry key="aggregateTimeout" value="600"/>
```

> [!NOTE]
>
> The value for aggregateTimeout (configured in seconds) can be adjusted based on the volume of entitlements configured on your managed system.

## Aggregation or test connection fails with InsufficientPermissionException

Aggregation or test connection fails with an error similar to the following:

```text
[ InsufficientPermissionException ]
[ Possible suggestions ] Required permission of table "TUTYPA" is missing, ensure adding recommended permissions.
[ Error details ] Caused by class com.sap.conn.jco.AbapException: (126) TABLE_ACCESS_NOT_ALLOWED:
Message 010 of class /SAILPOIN/CL_ER_MSG type E: TUTYPA
SAP_QUERY_TABLE_NAME:TUTYPA LIST_QUERY: ?? EQ &&
```

The table name in the error might differ. For example, the error might list `USR02`, `TUTYP`, or `AGR_1251`. Use the table name after `SAP_QUERY_TABLE_NAME:` or in the connector suggestion message.

The SailPoint service account cannot read the SAP table named in the error. When you use the SailPoint ABAP Add-on function module (`/SAILPOIN/SAIL_READ_TABLE`), configure table access in both of the following places:

1. SAP authorization - the service account role must include table display permissions.
2. `/SAILPOIN/CONF` configuration - the table and its allowed columns must be registered for your service account.

Complete both configurations. Completing only one still produces this error.

**Resolution**: Complete both of the following checks:

1. Verify SAP authorization. Compare the table against [Required Permissions](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/index.html#required-permissions>) and add the missing table to the service account role.
2. Verify the `/SAILPOIN/CONF` table configuration. Compare the same table in [Configuration Table for SAP Direct](<https://documentation.sailpoint.com/connectors/sap/direct/va/help/sailpoint_add_on.html#configuration-table-for-sap-direct>) and confirm that entries exist for your service account.

# Timeout Errors and Settings

Timeout errors might occur when SailPoint is waiting for a response from the Virtual Appliance (VA). These errors are applicable to all connectors and tend to occur during the setup of sources or when sources are down.

This document is designed to give specific information that can be used to resolve these errors.

Each timeout attribute has a default time value that is listed in seconds or minutes. Increasing the time value may resolve the error as it will allow for longer communication time between the two systems, thus avoiding the timeout error.

> [!IMPORTANT]
>
> Add the necessary attributes or values before performing the "replace" operation, as missing attributes will cause the operation to fail.

To increase the communication time, increase the value of the appropriate timeout attribute. Then submit the change to the VA using the SailPoint REST API.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

### aggregateTimeout

**Description:** This parameter is set for the aggregation timeout, measured in seconds.

**Resolution:** Increase the `aggregateTimeout` value gradually to optimize aggregation. Start with 180, then increase to 600, 900, and finally 1800. The maximum value is 3600 seconds.

For example:

If your current time value is 180 seconds, update the `aggregateTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/aggregateTimeout",
        "value": 600
    }
]
```

### healthCheckTimeout

**Description:** This parameter is set for the test connection and health check timeout.

**Resolution:** The default value is 30 seconds. If the timeout error continues, increase the value in 15 second increments and try again.

For example:

If your current time value is 30 seconds, update the `healthCheckTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/healthCheckTimeout",
        "value": 45
    }
]
```

### provisioningTimeout

**Description:** This parameter is set for provisioning timeout.

**Resolution:** Increase the `provisioningTimeout` value gradually to optimize provisioning. Start with 180, then increase to 360, and finally 600. The maximum value is 600 seconds.

For example:

If your current time value is 180 seconds, update the `provisioningTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/provisioningTimeout",
        "value": 360
    }
]
```

### timeout

**Description:** This parameter is set for pass-through authentication timeout.

**Resolution:** The default value is 15 seconds. If the timeout error continues, increase this value in 15 second increments and try again.

For example:

If your current time value is 15 seconds, update the `timeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/timeout",
        "value": 30
    }
]
```

### apiTimeout

**Description:** This parameter is set for API time tracking; customers can check it using an external tool.

**Resolution:** The default value is 60 seconds. If the error continues, increase the value by 15 second increments and try again.

For example:

If your current time value is 60 seconds, update the `apiTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/apiTimeout",
        "value": "75"
    }
]
```

### timeoutInSeconds

**Description:** This parameter helps prevent the VA from waiting indefinitely for an API response, ensuring efficient handling of API requests.

For example:

If your current time value is 30 seconds, update the `timeoutInSeconds` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/timeoutInSeconds",
        "value": "15"
    }
]
```