Skip to content

SailPoint Add-On to replace the use of RFC_READ_TABLE

SailPoint's ABAP Integration is designed to replace the functionality of SAP's RFC_READ_TABLE to securely access the information in the SAP system required for deeper governance.

Important

SailPoint strongly recommends installing the SAP-certified add-on in the SAP environment and then using /SAILPOIN/SAIL_READ_TABLE instead of RFC_READ_TABLE.

This integration needs to be deployed on the SAP Direct system for querying the SAP Direct tables. For the deployment process follow these instructions in order:

  1. Installation of SAILPOIN Add-On
  2. Configuring SailPoint's Function Module
  3. Configuration Table for SAP Direct (see the connector-specific configuration table section below)

Prerequisites

To install the Add-On and support packages using the SAINT transaction code (t-code), follow these steps:

  1. Log into client 000.
  2. Ensure that you have installed at least SPAM/SAINT version 0053 to be able to uninstall Add-Ons using the SAINT t-code.

  3. Deselect the digital signature setting in SAINT t-code:

    1. Go to SAINT t-code.
    2. Select Extras.
    3. Choose Setting.
    4. Deselect the Check for digital signature of to be imported OCS Packages.

  4. Proceed with installing the Add-On and support packages using the SAINT t-code.

Screenshot

SAINT t-code Add-On prerequisites

Installation of SAILPOIN Add-On

Note

If Add-on is already installed, reference Importing Support Packages for Add-On SAILPOIN.

  1. Download the PAT file(s) for the Add-On and all the required support packages from the Package Download Matrix.

    Note

    The PAT file is a special file used to package the SAP Add-on. If you install the add-on using SPAM/SAINT, the contents of the PAT file will be extracted (disassembled) to your transport directory.

  2. Copy the .PAT file on your server location for the Add-On and all the required support packages:

    Server Location: (Windows : <DRIVE>:\usr\sap\trans\EPS\in ; Linux/Unix : /usr/sap/trans/EPS/in).

  3. Login to SAP GUI, and then execute the Tcode SAINT.

    Screenshot

    SAINT t-code

  4. Go to Installation Package > Load Packages > EPS Files From Application Server.

    Screenshot

    Load Packages

  5. Ensure the following PAT file(s) uploaded successfully:

    Screenshot

    Uploaded PAT files

  6. Select Start.

  7. Select SAILPOIN from the Installable Add-on Package packages for your system grid.

    Screenshot

    SAILPOIN package

  8. Select Continue.

  9. To install the Add-On and support package(s), perform the following:

    1. Select the highest version from the available support package(s) under the Target Support Package drop down of the component SAILPOIN.

      Screenshot

      Target Support Package

    2. The column Level should indicate the chosen target support package.

      Screenshot

      Support package level

  10. Select Continue.

  11. On the Add Modification Adjustment Transports to the Queue dialog, select No.

    Screenshot

    Modification Adjustment Transports

  12. If prompted on the Start Options dialog box, select Continue.

    Screenshot

    Start Options

    Note

    The Add-on and the support package(s) will begin installing, and the progress can be seen at the bottom of the window.

  13. Select Finish. If prompted to send Runtime Analysis, select Do not send.

  14. Go to System > Status > Details > Installed Software Component Versions to confirm the following:

    1. The Add-On and the support packages have been added in the system component.

      Screenshot

      Installed Software Component Versions

Configuring SailPoint's Function Module

Note

Configure any one function module based on your SAP_BASIS version.

Use the /SAILPOIN/SAIL_READ_TABLE function module to support systems whose SAP BASIS version is 751 and later.

This is a SAP-certified function module provided by SailPoint to replace the use of SAP's RFC_READ_TABLE function module, according to SAP recommendations, for reading data from SAP tables required for governance.

The /SAILPOIN/SAIL_READ_TABLE provides enhanced security, support for pagination, and performance improvements over the RFC_READ_TABLE. For more information on the deployment process, refer to Installation of SAILPOIN Add-On.

Important

  • SailPoint recommends having SAP BASIS version 751 and above for seamless functionality of the ABAP add-on. However, for lower BASIS versions, /SAILPOIN/SAIL_READ_TABLE_LEG can be tried with limited support from SailPoint.
  • RFC_READ_TABLE-based connections are deprecated, and it is recommended to use the SAP-certified add-on instead.

Configuration Table for SAP Direct

Insert the below data into the /SAILPOIN/CONF table:

Attribute Description
SERVICE_ACCOUNT This is the allowed service account to be used for accessing FM.
NAME Name of entity from which data is fetched. For now we can consider it as a table name.
COLUMN_NAME Column allowed for fetching data
ENTITY_TYPE Type of entity such as table, join, or any other. This is for future purposes.
COLUMN_DTYPE Data type of the column that is allowed.
COLUMN_DENAME Data element type of the column. Data element type can be found by using t-code SE11 when viewing the table details under the Fields tab.
COLUMN_LENGTH Length of the allowed column. The Length can be found by using t-code SE11 when viewing the table's details, under the Fields tab.

Note

Validate that the values for COLUMN_DENAME and COLUMN_LENGTH are correct as per your system. These can be validated through the t-code SE11 while viewing the table details under the Fields tab.

Inserting Data with a Script

Setting Up the Script

  • Enter t-code SE38 and then create program Z_CONFIGURE_SERVICEACCOUNT in the local object package and type as an executable program.
  • Copy and paste the SailPoint SAP ABAP Add-on Table Configuration script and activate the program.
  • For better readability of the input parameters edit the selection text from Go to > Text Element > Selection Text and update it as shown in the following image.
Screenshot

Selection text

  • Save and activate the program.

Running the Script

  • Enter t-code SE38 and then search for program Z_CONFIGURE_SERVICEACCOUNT. Select execute.
  • Enter the service account and integration module to be populated respectively.
Screenshot

Enter service account

  • Once you have entered the details correctly, select execute and you will see a success message.
Screenshot

Success message

Inserting Data with Transaction SE16

Enter SE16 > Table Name: /SAILPOIN/CONF > Create Entries.

Screenshot

SE16 table entry

The option to enter the data into the table will appear.

Screenshot

SE16 data entry

SERVICE_ACCOUNT NAME COLUMNNAME ENTITY_TYPE COLUMN_DNAME COLUMN_DTYPE COLUMN_LENGTH
<your-service-account-name> AGR_1251 AGR_NAME TABLE AGR_NAME C 10
<your-service-account-name> AGR_1251 DELETED TABLE TPR_ST_DEL C 40
<your-service-account-name> AGR_1251 FIELD TABLE AGRFIELD C 40
<your-service-account-name> AGR_1251 HIGH TABLE AGVAL C 40
<your-service-account-name> AGR_1251 LOW TABLE AGVAL C 30
<your-service-account-name> AGR_1251 OBJECT TABLE AGOBJECT C 40
<your-service-account-name> AGR_1252 AGR_NAME TABLE AGR_NAME C 40
<your-service-account-name> AGR_1252 HIGH TABLE AGVAL C 40
<your-service-account-name> AGR_1252 LOW TABLE AGVAL C 30
<your-service-account-name> AGR_1252 VARBL TABLE AGRORGVAR C 30
<your-service-account-name> AGR_DEFINE AGR_NAME TABLE AGR_NAME C 10
<your-service-account-name> AGR_FLAGS AGR_NAME TABLE AGR_NAME C 30
<your-service-account-name> AGR_FLAGS FLAG_TYPE TABLE FLAG_TYPE C 30
<your-service-account-name> AGR_FLAGS FLAG_VALUE TABLE AGR_ATT2 C 12
<your-service-account-name> AGR_PROF AGR_NAME TABLE AGR_NAME C 30
<your-service-account-name> AGR_PROF PROFILE TABLE XUPROFILE C 48
<your-service-account-name> AGR_TCODES AGR_NAME TABLE AGR_NAME C 01
<your-service-account-name> AGR_TCODES TCODE TABLE AGXREPORT C 02
<your-service-account-name> AGR_TCODES TYPE TABLE REPORTTYPE C 02
<your-service-account-name> TUTYP LANGU TABLE SPRAS C 01
<your-service-account-name> TUTYP USERTYP TABLE USERTYPEN C 02
<your-service-account-name> TUTYP UTYPLONGTEXT TABLE SLIM_LONG_TEXT55 C 55
<your-service-account-name> TUTYP UTYPTEXT TABLE UTYPTEXT C 30
<your-service-account-name> TUTYPA ACTIVE TABLE RSUVMFLAG C 01
<your-service-account-name> TUTYPA USERTYP TABLE USERTYPEN C 02
<your-service-account-name> USR02 BNAME TABLE XUBNAME C 12
<your-service-account-name> USR02 LTIME TABLE XULTIME T 06
<your-service-account-name> USR02 PWDSTATE TABLE PWDCHGSTATE B 03
<your-service-account-name> USR02 TRDAT TABLE XULDATE D 08
<your-service-account-name> USR11 LANGU TABLE SPRAS C 02
<your-service-account-name> USR11 PROFN TABLE XUPROFNAME C 12
<your-service-account-name> USR11 PTEXT TABLE XUTEXT C 60
<your-service-account-name> USR11 TRDAT TABLE SPRAS C 01
<your-service-account-name> USRSYSACTT AGR_NAME TABLE F_AGR_NAME C 30
<your-service-account-name> USRSYSACTT LANGU TABLE LANGU C 01
<your-service-account-name> USRSYSACTT SUBSYSTEM TABLE RFCRCVSYS C 10
<your-service-account-name> USRSYSACTT TEXT TABLE AGR_TITLE C 80
<your-service-account-name> USRSYSPRF TYP TABLE XUTYP C 01
<your-service-account-name> USRSYSPRFT LANGU TABLE LANGU C 01
<your-service-account-name> USRSYSPRFT PROFN TABLE XUPROFNAME C 12
<your-service-account-name> USRSYSPRFT PTEXT TABLE XUTEXT C 60
<your-service-account-name> UST10C PROFN TABLE XUPROFILE C 12
<your-service-account-name> UST10C SUBPROF TABLE XUPROFILE C 12
<your-service-account-name> UST10S PROFN TABLE XUPROFILE C 12
<your-service-account-name> USRSYSACT SUBSYSTEM TABLE RFCRCVSYS C 10
<your-service-account-name> USRSYSACT AGR_NAME TABLE F_AGR_NAME C 30
<your-service-account-name> USRSYSACT COL_AGR TABLE XUFLAG C 4
<your-service-account-name> AGR_TEXTS AGR_NAME TABLE AGR_NAME C 30
<your-service-account-name> AGR_TEXTS LINE TABLE MENU_NUM_S N 5
<your-service-account-name> AGR_TEXTS SPRAS TABLE MENU_SPRAS C 1
<your-service-account-name> AGR_TEXTS TEXT TABLE AGR_TITLE C 80
<your-service-account-name> USGRP USERGROUP TABLE XUCLASS C 12
<your-service-account-name> USGRPT USERGROUP TABLE XUCLASS C 12
<your-service-account-name> USGRPT SPRSL TABLE SPRAS L 1
<your-service-account-name> USGRPT TEXT TABLE XUTEXT C 60

For Group Aggregation in CUA systems, additional permissions are required as follows:

SERVICE_ACCOUNT NAME COLUMNNAME ENTITY_TYPE COLUMN_DNAME COLUMN_DTYPE COLUMN_LENGTH
<your-service-account-name> USRSYSPRF SUBSYSTEM TABLE RFCRCVSYS C 10
<your-service-account-name> USRSYSPRF PROFN TABLE XUPROFNAME C 12

Importing Support Packages for Add-On SAILPOIN

Prerequisites

  • Add-On "SAILPOIN" is already installed in your SAP SAP Direct system.
  • You are logged into client 000.
  • You can import support packages using SPAM t-code.

Installation

  1. Download the PAT file(s) for the support packages from the Package Download Matrix.

  2. Copy the PAT file(s) on your server location:

    (Windows : <DRIVE>:\usr\sap\trans\EPS\in ; Linux/Unix : /usr/sap/trans/EPS/in).

  3. Sign in to the SAP GUI and execute the SPAM t-code. The status of the queue for importing support package should be green as shown in the following figure.

    Screenshot

    SPAM t-code

  4. Go to Installation Package > Load Packages > EPS Files From Application Server.

    Screenshot

    Load Packages

  5. When prompted to upload OCS packages from the EPS inbox, select Yes.

    Screenshot

    Upload OCS packages

  6. Verify that the upload was successful.

    Screenshot

    Upload verification

  7. Select Display/Define to choose the software component for which you want to import Support Packages.

    Screenshot

    Display/Define

  8. Select the SAILPOIN component.

    Screenshot

    Select SAILPOIN component

  9. Confirm the queue by selecting Continue.

    Note

    The queue in the image below shows the number of support packages that can be installed based on the PAT files placed on your server location. The below example shows importing 2 support packages.

    Screenshot

    Confirm queue

  10. When prompted to add the Modification Adjustment Transports to the queue, select No.

    Screenshot

    Modification Adjustment Transports

  11. Verify that the queue contains the intended support packages for import that were added/defined in the queue in the previous steps.

    Screenshot

    Import queue

  12. Go to Support Package > Import Queue.

    Screenshot

    Import Queue

  13. Select Continue to import the queue.

    Screenshot

    Continue import

    Note

    The support package begins installing, and you can view the progress at the bottom of the window.

  14. After the support package(s) are successfully imported, the below prompt should display. Select Continue to proceed with the import.

    Screenshot

    Continue prompt

  15. Confirm the queue by going to Support Package > Confirm.

    Screenshot

    Confirm queue

  16. When prompted to send Runtime Analysis, select Do not send.

  17. Go to System > Status > Details > Installed Software Component Versions to confirm that the Add-on's support package is now set to the desired support package level. For example, 0002.

    Screenshot

    Installed Software Component Versions

Package Download Matrix

Overview

Use this page to identify and download the correct PAT files for the SailPoint SAP ABAP Add-on (SAILPOIN) before installation in your SAP system.

All PAT files are available from the SailPoint community download page: SailPoint SAP ABAP Add-on PAT Files.

After you download the files, copy the PAT files to your SAP transport directory and install them using transaction SAINT. For step-by-step installation instructions, refer to Installation of SAILPOIN Add-On.

Package Types

Package Type Full Name When to Use
AOI Add-On Installation Package First-time installation of the SAILPOIN add-on on a new SAP system
CSP Component Support Package Updates to an already installed SAILPOIN add-on (support package level 0001, 0002, and so on)
ACP Attribute Change Package Dependency resolution only - use when SAINT reports dependency errors during add-on installation

Note

A PAT file is SAP's packaging format for add-ons and support packages. When you load a PAT file in SAINT, SAP extracts its contents into your transport directory.

Selecting the Correct PAT File

Installing SAILPOIN for the First Time

  1. Download the base AOI file.
  2. Download the latest CSP file available for your release (currently SP-Level 0002).
  3. If SAINT reports dependency errors, download the applicable ACP files from Dependency Resolution Packages.

Updating an Installed SAILPOIN Add-On

  1. Download only the CSP file for the target support package level.
  2. Do not re-download the base AOI unless you are performing a fresh installation.

Resolving SAINT Dependency Errors

Download the ACP file that matches your installed SAP software components. Refer to Dependency Resolution Packages.

Release 100_2022 Downloadable Packages

Your Situation Package Type Support Package PAT File Name
New installation (base add-on) AOI (Add-On Installation Package) Base component G750020862508_0000028.PAT
Update to support package level 0001 CSP (Component Support Package) SAPK-12201INSAILPOIN G750020862508_0000032.PAT
Update to support package level 0002 CSP (Component Support Package) SAPK-12202INSAILPOIN G750020862508_0000033.PAT

Download link (all files): SailPoint SAP ABAP Add-on PAT Files

Dependency Resolution Packages

If installation fails with dependency errors, download and install the ACP file that matches the SAP software components already present in your system.

If Your System Has These Installed Components Download This ACP PAT File
DW4CORE, S4CORE, SAP_GWFND G750020862508_0000076.PAT
S4FND, MDG_FND, SAP_GWFND G750020862508_0000077.PAT

Install the ACP file before retrying the add-on or support package installation.

Gathering Information for Support

If installation or support package import still fails after you use the correct PAT files, gather the information below before contacting SailPoint Support or your implementation partner. Complete details help SailPoint Support diagnose dependency, version, or transport issues faster.

Providing System Details

Provide:

Field What to Enter
SAP module / landscape On-prem ECC, S/4HANA, SAP Cloud, or other - include environment (DEV, QA, PROD)
System version SAP release and support package level, if known (for example, ECC 6.0 EHP8, S/4HANA 2022)
Connector context Which SailPoint SAP connector you are integrating (Direct, HR/HCM, GRC, etc.)

Exporting Installed Software Versions

Export both tabs from SAP and attach the spreadsheet and a screenshot.

To export installed software versions:

  1. Connect to your SAP system.
  2. Go to System > Status.
  3. On System Status, open SAP System Data details (Component Information).

  4. In the Installed Software window, open both tabs:

    • Installed Software Component Versions
    • Installed Product Versions

  5. Right-click the window and select Spreadsheet.

  6. Choose your export format and select OK.
  7. Attach the exported file and screenshots of both tabs.

Checking SAILPOIN Package Status from SAP Tables

Run the following in transaction SE16 and attach screenshots of the results.

Table Field Input Value Action
PAT07 PATCH *SAILPOIN* Execute
PAT07_ACP ACP_PATCH *SAILPOIN* Execute

These results show which SAILPOIN packages and ACP files are present in the system.

Describing the Error

Include:

  • A clear description of the issue (what you were doing, what failed, and when).
  • Screenshots of the exact error message from SAINT/SPAM or related SAP transactions.
  • The step where the failure occurred (load PAT, select support package, start installation, and so on).

Providing PAT File Details

List every PAT file you used, including files that failed:

Item Example
PAT file name G750020862508_0000033.PAT
Package type AOI, CSP, or ACP
Support package SAPK-12202INSAILPOIN (if applicable)
Outcome Loaded successfully / installation failed with error

(Optional) Providing Additional Information

  • Whether this is a new installation or an update to an existing SAILPOIN add-on.
  • Dependency or ACP errors seen during SAINT.
  • Whether other SAP add-ons or support packages were installed at the same time.
  • Recent SAP Basis or kernel changes.
  • Other context that might be relevant.

Uninstallation of SAILPOIN Add-On

  1. In the SAP GUI, execute the Tcode SAINT.

  2. Ensure that the Add-on SAILPOIN was successfully installed by confirming that it is visible in the Installed Components list.

    Screenshot

    Installed Components

  3. Select Uninstallable Components. The Add-on SAILPOIN should be visible.

    Screenshot

    Uninstallable Components

  4. Select SAILPOIN from the grid, and then select Start.

  5. Select Continue when prompted on the Start Options dialog box.

    Screenshot

    Start Options

    Note

    If there are any specific preferences for any of the start options, those can be selected as per requirement.

  6. Select Finish.

  7. When prompted to send Runtime Analysis, select Do not send.

    Screenshot

    Do not send Runtime Analysis

  8. Perform the following to confirm that the Add-on SAILPOIN was uninstalled:

    1. Select Installable Components and scroll through the list to ensure SAILPOIN is not found.
    2. Select Uninstallable Components and scroll through the list to ensure SAILPOIN is not found.
    3. Go to System > Status. Under SAP System data go to Product Version > Details > Installed Software Component Versions and ensure Add-on SAILPOIN is not found.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.