Connecting SailPoint and SAP GRC

To connect SailPoint with SAP GRC, perform the following tasks:

Adding the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

To configure a new source:

1. Sign in to SailPoint.
2. Go to Admin > Connections > Sources.
3. Select Create New.
4. Search for the connector by entering the name in the search box, and then select Configure.
5. In the Source Name field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
6. In the Description field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
7. In the Source Owner field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to Assigning a Source Owner.

8. Under Connection Type, select Direct Connection or Flat File.

   • Direct Connection - A direct connection fetches data from the Virtual Appliance Cluster you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the Virtual Appliance Reference Guide.
   • Flat File - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable.

9. If you selected Direct Connection, in Virtual Appliance Cluster, select the virtual appliance cluster that will be used as the application connector for the source.

10. (Optional) Select a governance group to grant its members source or role sub-admin level oversight of the source and its access. For more information, refer to Creating and Managing Governance Groups.
11. If this source represents a primary system containing your organization's personnel records, select the Authoritative Source checkbox. For more information, refer to Creating Identity Profiles.
12. Select Continue. The source is created, and you are navigated to the Source Setup > Base Configuration page. Continue to configure your connected source there.

Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a unique name and description for the source.

2. In the Source Owner dropdown list, select the identity that owns this source.

   • To find a source owner, begin entering their name.

3. In the Virtual Appliance Cluster dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to SailPoint Virtual Appliances.

4. (Optional) If enabled for your organization, select the Use a Credential Provider checkbox to manage the source's authentication using a credential provider.

   Note

   To add a credential provider, go to Admin > Connections > Credential Providers. For more information about credential providers, refer to Credential Providers.

5. Configure the authentication to allow SailPoint to connect to the source. Refer to Connection Settings for more information.

6. (Optional) In the Governance Group for Source Management dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to Associating Governance Groups with a Source.

7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default.

   • Enable Provisioning - Set the toggle to Enabled to allow the source to create, update, and deactivate accounts in the connected source system.

   • Disable Provisioning - Set the toggle to Disabled to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source.

8. Drag and drop the required files into the Upload Files box, or upload them from your computer.

   Warning

   Ensure that the file you upload is not vulnerable or malicious.

   Upload the sapjco3.jar and libsapjco3.so files. Download the JCO libraries (JCO Release 3.1.x) from the SAP customer service marketplace.

9. Select Save.

Connection Settings

This section contains the information that SailPoint uses to authenticate with the managed system. After you select Connection Settings the following page is displayed.

1. Enter the User Name with the appropriate permissions.
2. Enter the Password of the user.

3. Enter the Host on which the SAP service is running.

   Note

   The server must have Java Connector (JCo) enabled.

4. Enter the two digit System Number that was generated during the SAP system installation.

5. Enter the three digit client ID or Client Number to use while connecting to SAP.
6. Enter the two character code for the Client Language used by the application.

7. Select the option to Enable IAG Bridge configurations (optional).

   Screenshot

   

8. Complete the Webservice URL Configuration by inserting the URL for each required web service:

   Screenshot

   

   • User Access

     For example,

     http://<privateIP of GRC System>/sap/bc/srt/rfc/sap/grac_user_acces_ws/<client id>/grac_user_acces_ws_name/grac_user_acces_ws_name
     

   • Request Details

     For example,

     http://<privateIP of GRC System>/sap/bc/srt/rfc/sap/grac_request_details_ws/<client id>/grac_request_details_ws/grac_request_details_ws
     

   • Search Roles

     For example,

     http://<privateIP of GRC System>/sap/bc/srt/rfc/sap/grac_search_roles_ws/<client id>/grac_search_roles_ws/grac_search_roles_ws
     

   • Role Details

     For example,

     http://<privateIP of GRC System>/sap/bc/srt/rfc/sap/grac_role_details_ws/<client id>/grac_role_details_ws/grac_role_details_ws
     

   For more information, refer to Obtain the SAP GRC URLs.

9. Select the Name of the Function Module Configuration as per your SAP Basis Version.

   Screenshot

   

10. Select Save.

Configuring Secure Network Communication (SNC)

This section contains the information for the Secure Network Communication (SNC) configuration. SNC protects the logical link between the end points of a communication.

1. Select the option to Enable SNC.
2. Select a Level of Security. Each level sets the Quality of Protection (QOP) level. In SAP, it relates to jco.client.snc_qop.
3. Enter the name that internally identifies in SNC Name. In SAP, it relates to jco.client.snc_myname.

4. Enter the SNC partner's name in SNC Name of SAP Application Server. If SNC is configured in SAP, it relates to jco.client.snc_partnername.

   For example, provide input as p:CN=R3, O=XYZ-INC, C=EN in SAP.

5. Enter the path to the library that provides the SNC service in SNC Library Path. In SAP it relates to jco.client.snc_lib.

6. Select Save.

Configuring Aggregation Settings

Configure the aggregation filters to determine which accounts are aggregated.

1. Provide the list of Role Types(s), Business Process(es), and Sub Process(es) to aggregate by entering them using commas to separate the values.

   • Business Process(es) aggregate roles for only the specified business processes.
   • Sub Process(es) only aggregates roles for the specified sub processes.

2. Specify the Aggregation Delimiter. The Aggregation Delimiter configuration is applicable only in the case of the '/SAILPOIN/SAIL_READ_TABLE' and the '/SAILPOIN/SAIL_READ_TABLE_LEG' Function Module.

3. Specify the Page Size for your Function Module Configuration. The Page Size is applicable for /SAILPOIN/SAIL_READ_TABLE.

4. Select the Enable Partitioning option. Specify a number in Number of Partitioning Threads. Account Partitioning Aggregation allows processing of data in parallel, across multiple threads, to help increase the performance of aggregation tasks.

   Note

   • If the VA has configuration for multiple CPU cores a higher number of partition threads can be configured in order to improve performance.
   • Account Partitioning configuration is supported only for SAP Basis version 751 or later.

5. (Optional) Specify the name of the BAPI configuration in BAPI Name. This allows you to aggregate based on additional account attributes such as Functional Area, User Group Assignments, and SNC-Name. For more information, refer to Creating a Custom Business Application Programming Interface (BAPI).

6. Select Save.

Creating a Custom Business Application Programming Interface (BAPI)

You can aggregate the following attributes by manually adding them in the Schema Attributes section:

• Function: Use Function as the field name in the provisioning policy.
• SNC Name: Use SNC Name as the field name in the provisioning policy.
• Functional Area: Use function_area as the field name in the provisioning policy.
• User Group Assignments
• Logon Language
• Function
• Phone
• Department

SailPoint provides support for aggregation and provisioning of the additional attributes mentioned below. You must add these to the account schema and create a custom BAPI.

• Alias
• Personnel Number
• Company
• Parameters (Multi valued)

To create a custom BAPI:

In the GRC system, provide the input and output parameters.

Input

The input for the custom BAPI must be User_ID as described below:

Output

The output of this value must be in the form of:

1. Z_USER_DETAILS_TABLE - Internal table: where each row is of Line Type: ZUSER_SYSTEM_DETAILS.

   Screenshot

   

   ZUSER_SYSTEM_DETAILS is a custom structure which contains two fields:

   • SYSTEM: The system to which the user is connected. Associated type is CHAR.
   • Z_GRAC_S_USER_DETAIL: The complete user details. The associated type is GRAC_S_USER_DETAIL.

   Note

   This is GRC's built-in structure which represents a complete user entity connected to a system.

2. ET_MESSAGE: contains error message details and the associated type is BAPIRET2_TAB.

   Screenshot

   

Example Source Code

FUNCTION ZCUSTOM_BAPI_FOR_ADDITIONAL_ATTRIBUTES.
*"----------------------------------------------------------------------
*"*"Local Interface:
*"  IMPORTING
*"     VALUE(USER_ID) TYPE  GRAC_USER
*"  EXPORTING
*"     VALUE(Z_USER_DETAILS_TABLE) TYPE  ZGRAC_S_USER_TAB
*"     VALUE(ET_MESSAGE) TYPE  BAPIRET2_TAB
*"----------------------------------------------------------------------


DATA:
ld_IV_USER TYPE GRAC_USER ,
ld_ES_USER_DETAILS TYPE GRAC_S_USER_DETAIL ,
it_data TYPE STANDARD TABLE OF GRACUSERCONN INITIAL SIZE 0 ,
wa_data TYPE GRACUSERCONN ,
id_system_id  TYPE string ,
it_user_details TYPE STANDARD TABLE OF ZUSER_SYSTEM_DETAILS INITIAL SIZE 0 ,
ld_custom_user_struct TYPE ZUSER_SYSTEM_DETAILS,
exception_ref TYPE REF TO cx_grfn_exception.


ld_IV_USER = USER_ID.

*Getting systems associated with a user
SELECT * FROM GRACUSERCONN WHERE USER_ID = @ld_IV_user INTO TABLE @it_data.


TRY.
*Loop over each connector to get the user details
LOOP AT it_data INTO wa_data.

id_system_id = wa_data-CONNECTOR.
clear : ld_ES_USER_DETAILS.

CALL METHOD CL_GRAC_AD_ACCESS_MGMT=>GET_USER_DETAIL(
EXPORTING
IV_USER = ld_IV_USER
iv_system_id    = id_system_id
IMPORTING
ES_USER_DETAILS = ld_ES_USER_DETAILS
ET_MESSAGE = ET_MESSAGE

).

ld_custom_user_struct-SYSTEM = id_system_id.
 ld_custom_user_struct-Z_GRAC_S_USER_DETAIL = ld_ES_USER_DETAILS.

APPEND ld_custom_user_struct TO it_user_details.

ENDLOOP.

CATCH cx_grfn_exception INTO exception_ref.
RETURN.

ENDTRY.

Z_USER_DETAILS_TABLE =  it_user_details.


ENDFUNCTION.

SailPoint Add-On to replace the use of RFC_READ_TABLE

SailPoint's ABAP Integration is designed to replace the functionality of SAP's RFC_READ_TABLE to securely access the information in the SAP system required for deeper governance.

This integration needs to be deployed on the GRC system for querying the GRC tables. For the deployment process follow these instructions in order:

1. Installation of SAILPOIN Add-On
2. Configuration of SailPoint's Function Module
3. Configuration Table for SAP GRC

Prerequisites

To install the Add-On and support packages using the SAINT transaction code (t-code), follow these steps:

1. Log into client 000.
2. Ensure that you have installed at least SPAM/SAINT version 0053 to be able to uninstall Add-Ons using the SAINT t-code.
3. Deselect the digital signature setting in SAINT t-code:
   1. Go to SAINT t-code.
   2. Select Extras.
   3. Choose Setting.
   4. Deselect the Check for digital signature of to be imported OCS Packages.
4. Proceed with installing the Add-On and support packages using the SAINT t-code.

Installation of SAILPOIN Add-On

1. Download the PAT file(s) for the Add-On and all the required support packages from the New Package Download Matrix.

   Note

   The PAT file is a special file used to package the SAP Add-on. If you install the add-on using SPAM/SAINT, the contents of the PAT file will be extracted (disassembled) to your transport directory.

2. Copy the .PAT file on your server location for the Add-On and all the required support packages:

   Server Location: (Windows : <DRIVE>:\usr\sap\trans\EPS\in ; Linux/Unix : /usr/sap/trans/EPS/in).

3. Login to SAP GUI, and then execute the Tcode SAINT.

   Screenshot

   

4. Go to Installation Package > Load Packages > EPS Files From Application Server.

   Screenshot

   

5. Ensure the following PAT file(s) uploaded successfully:

   Screenshot

   

6. Select Start.

7. Select SAILPOIN from the Installable Add-on Package packages for your system grid.

   Screenshot

   

8. Select Continue.

9. To install the Add-On and support package(s), perform the following:

   1. Select the highest version from the available support package(s) under the Target Support Package drop down of the component SAILPOIN.

      Screenshot

      

   2. The column Level should indicate the chosen target support package.

      Screenshot

      

10. Select Continue.

11. On the Add Modification Adjustment Transports to the Queue dialog, select No.

    Screenshot

    

12. If prompted on the Start Options dialog box, select Continue.

    Screenshot

    

    Note

    The Add-on and the support package(s) will begin installing, and the progress can be seen at the bottom of the window.

13. Select Finish. If prompted to send Runtime Analysis, select Do not send.

14. Go to System > Status > Details > Installed Software Component Versions to confirm the following:

    1. The Add-On and the support packages have been added in the system component.

       Screenshot

       

Configuring SailPoint's Function Module

Use the /SAILPOIN/SAIL_READ_TABLE function module to support systems whose SAP BASIS version is 751 and later.

This is a SAP-certified function module provided by SailPoint to replace the use of SAP's RFC_READ_TABLE function module, according to SAP recommendations, for reading data from SAP tables required for governance.

The /SAILPOIN/SAIL_READ_TABLE provides enhanced security, support for pagination, and performance improvements over the RFC_READ_TABLE. For more information on the deployment process, refer to Installation of SAILPOIN Add-On.

Configuration Table for SAP GRC

Insert the following data into the /SAILPOIN/CONF table. The table uses the following fields:

• SERVICE_ACCOUNT - The allowed service account used for accessing the function module.
• NAME - The name of the entity from which data is fetched. Consider this a table name.
• COLUMN_NAME - The column allowed for fetching data.
• ENTITY_TYPE - The type of entity, such as table or join. This field is reserved for future use.
• COLUMN_DTYPE - The data type of the column that is allowed.
• COLUMN_DENAME - The data element type of the column. You can find the data element type using the t-code SE11 when viewing the table details, under Fields.
• COLUMN_LENGTH - The length of the column that is allowed. You can find the length using the t-code SE11 when viewing the table's details, under Fields.

Insert the data into the /SAILPOIN/CONF table using one of the following methods.

Inserting Data Using the SE16 T-Code

1. Enter SE16 > Table Name: /SAILPOIN/CONF > Create Entries.

   Screenshot

   

2. Enter the data into the table.

   Screenshot

   

Inserting Data Using a Script

Setup

1. Enter the t-code SE38, and then create the program Z_CONFIGURE_SERVICEACCOUNT in the local object package with the type set to executable program.
2. Copy and paste the script provided here, and activate the program.

3. Edit the selection text from Go to > Text Element > Selection Text and update it as shown in the following image, for better readability of the input parameters.

   Screenshot

   

4. Select Save, and then select Activate.

How It Works

1. Enter the t-code SE38, and then search for the program Z_CONFIGURE_SERVICEACCOUNT. Select Execute.

2. Enter the service account and integration module to populate.

   Screenshot

   

3. Select Execute. A success message appears once you have entered the details correctly.

   Screenshot

   

Table Permissions

Additional Table Permissions for GRC AC12 SP19 and Above Versions

Table Permissions for Configuring FireFighterID

For FFOwner

For FFController

For DefaultValidityDays

For FFUserID & Connector

For FireFighterIds for Account Schema

Role Aggregation Based on Connector Group and System

For more information refer to Troubleshooting.

Configuration Table for IAG Bridge

The following are additional table permissions for the SAP IAG Bridge integration.

Importing Support Packages for Add-On SAILPOIN

Prerequisites

• Add-On "SAILPOIN" is already installed in your SAP GRC system.
• You are logged into client 000.
• You can import support packages using SPAM t-code.

Installation

1. Download the PAT file(s) for the support packages from the New Package Download Matrix.

2. Copy the PAT file(s) on your server location:

   (Windows : <DRIVE>:\usr\sap\trans\EPS\in ; Linux/Unix : /usr/sap/trans/EPS/in).

3. Sign in to the SAP GUI and execute the SPAM t-code. The status of the queue for importing support package should be green as shown in the following figure.

   Screenshot

   

4. Go to Installation Package > Load Packages > EPS Files From Application Server.

   Screenshot

   

5. When prompted to upload OCS packages from the EPS inbox, select Yes.

   Screenshot

   

6. Verify that the upload was successful.

   Screenshot

   

7. Select Display/Define to choose the software component for which you want to import Support Packages.

   Screenshot

   

8. Select the SAILPOIN component.

   Screenshot

   

9. Confirm the queue by selecting Continue.

   Note

   The image below shows the number of support packages that can be installed based on the PAT files placed on your server location. The following example shows importing 2 support packages.

   Screenshot

   

10. When prompted to add the Modification Adjustment Transports to the queue, select No.

    Screenshot

    

11. Verify that the queue contains the intended support packages for import that were added/defined in the queue in the previous steps.

    Screenshot

    

12. Go to Support Package > Import Queue.

    Screenshot

    

13. Select Continue to import the queue.

    Screenshot

    

    Note

    The support package will begin installing, and the progress can be seen at the bottom of the window.

14. After the support package(s) are successfully imported, the below prompt should appear. Select Continue to proceed with the import.

    Screenshot

    

15. Go to Support Package > Confirm to confirm the queue.

    Screenshot

    

16. When prompted to send Runtime Analysis, select Do not send.

17. Go to System > Status > Details > Installed Software Component Versions to confirm that the Add-on's support package is now set to the desired support package level. For example, 0002.

    Screenshot

    

New Package Download Matrix

Refer the SailPoint SAP ABAP Add-on PAT Files for downloading the new package.

To overcome dependency errors during Add-on installation, use these Attribute Change Package (ACP) files:

Uninstallation of SAILPOIN Add-On

1. Sign in to the SAP GUI and execute the Tcode SAINT.

2. Ensure that the Add-on SAILPOIN was successfully installed by confirming that it is visible in the Installed Components list.

   Screenshot

   

3. Select Uninstallable Components. The Add-on SAILPOIN should be visible.

   Screenshot

   

4. Select SAILPOIN from the grid, and then select Start.

5. Select Continue when prompted on the Start Options dialog box.

   Screenshot

   

   Note

   If there are any specific preferences for any of the start options, those can be selected as per your requirements.

6. Select Finish.

7. If prompted to send Runtime Analysis, select Do not send.

   Screenshot

   

8. Perform the following to confirm that the Add-on SAILPOIN was uninstalled:

   1. Select Installable Components and scroll through the list to ensure SAILPOIN is not found.
   2. Select Uninstallable Components and scroll through the list to ensure SAILPOIN is not found.
   3. Go to System > Status > Product Version > Details > Installed Software Component Versions. Ensure Add-on SAILPOIN is not found.

Configuring Provisioning Settings

Configure the provisioning settings to change GRC access requests.

1. Enter the Requester ID to use for provisioning on the SAP GRC service. For one method of finding the requester ID, refer to Finding the Requester ID.
2. Enter the Requester Email to use for provisioning on the SAP GRC service.
3. Enter the Provisioning Business Process. By default, the value is basis.
4. Enter the Polling Interval in minutes. This indicates the time interval for requesting data from SAP GRC. The interval can be from 1 to 360 minutes. The default is 60.

5. Configure the mapping for the following:

   Screenshot

   

   • Access Request Type
   • Provisioning Actions for Role
   • Provisioning Actions for System

   For more information, refer to Verify the Request Type and Configuration.

6. Enter the Access Request Priority. This is the 3-digit number that indicates the priority for all SAP GRC access requests triggered by SailPoint. The default is 006.

7. The connector will disable all systems connected to SAP GRC. For more information, refer to Disable All Systems Connected to SAP GRC.
8. Select Save.

Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to Review and Test.

2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.

3. Select Test Connection.

SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to Discovered Applications in the SailPoint user interface.

For more information, refer to Application Onboarding in the SailPoint SaaS documentation.

Finding Aggregation Values for Child Roles

The SAP GRC connector supports aggregation of the Associated Child Roles attribute. The child roles are the roles associated with composite or business roles. For new connectors the Associated Child Roles attribute is available by default. For existing sources, you must manually add it. For more information on adding the attribute to the schema, refer to Adding Attributes to a Source Schema.

When the Associated Child Roles attribute is present in the schema for existing and new connectors, you must assign additional permissions such as GRACROLERELAT and GRACRLCOMPRL field values for the S_TABU_NAM authorization object.

Finding the Request ID

When users are provisioned, a request is sent to the SAP GRC system, and a Request ID is created in SAP GRC. To find the Request ID, refer to the following procedure:

1. In the SAP GRC system, go to Dashboard > Provisioning.
2. Select View All.
3. Enter a search query for the identity for which a request is placed.
4. Select Account Activity.

5. Select the Lifecycle Change Refresh row under the Action column.

   The Request ID appears.

System Bypass Configuration

The System Bypass Configuration enhancement supports customer use cases where a SAP GRC connected system needs to be skipped during all operations, such as:

• Aggregation
• Provisioning
• Modifying

With this configuration, you can selectively govern the systems that you intend to use with SailPoint. There are two modes available for use:

• Systems to Bypass for All Operations: To configure systems where all operations need to be skipped.

• Systems to Bypass for Provisioning Operations: To configure systems where only provisioning operations need to be skipped.

  Screenshot

  

Use the Systems to Bypass for All Operations field to specify one or more systems that are connected to SAP GRC, and need to be bypassed during all connector operations. For example, aggregation, provisioning, or modifying users, attributes, and entitlements.

1. Specify the system names separated by a new line for each system name. The expected outcome for the specified systems are as follows:

   • Account Aggregation
     • Users will not be aggregated if all the roles associated with it belong to the systems being bypassed.
     • Users will be aggregated if they have roles from multiple systems and any one of the roles is not set to be bypassed. In this case, the connector will only fetch the roles from systems that are not being bypassed.
     • Users and associated business roles will be aggregated if there is a business role that gives access to users from multiple systems and any one of the roles is not set to be bypassed. If all the roles inside a business role belong to the bypassed system, the business role will not be aggregated.
   • Group Aggregation
     • Entitlements associated with systems that are set be bypassed will not be aggregated.
   • Provisioning
     • All provisioning operations will fail for systems specified in the Systems to Bypass for All Operations field.
     • Provisioning for business roles will fail if the business role contains any role from the systems that are set to be bypassed.

Use the Systems to Bypass for Provisioning Operations field to specify one or more systems that are connected to GRC that need to be bypassed during the provisioning operation (mostly read-only systems).

1. Specify the system names separated by a new line for each system name. The expected outcome for the specified systems are as follows:

   • Provisioning
     • All provisioning operations will fail for systems specified in the Systems to Bypass for Provisioning Operations field.
     • Provisioning for business roles will fail if the business role contains any role from the systems that are set to be bypassed.
     • The connector (by default) aggregates all the users, entitlements, and attributes from all of the SAP GRC connected systems unless explicitly configured to bypass under Aggregation Settings.

Configuration Summary Table

The following table lists the expected behavior when a particular system is added to Systems to Bypass for All Operations and/or Systems to Bypass for Provisioning Operations.

Configuring for Existing Sources

If systems are configured to be bypassed for an existing source that already has aggregated data, you must ensure the following aggregation settings in place.

• For the account aggregation task, enable the option to Enable Account Deletion. Existing accounts, with all the entitlements from the system configured to be bypassed, can then be removed. For more information, refer to Loading Account Data.
• For entitlement aggregation, entitlements can't be deleted directly in SailPoint. To remove entitlements that are associated with the system to be bypassed, delete them directly from the source and then run an entitlement aggregation. For more information, refer to Managing Entitlements.

Additional Information

Enable and Disable Account

Update the Valid From and/or Valid To Dates When the Account Is Enabled or Disabled

• Example AttributeRequest for single account disable/enable:

  <AttributeRequest name="Valid To" op="Set " value="systemName/20230101 "/>
  

• Example Attribute Request for Multiple account disable/enable:

  <AttributeRequest name="Valid To" op="Set">
   <Value>
    <List>
     <String>systemNameA/20501029</String>
     <String>systemNameB/20231029</String>
     <String>systemNameC/20301029</String>
    </List>
   </Value>
  </AttributeRequest>
  

Update the User Group and/or User Group Assignments When the Account Is Disabled

• Example attribute request to update the User Group:

  <AttributeRequest name="User Group" op="Set">
   <Value>
    <List>
     <String>systemNameA/GroupName1</String>
     <String>systemNameB/GroupName2</String>
    </List>
   </Value>
  </AttributeRequest>
  

• Example attribute request to update the User Group Assignments:

  <AttributeRequest name="User Group Assignments" op="Set">
   <Value>
    <List>
     <String>systemNameA/GroupName1a</String>
     <String>systemNameA/GroupName1b</String>
     <String>systemNameB/GroupName2a</String>
     <String>systemNameB/GroupName2b</String>
    </List>
   </Value>
  </AttributeRequest>
  

Disable All Systems Connected to SAP GRC

• Systems to Bypass for Disable Operations: Provide the name(s) of systems that the connector should bypass during the disable operation. The requested line item for specified systems will not be created in the GRC portal.

Remove All Roles When Account Is Disabled

To remove all of the roles when account is disabled, select Remove All Roles When Account is Disabled option. All of the roles from the GRC user account will be removed during the disable operation.

Modify Account

SAP has introduced a new process where any modifications in the user attributes reflect in GRC tables only after completing a Repository Sync Job from the GRC side.

The following steps must be performed sequentially for a successful modify operation:

1. Configure the Attribute Sync request on the user in SailPoint for the GRC source. To configure the attribute sync request, refer to Synchronizing Attributes - SailPoint Identity Services.
2. Run the Repository Object Sync job on your GRC system.
3. Execute User Aggregation on your GRC source to get the updated values of the user attributes.

Provisioning Multiple Systems Using User Group Attribute

The SAP GRC connector supports modification of the User Group attribute for multiple systems. To enable this functionality, follow these steps:

1. Pass the User Group attribute as a list in the provisioning plan:

   <AttributeRequest name="User Group" op="Set">
       <Value>
           <List>
               <String>systemNameA/GroupName1</String>
               <String>systemNameB/GroupName2</String>
           </List>
       </Value>
   </AttributeRequest>
   

2. Set the setUserGroupInUserInfo flag to true in the source configuration:

   Key=setUserGroupInUserInfo

   Value=true

   The setUserGroupInUserInfo is a boolean attribute.

   Note

   The setUserGroupInUserInfo flag must be set to true for the provisioning of multiple systems to be supported.

Firefighter ID Configuration

1. Enable the Manage Firefighter IDs setting to aggregate and provision Firefighter IDs where applicable. By default, this checkbox is unselected for new and existing applications.

2. Enter Firefighter ID with days to configure the Validity Period in Days for Firefighter ID or Superuser Access in days.

   This setting overrides SAP GRC configurations when applied in SailPoint. If no value is provided, the system defaults to the standard SAP GRC Firefighter ID validation period (days). The start date is automatically set to the current system date, and the end date is determined by adding the specified number of days.

3. Enter the Firefighter ID Access Request Priority, which is a 3-digit number that indicates the priority for all SAP GRC FFID access requests triggered by SailPoint. The default value is 006.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.