Integrating SailPoint with SAP GRC

This document is designed to provide the information required to configure a working instance of a SAP GRC connector for SailPoint. This connector supports:

Access Management

This integration is used to aggregate all the Users and Roles from the systems (SAP SCM, JAVA, SAP ERP HCM, and so on) connected to SAP GRC and facilitates their provisioning by creating requests in GRC irrespective if there is risk present or not, as illustrated in the following figure:

The figure explains the following methods:

1. User Aggregated from the GRC connected system.
2. Roles Aggregated from the GRC connected system.
3. Request sent for adding or removing access to the connected system.
4. Access Request ID created in GRC.
5. Requests wait and are queued until a response is issued by SAP GRC.
6. On the basis of the response returned from SAP GRC (approval or rejection in GRC), SAP GRC provisions or rejects the request and the corresponding status is maintained in the SAP GRC source.

SAP GRC IAG Bridge

SAP GRC IAG Bridge is an additional setup on top of an existing SAP Access Control (GRC) on-premise solution, which communicates with SAP Cloud Identity Access Governance (IAG). This feature extends access governance functionality to cloud systems in a hybrid landscape.

IAG Bridge is a SAP suggested approach for the customers who have invested heavily in SAP GRC access control, but now want to provide support for cloud applications as well. This configuration helps to perform risk analysis of user requests in IAG for connected SAP cloud systems using the SAP GRC system as a bridge.

The major benefit for this integration is that the source of truth for access requests and risk analysis remains to be SAP GRC, and IAG acts as secondary system to communicate with cloud applications. Separate licenses must be procured from SAP for both GRC and IAG systems to use this feature.

Supported Features

The SAP GRC integration supports the following functions:

• Aggregation of users from connected GRC systems of User Type - Dialog

  Note

  With the upgrade of GRC from AC12 SP19 and above, the SailPoint connector can show System as INACTIVE_USER for the accounts that are disabled on the highest priority system. For more information, refer to the Troubleshooting section.

• Additional attribute support in account aggregation and account provisioning:

  • Function
  • SNC Name
  • Multi-Valued User Group Assignments (multi-valued user group assignments are for account aggregation only. Use single use User Group Assignments for authorization checks).

  • Functional Area

    These attributes are aggregated from a custom BAPI. For more information, refer to Creating a Custom Business Application Programming Interface (BAPI).

• Aggregation of the following role types from SAP GRC:

  • Business, Composite, CUA Composite, Derived, and Single Role

    Important

    Ensure business role names follow the standard naming convention with single spaces between words to avoid data loss during aggregation. For example, the role names should be like "BUPA Healthcare Manager" with single spacing between words.

  • Group

  • HANA Analytic Privileges
  • Firefighter ID Role Type (FireFighterID)

• Create and Update User

• Add / Remove Entitlement

• Enable / Disable Account

  • Update the Valid From and/or Valid To dates when the account is enabled or disabled.
  • Update the User Group and/or User Group Assignments when the account is disabled.
  • Disable All Systems Connected to SAP GRC.
  • Read-only Systems to Bypass.

  For more information, refer to Additional Information.

• Remove All Roles When Account is Disabled.

  • For more information, refer to Additional Information.

• Modify Account

  • Update of the following user attributes
    • FirstName
    • LastName
    • Email
    • Manager
    • EmployeeID

  For more information, refer to Modify Account.

• SailPoint SAP GRC Integration now supports Access Management Requests that are configured for Auto-Approval in the SAP GRC system.

• Display actual requester details and description on access request.

SAP GRC Access Analysis

The SAP GRC connector supports the skipSystemItem attribute. The default value is false. When it is set to true in the source XML, the first item in RequestedLineItem containing the source name is skipped in the GracIdmUsrAccsReqServices API for the Create operation. You can use the skipSystemItem attribute when a user is created through request access. It is not mandatory to pass the source name (system name) in your environment.

IAG Bridge Supported Features

SAP GRC IAG Bridge supports the following features for accounts:

• Aggregation

  • Account
  • Groups

• Provisioning

  • Create
  • Add / Remove Entitlement

Firefighter ID Role Type

The SAP GRC connector supports the FireFighterID attribute to manage critical or emergency tasks in SAP systems. The SAP GRC connector allows you to add or remove entitlements for FireFighterID role type. For more information, refer to Access Request Schema Attributes.

To add FirefighterID to the mapping, follow the instructions provided in step 5 of the Access Request Type Mapping configuration process. For more information, refer to Configuring Provisioning Settings.

Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

For more information, refer to Managing Privilege Classification.

Supported Managed Systems

The SAP GRC connector supports SAP GRC Access Control 12.0 SP10 to SPS31.

The SAP GRC connector supports the following versions of managed systems:

• SAP NetWeaver 7.51 and above
• SAP Enterprise Resource Planning (ERP) Central Component (ECC) 6.0 with EHP8 (Enhancement package 8)
• SAP S/4HANA 2021 to SAP S/4HANA 2025 (on-premise)

SAP ABAP-Based Systems

• All

SAP Non-ABAP Systems

• SAP Enterprise Portal
• SAP Process Orchestration

SAP IAG Supported Systems

• All SAP IAG supported systems mentioned by SAP at the SAP official website. Use your S-user ID to sign in.

Prerequisites

• Configure at least one virtual appliance (VA) cluster and successfully test the connection.
• Configure the Multi-Step Multi-Process (MSMP) workflow on the SAP GRC server.
• Configure the SAP GRC Server
• Obtain the SAP GRC URLs
• Download the JCO libraries
• Synchronization Jobs
• Obtain the values for Filter Parameters
• Verify the Request Type and Configuration
• (Optional) If you want to configure Secure Network Communication (SNC), refer to SAP Secure Network Communication for SAP Source for additional SNC prerequisites.

Prerequisites for Aggregation

Create a custom Business Application Programming Interface (BAPI) in SAP GRC. For more information, refer to Creating a Custom Business Application Programming Interface (BAPI).

Configure the SAP GRC Server

Perform the following on the SAP GRC Server using the administrator privileges:

1. Execute SPRO transaction code and select SAP Reference IMG.
2. Go to Governance, Risk and Compliance > Access Control > User Provisioning.
3. Select the image to execute Maintain Provisioning Settings transaction.
4. In Dialog Structure, select Maintain Global Provisioning.
5. In the Provisioning option section, go to Auto Provisioning > Auto provisioning at end of request.

Obtain the SAP GRC URLs

Perform the following steps for each of the following web services:

• Request Details: GRAC_REQUEST_DETAILS_WS
• Search Roles: GRAC_SEARCH_ROLES_WS
• Role Details: GRAC_ROLE_DETAILS_WS

To obtain the required SAP GRC URLs:

1. Execute the SOAMANAGER transaction code on the SAP GRC server.
2. Go to Service Administration > Web Service Configuration.
3. In Search criteria, select Object Type as Service Definition and Object Name contains GRAC*.
4. Select Search.
5. In the search results, search (User Access web service) and select GRAC_USER_ACCESS_WS web service.
6. Complete the following for GRAC_USER_ACCESS_WS web service:
   • Select the icon to open Service WSDL Generation.
   • Copy the URL from the WSDL Generation section and open this URL in a browser.

   • Locate the following string in the XML and copy the binding URL (in bold) mentioned in the string:

     <wsdl:port name="Web_Service_BINDING_soap12" binding="tns:Web_Service_WS_BINDING_soap12">
     <wsoap12:address location="http://XXXX"/>
     <wsoap12:address location="https://XXXX"/>
     </wsdl:port>
     

These URLs are used for User Request and Request Details in the SAP GRC connector configuration.

Download the JCO Libraries

The JCO libraries (JCO Release 3.1.X) must be downloaded from the SAP website by going to the customer service marketplace and downloading the Java Integration Module.

SAP JCO version 3.1.X libraries, libsapjco3.so (on UNIX), must be present in the java.library.path (WEB-INF/lib) directory on the VA host. Upload these .jar and .so files on the Basic Configuration page.

For more information on downloading the .jar files, refer to Obtaining the Custom Connector Files. Ensure these jar files are compatible with the VA.

The following ports must be open on the SAP system:

Synchronization Jobs

For all the connected systems, ensure that the Repository Object Synchronization job is successful and is in the same order as maintained in User Detail Data Sources.

For verifying the order, complete the following steps:

1. Go to SPRO > SAP Reference IMG > Governance Risk and Compliance > Access Control > Maintain Data Source Configuration.
2. Select User Detail Data Source.

Obtain the Values for Filter Parameters

This section describes the procedure for obtaining the values for Business Process, Sub Process, and Role Type parameters.

Obtaining the Values for Business Process and Sub Process

1. Execute SPRO transaction code and select SAP Reference IMG.

2. Go to Governance > Risk and Compliance > Access Control > Maintain Business Process and Subprocesses.

   The following figure displays the list of business processes:

   

   As displayed in the above figure, code must be added instead of the description. For example AP00.

3. To get the sub processes associated with Business Process, select the code from the list of the business processes as displayed in the following figure:

   

4. Select Business Subprocess from the pane.

   The following figure displays the business subprocess:

   

Obtaining the Value for Role Type

By default, the connector aggregates all role types. To filter for a specific role type, the roleTypeFilter entry key must be used with the following values:

Verify the Request Type and Configuration

As part of the configuration process, you must map access request types and provisioning actions for the role and system. Verify the default request type codes and determine if you need to change them.

Complete the following steps to verify the request type and configuration:

1. Go to SPRO > SAP Reference IMG > Governance Risk and Compliance > Access Control > User Provisioning.

2. Select Define Request Type and verify the request type code is mapped to the default value. If not, change it by specifying the Configuring Provisioning Settings.

   Screenshot

   

3. Select Maintain Priority configuration and provide the priority value.

Optional Configuration of SAP GRC IAG Bridge

The following applications must be configured before enabling the SAP GRC IAG Bridge setup:

• SAP Access Control 12.0 system (SP 15 and higher)
• SAP IAG tenant with connected managed systems
• SAP Cloud connector

IAG System Configuration

1. The target application ID must be created and repository sync jobs must already be run on them.

2. Maintain the destination for SAP GRC under the BTP subaccount.

   For example, IAGAuthService and IAGProvisionStatusUpdate must be present.

3. You must schedule a recurring provisioning job in IAG.

GRC System Configuration

1. The RFC destination for authentications and SOD check must be present in Tcode SM59. (Ex. IAG_SOD_AUTH, IAG_SOD)

2. Configuration parameters for the bridge must be set up with the RFC names created in step 1 under SPRO > Governance, Risks and Compliance > Access Control > Maintain Configuration Settings.

   Parameter Group	Parameter ID	Parameter value
   Cloud Integration	1090	YES
   Cloud Integration	1091	RFC name created in step 1 for SOD
   Cloud Integration	1092	RFC name created in step 1 for SOD Auth

   Example of parameter names:

   

3. Separate RFC destinations for all the cloud applications.

   Note

   The name of the RFC destination for every cloud application must be exactly the same as its corresponding application ID name in IAG. This behavior is for SAP by-design.

4. In SAP Gateway administrator, the IAG_PROVISION_STATUS_UPDATE_SRV service must be maintained under SPRO > Governance, Risks and Compliance > SAP NetWeaver > SAP Gateway Administration > General Settings > Activate and Maintain Services.

5. The repository sync job GRAC_REPOSITORY_OBJECT_SYNC must be ran in GRC as well for cloud applications.

Required Permissions

The following table lists the required permissions for the specific operations mentioned below:

The SAP GRC account must have the following Authorization Objects assigned to it:

Test Connection

Account Aggregation

Entitlement Aggregation

Provisioning

Creating a Custom Business Application Programming Interface (BAPI)

IAG Bridge Required Permissions

Apart from existing GRC permissions, the following permission is required:

FireFighterID Permissions

Following permissions are required for configuring FireFighterID to perform different operations:

Role Aggregation Based on Connector Group and System

Refer to Troubleshooting for more information.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.