# SailPoint SAP GRC Connector Documentation > SAP GRC Connector Documentation # Documentation # Connecting SailPoint and SAP GRC To connect SailPoint with SAP GRC, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. > [!IMPORTANT] > > By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration. **To configure a new source:** 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Configure**. 5. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 6. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 7. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 8. Under **Connection Type**, select **Direct Connection** or **Flat File**. - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](). - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable. 9. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source. 10. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 11. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 12. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](). 4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 8. Drag and drop the required files into the **Upload Files** box, or upload them from your computer. > **Warning** > > Ensure that the file you upload is not vulnerable or malicious. Upload the `sapjco3.jar` and `libsapjco3.so` files. Download the JCO libraries (JCO Release 3.1.x) from the SAP customer service marketplace. 9. Select **Save**. ## Connection Settings This section contains the information that SailPoint uses to authenticate with the managed system. After you select **Connection Settings** the following page is displayed. > [!NOTE] > > **Screenshot** > > [![Connection Settings]()]() 1. Enter the **User Name** with the appropriate permissions. 2. Enter the **Password** of the user. 3. Enter the **Host** on which the SAP service is running. > **Note** > > The server must have Java Connector (JCo) enabled. 4. Enter the two digit **System Number** that was generated during the SAP system installation. 5. Enter the three digit client ID or **Client Number** to use while connecting to SAP. 6. Enter the two character code for the **Client Language** used by the application. 7. Select the option to **Enable IAG** Bridge configurations (optional). > **Screenshot** > > [![Enable IAG]()]() 8. Complete the **Webservice URL Configuration** by inserting the URL for each required web service: > **Screenshot** > > [![Webservice URL Configuration]()]() - User Access For example, ```text http:///sap/bc/srt/rfc/sap/grac_user_acces_ws//grac_user_acces_ws_name/grac_user_acces_ws_name ``` - Request Details For example, ```text http:///sap/bc/srt/rfc/sap/grac_request_details_ws//grac_request_details_ws/grac_request_details_ws ``` - Search Roles For example, ```text http:///sap/bc/srt/rfc/sap/grac_search_roles_ws//grac_search_roles_ws/grac_search_roles_ws ``` - Role Details For example, ```text http:///sap/bc/srt/rfc/sap/grac_role_details_ws//grac_role_details_ws/grac_role_details_ws ``` For more information, refer to [Obtain the SAP GRC URLs](). 9. Select the **Name** of the **Function Module Configuration** as per your SAP Basis Version. > **Screenshot** > > [![Function Module Configuration]()]() 10. Select **Save**. ## Configuring Secure Network Communication (SNC) This section contains the information for the Secure Network Communication (SNC) configuration. SNC protects the logical link between the end points of a communication. > [!NOTE] > > For prerequisites, refer to [SAP Secure Network Communication (SNC) For SAP Source]() in the Compass community. > [!NOTE] > > **Screenshot** > > [![Configuring SNC]()]() 1. Select the option to **Enable SNC**. 2. Select a **Level of Security**. Each level sets the Quality of Protection (QOP) level. In SAP, it relates to `jco.client.snc_qop`. 3. Enter the name that internally identifies in **SNC Name**. In SAP, it relates to `jco.client.snc_myname`. 4. Enter the SNC partner's name in **SNC Name of SAP Application Server**. If SNC is configured in SAP, it relates to `jco.client.snc_partnername`. For example, provide input as `p:CN=R3, O=XYZ-INC, C=EN` in SAP. 5. Enter the path to the library that provides the SNC service in **SNC Library Path**. In SAP it relates to `jco.client.snc_lib`. 6. Select **Save**. ## Configuring Aggregation Settings Configure the aggregation filters to determine which accounts are aggregated. > [!NOTE] > > These attributes will be aggregated from a custom Business Application Programming Interface (BAPI). [Creating a Custom Business Application Programming Interface (BAPI)](<#creating-a-custom-business-application-programming-interface-bapi>) is required to aggregate on these values. > [!NOTE] > > **Screenshot** > > [![Aggregation Settings]()]() [![Aggregation Delimiter]()]() [![Aggregation Page]()]() [![Partitioning]()]() [![Bapi Name]()]() > [!NOTE] > > For more information about obtaining these values, refer to [Finding Aggregation Values for Child Roles](<#finding-aggregation-values-for-child-roles>). 1. Provide the list of **Role Types**(s), **Business Process**(es), and **Sub Process**(es) to aggregate by entering them using commas to separate the values. - **Business Process**(es) aggregate roles for only the specified business processes. - **Sub Process**(es) only aggregates roles for the specified sub processes. 2. Specify the **Aggregation Delimiter**. The Aggregation Delimiter configuration is applicable only in the case of the '/SAILPOIN/SAIL\_READ\_TABLE' and the '/SAILPOIN/SAIL\_READ\_TABLE\_LEG' Function Module. 3. Specify the **Page Size** for your Function Module Configuration. The Page Size is applicable for /SAILPOIN/SAIL\_READ\_TABLE. 4. Select the **Enable Partitioning** option. Specify a number in **Number of Partitioning Threads**. Account Partitioning Aggregation allows processing of data in parallel, across multiple threads, to help increase the performance of aggregation tasks. > **Note** > > - If the VA has configuration for multiple CPU cores a higher number of partition threads can be configured in order to improve performance. > - Account Partitioning configuration is supported only for SAP Basis version 751 or later. 5. (Optional) Specify the name of the BAPI configuration in **BAPI Name**. This allows you to aggregate based on additional account attributes such as Functional Area, User Group Assignments, and SNC-Name. For more information, refer to [Creating a Custom Business Application Programming Interface (BAPI)](<#creating-a-custom-business-application-programming-interface-bapi>). 6. Select **Save**. ## Creating a Custom Business Application Programming Interface (BAPI) You can aggregate the following attributes by manually adding them in the Schema Attributes section: > [!NOTE] > > **Screenshot** > > [![Bapi Name]()]() - Function: Use **Function** as the field name in the provisioning policy. - SNC Name: Use **SNC Name** as the field name in the provisioning policy. - Functional Area: Use **function\_area** as the field name in the provisioning policy. - User Group Assignments - Logon Language - Function - Phone - Department SailPoint provides support for aggregation and provisioning of the additional attributes mentioned below. You must add these to the account schema and create a custom BAPI. - Alias - Personnel Number - Company - Parameters (Multi valued) > [!IMPORTANT] > > After creating the BAPI, you must add the name of the BAPI under `RFC_NAME` in authorization object `S_RFC` in SAP GRC. **To create a custom BAPI:** In the GRC system, provide the input and output parameters. ### Input The input for the custom BAPI must be `User_ID` as described below: > [!NOTE] > > **Screenshot** > > [![Parameter Name]()]() > > [![Dictionary Display Data Element]()]() ### Output The output of this value must be in the form of: 1. `Z_USER_DETAILS_TABLE - Internal table`: where each row is of Line Type: `ZUSER_SYSTEM_DETAILS`. > **Screenshot** > > [![ZUSER\_SYSTEM\_DETAILS]()]() `ZUSER_SYSTEM_DETAILS` is a custom structure which contains two fields: - `SYSTEM`: The system to which the user is connected. Associated type is `CHAR`. - `Z_GRAC_S_USER_DETAIL`: The complete user details. The associated type is `GRAC_S_USER_DETAIL`. > **Note** > > This is GRC's built-in structure which represents a complete user entity connected to a system. 2. `ET_MESSAGE`: contains error message details and the associated type is `BAPIRET2_TAB`. > **Screenshot** > > [![Parameter Name]()]() ### Example Source Code ```text FUNCTION ZCUSTOM_BAPI_FOR_ADDITIONAL_ATTRIBUTES. *"---------------------------------------------------------------------- *"*"Local Interface: *" IMPORTING *" VALUE(USER_ID) TYPE GRAC_USER *" EXPORTING *" VALUE(Z_USER_DETAILS_TABLE) TYPE ZGRAC_S_USER_TAB *" VALUE(ET_MESSAGE) TYPE BAPIRET2_TAB *"---------------------------------------------------------------------- DATA: ld_IV_USER TYPE GRAC_USER , ld_ES_USER_DETAILS TYPE GRAC_S_USER_DETAIL , it_data TYPE STANDARD TABLE OF GRACUSERCONN INITIAL SIZE 0 , wa_data TYPE GRACUSERCONN , id_system_id TYPE string , it_user_details TYPE STANDARD TABLE OF ZUSER_SYSTEM_DETAILS INITIAL SIZE 0 , ld_custom_user_struct TYPE ZUSER_SYSTEM_DETAILS, exception_ref TYPE REF TO cx_grfn_exception. ld_IV_USER = USER_ID. *Getting systems associated with a user SELECT * FROM GRACUSERCONN WHERE USER_ID = @ld_IV_user INTO TABLE @it_data. TRY. *Loop over each connector to get the user details LOOP AT it_data INTO wa_data. id_system_id = wa_data-CONNECTOR. clear : ld_ES_USER_DETAILS. CALL METHOD CL_GRAC_AD_ACCESS_MGMT=>GET_USER_DETAIL( EXPORTING IV_USER = ld_IV_USER iv_system_id = id_system_id IMPORTING ES_USER_DETAILS = ld_ES_USER_DETAILS ET_MESSAGE = ET_MESSAGE ). ld_custom_user_struct-SYSTEM = id_system_id. ld_custom_user_struct-Z_GRAC_S_USER_DETAIL = ld_ES_USER_DETAILS. APPEND ld_custom_user_struct TO it_user_details. ENDLOOP. CATCH cx_grfn_exception INTO exception_ref. RETURN. ENDTRY. Z_USER_DETAILS_TABLE = it_user_details. ENDFUNCTION. ``` ## SailPoint Add-On to replace the use of RFC\_READ\_TABLE SailPoint's ABAP Integration is designed to replace the functionality of SAP's RFC\_READ\_TABLE to securely access the information in the SAP system required for deeper governance. > [!IMPORTANT] > > SailPoint strongly recommends installing the SAP-certified add-on in the SAP environment and then using /SAILPOIN/SAIL\_READ\_TABLE instead of RFC\_READ\_TABLE. This integration needs to be deployed on the GRC system for querying the GRC tables. For the deployment process follow these instructions in order: 1. [Installation of SAILPOIN Add-On](<#installation-of-sailpoin-add-on>) 2. [Configuration of SailPoint's Function Module](<#configuring-sailpoints-function-module>) 3. [Configuration Table for SAP GRC](<#configuration-table-for-sap-grc>) ### Prerequisites To install the Add-On and support packages using the SAINT transaction code (t-code), follow these steps: 1. Log into client 000. 2. Ensure that you have installed at least **SPAM/SAINT** version 0053 to be able to uninstall Add-Ons using the **SAINT** t-code. 3. Deselect the digital signature setting in **SAINT** t-code: 1. Go to **SAINT** t-code. 2. Select **Extras**. 3. Choose **Setting**. 4. Deselect the **Check for digital signature of to be imported OCS Packages**. 4. Proceed with installing the Add-On and support packages using the **SAINT** t-code. > [!NOTE] > > **Screenshot** > > [![SAINT t-code]()]() [![Add-On prerequisites]()]() ### Installation of SAILPOIN Add-On > [!NOTE] > > If Add-on is already installed, reference [Importing Support Packages for Add-On SAILPOIN](<#importing-support-packages-for-add-on-sailpoin>). 1. Download the PAT file(s) for the Add-On and all the required support packages from the [New Package Download Matrix](<#new-package-download-matrix>). > **Note** > > The PAT file is a special file used to package the SAP Add-on. If you install the add-on using SPAM/SAINT, the contents of the PAT file will be extracted (disassembled) to your transport directory. 2. Copy the .PAT file on your server location for the Add-On and all the required support packages: Server Location: (Windows : `:\usr\sap\trans\EPS\in` ; Linux/Unix : `/usr/sap/trans/EPS/in`). 3. Login to SAP GUI, and then execute the Tcode **SAINT**. > **Screenshot** > > [![SAINT t-code]()]() 4. Go to **Installation Package \> Load Packages \> EPS Files From Application Server**. > **Screenshot** > > [![Load Packages]()]() 5. Ensure the following PAT file(s) uploaded successfully: > **Screenshot** > > [![Uploaded PAT files]()]() 6. Select **Start**. 7. Select **SAILPOIN** from the **Installable Add-on Package packages for your system** grid. > **Screenshot** > > [![SAILPOIN package]()]() 8. Select **Continue**. 9. To install the Add-On and support package(s), perform the following: 1. Select the highest version from the available support package(s) under the **Target Support Package** drop down of the component **SAILPOIN**. > **Screenshot** > > [![Target Support Package]()]() 2. The column **Level** should indicate the chosen target support package. > **Screenshot** > > [![Support package level]()]() 10. Select **Continue**. 11. On the **Add Modification Adjustment Transports to the Queue** dialog, select **No**. > **Screenshot** > > [![Modification Adjustment Transports]()]() 12. If prompted on the **Start Options** dialog box, select **Continue**. > **Screenshot** > > [![Start Options]()]() > **Note** > > The Add-on and the support package(s) will begin installing, and the progress can be seen at the bottom of the window. 13. Select **Finish**. If prompted to send Runtime Analysis, select **Do not send**. 14. Go to **System \> Status \> Details \> Installed Software Component Versions** to confirm the following: 1. The Add-On and the support packages have been added in the system component. > **Screenshot** > > [![Installed Software Component Versions]()]() ### Configuring SailPoint's Function Module > [!NOTE] > > Configure any one function module based on your SAP\_BASIS version. Use the /SAILPOIN/SAIL\_READ\_TABLE function module to support systems whose SAP BASIS version is 751 and later. This is a SAP-certified function module provided by SailPoint to replace the use of SAP's RFC\_READ\_TABLE function module, according to SAP recommendations, for reading data from SAP tables required for governance. The /SAILPOIN/SAIL\_READ\_TABLE provides enhanced security, support for pagination, and performance improvements over the RFC\_READ\_TABLE. For more information on the deployment process, refer to [Installation of SAILPOIN Add-On](<#installation-of-sailpoin-add-on>). > [!IMPORTANT] > > - SailPoint recommends having SAP BASIS version 751 and above for seamless functionality of the ABAP add-on. However, for lower BASIS versions, /SAILPOIN/SAIL\_READ\_TABLE\_LEG can be tried with limited support from SailPoint. > - RFC\_READ\_TABLE-based connections are deprecated, and it is recommended to use the SAP-certified add-on instead. ### Configuration Table for SAP GRC Insert the following data into the `/SAILPOIN/CONF` table. The table uses the following fields: - **SERVICE\_ACCOUNT** - The allowed service account used for accessing the function module. - **NAME** - The name of the entity from which data is fetched. Consider this a table name. - **COLUMN\_NAME** - The column allowed for fetching data. - **ENTITY\_TYPE** - The type of entity, such as table or join. This field is reserved for future use. - **COLUMN\_DTYPE** - The data type of the column that is allowed. - **COLUMN\_DENAME** - The data element type of the column. You can find the data element type using the t-code `SE11` when viewing the table details, under **Fields**. - **COLUMN\_LENGTH** - The length of the column that is allowed. You can find the length using the t-code `SE11` when viewing the table's details, under **Fields**. > [!NOTE] > > Validate that the values for `COLUMN_DENAME` and `COLUMN_LENGTH` are correct for your system. You can validate these values using the t-code `SE11` while viewing the table details, under **Fields**. Insert the data into the `/SAILPOIN/CONF` table using one of the following methods. > [!NOTE] > > **Choose how to insert the table data** > > - [Using the SE16 T-Code](<#inserting-data-using-the-se16-t-code>) > - [Using a Script](<#inserting-data-using-a-script>) #### Inserting Data Using the SE16 T-Code 1. Enter **SE16 \> Table Name: /SAILPOIN/CONF \> Create Entries**. > **Screenshot** > > [![SE16 table entry]()]() 2. Enter the data into the table. > **Screenshot** > > [![SE16 data entry]()]() #### Inserting Data Using a Script ##### Setup 1. Enter the t-code **SE38**, and then create the program `Z_CONFIGURE_SERVICEACCOUNT` in the local object package with the type set to executable program. 2. Copy and paste the script provided [here](), and activate the program. 3. Edit the selection text from **Go to \> Text Element \> Selection Text** and update it as shown in the following image, for better readability of the input parameters. > **Screenshot** > > [![Selection text]()]() 4. Select **Save**, and then select **Activate**. ##### How It Works 1. Enter the t-code **SE38**, and then search for the program `Z_CONFIGURE_SERVICEACCOUNT`. Select **Execute**. 2. Enter the service account and integration module to populate. > **Screenshot** > > [![Enter service account]()]() 3. Select **Execute**. A success message appears once you have entered the details correctly. > **Screenshot** > > [![Success message]()]() #### Table Permissions | SERVICE\_ACCOUNT | NAME | COLUMNNAME | ENTITY\_TYPE | COLUMN\_DTYPE | COLUMN\_DENAME | COLUMN\_LENGTH | | --- | --- | --- | --- | --- | --- | --- | | \ | GRACPROFILE | AC\_REF\_ROLE\_ID | TABLE | C | GRFN\_GUID | 32 | | \ | GRACPROFILE | CONNECTOR | TABLE | C | GRFN\_CONNECTORID | 32 | | \ | GRACPROFILE | PROFILE | TABLE | C | GRAC\_PROFILE | 20 | | \ | GRACRLCOMPRL | CHILD\_ROLEID | TABLE | C | GRFN\_GUID | 32 | | \ | GRACRLCOMPRL | COMP\_ROLEID | TABLE | C | GRFN\_GUID | 32 | | \ | GRACRLCONN | AC\_REF\_ROLE\_ID | TABLE | C | GRFN\_GUID | 32 | | \ | GRACRLCONN | CONNECTOR | TABLE | C | RFCDEST | 32 | | \ | GRACRLCONN | ROLE\_ID | TABLE | C | GRFN\_GUID | 32 | | \ | GRACRLCONN | ROLE\_NAME | TABLE | C | GRAC\_ROLE\_NAME | 300 | | \ | GRACRLCUARELAT | ROLEID1 | TABLE | C | GRAC\_ROLEID | 32 | | \ | GRACRLCUARELAT | ROLEID2 | TABLE | C | GRAC\_ROLEID | 32 | | \ | GRACROLE | BPROC | TABLE | C | GRAC\_BPROC | 10 | | \ | GRACROLE | BSUBPROC | TABLE | C | GRAC\_BSUBPROC | 10 | | \ | GRACROLE | CONNECTOR\_GRP | TABLE | C | GRFN\_CONNECTORGRP | 10 | | \ | GRACROLE | ROLEID | TABLE | C | GRAC\_ROLEID | 32 | | \ | GRACROLE | ROLE\_NAME | TABLE | C | GRAC\_ROLE\_NAME | 300 | | \ | GRACROLE | ROLE\_STATUS | TABLE | C | GRAC\_ROLE\_STATUS | 3 | | \ | GRACROLE | ROLE\_TYPE | TABLE | C | GRAC\_ROLE\_TYPE | 3 | | \ | GRACROLERELAT | RELAT\_TYPE | TABLE | C | GRAC\_RL\_RELAT\_TYPE | 4 | | \ | GRACROLERELAT | ROLEID1 | TABLE | C | GRAC\_ROLEID | 32 | | \ | GRACROLERELAT | ROLEID2 | TABLE | C | GRAC\_ROLEID | 32 | | \ | GRACUSER | CONNECTOR | TABLE | C | GRFN\_CONNECTORID | 32 | | \ | GRACUSER | DEPARTMENT | TABLE | C | GRAC\_DEPARTMENT | 100 | | \ | GRACUSER | EMAIL | TABLE | C | AD\_SMTPADR | 241 | | \ | GRACUSER | FIRST\_NAME | TABLE | C | GRAC\_USER\_NAME | 50 | | \ | GRACUSER | LAST\_NAME | TABLE | C | GRAC\_USER\_NAME | 50 | | \ | GRACUSER | MANAGER\_ID | TABLE | C | GRAC\_USER | 50 | | \ | GRACUSER | PHONE | TABLE | C | GRAC\_PHONE\_NUMBER | 20 | | \ | GRACUSER | USER\_ID | TABLE | C | GRAC\_USER | 50 | | \ | GRACUSERCONN | CONNECTOR | TABLE | C | RFCDEST | 32 | | \ | GRACUSERCONN | INACTIVE | TABLE | C | BOOLEAN | 1 | | \ | GRACUSERCONN | USER\_GROUP | TABLE | C | GRAC\_USER\_GRP | 50 | | \ | GRACUSERCONN | USER\_ID | TABLE | C | GRAC\_USER | 50 | | \ | GRACUSERCONN | USER\_TYPE | TABLE | C | XUUSTYP | 1 | | \ | GRACUSERCONN | VALID\_FROM | TABLE | C | GRAC\_VALID\_FROM | 8 | | \ | GRACUSERCONN | VALID\_TO | TABLE | D | GRAC\_VALID\_TO | 8 | | \ | GRACUSERPROFILE | CONNECTOR | TABLE | C | GRFN\_CONNECTORID | 32 | | \ | GRACUSERPROFILE | PROFILE | TABLE | C | GRAC\_PROFILE | 20 | | \ | GRACUSERPROFILE | USER\_ID | TABLE | C | GRAC\_USER | 50 | | \ | GRACUSERROLE | BUS\_ROLEID | TABLE | C | GRFN\_GUID | 32 | | \ | GRACUSERROLE | CONNECTOR | TABLE | C | GRFN\_CONNECTORID | 32 | | \ | GRACUSERROLE | ROLE\_ID | TABLE | C | GRFN\_GUID | 32 | | \ | GRACUSERROLE | USER\_ID | TABLE | C | GRAC\_USER | 50 | | \ | GRACUSERROLE | VALID\_FROM | TABLE | | GRFN\_TIMESTAMP | 15 | | \ | GRACUSERROLE | VALID\_TO | TABLE | | GRFN\_TIMESTAMP | 15 | | \ | USRSYSACT | SUBSYSTEM | TABLE | C | RFCRCVSYS | 10 | | \ | USRSYSACT | AGR\_NAME | TABLE | C | F\_AGR\_NAME | 30 | | \ | USRSYSACT | COL\_AGR | TABLE | C | XUFLAG | 4 | | \ | CVERS | COMPONENT | TABLE | C | DLVUNIT | 30 | | \ | CVERS | RELEASE | TABLE | C | SAPRELEASE | 10 | | \ | CVERS | EXTRELEASE | TABLE | C | SAPPATCHLV | 10 | | \ | PRDVERS | NAME | TABLE | C | BORM\_NAME | 30 | | \ | PRDVERS | VERSION | TABLE | C | BORM\_VERS | 30 | | \ | PRDVERS | VENDOR | TABLE | C | BORM\_VEND | 30 | #### Additional Table Permissions for GRC AC12 SP19 and Above Versions > [!NOTE] > > For SAP GRC AC12 SP19 and above versions, the following additional permissions for the GRACUSERSOURCE table are required. | SERVICE\_ACCOUNT | NAME | COLUMNNAME | ENTITY\_TYPE | COLUMN\_DTYPE | COLUMN\_DENAME | COLUMN\_LENGTH | | --- | --- | --- | --- | --- | --- | --- | | \ | GRACUSERSOURCE | CONNECTOR | TABLE | C | GRFN\_CONNECTORID | 32 | | \ | GRACUSERSOURCE | DATA\_SOURCE\_TYPE | TABLE | N | GRAC\_DATA\_SOURCE | 2 | | \ | GRACUSERSOURCE | SEQUENCE | TABLE | N | GRAC\_SEQUENCE | 4 | #### Table Permissions for Configuring FireFighterID ##### For FFOwner | SERVICE\_ACCOUNT | NAME | COLUMNNAME | ENTITY\_TYPE | COLUMN\_DTYPE | COLUMN\_DENAME | COLUMN\_LENGTH | | --- | --- | --- | --- | --- | --- | --- | | \ | GRACFFOWNER | CONNECTOR | TABLE | C | GRFN\_CONNECTORID | 32 | | \ | GRACFFOWNER | FFOBJECT | TABLE | C | GRAC\_FFOBJECT | 30 | | \ | GRACFFOWNER | OWNER | TABLE | C | GRAC\_OWNER | 12 | ##### For FFController | SERVICE\_ACCOUNT | NAME | COLUMNNAME | ENTITY\_TYPE | COLUMN\_DTYPE | COLUMN\_DENAME | COLUMN\_LENGTH | | --- | --- | --- | --- | --- | --- | --- | | \ | GRACFFCTRL | CONNECTOR | TABLE | C | GRFN\_CONNECTORID | 32 | | \ | GRACFFCTRL | FFOBJECT | TABLE | C | GRAC\_FFOBJECT | 30 | | \ | GRACFFCTRL | CNTRL\_ID | TABLE | C | GRAC\_CONTROLLER | 12 | ##### For DefaultValidityDays | SERVICE\_ACCOUNT | NAME | COLUMNNAME | ENTITY\_TYPE | COLUMN\_DTYPE | COLUMN\_DENAME | COLUMN\_LENGTH | | --- | --- | --- | --- | --- | --- | --- | | \ | GRACCONFIGSET | PARAMID | TABLE | C | GRAC\_CONFIG\_PARAMID | 4 | | \ | GRACCONFIGSET | PARAM\_VALUE | TABLE | C | GRAC\_CONFIG\_VALUE | 100 | ##### For FFUserID & Connector | SERVICE\_ACCOUNT | NAME | COLUMNNAME | ENTITY\_TYPE | COLUMN\_DTYPE | COLUMN\_DENAME | COLUMN\_LENGTH | | --- | --- | --- | --- | --- | --- | --- | | \ | GRACFFOBJECT | APP\_TYPE | TABLE | C | GRAC\_APP\_TYPE | 1 | | \ | GRACFFOBJECT | CONNECTOR | TABLE | C | GRFN\_CONNECTORID | 32 | | \ | GRACFFOBJECT | FFOBJECT | TABLE | C | GRAC\_FFOBJECT | 30 | ##### For FireFighterIds for Account Schema | SERVICE\_ACCOUNT | NAME | COLUMNNAME | ENTITY\_TYPE | COLUMN\_DTYPE | COLUMN\_DENAME | COLUMN\_LENGTH | | --- | --- | --- | --- | --- | --- | --- | | \ | GRACFFUSER | APP\_TYPE | TABLE | C | GRAC\_APP\_TYPE | 1 | | \ | GRACFFUSER | CONNECTOR | TABLE | C | GRFN\_CONNECTORID | 32 | | \ | GRACFFUSER | FFOBJECT | TABLE | C | GRAC\_FFOBJECT | 30 | | \ | GRACFFUSER | FF\_USER | TABLE | C | GRAC\_FIREFIGHTER | 12 | | \ | GRACFFUSER | VALID\_FROM | TABLE | | GRAC\_VALID\_FROM | 8 | | \ | GRACFFUSER | VALID\_TO | TABLE | | GRAC\_VALID\_TO | 8 | #### Role Aggregation Based on Connector Group and System | Service Account | Name | COLUMNNAME | ENTITY\_TYPE | COLUMN\_DTYPE | COLUMN\_DENAME | COLUMN\_LENGTH | | --- | --- | --- | --- | --- | --- | --- | | \ | GRFNCCICONNECTOR | CONNECTOR | TABLE | C | GRFN\_CONNECTORID | 32 | | \ | GRFNCCICONNECTOR | CONNECTOR\_GRP | TABLE | C | GRFN\_CONNECTORID | 10 | For more information refer to [Troubleshooting](). ### Configuration Table for IAG Bridge The following are additional table permissions for the SAP IAG Bridge integration. | SERVICE\_ACCOUNT | NAME | COLUMNNAME | ENTITY\_TYPE | COLUMN\_DTYPE | COLUMN\_DENAME | COLUMN\_LENGTH | | --- | --- | --- | --- | --- | --- | --- | | \ | GRFNCCICONNECTOR | CONNECTOR | TABLE | C | GRFN\_CONNECTORID | 32 | | \ | GRFNCCICONNECTOR | CONNECTION\_TYPE | TABLE | C | GRFN\_CONNECTTYPE | 08 | ### Importing Support Packages for Add-On SAILPOIN #### Prerequisites - Add-On "SAILPOIN" is already installed in your SAP GRC system. - You are logged into client 000. - You can import support packages using SPAM t-code. #### Installation 1. Download the PAT file(s) for the support packages from the [New Package Download Matrix](<#new-package-download-matrix>). 2. Copy the PAT file(s) on your server location: (Windows : `:\usr\sap\trans\EPS\in` ; Linux/Unix : `/usr/sap/trans/EPS/in`). 3. Sign in to the SAP GUI and execute the SPAM t-code. The status of the queue for importing support package should be green as shown in the following figure. > **Screenshot** > > [![SPAM t-code]()]() 4. Go to **Installation Package \> Load Packages \> EPS Files From Application Server**. > **Screenshot** > > [![Load Packages]()]() 5. When prompted to upload OCS packages from the EPS inbox, select **Yes**. > **Screenshot** > > [![Upload OCS packages]()]() 6. Verify that the upload was successful. > **Screenshot** > > [![Upload verification]()]() 7. Select **Display/Define** to choose the software component for which you want to import Support Packages. > **Screenshot** > > [![Display/Define]()]() 8. Select the **SAILPOIN** component. > **Screenshot** > > [![Select SAILPOIN component]()]() 9. Confirm the queue by selecting **Continue**. > **Note** > > The image below shows the number of support packages that can be installed based on the PAT files placed on your server location. The following example shows importing 2 support packages. > **Screenshot** > > [![Confirm queue]()]() 10. When prompted to add the Modification Adjustment Transports to the queue, select **No**. > **Screenshot** > > [![Modification Adjustment Transports]()]() 11. Verify that the queue contains the intended support packages for import that were added/defined in the queue in the previous steps. > **Screenshot** > > [![Import queue]()]() 12. Go to **Support Package \> Import Queue**. > **Screenshot** > > [![Import Queue]()]() 13. Select **Continue** to import the queue. > **Screenshot** > > [![Continue import]()]() > **Note** > > The support package will begin installing, and the progress can be seen at the bottom of the window. 14. After the support package(s) are successfully imported, the below prompt should appear. Select **Continue** to proceed with the import. > **Screenshot** > > [![Continue prompt]()]() 15. Go to **Support Package \> Confirm** to confirm the queue. > **Screenshot** > > [![Confirm queue]()]() 16. When prompted to send Runtime Analysis, select **Do not send**. 17. Go to **System \> Status \> Details \> Installed Software Component Versions** to confirm that the Add-on's support package is now set to the desired support package level. For example, `0002`. > **Screenshot** > > [![Installed Software Component Versions]()]() ### New Package Download Matrix Refer the [SailPoint SAP ABAP Add-on PAT Files]() for downloading the new package. | Release | Installed Software Component Level and Support Package Name | Downloadable Package Type | PAT File Name | Download Link | | --- | --- | --- | --- | --- | | 100\_2022 | Base Component | AOI (Add-On Installation Package) | `G750020862508_0000028.PAT` | [https://community.sailpoint.com/knowledge/SailPoint-SAP-ABAP-Add-on-PAT-Files]() | | 100\_2022 | SP-Level: 0001, Support Package: SAPK-12201INSAILPOIN | CSP (Component Support Package) | `G750020862508_0000032.PAT` | | | 100\_2022 | SP-Level: 0002, Support Package: SAPK-12202INSAILPOIN | CSP (Component Support Package) | `G750020862508_0000033.PAT` | | To overcome dependency errors during Add-on installation, use these Attribute Change Package (ACP) files: | Installed Software Component Level and Support Package Name | PAT File Name | | --- | --- | | DW4CORE, S4CORE, SAP\_GWFND | `G750020862508_0000076.PAT` | | S4FND, MDG\_FND, SAP\_GWFND | `G750020862508_0000077.PAT` | ### Uninstallation of SAILPOIN Add-On 1. Sign in to the SAP GUI and execute the Tcode **SAINT**. 2. Ensure that the Add-on **SAILPOIN** was successfully installed by confirming that it is visible in the **Installed Components** list. > **Screenshot** > > [![Installed Components]()]() 3. Select **Uninstallable Components**. The Add-on **SAILPOIN** should be visible. > **Screenshot** > > [![Uninstallable Components]()]() 4. Select **SAILPOIN** from the grid, and then select **Start**. 5. Select **Continue** when prompted on the **Start Options** dialog box. > **Screenshot** > > [![Start Options]()]() > **Note** > > If there are any specific preferences for any of the start options, those can be selected as per your requirements. 6. Select **Finish**. 7. If prompted to send Runtime Analysis, select **Do not send**. > **Screenshot** > > [![Do not send Runtime Analysis]()]() 8. Perform the following to confirm that the Add-on **SAILPOIN** was uninstalled: 1. Select **Installable Components** and scroll through the list to ensure **SAILPOIN** is not found. 2. Select **Uninstallable Components** and scroll through the list to ensure **SAILPOIN** is not found. 3. Go to **System \> Status \> Product Version \> Details \> Installed Software Component Versions**. Ensure Add-on **SAILPOIN** is not found. ## Configuring Provisioning Settings Configure the provisioning settings to change GRC access requests. > [!NOTE] > > **Screenshot** > > [![Configuring Provisioning Settings]()]() 1. Enter the **Requester ID** to use for provisioning on the SAP GRC service. For one method of finding the requester ID, refer to [Finding the Requester ID](<#finding-the-request-id>). 2. Enter the **Requester Email** to use for provisioning on the SAP GRC service. 3. Enter the **Provisioning Business Process**. By default, the value is `basis`. 4. Enter the **Polling Interval** in minutes. This indicates the time interval for requesting data from SAP GRC. The interval can be from 1 to 360 minutes. The default is 60. 5. Configure the mapping for the following: > **Screenshot** > > [![Access Request Type Mapping]()]() [![Provisioning Action for Role]()]() [![Provisioning Action for Scheme]()]() [![Access Request Privacy]()]() - Access Request Type - Provisioning Actions for Role - Provisioning Actions for System For more information, refer to [Verify the Request Type and Configuration](). 6. Enter the **Access Request Priority**. This is the 3-digit number that indicates the priority for all SAP GRC access requests triggered by SailPoint. The default is 006. 7. The connector will disable all systems connected to SAP GRC. For more information, refer to [Disable All Systems Connected to SAP GRC](<#additional-information>). 8. Select **Save**. ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation. ## Finding Aggregation Values for Child Roles The SAP GRC connector supports aggregation of the Associated Child Roles attribute. The child roles are the roles associated with composite or business roles. For new connectors the Associated Child Roles attribute is available by default. For existing sources, you must manually add it. For more information on adding the attribute to the schema, refer to [Adding Attributes to a Source Schema](). When the Associated Child Roles attribute is present in the schema for existing and new connectors, you must assign additional permissions such as `GRACROLERELAT` and `GRACRLCOMPRL` field values for the `S_TABU_NAM` authorization object. ## Finding the Request ID When users are provisioned, a request is sent to the SAP GRC system, and a **Request ID** is created in SAP GRC. To find the **Request ID**, refer to the following procedure: 1. In the SAP GRC system, go to **Dashboard \> Provisioning**. 2. Select **View All**. 3. Enter a search query for the identity for which a request is placed. 4. Select **Account Activity**. 5. Select the **Lifecycle Change Refresh** row under the Action column. *The Request ID appears.* ## System Bypass Configuration The System Bypass Configuration enhancement supports customer use cases where a SAP GRC connected system needs to be skipped during all operations, such as: - Aggregation - Provisioning - Modifying With this configuration, you can selectively govern the systems that you intend to use with SailPoint. There are two modes available for use: - **Systems to Bypass for All Operations**: To configure systems where all operations need to be skipped. - **Systems to Bypass for Provisioning Operations**: To configure systems where only provisioning operations need to be skipped. > **Screenshot** > > [![System Bypass Configuration]()]() Use the **Systems to Bypass for All Operations** field to specify one or more systems that are connected to SAP GRC, and need to be bypassed during all connector operations. For example, aggregation, provisioning, or modifying users, attributes, and entitlements. 1. Specify the system names separated by a new line for each system name. The expected outcome for the specified systems are as follows: - **Account Aggregation** - Users will not be aggregated if all the roles associated with it belong to the systems being bypassed. - Users will be aggregated if they have roles from multiple systems and any one of the roles is not set to be bypassed. In this case, the connector will only fetch the roles from systems that are not being bypassed. - Users and associated business roles will be aggregated if there is a business role that gives access to users from multiple systems and any one of the roles is not set to be bypassed. If all the roles inside a business role belong to the bypassed system, the business role will not be aggregated. - **Group Aggregation** - Entitlements associated with systems that are set be bypassed will not be aggregated. - **Provisioning** - All provisioning operations will fail for systems specified in the **Systems to Bypass for All Operations** field. - Provisioning for business roles will fail if the business role contains any role from the systems that are set to be bypassed. Use the **Systems to Bypass for Provisioning Operations** field to specify one or more systems that are connected to GRC that need to be bypassed during the provisioning operation (mostly read-only systems). 1. Specify the system names separated by a new line for each system name. The expected outcome for the specified systems are as follows: - **Provisioning** - All provisioning operations will fail for systems specified in the **Systems to Bypass for Provisioning Operations** field. - Provisioning for business roles will fail if the business role contains any role from the systems that are set to be bypassed. - The connector (by default) aggregates all the users, entitlements, and attributes from all of the SAP GRC connected systems unless explicitly configured to bypass under **Aggregation Settings**. > [!NOTE] > > SailPoint recommends running full account and group aggregation tasks after configuring these settings. ### Configuration Summary Table The following table lists the expected behavior when a particular system is added to **Systems to Bypass for All Operations** and/or **Systems to Bypass for Provisioning Operations**. | Systems to Bypass for All Operations | Systems to Bypass for Provisioning Operations | Expected Behavior | | --- | --- | --- | | Present | Present | Aggregation will exclude users/roles from systems to be bypassed. Provisioning will be restricted for bypassed systems. | | Not Present | Present | Provisioning will be restricted for bypassed systems. | | Present | Not Present | Aggregation will exclude users/roles from systems to be bypassed. Provisioning will be restricted for bypassed systems. | | Not Present | Not Present | No restrictions. All users/roles will be aggregated. | ### Configuring for Existing Sources If systems are configured to be bypassed for an existing source that already has aggregated data, you must ensure the following aggregation settings in place. - For the account aggregation task, enable the option to **Enable Account Deletion**. Existing accounts, with all the entitlements from the system configured to be bypassed, can then be removed. For more information, refer to [Loading Account Data](). - For entitlement aggregation, entitlements can't be deleted directly in SailPoint. To remove entitlements that are associated with the system to be bypassed, delete them directly from the source and then run an entitlement aggregation. For more information, refer to [Managing Entitlements](). ## Additional Information ### Enable and Disable Account #### Update the Valid From and/or Valid To Dates When the Account Is Enabled or Disabled > [!NOTE] > > The **Valid From** or **Valid To** date must be present in the provisioning plan in the format `SystemName/yyyyMMdd` to update the dates when the account is enabled or disabled. - Example AttributeRequest for single account disable/enable: ```xml ``` - Example Attribute Request for Multiple account disable/enable: ```xml systemNameA/20501029 systemNameB/20231029 systemNameC/20301029 ``` #### Update the User Group and/or User Group Assignments When the Account Is Disabled > [!NOTE] > > The **User Group** or **User Group Assignments** must be present in the provisioning plan in the format `SystemName/` to update the dates when the account is disabled. Existing groups will be replaced with those provided in the provisioning plan. - Example attribute request to update the User Group: ```xml systemNameA/GroupName1 systemNameB/GroupName2 ``` - Example attribute request to update the User Group Assignments: ```xml systemNameA/GroupName1a systemNameA/GroupName1b systemNameB/GroupName2a systemNameB/GroupName2b ``` #### Disable All Systems Connected to SAP GRC [![Disable All Systems]()]() - **Systems to Bypass for Disable Operations**: Provide the name(s) of systems that the connector should bypass during the disable operation. The requested line item for specified systems will not be created in the GRC portal. #### Remove All Roles When Account Is Disabled To remove all of the roles when account is disabled, select **Remove All Roles When Account is Disabled** option. All of the roles from the GRC user account will be removed during the disable operation. > [!NOTE] > > Role(s) associated with bypass systems configured during **System Bypass Configuration** will also be removed when **Remove All Roles When Account is Disabled** option is selected. ### Modify Account > [!NOTE] > > - This is applicable for SAP GRC AC12 SP19 and above versions. > - Modify Attributes only supports updating the values of the attributes on the user's highest priority connector. For example, the `System` value for the user. SAP has introduced a new process where any modifications in the user attributes reflect in GRC tables only after completing a Repository Sync Job from the GRC side. The following steps must be performed sequentially for a successful modify operation: 1. Configure the **Attribute Sync** request on the user in SailPoint for the GRC source. To configure the attribute sync request, refer to [Synchronizing Attributes - SailPoint Identity Services](). 2. Run the **Repository Object Sync** job on your GRC system. 3. Execute **User Aggregation** on your GRC source to get the updated values of the user attributes. #### Provisioning Multiple Systems Using User Group Attribute The SAP GRC connector supports modification of the User Group attribute for multiple systems. To enable this functionality, follow these steps: 1. Pass the User Group attribute as a list in the provisioning plan: ```xml systemNameA/GroupName1 systemNameB/GroupName2 ``` 2. Set the `setUserGroupInUserInfo` flag to true in the source configuration: Key=setUserGroupInUserInfo Value=true The `setUserGroupInUserInfo` is a boolean attribute. > **Note** > > The `setUserGroupInUserInfo` flag must be set to true for the provisioning of multiple systems to be supported. ### Firefighter ID Configuration > [!NOTE] > > **Screenshot** > > [![Firefighter ID]()]() 1. Enable the **Manage Firefighter IDs** setting to aggregate and provision Firefighter IDs where applicable. By default, this checkbox is unselected for new and existing applications. 2. Enter **Firefighter ID** with days to configure the **Validity Period in Days** for Firefighter ID or Superuser Access in days. This setting overrides SAP GRC configurations when applied in SailPoint. If no value is provided, the system defaults to the standard SAP GRC Firefighter ID validation period (days). The start date is automatically set to the current system date, and the end date is determined by adding the specified number of days. 3. Enter the **Firefighter ID Access Request Priority**, which is a 3-digit number that indicates the priority for all SAP GRC FFID access requests triggered by SailPoint. The default value is 006. # Frequently Asked Questions This Frequently Asked Questions (FAQs) section provides answers to the most commonly asked questions for SAP GRC for SailPoint. ## What is SAP GRC IAG Bridge? With the ongoing digital transformation, there is a considerable shift of business functionalities from on-premise to the cloud systems. SAP IAG Bridge connects SAP Access Control (GRC) solution with SAP Cloud Identity Access Governance (IAG), to extend access governance functionality into the cloud. This solution is built on the SAP cloud platform powered by HANA database. A GRC IAG Bridge connection enables SAP Access Control to create access requests and perform risk analysis for a hybrid landscape. The access risks of the user (SOD risks and critical access risks) are shown on the GRC UI. For more information, refer to the [SAP IAG product documentation](). ## How does the functionality compare between the modules for SAP GRC and IAG? The following table provides a high-level comparison of the interrelated modules and some brief information about each of them. | SAP Access Control | Function | SAP IAG | Function | | --- | --- | --- | --- | | Access risk analysis (ARA) | Access analysis for on-premise systems, ruleset management. | Access analysis | Access analysis for on-premise and cloud, limitation to user and roles, ruleset management. | | Business role management (BRM) | Role management and business roles | Role design | Business roles for hybrid landscapes. | | Access request management (ARM) | Fully customizable and extendable access request workflows. | Access request | Predefined set of workflows with limited configuration capabilities. | | Emergency access management (EAM) | Firefighter for ABAP on-premise SAP systems (for example, ABAP-based systems or SAP HANA database). | Privileged access management | Firefighter for ABAP systems. | | User access review (UAR) and SOD risk review | Customizable UAR and SOD risk review workflows through ARM. | Access certification | Campaigns to review user access. | ## Does GRC IAG Bridge setup require licenses for both GRC and IAG? Yes, there has to be separate license procured from SAP for both SAP GRC and IAG instances for maintaining bridge setup. ## How can leaver use cases be handled in the SAP GRC IAG Bridge setup? SAP does not support the Disable operation for the GRC IAG Bridge setup, but it does support the Delete operation. SailPoint does not show the Delete operation in its UI, therefore a before provisioning rule must be implemented to convert the Disable call from the SailPoint platform to a Delete call. The following is a reference of a before provisioning rule: `{lifecycle_state_name}` - Your Lifecycle state name ```text try { import sailpoint.object.ProvisioningPlan; import sailpoint.object.ProvisioningPlan.Operation; import sailpoint.object.Identity; import sailpoint.object.ProvisioningPlan.AccountRequest; import sailpoint.object.ProvisioningPlan.AccountRequest.Operation; import sailpoint.object.ProvisioningPlan.AttributeRequest; import sailpoint.object.Link; import sailpoint.api.IdentityService; List accountRequests = plan.getAccountRequests(); application.setAttribute("isDeleteUser", true); if (accountRequests != null) { for (AccountRequest accountRequest: accountRequests) { AccountRequest.Operation op = accountRequest.getOperation(); if (op == null) continue; Identity identity = plan.getIdentity(); if (identity != null && op == AccountRequest.Operation.Disable) { // Check if account has entitlements IdentityService is = new IdentityService(context); List links = is.getLinks(identity, application); if (links != null){ for (Link link : links) { if (link != null) { Object rolesAssigned = link.getAttribute("Roles"); if (rolesAssigned != null) { throw new UnsupportedOperationException("Unable to delete account "+identity.getName()+" please remove all entitlements and try again."); } } } } accountRequest.setOperation(AccountRequest.Operation.Delete); } } } } catch (UnsupportedOperationException ex) { throw ex; } catch (Exception e) {} ``` ## How can validity dates be set for the cloud application? SAP doesn't support valid from/valid to dates to be set up for connected cloud applications. Reference [SAP KBA 3357215](). ## Is the nesting of business roles supported in SAP GRC IAG Bridge? According to SAP, IAG bridge configuration does not support nested business roles, so it's recommended to avoid placing one business role inside another. ## What happens when no validity periods are configured for FireFighterID? If no validity periods (in days) are provided, the system will consider the default days configured in the SAP GRC system. ## What happens when 0 days are configured for FireFighterID? If 0 days are provided, the system will consider the current date only. # Integrating SailPoint with SAP GRC > [!NOTE] > > **Integration** > > This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager. This document is designed to provide the information required to configure a working instance of a SAP GRC connector for SailPoint. This connector supports: ## Access Management This integration is used to aggregate all the Users and Roles from the systems (SAP SCM, JAVA, SAP ERP HCM, and so on) connected to SAP GRC and facilitates their provisioning by creating requests in GRC irrespective if there is risk present or not, as illustrated in the following figure: > [!NOTE] > > **Screenshot** > > [![Access Management]()]() The figure explains the following methods: 1. User Aggregated from the GRC connected system. 2. Roles Aggregated from the GRC connected system. 3. Request sent for adding or removing access to the connected system. 4. Access Request ID created in GRC. 5. Requests wait and are queued until a response is issued by SAP GRC. 6. On the basis of the response returned from SAP GRC (approval or rejection in GRC), SAP GRC provisions or rejects the request and the corresponding status is maintained in the SAP GRC source. ## SAP GRC IAG Bridge > [!NOTE] > > SAP GRC IAG Bridge is an additional optional feature provided in the existing SailPoint SAP GRC connector. An existing SailPoint SAP GRC connector set up is a prerequisite for this feature. SAP GRC IAG Bridge is an additional setup on top of an existing SAP Access Control (GRC) on-premise solution, which communicates with SAP Cloud Identity Access Governance (IAG). This feature extends access governance functionality to cloud systems in a hybrid landscape. IAG Bridge is a SAP suggested approach for the customers who have invested heavily in SAP GRC access control, but now want to provide support for cloud applications as well. This configuration helps to perform risk analysis of user requests in IAG for connected SAP cloud systems using the SAP GRC system as a bridge. The major benefit for this integration is that the source of truth for access requests and risk analysis remains to be SAP GRC, and IAG acts as secondary system to communicate with cloud applications. Separate licenses must be procured from SAP for both GRC and IAG systems to use this feature. > [!NOTE] > > **Screenshot** > > [![IAG Bridge]()]() > [!NOTE] > > The RFC\_READ\_TABLE integration function module has been deprecated, and replaced with the ABAP Function module. For more information on configuration, refer to [SailPoint Add-On to replace the use of RFC\_READ\_TABLE](). > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features The SAP GRC integration supports the following functions: - Aggregation of users from connected GRC systems of User Type - Dialog > **Note** > > With the upgrade of GRC from AC12 SP19 and above, the SailPoint connector can show `System` as INACTIVE\_USER for the accounts that are disabled on the highest priority system. For more information, refer to the [Troubleshooting]() section. - Additional attribute support in account aggregation and account provisioning: - Function - SNC Name - Multi-Valued User Group Assignments (multi-valued user group assignments are for account aggregation only. Use single use User Group Assignments for authorization checks). - Functional Area These attributes are aggregated from a custom BAPI. For more information, refer to [Creating a Custom Business Application Programming Interface (BAPI)](). - Aggregation of the following role types from SAP GRC: - Business, Composite, CUA Composite, Derived, and Single Role > **Important** > > Ensure business role names follow the standard naming convention with single spaces between words to avoid data loss during aggregation. For example, the role names should be like "BUPA Healthcare Manager" with single spacing between words. - Group - HANA Analytic Privileges - [Firefighter ID Role Type](<#firefighter-id-role-type>) (`FireFighterID`) - Create and Update User - Add / Remove Entitlement - Enable / Disable Account - Update the **Valid From** and/or **Valid To** dates when the account is enabled or disabled. - Update the **User Group** and/or **User Group Assignments** when the account is disabled. - Disable All Systems Connected to SAP GRC. - Read-only Systems to Bypass. For more information, refer to [Additional Information](). - Remove All Roles When Account is Disabled. - For more information, refer to [Additional Information](). - Modify Account - Update of the following user attributes - FirstName - LastName - Email - Manager - EmployeeID For more information, refer to [Modify Account](). - SailPoint SAP GRC Integration now supports Access Management Requests that are configured for Auto-Approval in the SAP GRC system. - Display actual requester details and description on access request. ### SAP GRC Access Analysis The SAP GRC connector supports the `skipSystemItem` attribute. The default value is `false`. When it is set to `true` in the source XML, the first item in `RequestedLineItem` containing the source name is skipped in the `GracIdmUsrAccsReqServices` API for the **Create** operation. You can use the `skipSystemItem` attribute when a user is created through request access. It is not mandatory to pass the source name (system name) in your environment. ### IAG Bridge Supported Features SAP GRC IAG Bridge supports the following features for accounts: - Aggregation - Account - Groups - Provisioning - Create - Add / Remove Entitlement > [!NOTE] > > The following operations are not supported by the SAP GRC IAG Bridge configuration due to API limitations and IAG design by SAP: > > - Modify user attributes > - Enable/Disable user accounts > - Risk analysis/access violation visibility on the SailPoint platform > > Workarounds: > > - Modify user attributes: There are no alternate options or APIs for managing user attributes, provided by SAP. > - Enable/Disable user accounts: For de-provisioning accounts permanently or leaver use cases, a before provisioning rule can be used to map 'Disable' requests in SailPoint to the 'Delete' user request in IAG, as the IAG platform does not support disabling a user account. > - Risk analysis/access violation visibility on the SailPoint platform: Due to the limitations of the SAP APIs, we cannot show the risk or access violations on the SailPoint platform. Administrators need to log into GRC or IAG to check and mitigate the risks. This is in accordance with the SAP application design (SAP KBA 3492795). ### Firefighter ID Role Type The SAP GRC connector supports the `FireFighterID` attribute to manage critical or emergency tasks in SAP systems. The SAP GRC connector allows you to add or remove entitlements for `FireFighterID` role type. For more information, refer to [Access Request Schema Attributes](). To add `FirefighterID` to the mapping, follow the instructions provided in step 5 of the Access Request Type Mapping configuration process. For more information, refer to [Configuring Provisioning Settings](). > [!IMPORTANT] > > When Firefighter IDs (FFIDs) with expired validity are removed from the SAP GRC system based on the configured settings, SailPoint will process these changes in the next aggregation cycle. As a result, the removed FFIDs will continue to appear in SailPoint until the next successful aggregation is completed. This approach ensures continuity in tracking and managing FFIDs throughout the removal process, guaranteeing that the FFIDs are fully removed from all connected systems. ## Privilege Classification SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements. | Privilege Level | Description | | --- | --- | | High | Administrative level access to accounts | | Medium | Administrative level access for a specific role or function | | Low | Only basic access of data | > [!NOTE] > > To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin. For more information, refer to [Managing Privilege Classification](). > [!NOTE] > > **Example** > > [![Recommended Privilege Level - High]()]() ## Supported Managed Systems The SAP GRC connector supports SAP GRC Access Control 12.0 SP10 to SPS31. > [!NOTE] > > For SP24 and above, ensure that SAP Note 3523140 is implemented. The SAP GRC connector supports the following versions of managed systems: - SAP NetWeaver 7.51 and above - SAP Enterprise Resource Planning (ERP) Central Component (ECC) 6.0 with EHP8 (Enhancement package 8) - SAP S/4HANA 2021 to SAP S/4HANA 2025 (on-premise) > [!NOTE] > > SAP GRC connector works with SAP private cloud environments and supports SAP RISE solutions. ### SAP ABAP-Based Systems - All ### SAP Non-ABAP Systems - SAP Enterprise Portal - SAP Process Orchestration ### SAP IAG Supported Systems - All SAP IAG supported systems mentioned by SAP at the [SAP official website](). Use your S-user ID to sign in. ## Prerequisites > [!NOTE] > > The SAP GRC integration requires an additional license purchase for the number of users that will be integrated. > [!IMPORTANT] > > SailPoint strongly recommends installing the SAP-certified add-on in the SAP environment and then using /SAILPOIN/SAIL\_READ\_TABLE instead of RFC\_READ\_TABLE. - Configure at least one [virtual appliance (VA) cluster]() and successfully test the connection. - Configure the Multi-Step Multi-Process (MSMP) workflow on the SAP GRC server. - [Configure the SAP GRC Server](<#configure-the-sap-grc-server>) - [Obtain the SAP GRC URLs](<#obtain-the-sap-grc-urls>) - [Download the JCO libraries](<#download-the-jco-libraries>) - [Synchronization Jobs](<#synchronization-jobs>) - [Obtain the values for Filter Parameters](<#obtain-the-values-for-filter-parameters>) - [Verify the Request Type and Configuration](<#verify-the-request-type-and-configuration>) - (Optional) If you want to configure Secure Network Communication (SNC), refer to [SAP Secure Network Communication for SAP Source]() for additional SNC prerequisites. ### Prerequisites for Aggregation Create a custom Business Application Programming Interface (BAPI) in SAP GRC. For more information, refer to [Creating a Custom Business Application Programming Interface (BAPI)](). ### Configure the SAP GRC Server Perform the following on the SAP GRC Server using the administrator privileges: 1. Execute **SPRO** transaction code and select **SAP Reference IMG**. 2. Go to **Governance, Risk and Compliance \> Access Control \> User Provisioning**. 3. Select the image to execute **Maintain Provisioning Settings** transaction. 4. In Dialog Structure, select **Maintain Global Provisioning**. 5. In the Provisioning option section, go to **Auto Provisioning \> Auto provisioning at end of request**. ### Obtain the SAP GRC URLs > [!NOTE] > > All required web services must be set to the active mode before performing the following steps. Perform the following steps for each of the following web services: - Request Details: GRAC\_REQUEST\_DETAILS\_WS - Search Roles: GRAC\_SEARCH\_ROLES\_WS - Role Details: GRAC\_ROLE\_DETAILS\_WS **To obtain the required SAP GRC URLs:** 1. Execute the **SOAMANAGER** transaction code on the SAP GRC server. 2. Go to **Service Administration \> Web Service Configuration**. 3. In Search criteria, select **Object Type** as Service Definition and Object Name contains **GRAC\***. 4. Select **Search**. 5. In the search results, search (User Access web service) and select **GRAC\_USER\_ACCESS\_WS** web service. 6. Complete the following for `GRAC_USER_ACCESS_WS` web service: - Select the icon to open Service WSDL Generation. - Copy the URL from the WSDL Generation section and open this URL in a browser. - Locate the following string in the XML and copy the binding URL (in bold) mentioned in the string: ```text ``` These URLs are used for User Request and Request Details in the SAP GRC connector configuration. ### Download the JCO Libraries The JCO libraries (JCO Release 3.1.X) must be downloaded from the SAP website by going to the customer service marketplace and downloading the Java Integration Module. SAP JCO version 3.1.X libraries, `libsapjco3.so` (on UNIX), must be present in the `java.library.path` (`WEB-INF/lib`) directory on the VA host. Upload these `.jar` and `.so` files on the Basic Configuration page. For more information on downloading the `.jar` files, refer to [Obtaining the Custom Connector Files](). Ensure these jar files are compatible with the VA. The following ports must be open on the SAP system: | Port Name | Service in etc/services | Default | Range | Rule | | --- | --- | --- | --- | --- | | SAP Dispatcher | sapdp\ | 3200 | 3200-3299 | 32\ | | Gateway | sapgw\ | 3300 | 3300-3399 | 33\ | | Gateway Secured | sapgw\s | 4800 | 4800-4899 | 48\ | | ICM HTTPS / Web Dispatcher HTTPS | (typically HTTPS; no SAP-specific fixed service name in many hosts) | 443NN | 44300-44399 (instance-based) | Must be open when GRC Web Service endpoint URL uses HTTPS on 443NN. | | ICM HTTP / Web service binding port | HTTP | 80NN (common alternative) | 8000-8099 (instance-based) | Open if service bindings are HTTP rather than HTTPS. | > [!NOTE] > > - The \ represents the system number. > - The specific port used for the GRC service binding must be open for communication between SailPoint and the GRC system. For example, if your service uses HTTPS on port 443NN, that port must be open. Similarly, if it uses port 80NN or another custom port, that specific port must be open. ### Synchronization Jobs For all the connected systems, ensure that the Repository Object Synchronization job is successful and is in the same order as maintained in **User Detail Data Sources**. For verifying the order, complete the following steps: 1. Go to **SPRO \> SAP Reference IMG \> Governance Risk and Compliance \> Access Control \> Maintain Data Source Configuration**. 2. Select **User Detail Data Source**. ### Obtain the Values for Filter Parameters This section describes the procedure for obtaining the values for Business Process, Sub Process, and Role Type parameters. #### Obtaining the Values for Business Process and Sub Process 1. Execute **SPRO** transaction code and select **SAP Reference IMG**. 2. Go to **Governance \> Risk and Compliance \> Access Control \> Maintain Business Process and Subprocesses**. The following figure displays the list of business processes: [![List of Business Process]()]() As displayed in the above figure, code must be added instead of the description. For example `AP00`. 3. To get the sub processes associated with **Business Process**, select the code from the list of the business processes as displayed in the following figure: [![Business Process]()]() 4. Select **Business Subprocess** from the pane. The following figure displays the business subprocess: [![Business Subprocess]()]() #### Obtaining the Value for Role Type By default, the connector aggregates all role types. To filter for a specific role type, the `roleTypeFilter` entry key must be used with the following values: | Role Type | Description | | --- | --- | | BUS | Business Role | | COM | Composite Role | | CUA | CUA Composite Role | | DRD | Derived Role | | GRP | Group | | HAP | HAN AnalyticPrivileges | | PRF | Profile | | SIN | Single Role | ### Verify the Request Type and Configuration As part of the configuration process, you must map access request types and provisioning actions for the role and system. Verify the default request type codes and determine if you need to change them. Complete the following steps to verify the request type and configuration: 1. Go to **SPRO \> SAP Reference IMG \> Governance Risk and Compliance \> Access Control \> User Provisioning**. 2. Select **Define Request Type** and verify the request type code is mapped to the default value. If not, change it by specifying the [Configuring Provisioning Settings](). > **Screenshot** > > [![Change View Request View]()]() 3. Select **Maintain Priority configuration** and provide the priority value. ### Optional Configuration of SAP GRC IAG Bridge The following applications must be configured before enabling the SAP GRC IAG Bridge setup: - SAP Access Control 12.0 system (SP 15 and higher) - SAP IAG tenant with connected managed systems - SAP Cloud connector #### IAG System Configuration 1. The target application ID must be created and repository sync jobs must already be run on them. 2. Maintain the destination for SAP GRC under the BTP subaccount. For example, `IAGAuthService` and `IAGProvisionStatusUpdate` must be present. 3. You must schedule a recurring provisioning job in IAG. > [!NOTE] > > The provisioning request is sent to IAG from SAP GRC. IAG then picks each of the requests in the queue and provisions them to the corresponding cloud systems. For this reason, you are required to schedule recurrent provisioning jobs. #### GRC System Configuration 1. The RFC destination for authentications and SOD check must be present in Tcode SM59. (Ex. IAG\_SOD\_AUTH, IAG\_SOD) 2. Configuration parameters for the bridge must be set up with the RFC names created in step 1 under **SPRO \> Governance, Risks and Compliance \> Access Control \> Maintain Configuration Settings**. | Parameter Group | Parameter ID | Parameter value | | --- | --- | --- | | Cloud Integration | 1090 | YES | | Cloud Integration | 1091 | RFC name created in step 1 for SOD | | Cloud Integration | 1092 | RFC name created in step 1 for SOD Auth | Example of parameter names: [![Parameter Names]()]() 3. Separate RFC destinations for all the cloud applications. > **Note** > > The name of the RFC destination for every cloud application must be exactly the same as its corresponding application ID name in IAG. This behavior is for SAP by-design. 4. In SAP Gateway administrator, the `IAG_PROVISION_STATUS_UPDATE_SRV` service must be maintained under **SPRO \> Governance, Risks and Compliance \> SAP NetWeaver \> SAP Gateway Administration \> General Settings \> Activate and Maintain Services**. 5. The repository sync job `GRAC_REPOSITORY_OBJECT_SYNC` must be ran in GRC as well for cloud applications. ## Required Permissions > [!NOTE] > > The RFC\_READ\_TABLE integration function module has been deprecated, and replaced with the ABAP Function module. For more information on configuration, refer to [SailPoint Add-On to replace the use of RFC\_READ\_TABLE](). The following table lists the required permissions for the specific operations mentioned below: | Operation | Required Permissions | | --- | --- | | Access Management - Test Connection | [Test Connection](<#test-connection>) | | Access Management - Account Aggregation | [Test Connection](<#test-connection>) and [Account Aggregation](<#account-aggregation>) | | Access Management - Group Aggregation | [Test Connection](<#test-connection>) and [Group Aggregation](<#entitlement-aggregation>) | | Access Management - Provisioning | [Test Connection](<#test-connection>), [Account Aggregation](<#account-aggregation>), [Group Aggregation](<#entitlement-aggregation>), and [Provisioning](<#provisioning>) | The SAP GRC account must have the following Authorization Objects assigned to it: > [!NOTE] > > - Asterisks (\*) indicate required values. > - To assign service authorization select External services and under that select WS from dropdown. > > [![Required Permissions]()]() ### Test Connection | Authorization Objects | Field Names | Values | | --- | --- | --- | | S\_SERVICE | SRV\_NAME | GRAC\_SEARCH\_ROLES
GRAC\_USER\_ACCESS\_WS
GRAC\_ROLE\_DETAILS\_WS
GRAC\_REQUEST\_DETAILS\_WS | | S\_SERVICE | SRV\_TYPE | WS | | S\_RFC | Activity: 16, RFC\_NAME | RFCPING | | S\_RFC | RFC TYPE | FUGR, FUNC | ### Account Aggregation > [!NOTE] > > To open a profile object with blank text when aggregating accounts from SAP GRC version 750, you can use the new `USR11` admin permission field value in the Table Name field of the S\_TABU\_NAM Authorization Object. | Authorization Objects | Field Names | Values | | --- | --- | --- | | S\_SERVICE | SRV\_NAME | GRAC\_SEARCH\_ROLES\_WS,
GRAC\_USER\_ACCESS\_WS,
GRAC\_ROLE\_DETAILS\_WS,
GRAC\_REQUEST\_DETAILS\_WS | | S\_SERVICE | SRV\_TYPE | WS | | S\_RFC | Activity: 16, RFC\_NAME | MSS\_GET\_SY\_DATE\_TIME, RFCPING, RFC\_GET\_FUNCTION\_INTERFACE, RFC\_METADATA\_GET, SDTX, SYST

**Note:** Based on the options configured in the UI, select one of the following options:

\- RFC\_READ\_TABLE. **Note:** SailPoint will continue to support the RFC\_READ\_TABLE as per our deprecation policies. SailPoint highly recommends that you start planning the move to use SailPoint's Function Module.
\- /SAILPOIN/SAIL\_READ\_TABLE\_LEG. Add this permission to use SailPoint's Function Module over RFC\_READ\_TABLE if your SAP\_BASIS version is 740, Support Package 08, up to BASIS 750.
\- /SAILPOIN/SAIL\_READ\_TABLE. Add this permission to use SailPoint's Function Module over RFC\_READ\_TABLE if your SAP\_BASIS version is 751 and later.

**Note:** If you configure the permissions for SailPoint's function module then remove RFC\_READ\_TABLE value from S\_RFC authorization object. | | S\_RFC | RFC\_TYPE | FUGR, FUNC, GRACUSER, GRACUSERCONN | | S\_TABU\_NAM | Activity: 03, TABLE | GRACUSERPROFILE, GRACUSERROLE, GRACUSERSOURCE, GRACRLCONN, GRACROLE, GRACRLCUARELAT, GRACRLCOMPRL, CVERS, PRDVERS, GRACUSER

**Note:** For SAP GRC AC12 SP19 and above versions, additional permissions for the GRACUSERSOURCE table are required. | ### Entitlement Aggregation | Authorization Objects | Field Names | Field Values | | --- | --- | --- | | S\_SERVICE | SRV\_NAME | GRAC\_SEARCH\_ROLES\_WS
GRAC\_USER\_ACCESS\_WS
GRAC\_ROLE\_DETAILS\_WS
GRAC\_REQUEST\_DETAILS\_WS | | S\_SERVICE | SRV\_TYPE | WS | | S\_RFC | Activity: 16, RFC\_NAME | MSS\_GET\_SY\_DATE\_TIME
RFCPING
RFC\_GET\_FUNCTION\_INTERFACE
RFC\_METADATA\_GET
SDTX
SYST

**Note:** Based on the options configured in the UI, select one of the following options:

\- RFC\_READ\_TABLE. **Note:** SailPoint will continue to support the RFC\_READ\_TABLE as per our deprecation policies. SailPoint highly recommends that you start planning the move to use SailPoint's Function Module.
\- /SAILPOIN/SAIL\_READ\_TABLE\_LEG. Add this permission to use SailPoint's Function Module over RFC\_READ\_TABLE if your SAP\_BASIS version is 750 and earlier.
\- /SAILPOIN/SAIL\_READ\_TABLE. Add this permission to use SailPoint's Function Module over RFC\_READ\_TABLE if your SAP\_BASIS version is 751 and later.

**Note:** If you configure the permissions for SailPoint's function module then remove RFC\_READ\_TABLE value from S\_RFC authorization object. | | S\_RFC | RFC\_TYPE | FUGR, FUNC | | S\_TABU\_NAM | Activity: 3, TABLE | GRACPROFILE, GRACRLCONN, GRACROLE, GRACROLERELAT, and GRACRLCOMPRL | | GRAC\_ROLED | | GRAC\_ACTRD: 03
GRAC\_BPROC: \* OR AS required
GRAC\_LDSCP: \* OR AS required
GRAC\_RLSEN \* OR AS required
GRAC\_RLTYP \* OR AS required
GRAC\_ROLE \* OR AS required | | GRAC\_ROLEP | ACTVT: 78 | GRAC\_BPROC: \* OR AS required
GRAC\_OUNIT: \* OR AS required
GRAC\_RLTYP: \* OR AS required
GRAC\_ROLE: \* OR AS required
GRAC\_SYSID: \* OR AS required | | GRAC\_SYS | ACTVT: 01 | GRAC\_APPTY: \* OR AS required
GRAC\_ENVRM: \* OR AS required
GRAC\_SYSID: \* OR AS required | ### Provisioning | Authorization Objects | Field Names | Values | | --- | --- | --- | | GRAC\_REQ | ACTVT: 1 | GRAC\_BPROC \* OR AS required
GRAC\_FNCAR \* OR AS required
GRAC\_RQFOR \* OR AS required
GRAC\_RQINF \* OR AS required
GRAC\_RQTYP: 001, 002, 003, 004, 005 | | S\_USER\_GRP | Activity: 03, CLASS | \* OR AS required | ### Creating a Custom Business Application Programming Interface (BAPI) | Authorization Objects | Field Names | Values | | --- | --- | --- | | S\_SERVICE | SRV\_NAME | GRAC\_SEARCH\_ROLES, GRAC\_USER\_ACCESS\_WS, GRAC\_ROLE\_DETAILS\_WS, GRAC\_REQUEST\_DETAILS\_WS | | S\_SERVICE | SRV\_TYPE | WS | | S\_RFC | Activity: 16, RFC\_NAME | MSS\_GET\_SY\_DATE\_TIME, RFCPING, RFC\_GET\_FUNCTION\_INTERFACE, RFC\_METADATA\_GET, SDTX, SYST, {Custom BAPI Name}

**Note:** Based on the options configured in the UI, select one of the following options:

\- RFC\_READ\_TABLE. **Note:** SailPoint will continue to support the RFC\_READ\_TABLE as per our deprecation policies. SailPoint highly recommends that you start planning the move to use SailPoint's Function Module.
\- /SAILPOIN/SAIL\_READ\_TABLE\_LEG. Add this permission to use SailPoint's Function Module over RFC\_READ\_TABLE if your SAP\_BASIS version is 750 and earlier.
\- /SAILPOIN/SAIL\_READ\_TABLE. Add this permission to use SailPoint's Function Module over RFC\_READ\_TABLE if your SAP\_BASIS version is 751 and later.

**Note:** If you configure the permissions for SailPoint's function module then remove RFC\_READ\_TABLE value from S\_RFC authorization object. | | S\_RFC | RFC\_TYPE | FUGR, FUNC | | S\_TABU\_NAM | Activity: 03, TABLE | GRACUSER, GRACUSERCONN, GRACUSERPROFILE, GRACUSERROLE, GRACRLCONN, GRACROLE, GRACRLUARELAT, GRACRLCOMPRL | ### IAG Bridge Required Permissions Apart from existing GRC permissions, the following permission is required: | Authorization Objects | Field Names | Values | | --- | --- | --- | | S\_TABU\_NAM | Activity: 03, TABLE | GRFNCCICONNECTOR

**Note:** For the cloud Target Connector, the supported connector types are: IAG, and IAG\_GRP. | ### FireFighterID Permissions Following permissions are required for configuring FireFighterID to perform different operations: | Operation | Authorization Objects | Field Names | Values | | --- | --- | --- | --- | | Account Aggregation | S\_TABU\_NAM | Activity: 03, TABLE | GRACFFUSER

**Note:** This is required for configuring FireFighterID. | | Group Aggregation | S\_TABU\_NAM | Activity: 03, TABLE | GRACFFCTRL, GRACFFOBJECT, GRACFFOWNER, GRACCONFIGSET

**Note:** These are required for configuring FireFighterID. | | Provisioning | GRAC\_FFOWN | ACTVT (All Activities) | GRAC\_SYSID
GRAC\_USER\*
GRAC\_OWN\_T (All Values) | | Provisioning | GRFN\_USER | ACTVT | Display, Lock, Generate, Discard, Override, Unlock | ### Role Aggregation Based on Connector Group and System | Operation | Authorization Objects | Field Names | Values | | --- | --- | --- | --- | | Group Aggregation | S\_TABU\_NAM | Activity: 03, TABLE | GRFNCCICONNECTOR, GRFNCONNGRP | Refer to [Troubleshooting]() for more information. # Machine Account Attributes ## Machine Account Provisioning Attributes Machine account creation uses the same source attributes as standard account creation. For the complete list of supported attributes and their descriptions, refer to [Default Create Account Attributes](). For more information, refer to [Machine Identity Security Overview](). ### Classification The Classification attribute is used to identify and categorize the account as a Machine Account. - Attribute name: `UserType` - Value: Communication, Reference, Service, System. For more information, refer to [Implementing Without Application Data](). # Provisioning The SAP GRC connector supports provisioning, allowing you to create and manage accounts and entitlements in SAP GRC directly from SailPoint. **Prerequisite:** Your system is configured for provisioning. When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*. When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment. For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account. > [!IMPORTANT] > > This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail. ## Default Create Account Attributes The following generators create the required information for a new SAP GRC account: | Account Attribute | Identity Attribute | Description | | --- | --- | --- | | User ID | Create Unique Account ID | The identity of the user | | Last Name | Identity Attribute | The last name of the user | | First Name | Identity Attribute | The first name of the user | | System | Static | You must enter the name of the system to which user is connected | | Manager ID | Static | The manager identity of the user | | User Type | Static | The type of the user | | Email | Identity Attribute | The email address of the user | # Schema Reference The application schema is used to configure the objects returned from a connector. > [!NOTE] > > - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas]() for more information. > - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified. The SAP GRC connector uses the following default correlation and object configurations. > [!IMPORTANT] > > The parameters and their respective descriptions of the parameters are mentioned in the following format: > > Parameter Name: Description of the parameter ## Default Account Schema Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location. The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas]() for more information. ### Default Account ID SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*. > [!CAUTION] > > Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts. > > To resolve issues caused by changing account IDs, reconfigure them to their default values. The following table lists the default account IDs for this connector: | Account ID | Schema Object Type | | --- | --- | | User ID (only valid under Access Management Integration Mode) | Account | | Role UUID | Group | | FFUserID | FireFighterID | ### Default Account Attributes The SAP GRC connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified. The following lists the account attributes: | Attribute Name | Description | | --- | --- | | First Name | First name of the user. | | Last Name | Last name of the user. | | User ID | ID of the user. This is an Account ID which must not be changed. Only valid under Access Management Integration Mode. | | Email | Email of the user. | | Phone | Telephone number of the user. | | Department | Department of the user. | | FireFighterID | The FireFighterID assigned to the user. | | Manager ID | Manager Id of the user. | | User Group | User group assigned to a user. | | User Type | Type of the user. For more information on the abbreviations used for the type of user aggregated, refer to [Status of User Type](<#status-of-user-type>). | | Valid From | System ID with from validity of the user in a format as `SystemID/Date`. The date format is yyyymmdd. | | Valid To | System ID with upto validity of the user in a format as `SystemID/Date`. The date format is yyyymmdd. | | Status | User Status (per connector). | | System | System ID of the connector with highest sequence (priority) maintained in the data source configuration from SPRO. | | Roles | Roles assigned to a user. | #### Status of User Type The following table lists details about the abbreviations used to represent the type of user aggregated: | User Type | Description | | --- | --- | | A | Dialog | | B | System | | C | Communication Data | | L | Reference (Logon not possible) | | S | Service | > [!NOTE] > > "Account Number" (ACCNT) and "Cost Center" (KOSTL) are supported only for provisioning. ## Default Entitlement Attributes Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements]() for more information. > [!CAUTION] > > Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations. ### Default Group Attributes The SAP GRC connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups. #### Object Type: Group | Attribute Name | Description | | --- | --- | | Role UUID | Role universally unique identifier. This is an Account ID which must not be changed. | | Role Name | Name of the role. | | Role Desc | Role description. | | System | System to which role belongs. | | Role Type | Type of the role. | | Role Type Desc | Role type description. | | Landscape | Role landscape. | | Role Owner | Owner of the role. | | Business Process | Business Process to which role belongs. | | Sub Process | Sub Process to which role belongs. | | Role Status | Role Status. | | Associated Child Roles | Roles associated with Composite or Business role. | #### Object Type: FireFighterID | Attribute Name | Description | | --- | --- | | FFUserID | The Fire Fighter ID. (Connector + delimiter + FFUserID) | | Connector | The connector name of the ID. | | FFOwner | The owner who approves access and monitors usage. | | FFController | The controller who reviews logs and adds comments. | | DefaultValidityDays | The default validity dates for usage of ID. | | Roles | The roles assigned to Firefighter ID. | ## Considerations for Schema Attributes - The connector aggregates the value for the following account attributes based on the connector that is maintained in the highest sequence in the **User Detail Data Source**: - First Name - Last Name - User ID - Email - Phone - Department - Manager ID - User Type - The connector aggregates the Role name in the format `System Name/Role Name` - for example, `HANADB/CONTENT_ADMIN`. For the GRC business role, only the **Role Name** is displayed. - Update account is supported during the Create Account operation for all the account attributes except for the **Status** attribute. - If values are changed by the GRC administrator after a request is created, that request is not completed. - Only the **Add** and **Remove** operations are supported. - The Request ID is sent to GRC for every provisioning operation and is not available in the UI during certification. - Line item approval and rejection (only) is supported for the Role attribute from the GRC side. - An Identity Status as **Enabled** or **Disabled** is mapped to the **Locked/Unlocked** status of the user in the system. If there are multiple systems, it is based on the order in which the **Repository Objects** sync job is run for the system in SAP GRC. Additionally, it depends on the effective record updated in GRC after all repository object sync jobs are executed. If the option for **Enable/Disable users on all the SAP GRC connected-systems** is enabled: - The identity status will be disabled when the user account is disabled on all the systems. - The identity status will be enabled even if the user account is enabled on any single system. - If the option for **Enable/Disable users on all the SAP GRC connected-systems** is disabled: - The identity status will be disabled only when the user account is disabled on the master system. - The identity status will be enabled only when the user account is enabled on the master system. - The **Requester ID** and **Requester Email** are automatically set as the **Application Owner ID** and **Email** in GRC while placing the Access Request. # Enable Connector Logging This topic provides the steps needed to enable logging on SailPoint using REST APIs. > [!NOTE] > > This topic only applies to VA-based integrations. > [!NOTE] > > The examples provided might not match your configuration. Use the logging levels and logging classes reference at the bottom of the topic to configure your API responses to match your connector. This process is broken up into four steps: 1. Identify the Virtual Appliance (VA) cluster on which you want to enable logging. 2. Get the logging configuration for the existing VA cluster. 3. Update the VA cluster to enable logging levels. 4. Observe logging changes to the logging levels. ### Identify the Virtual Appliance Cluster Select the VA on which you need to enable logging using REST API. If you already know the VA application's `id`, proceed to [Get the Logging Configuration](<#get-the-logging-configuration>). 1. Make the following call to the REST API to return a list of available VA clusters: GET /v3/managed-clusters The REST API returns a response that looks similar to the following: ```json [ { "id": "2c9180866166b5b0016167c32ef31a66", "name": "Development Cluster", "description": "Development Cluster", "clientType": "CCG", "ccgVersion": "373_535_70.2.0", "pinnedConfig": true, "logConfiguration": null }, { "id": "2c9180846a93ce60016ab29f039944de", "name": "Cloud Cluster", "description": "Cloud Cluster", "clientType": "CCG", "ccgVersion": "373_535_70.2.0", "pinnedConfig": true, "logConfiguration": { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } } ] ``` > **Note** > > The previous example code shows two VA clusters. One VA cluster has a log configuration and the other does not (refer to the `logConfiguration` value in each returned VA cluster). This is because one of the clusters already has logging enabled. This is just an example configuration, and your environment may not have logging enabled on a cluster. 2. Identify the VA cluster that you want to enable logging on by its name or description and record its `id` attribute. ### Get the Logging Configuration Get your selected VA's cluster logging configuration and identify the values you need to update. 1. Make the following call to the REST API to return the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier. GET /v3/managed-clusters/{id}/log-config - If the VA doesn't have a logging configuration currently set, it returns `204 No Content` as a response. - If the VA has an existing logging configuration, it returns something similar to the following: ```json { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` You'll need to configure the following information in the response: - `durationMinutes` is the number of minutes logging should remain enabled. - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>). - `logLevels` is a map object with logging classes as keys and logging levels as values. - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes. - For a list of available values, refer to [Logging Levels](<#logging-levels>). ### Update Logging Configuration Update the VA cluster configuration returned by the REST API to update the logging settings as needed. 1. Make the following call to the REST API to update the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier. PUT /v3/managed-clusters/{id}/log-config 2. Submit your configuration changes to the REST API in a JSON body. - If the VA cluster did not already have a logging configuration and you received a `204 No Content` response, you can create a new one. - If the VA returned a configuration, you can edit it to include the changes. The JSON body should be as follows: ```json { "durationMinutes": 60, "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` Consider the following as you edit the JSON: - `durationMinutes` is the number of minutes logging should remain enabled. - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>). - `logLevels` is a map object with logging classes as keys and logging levels as values. - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes. - For a list of available values, refer to [Logging Levels](<#logging-levels>). If the update was successful, the REST API should return a response similar to the following: ```json { "clientId": null, "durationMinutes": 60, "expiration": "2020-12-15T19:13:36.079Z", "rootLevel": "DEBUG", "logLevels": { "sailpoint.connector.ADLDAPConnector": "DEBUG" } } ``` ### Observe Logging Changes Approximately five minutes after you update the configuration, the VA cluster starts generating log files you can review. You can view the log files in **ccg.log**. ### References The tables in this reference section list information that can be helpful when creating the JSON body you'll use to configure the VA cluster's configuration file. #### Logging Levels | Logging Level | Description | | --- | --- | | ERROR | Designates error events that might still allow the connector to continue. | | WARN | Designates potentially harmful situations. | | INFO | Designates information messages that highlight process at a coarse-grain level. | | DEBUG | Very verbose. Fine grain logging levels used for development and debugging. | | TRACE | Most verbose. Finer grain logging levels than debugging. | #### Logging Classes | Connector | Logging Class | | --- | --- | | Active Directory | sailpoint.connector.ADLDAPConnector sailpoint.connector.LDAPConnector | | AIX | openconnector.connector.unix.AIXConnector openconnector.connector.unix.UnixConnector | | Amazon Web Services | logger.aws.name=openconnector.connector.aws logger.aws.level=trace logger.aws.additivity = false logger.aws.appenderRef.rolling.ref = STDOUT | | Atlassian Suite Cloud | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianConnector | | Atlassian Data Center | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianDataCenterConnector | | Microsoft Entra ID | sailpoint.connector.AzureADConnector | | Box | openconnector.connector.BoxNetConnector sailpoint.connector.OpenConnectorAdapter | | Cerner | openconnector.connector.CernerConnector sailpoint.connector.OpenConnectorAdapter | | Delimited File | logger.DelimitedFileConnector.name = sailpoint.connector.DelimitedFileConnector logger.DelimitedFileConnector.level = debug logger.DelimitedFileConnector.additivity = false logger.DelimitedFileConnector.appenderRef.rolling.ref = STDOUT | | Dropbox | openconnector.connector.DropBoxConnector sailpoint.connector.OpenConnectorAdapter | | Epic | openconnector.connector.EPICConnector sailpoint.connector.OpenConnectorAdapter | | GE Centricity | openconnector.connector.GECentricity sailpoint.connector.OpenConnectorAdapter | | Google Apps / G Suite | openconnector.connector.GoogleAppsDirect sailpoint.connector.OpenConnectorAdapter | | IBM i | openconnector.connector.IBMiConnector | | Lotus Domino | sailpoint.connector.LotusDomino | | JDBC | sailpoint.connector.JDBCConnector | | Sun One LDAP | sailpoint.connector.LDAPConnector | | Linux | openconnector.connector.unix.LinuxConnector sailpoint.connector.OpenConnectorAdapter sailpoint.connector.UnixConnector | | Microsoft Office365 | sailpoint.connector.Office365Connector | | Microsoft SQL Server | sailpoint.connector.mssql.serviceimpl.MSSQLServerConnectorV2 | | Okta | logger.openconnector.name = openconnector.connector.okta.OktaConnector logger.openconnector.level = debug logger.openconnector.additivity = false logger.openconnector.appenderRef.rolling.ref = STDOUT | | Oracle Database | sailpoint.connector.OracleDBConnector sailpoint.connector.JDBCConnector | | Oracle E-Business | sailpoint.connector.OracleEBSConnector sailpoint.connector.JDBCConnector | | Oracle Fusion HCM | openconnector.connector.oraclefusionhcm.OracleFusionHCMConnector sailpoint.connector.OpenConnectorAdapter | | Oracle HCM Cloud | sailpoint.connector.oraclehcmcloud.OracleHCMCloudConnector | | Oracle HRMS | sailpoint.connector.OracleAppsHRMSConnector sailpoint.connector.JDBCConnector | | Oracle Netsuite | openconnector.connector.netsuite.NetsuiteConnector | | PeopleSoft ERP | openconnector.connector.PeopleSoftConnector sailpoint.connector.OpenConnectorAdapter | | PeopleSoft HRMS | sailpoint.connector.PeopleSoftHRMSConnector | | RemedyForce | sailpoint.connector.ForceConnector | | RSA Authentication Manager | openconnector.connector.RSAConnector openconnector.connector.rsa.RSAHTTPClient sailpoint.connector.OpenConnectorAdapter | | Salesforce | sailpoint.connector.ForceConnector | | SAP Concur | openconnector.connector.sapconcur.SAPConcurConnector | | SAP - Direct | sailpoint.connector.SAPConnector sailpoint.connector.SAPInternalConnector | | SAP GRC | logger.SAPGRCConnector.name = sailpoint.connector.sapgrc logger.SAPGRCConnector.level = debug logger.SAPGRCConnector.additivity = false logger.SAPGRCConnector.appenderRef.rolling.ref = STDOUT | | SAP HR/HCM | sailpoint.connector.SAPHRInternalConnector | | SCIM 1.1 | openconnector.connector.SCIMConnector sailpoint.connector.OpenConnectorAdapter | | SCIM 2.0 | openconnector.connector.scim2.SCIM2Connector sailpoint.connector.OpenConnectorAdapter | | ServiceNow | openconnector.connector.servicenow.ServiceNowConnector openconnector.connector.servicenow.ServiceNowRestClient sailpoint.connector.OpenConnectorAdapter | | ServiceNow Service Desk Integration | openconnector.connector.servicedesk.ServiceNowServiceDeskConnector sailpoint.connector.OpenConnectorAdapter | | Siebel | openconnector.connector.SiebelConnector sailpoint.connector.OpenConnectorAdapter | | Snowflake | openconnector.connector.snowflake.SnowflakeConnector sailpoint.connector.OpenConnectorAdapter | | Solaris | openconnector.connector.unix.SolarisConnector openconnector.connector.unix.UnixConnector sailpoint.connector.OpenConnectorAdapter | | SuccessFactors | sailpoint.connector.SuccessFactorsConnector | | Sybase | sailpoint.connector.SybaseDirectConnector sailpoint.connector.JDBCConnector | | Webex | openconnector.connector.Webex sailpoint.connector.OpenConnectorAdapter | | Workday | openconnector.connector.WorkDay sailpoint.connector.OpenConnectorAdapter | | Workday Accounts | openconnector.connector.workdayaccounts openconnector.connector.workdayaccounts.WorkdayAccountsConnector sailpoint.connector.OpenConnectorAdapter | | Web Services | sailpoint.connector.WebServices | | XML | openconnector.connector.XMLConnector sailpoint.connector.OpenConnectorAdapter | | Yammer | openconnector.connector.YammerConnector sailpoint.connector.OpenConnectorAdapter | | Zoom | openconnector.connector.zoom.ZoomConnector sailpoint.connector.OpenConnectorAdapter | # Troubleshooting IAG Bridge ## Enable/Disable Operation Is Not Supported with GRC IAG Integration Error The following error displays: Enable/Disable operation is not supported with GRC IAG integration (when `Enable IAG` option is selected). **Resolution**: [Work with Services]() to write the before provisioning rule to handle leaver use cases. ## No Cloud Groups Are Synced to the SailPoint Platform **Resolution**: Make sure to run the repository sync job for the particular connector in SAP GRC. The SailPoint connector picks data from the GRAC\* tables. ## The Access Request Is Shown in `Queued` Status for a Long Time **Resolution**: Ensure the Provisioning job in IAG Bridge is recurrently scheduled. # Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Failure Status for Identity Access Requests When the SAP GRC system is unreachable during the connector's polling cycle, identity access requests remain in the GRC queue as pending and can still be processed once the system becomes available. However, the SailPoint incorrectly reports these requests as failed due to a `SocketTimeoutException` or `UnknownHostException` issue, but are actually still actionable within GRC. **Resolution**: To prevent the connector from prematurely reporting a failure status when the GRC system experiences a timeout during the polling cycle, add the `ignoreTimeoutOnStatusCheck` attribute to the source configuration using the REST API: ```json [ { "op": "add", "path": "/connectorAttributes/ignoreTimeoutOnStatusCheck", "value": "true" } ] ``` > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ## SAP GRC - AC12 SP19 and above considerations SAP has introduced significant modifications in its SAP GRC version AC 12.0 SP19 and above in inactive users and sync job processes, which has affected our SAP GRC connector functionality adversely. ### Details about the issues and fixes #### Disable Operation - **Issue**: With the upgrade of GRC from AC12 SP19 and above, you may see **System attribute on account schema** as **INACTIVE\_USER** for the aggregated accounts which are disabled only on the highest priority system on SAP GRC. - **Resolution**: This issue is observed due to the Repository sync job changes introduced by SAP for updating their table values. For resolution, ensure the changes on GRC and the source configuration are as follows: 1. Ensure that the Repository sync job is scheduled on your SAP GRC instance. 2. The option for `Disable only Master` system has been removed from the source config UI without impacting existing customers configuration. SailPoint highly recommends, however, that you revisit your source configuration for `Disable` operations. The changes have been documented in [Enable and Disable Account](). 3. Provide additional permissions required on the SAP tables for GRC 12 SP19 and above for aggregation and disable operations. For more information, refer to the [Configuration Table for SAP GRC](). #### Modify Operations - **Issue**: SAP has introduced a new process where any modifications in the user profile reflect in GRC tables only after completing the repository sync job. This has adversely affected our connector operations. - **Resolution**: The following steps must be performed sequentially for a successful modify operation: 1. Configure the Attribute Sync request on the user in SailPoint for the GRC source. To configure the attribute sync request, refer to [Synchronizing Attributes - SailPoint Identity Services](). 2. Run the Repository Object Sync job on your GRC system. 3. Execute the User Aggregation on your GRC source to get the updated values of the user attributes. ## System attribute value is showing INACTIVE\_USER \[For SAP GRC - AC12 SP19 and above\] in SailPoint For SAP GRC - AC12 SP19 and above, the connector column in the GRACUSER table shows '\<\#INACTIVE\_USER\#\>' for accounts that are disabled on the highest priority data source. With GRC12 SP19 and above, SAP has introduced changes in the GRACUSER table and sync job. Users will now see \<\#Inactive\_User\> as the connector value for the disable operation in the following cases if the full sync job has not completed: 1. If an account is disabled only on a GRC-connected master system (highest priority system). 2. If an account is disabled on all the GRC-connected systems including the master system. For more details, refer to SAP KBA 3251717. Due to the above, the SailPoint platform will show 'INACTIVE\_USER' in the `System` attribute until the full sync job is completed successfully before aggregation. ## Provisioning fails with Invalid request type error **Resolution**: Ensure the request type is configured correctly. Follow the steps in [Verify the Request Type and Configuration](), and confirm the BRF + MSMP workflow is configured correctly for the request type. > [!NOTE] > > **Screenshot** > > [![BRF MSMP]()]() If it isn't, provide the correct permissions for the service account created for authorization object **GRAC\_REQ**, by providing a correct value for **GRAC\_RQTYP**. ## usertype attribute causes changes on all connected systems When the usertype attribute is passed in the provisioning plan for an account, the changes are reflected on all the systems connected to that account. **Resolution**: Add the following attribute using [Rest API for updating a source]() in SailPoint. - Key=`supportSystemUpdate` Value=`true` - `supportSystemUpdate` is a boolean attribute The flag must be set to true, so that when the userType attribute is passed in the provisioning plan, only the system passed in the plan will be sent in the GRC API. ## Entitlement count mismatch (SAP GRC vs SailPoint) If the number of roles (entitlements) in SailPoint does not match what you see in SAP GRC Access Control, the connector usually reads incomplete or non-production-ready role data from GRC backend tables. The SAP GRC connector aggregates entitlements from GRC repository tables (such as `GRACROLE` and `GRACRLCONN`). If a role is not fully synchronized, not in production status, or not requestable in the GRC portal, it might exist in the connected SAP system but not appear in SailPoint. 1. Confirm that the role is requestable in the SAP GRC portal. 2. Verify that role synchronization jobs completed successfully. 3. Confirm that the role status is **Complete** in Role Maintenance. Go to **SAP GRC \> Role Management**. Open the role under the current phase on the **Role Maintenance** tab. Verify: | Check | Required Value | | --- | --- | | Role exists in current phase | Yes | | Role maintenance status | **Complete** | | All required role maintenance steps | Finished for current phase | 4. Confirm provisioning settings on the **Provisioning** tab. Open the same role in GRC and go to the **Provisioning** tab. Verify: | Field | Required Value | | --- | --- | | **Production status** | Set to **Production** | | **Role Exists** | **Yes** | | **Provisioning Allowed** | **Yes** | ## SAP source config test connection fails when the VA is configured with secure tunnel, or when the VA and manage system are on a different network ```text "sailpoint.connector.ConnectionFailedException: Server is DOWN or Connection parameters are incorrect. ``` OR ```text ERROR hostname 'sailpoint-va' unknown\nTIME ``` OR ```text JCO_ERROR_COMMUNICATION: Connect to SAP gateway failed ``` **Resolution**: There are three possible options to solve this error. **Option 1**: One of the reasons for the issue to occur is the IP address of the VA is not recognized by the connector. To resolve this, you must make an entry in hosts.yaml with the IP address of the VA as well as the managed source (SAP server). > [!NOTE] > > For information on creating a hosts.yaml file, refer to [Configuring a Hosts.yaml File](). For example: ```text hosts: 10.200.80.60: -SAPSER4 10.22.131.14: -sailpoint-va ``` Where `10.200.80.60` is the IP and `SAPSER4` is the hostname of the SAP server, and `10.22.131.14` is the IP of the VA and `sailpoint-va` is the default name of the VA. Ensure that SAP is installed with JCO enabled. Similarly, add the IP and hostname of the VA being used in the file. Restart CCG/ Reboot VA after the update. **Option 2**: Add Route entry in static.network file to persist routing table entry of the VA hostname. To do so, perform the following steps: 1. In your VA, go to ../etc/systemd/network/static.network 2. Add the following entry: ```text [Route] Gateway=<10.0.0.1> Destination=/ ``` 3. Run `sudo systemctl restart systemd-networkd` to apply the configuration. 4. Run `route -n` to show routes. 5. Restart CCG/ Reboot VA and check if the entry still persisted. **Option 3**: Update DNS entries for VAs on your network so that FQDN resolves for each VA. To do so, perform the following steps: 1. Run `sudo hostnamectl set-hostname ` to set the VA hostname. 2. Run the `hostname` command to validate. 3. Run `sudo reboot` to reboot the VA. The VA should reflect the new hostname. ## Could not initialize class com.sap.conn.jco.rt.JCoRuntimeFactoryError during test connection and aggregations ```text Could not initialize class com.sap.conn.jco.rt.JCoRuntimeFactory ``` **Resolution**: The host value must be updated on VA with the FQDN of the SAP server. Re-upload the `sapjco` and `libsapjco` jars on the UI. ## ASSIGN\_TYPE\_CONFLICT exception occurs on UI during connector operations The following error message is displayed when using Function Module /SAILPOIN/SAIL\_READ\_TABLE and /SAILPOIN /SAIL\_READ\_TABLE\_LEG: ```text Exception during aggregation. Reason: java.lang.RuntimeException: ASSIGN_TYPE_CONFLICT while querying table *Table_Name*. One of the fields queried (field1,field2,field3… ) may have incorrect COLUMN_LENGTH set in /SAILPOIN/CONF table. Please refer ASSIGN_TYPE_CONFLICT in troubleshooting section of documentation for more details. ``` **Resolution**: Ensure COLUMN\_LENGTH is correctly configured for the fields of `Table_Name` in /SAILPOIN/CONF table. This can be validated through the t-code "SE11" while viewing the table details, under "Fields" tab. ## TABLE\_ACCESS\_NOT\_ALLOWED error gets logged in log file and WARN level while executing account aggregation ```text connector.sapgrc.service.SAPGRCConnectorService:302 - Exception while getting system info from CVERS and PRDVERS tables sailpoint.connector.ConnectorException: Caused by class com.sap.conn.jco.AbapException: (126) TABLE_ACCESS_NOT_ALLOWED: Message 000 of class null type : . SAP_QUERY_TABLE_NAME:CVERS ``` **Resolution**: Provide the correct permissions to service account user on CVERS and PRDVERS tables and ensure you have both of the following: - CVERS/PRDVERS is added S\_TABU\_NAME authorization object. - CVERS/PRDVERS added in SAILPOIN/CONF table. ## SAP GRC Access Control 12.0 - Requests approved by GRC are displayed as rejected in SailPoint **Resolution**: Ensure that the following SAP Note is implemented in the SAP GRC Server: ```text 2698051 - AC12 - GET_REQUEST_DETAILS is returning empty line items ``` ## SAP GRC Access Requests Fail The access requests fails with the following message: ```text Invalid Request No. ``` **Resolution**: Add the `numberOfRetries` and `retryWaitTime` parameters to configure polling requests retries. Add the following entry keys to the SAP GRC connector: ```text ``` > [!NOTE] > > The following are the default values for the parameters: > > - `numberOfRetries` is 3 retries. > - `retryWaitTime` is 5 seconds. > > You can update these values as required. ## Test connection fails with 307 error When attempting a test connection it fails with the following error: ```text HttpException errorCode=307 ``` The 307 error is for URL redirects. This error is observed when the SAP GRC managed system is configured for HTTPS URLs and the source XML is configured with HTTP URLs. **Resolution**: Update the source XML with the HTTPS URLs and the correct HTTPS port number. ## Access Request Status displayed as Incomplete **Resolution**: Ensure that the **Repository Object Synchronization** task is executed in GRC. ## Role owner details are not aggregated **Resolution:** Refer to and apply the following SAP note in the SAP GRC managed system: ```text https://launchpad.support.sap.com/#/notes/3043243 :WS: GRC Role owner is not getting fetched in Search roles web service. ``` ## The Valid From and Valid To dates are not configured during provisioning operation **Resolution:** Refer to and apply the following SAP note in the SAP GRC managed system: ```text 2970855 - IDM GRC Request creation date: https://launchpad.support.sap.com/#/notes/2970855 2958851:2958851 - User Valid from date is not updating correctly: https://launchpad.support.sap.com/#/notes/2958851 ``` ## User ID and Email of Requester is mandatory **Resolution:** Follow the steps to add the requester and email to the source config as documented in [Configuring Provisioning Settings](). ## Missing data in Account aggregation when the slash (/) character is used in the user ID **Resolution**: If GRC users that have the slash (/) character in their user ID are not getting aggregated during account aggregation, perform the following: 1. Modify the source XML using the following REST API: ```text POST https://{orgName}.api.identitynow.com/cc/api/source/update/{source ID} ``` In the body of the POST, use the form-data as follows: - Key: `grc_delimiter` - Value: `~` You can replace the value with other special characters (for example, \#, $, @, etc.) that are not part of any of the user data fields like FirstName, LastName, UserId, Department, Email, etc. > **Note** > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. 2. Execute an Account aggregation. > **Note** > > This configuration is only application in cases where you're using the `SAILPOIN/SAIL_READ_TABLE` function module. ## Provisioning of SAP profiles fails SAP profiles are aggregated as entitlements during account aggregation if some accounts have standard profiles assigned to them (like SAP\_ALL or A\_ALL). The provisioning for these profiles fails. ```text sailpoint.connector.ConnectorException: Object not found ``` **Resolution**: Import the SAP profiles into the GRC BRM module using the following procedure: 1. In the GRC Portal, go to **Role Mass Maintenance \> Role Import**. 2. In **Role Selection**, select **Technical Role**. 3. In **Import Source**, select **Role Attribute Source** as **File on Desktop** and **Role Authorization** as **Skip**. 4. In **Role Selection Criteria**, in the **Role From** field, enter profile name and set **Methodology Status** to **Complete**. 5. Download the attribute file template. 6. Enter the profile details in the file template. 7. Import the file template. 8. Once you have successfully imported the file then you can provision the profiles. ## System From date is getting updated to today's date when the provisioning plan contains only system To date **Resolution**: Add the following attribute using [Rest API for updating a source]() and then, try modifying the system to date of a user. Key=`updateValidFrom` Value=`true` `updateValidFrom` is a boolean attribute. When this flag is true, the already existing From date (for the system in which the To date has passed) will be fetched for the account and set in the API. If there is no existing FromDate then today's date will be used as the From date. ## Invalid configuration exception during Test Connection **Resolution**: To resolve configuration related errors, try the following: - Verify that the configurations are valid and align with the requirements of your environment. - Ensure the user is active with the correct set of permissions and credentials. ## Unable to find valid certification path to requested target The following error appears: ```text javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target ``` **Resolution**: Follow these steps to resolve the `SSLHandshakeException` error caused by the inability to find a valid certification path: Option 1: 1. Open the URL `https://{host}.com` in a web browser 2. Export the SSL certificate. Follow the wizard's instructions and select the `.cer` format for the exported certificate. 3. Place the exported certificate file under the `/home/sailpoint/certificates` directory on the Virtual Appliance (VA). Option 2 : 1. Login to Virtual Appliance (VA). Run the following command to initiate an SSL/TLS connection: ```text openssl s_client -connect {host}:{port} ``` 2. Once the connection is established, locate the certificate block in the response, which starts with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE-----. Copy the entire certificate content, including the begin and end lines, and save it to a file with a `.cer` extension. 3. Place the exported certificate file under the `/home/sailpoint/certificates` directory on the Virtual Appliance (VA). Restart the CCG service and perform the test connection. ## Development roles are not aggregated; only production roles are aggregated During role or group aggregation, only production roles are returned. Development roles are not aggregated in SailPoint. This is standard behavior of the `GRAC_SEARCH_ROLES` web service. The web service returns roles that have a role status marked as production status in SAP GRC. **Resolution**: To include development roles in aggregation results, enable the development role status as production status in SAP GRC and verify role-level provisioning settings. 1. Go to **SPRO \> SAP Reference IMG \> Governance, Risk and Compliance \> Access Control \> Role Management \> Maintain Role Status**. 2. Select the development role status for your environment (for example, `DEV`). 3. Select the **Production Status** checkbox for the development role status. 4. Save your changes. 5. For each development role you want to aggregate, verify the following in role management: - On the **Role Maintenance** tab, the role status is **Complete** for the current phase. - On the **Provisioning** tab, set **Role Exists** to **Yes**, set **Provisioning Allowed** to **Yes**, and ensure the role is set for production status. 6. Run the role sync job on your SAP GRC system if the role is available in the `GRACRLCONN` and `GRACROLE` tables. 7. Run group or entitlement aggregation again in SailPoint. > [!NOTE] > > SAP typically recommends `PRD` or `PRO` as production role statuses. You can also enable `DEV` or `TST` as production status based on your testing environment requirements. ## skipSystemItem attribute is not honored during Modify operations when user type and company attributes are present During the Modify (Add Entitlement) operation, the `skipSystemItem` attribute is not honored when the `usertype` and `company` attributes are present in the provisioning request. The system gives precedence to these attributes, which prevents it from skipping the SYS request line item as expected. **Resolution**: Add the following entry to the source XML to skip the SYS request line item from the GRC access request during update or modify user operations: ```text ``` > [!NOTE] > > - After this key is added, the connector skips the SYS request line item irrespective of attributes requested for the modify provisioning operation. > - This key is applicable only for update or modify user operations. ## SAP GRC ticket shows a truncated source UUID in Submitted by when Credential Provider is enabled When Credential Provider is enabled on the SAP GRC source, the SAP GRC access request ticket displays a truncated source UUID (for example, `7245aec0899`) in the Submitted by field instead of the configured requester ID (for example, `SAIL_IGA_GRC`). The connector `requesterId` attribute is temporarily overwritten with the source UUID for credential retrieval and is submitted to SAP GRC. **Resolution**: Add the following attributes to the source configuration using SailPoint's REST API so the connector uses a separate static value for the SAP GRC ticket requester when Credential Provider is enabled: ```json [ { "op": "add", "path": "/connectorAttributes/useConfiguredGrcRequesterId", "value": "true" }, { "op": "add", "path": "/connectorAttributes/configuredGrcRequesterId", "value": "{requesterID}" } ] ``` > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. > > `useConfiguredGrcRequesterId` is honored only when Credential Provider is enabled on the source. Otherwise, connector behavior is unchanged. ## Valid from and Valid to dates are not getting set during provisioning operation **Resolution**: Apply the following SAP Notes: - 2970855 :IDM GRC Request creation date: [https://launchpad.support.sap.com/\#/notes/2970855]() - 2958851:2958851 - User Valid from date is not updating correctly: [https://launchpad.support.sap.com/\#/notes/2958851]() ## Group aggregation fails with an error message When running the group aggregation task to aggregate SAP GRC Roles the following error appears: ```text 25 Mar 2021 17:33:50,628 196554352 [QuartzScheduler_Worker-2] ERROR ExecutionMediator [] - Exception while executing request for URL https://urldefense.com/v3/__https://dggdb.absa.co.za:8201/sap/bc/srt/rfc/sap/grac_search_roles_ws/200/grac_search_roles_ws/grac_search_roles_ws__;!!MsNKLpFGsw!b_c3uRmriMN5_S9zF7rZyUtSDGHENCJNtKK_yyuonrPxT_gU5F9qMcQ2_ubmdEQQ$ connector.common.http.exception.HttpException: java.net.SocketTimeoutException: Read timed out ``` **Resolution**: To increase the timeout values, add the `apiTimeout` attribute to the application debug page as follows: ```text ``` ## RequestStatus Map is empty **Resolution**: Add the following to the source configuration using SailPoint's REST API. > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ```xml true ``` ## Group aggregation fails with a read timeout error **Issue:** When running group aggregation, the following error appears: ```text java.net.SocketTimeoutException: Read time out ``` **Resolution:** Configure group aggregation by System or by Connector group. When you enable this option, the connector sends iterative calls for each System or Connector group. This avoids the `TIMEOUT` error. Add the following to the source configuration using SailPoint's REST API. For System: ```text for System OR ``` For Connector Group: ```text ``` > [!NOTE] > > Ensure to have required permission for service account and on /SAILPOIN/CONF table as per the connector permission section. Ensure to have parameter 'apiTimeout' with value 10 and above as per [Timeout Errors and Settings](). This will aggregate roles per system/connector group calls to SAP GRC. ## FireFighterID and Owner Name Are Not in Sync **Resolution**: Ensure that you have added the authorization object to the roles assigned to the user. For more information, refer to [FireFighterID Permissions](). Refer to [Troubleshooting IAG Bridge]() and [Support for Custom Workflow]() for more troubleshooting information. # Support for Custom Workflow The following outlines how the before provisioning rule can be used to modify the provisioning plan (as provisioning is sent out), for a custom workflow use case. ## Before Provisioning Rule - Custom Workflow SailPoint has configured a key named `CustomRequestType` that can be used to provision the custom request type. In the before provisioning rule you can set this key with the request type that you want to be provisioned in SAP. For example, if you want to set `028` in the request type, you will set it by using the following: ```text attrRequest.setName("CustomRequestType"); attrRequest.setOperation(ProvisioningPlan.Operation.Set); attrRequest.setValue("028"); ``` ## Custom Type for Certification If you want to provision the custom request type when a certification is done, use the before provisioning rule to set the `CustomRequestType` key. You can check to see if the request is for certification by using the following line: ```text String source = plan.get("source"); ``` If the source equals certification, you can set the `CustomRequestType` in the attribute request, by using the following: ```text if ("Certification".equals(source)) { log.warn(" Inside Certification "); AttributeRequest attrRequest = new ProvisioningPlan.AttributeRequest(); attrRequest.setName("CustomRequestType"); attrRequest.setOperation(ProvisioningPlan.Operation.Set); attrRequest.setValue("028"); } ``` A Sample provisioning plan for certification after this rule will look like the following: ```xml SELF~~0050568569A01EDB82A956794BCE8C77 SELF~~0050568569A01EDB82AA25091DEECC77 ``` # Timeout Errors and Settings Timeout errors might occur when SailPoint is waiting for a response from the Virtual Appliance (VA). These errors are applicable to all connectors and tend to occur during the setup of sources or when sources are down. This document is designed to give specific information that can be used to resolve these errors. Each timeout attribute has a default time value that is listed in seconds or minutes. Increasing the time value may resolve the error as it will allow for longer communication time between the two systems, thus avoiding the timeout error. > [!IMPORTANT] > > Add the necessary attributes or values before performing the "replace" operation, as missing attributes will cause the operation to fail. To increase the communication time, increase the value of the appropriate timeout attribute. Then submit the change to the VA using the SailPoint REST API. > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ### aggregateTimeout **Description:** This parameter is set for the aggregation timeout, measured in seconds. **Resolution:** Increase the `aggregateTimeout` value gradually to optimize aggregation. Start with 180, then increase to 600, 900, and finally 1800. The maximum value is 3600 seconds. For example: If your current time value is 180 seconds, update the `aggregateTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/aggregateTimeout", "value": 600 } ] ``` ### healthCheckTimeout **Description:** This parameter is set for the test connection and health check timeout. **Resolution:** The default value is 30 seconds. If the timeout error continues, increase the value in 15 second increments and try again. For example: If your current time value is 30 seconds, update the `healthCheckTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/healthCheckTimeout", "value": 45 } ] ``` ### provisioningTimeout **Description:** This parameter is set for provisioning timeout. **Resolution:** Increase the `provisioningTimeout` value gradually to optimize provisioning. Start with 180, then increase to 360, and finally 600. The maximum value is 600 seconds. For example: If your current time value is 180 seconds, update the `provisioningTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/provisioningTimeout", "value": 360 } ] ``` ### timeout **Description:** This parameter is set for pass-through authentication timeout. **Resolution:** The default value is 15 seconds. If the timeout error continues, increase this value in 15 second increments and try again. For example: If your current time value is 15 seconds, update the `timeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/timeout", "value": 30 } ] ``` ### apiTimeout **Description:** This parameter is set for API time tracking; customers can check it using an external tool. **Resolution:** The default value is 60 seconds. If the error continues, increase the value by 15 second increments and try again. For example: If your current time value is 60 seconds, update the `apiTimeout` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/apiTimeout", "value": "75" } ] ``` ### timeoutInSeconds **Description:** This parameter helps prevent the VA from waiting indefinitely for an API response, ensuring efficient handling of API requests. For example: If your current time value is 30 seconds, update the `timeoutInSeconds` attribute as follows: ```json [ { "op": "replace", "path": "/connectorAttributes/timeoutInSeconds", "value": "15" } ] ```