Provisioning
The SAP HANA connector supports provisioning, allowing you to create and manage accounts and entitlements in SAP HANA directly from SailPoint.
Prerequisite: Your system is configured for provisioning.
When SailPoint provisions new accounts to the source, it uses the attributes on the Create Account page as instructions or a template for what to include in the account. This page is also referred to as the provisioning policy.
When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.
For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.
Important
This section describes the default Create Account configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.
Default Create Account Attributes
| Account Attribute | Generator | Description |
|---|---|---|
| USER_NAME | Generator | The name of the user that needs to be created. |
| password | Generator | The password of the user. |
| FORCE_PWD_CHG_ON_NEXT_LOGON | Disable | Enable this attribute if the user must be requested to change their password at the next login. |
| IS_RESTRICTED | Disable | Enable this attribute to create a restricted user. |
Additional Attributes
The SAP HANA Source supports the following additional attributes:
| Account Attribute | Generator | Description |
|---|---|---|
| Disable Password | Static | Sets the password in 'disable' mode. By default, the value is false. |
| Email Address | Identity Attribute | The email address. It is mapped to the Work Email of the user. |
| Time Zone | Disable | The time zone of the user. |
| Valid From | Disable | The date/time from when the user account is valid. |
| Valid Until | Disable | The date/time until when the user account is valid. |
Supported Entitlement Attributes
The SAP HANA source supports the following entitlement attributes while creating or updating an account:
- CATALOG_ROLES
- REPOSITORY_ROLES
- SYSTEM_PRIVILEGES
- APPLICATION_PRIVILEGES
The SAP HANA source does not aggregate and display as CATALOG_ROLES. The roles are granted to a user in all the schema in the native HANA system (when the role exists in all the schema), however, it is granted to the user in one schema in the native HANA.
Force Password Change On Next Logon
Note
Force Password Change On Next Logon is set to YES when the service account is used to create an account. Force Password Change On Next Logon can be set to NO only when the Admin account is used as the service account for SAP HANA. The Service account must have the privilege AUDIT ADMIN to make these changes.
- Set the value to Yes, if the user must be requested to change their password at next login.
-
If the Force Password Change On Next Logon flag is not specified in the provisioning plan, then the password mode (permanent or temporarily) is dependent on the SAP HANA security policy.
-
To set the value to No, the following configurations must be made on the SAP HANA managed system.
- Sign in to the SAP HANA studio as the System User.
- Right-click on Security to open the security console.
- Select the Password Policy tab.
- Uncheck the option for User must change password at first logon.
Kerberos Authentication
Note
Kerberos authentication is not supported when using SAP HANA Cloud database.
| Attribute Name | Description |
|---|---|
| IS_KERBEROS_ENABLED | Specifies whether Kerberos authentication is enabled for a user as true or false. |
| External ID for Kerberos | Specifies the external identifier for Kerberos authentication. |
SAML Authentication
| Attribute Name | Description |
|---|---|
| Identity Provider Name | Specifies the SAML identity provider name. |
| External ID for SAML | Specifies the external identifier for SAML authentication. |
SAML Providers List
Use this field to create an account with multiple SAML identity providers for a user. Enter the SAML Provider names along with their external identifiers in the format: Provider::ExternalIdentifier.
To provide multiple values, separate them with a comma. For example, SAML_PROVIDER1::XS1,SAML_PROVIDER2::XS1
Note
If this field is used during the provisioning flow, it will take priority over the SAML Identity Provider Name and External ID.
JWT Authentication
IS_JWT_ENABLED
Boolean that enables JWT authentication for the user.
Note
If this attribute is set to true during Create Account operations, the connector updates the JWT_USER_MAPPINGS table with the corresponding JWT_PROVIDERS values. If the attribute is set to false, the connector doesn't perform any updates to the JWT_USER_MAPPINGS table.
JWT_PROVIDERS
Provide the JWT_PROVIDERS attribute value in the following format:
Defines the list of JWT providers along with each of the external identifiers each one uses in the following format:
<jwt_provider>::<external_identifier>
If there are multiple providers, separate each one with a comma (,).
For example:
MY_JWT_PROVIDER1::external1,MY_JWT_PROVIDER2::external2
Note
During Update operations, JWT_PROVIDERS takes precedence before IS_JWT_ENABLED.
For information on provisioning custom parameters, refer to Custom User Parameters.
Once you have added the custom parameter to your account schema you can update the parameter value in your provisioning policy. The technical name for the field should be the same as the name of the parameter to be provisioned along with the PARAM: prefix (this must be in all capital letters) to mark it as a parameter.
Note
Ensure the attribute name (except the prefix PARAM:) matches the case of the parameter name in the database without any unwanted leading or trailing spaces.
The SAP HANA connector supports provisioning of only the following attributes:
Note
The SAP HANA connector supports the provisioning of users having Kerberos and SAML 2.0 authentication along with password authentication mechanism. For more information on using Kerberos and SAML 2.0 authentication, refer to Additional Authentication Resources.
Create and Update Operation Only
Entitlement Attributes
- APPLICATION_PRIVILEGES
- CATALOG_ROLES
- REPOSITORY_ROLES
- SYSTEM_PRIVILEGES
Update Operation
Account Attributes
- EMAIL_ADDRESS
- TIME_ZONE
- VALID_FROM
- VALID_UNTIL
- DISABLE_PASSWORD
- IS_RESTRICTED
- IS_CLIENT_CONNECT_ENABLED
- EXTERNAL_IDENTITY_KERBEROS
- SAML_PROVIDER
- SAML_PROVIDERS
- EXTERNAL_IDENTITY_SAML
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.