# Provisioning

The SAP HANA connector supports provisioning, allowing you to create and manage accounts and entitlements in SAP HANA directly from SailPoint.

**Prerequisite:** Your system is configured for provisioning.

When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*.

When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.

For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.

> [!IMPORTANT]
>
> This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.

## Default Create Account Attributes

| Account Attribute | Generator | Description |
| --- | --- | --- |
| USER\_NAME | Generator | The name of the user that needs to be created. |
| password | Generator | The password of the user. |
| FORCE\_PWD\_CHG\_ON\_NEXT\_LOGON | Disable | Enable this attribute if the user must be requested to change their password at the next login. |
| IS\_RESTRICTED | Disable | Enable this attribute to create a restricted user. |

### Additional Attributes

The SAP HANA Source supports the following additional attributes:

| Account Attribute | Generator | Description |
| --- | --- | --- |
| Disable Password | Static | Sets the password in 'disable' mode. By default, the value is false. |
| Email Address | Identity Attribute | The email address. It is mapped to the Work Email of the user. |
| Time Zone | Disable | The time zone of the user. |
| Valid From | Disable | The date/time from when the user account is valid. |
| Valid Until | Disable | The date/time until when the user account is valid. |

### Supported Entitlement Attributes

The SAP HANA source supports the following entitlement attributes while creating or updating an account:

- CATALOG\_ROLES
- REPOSITORY\_ROLES
- SYSTEM\_PRIVILEGES
- APPLICATION\_PRIVILEGES

The SAP HANA source does not aggregate and display as CATALOG\_ROLES. The roles are granted to a user in all the schema in the native HANA system (when the role exists in all the schema), however, it is granted to the user in one schema in the native HANA.

### Force Password Change On Next Logon

> [!NOTE]
>
> **Force Password Change On Next Logon** is set to YES when the service account is used to create an account. **Force Password Change On Next Logon** can be set to NO only when the Admin account is used as the service account for SAP HANA. The Service account must have the privilege **AUDIT ADMIN** to make these changes.

- Set the value to **Yes**, if the user must be requested to change their password at next login.
- If the **Force Password Change On Next Logon** flag is not specified in the provisioning plan, then the password mode (permanent or temporarily) is dependent on the SAP HANA security policy.
- To set the value to **No**, the following configurations must be made on the SAP HANA managed system.

  1. Sign in to the SAP HANA studio as the System User.
  2. Right-click on **Security** to open the security console.
  3. Select the **Password Policy** tab.
  4. Uncheck the option for **User must change password at first logon**.

### Kerberos Authentication

> [!NOTE]
>
> Kerberos authentication is not supported when using SAP HANA Cloud database.

| Attribute Name | Description |
| --- | --- |
| IS\_KERBEROS\_ENABLED | Specifies whether Kerberos authentication is enabled for a user as true or false. |
| External ID for Kerberos | Specifies the external identifier for Kerberos authentication. |

### SAML Authentication

| Attribute Name | Description |
| --- | --- |
| Identity Provider Name | Specifies the SAML identity provider name. |
| External ID for SAML | Specifies the external identifier for SAML authentication. |

#### SAML Providers List

Use this field to create an account with multiple SAML identity providers for a user. Enter the SAML Provider names along with their external identifiers in the format: `Provider::ExternalIdentifier`.

To provide multiple values, separate them with a comma. For example, `SAML_PROVIDER1::XS1,SAML_PROVIDER2::XS1`

> [!NOTE]
>
> If this field is used during the provisioning flow, it will take priority over the `SAML Identity Provider Name` and `External ID`.

### JWT Authentication

#### IS\_JWT\_ENABLED

Boolean that enables JWT authentication for the user.

> [!NOTE]
>
> If this attribute is set to `true` during Create Account operations, the connector updates the `JWT_USER_MAPPINGS` table with the corresponding `JWT_PROVIDERS` values. If the attribute is set to `false`, the connector doesn't perform any updates to the `JWT_USER_MAPPINGS` table.

#### JWT\_PROVIDERS

Provide the `JWT_PROVIDERS` attribute value in the following format:

Defines the list of JWT providers along with each of the external identifiers each one uses in the following format:

`<jwt_provider>::<external_identifier>`

If there are multiple providers, separate each one with a comma (`,`).

For example:

`MY_JWT_PROVIDER1::external1,MY_JWT_PROVIDER2::external2`

> [!NOTE]
>
> During Update operations, `JWT_PROVIDERS` takes precedence before `IS_JWT_ENABLED`.

For information on provisioning custom parameters, refer to [Custom User Parameters](<https://documentation.sailpoint.com/connectors/sap/hana/va/help/schema.html#custom-user-parameters>).

Once you have added the custom parameter to your account schema you can update the parameter value in your provisioning policy. The technical name for the field should be the same as the name of the parameter to be provisioned along with the `PARAM:` prefix (this must be in all capital letters) to mark it as a parameter.

> [!NOTE]
>
> Ensure the attribute name (except the prefix `PARAM:`) matches the case of the parameter name in the database without any unwanted leading or trailing spaces.

The SAP HANA connector supports provisioning of only the following attributes:

> [!NOTE]
>
> The SAP HANA connector supports the provisioning of users having Kerberos and SAML 2.0 authentication along with password authentication mechanism. For more information on using Kerberos and SAML 2.0 authentication, refer to [Additional Authentication Resources](<https://documentation.sailpoint.com/connectors/sap/hana/va/help/connecting.html#additional-authentication-resources>).

### Create and Update Operation Only

Entitlement Attributes

- APPLICATION\_PRIVILEGES
- CATALOG\_ROLES
- REPOSITORY\_ROLES
- SYSTEM\_PRIVILEGES

### Update Operation

Account Attributes

- EMAIL\_ADDRESS
- TIME\_ZONE
- VALID\_FROM
- VALID\_UNTIL
- DISABLE\_PASSWORD
- IS\_RESTRICTED
- IS\_CLIENT\_CONNECT\_ENABLED
- EXTERNAL\_IDENTITY\_KERBEROS
- SAML\_PROVIDER
- SAML\_PROVIDERS
- EXTERNAL\_IDENTITY\_SAML