# Connecting SailPoint and SAP HR/HCM To connect SailPoint with SAP HR/HCM, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. > [!IMPORTANT] > > By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration. **To configure a new source:** 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Configure**. 5. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 6. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 7. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 8. Under **Connection Type**, select **Direct Connection** or **Flat File**. - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](). - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable. 9. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source. 10. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 11. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 12. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](). 4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 8. Drag and drop the required files into the **Upload Files** box, or upload them from your computer. > **Warning** > > Ensure that the file you upload is not vulnerable or malicious. Upload the `sapjco3.jar` and `libsapjco3.so` files. Download the JCO libraries (JCO Release 3.1.x) from the SAP customer service marketplace. 9. Select **Save**. ## Connection Settings Provide the information required to connect and interact with the source. > [!NOTE] > > **Screenshot** > > [![Connection Settings]()]() 1. Enter the **User Name** (service account) and **Password** for making the connection to the SAP server. 2. In **Host**, enter the SAP connection string on which the SAP server is running. For example, H/router/S/3299/backend/3246 3. Enter the two-digit SAP **System Number**. The default is 00. 4. Enter the three-digit **Client Number**. The default is 001 5. Enter the two-letter language code for the SAP **Client Language**. If SAP has been patched to SP 17 or later, change the client language to a single character. For example, if the client language is `EN`, change it to `E`. For more information on the One Character Code for Language, refer to the [SAP KB article](). 6. Select the **Name** of the function module configuration as per your SAP Basis version. Select **/SAILPOIN/SAIL\_READ\_TABLE** for SAP Basis version 751 and later, or **/SAILPOIN/SAIL\_READ\_TABLE\_LEG** for SAP Basis version 740, Support Package 08 and later. For more information on configuring SailPoint's replacement for the RFC\_READ\_TABLE, refer to [SailPoint Add-On to replace the use of RFC\_READ\_TABLE](). 7. Select **Save**. ## Aggregation Settings For more information about aggregation, refer to [Loading Account Data](). Provide the settings for your aggregation. The SAP HR source supports aggregation of the following SAP Info Types: - Action (0000) - Organizational Assignment (0001) - Personal Data (0002) - Addresses (0006) - Communication (0105) - PersonalIDExternal (0709) > [!NOTE] > > - To add the `Person External ID` attribute, you must configure it on the managed target system. > - You can use Custom BAPI for additional attributes to support aggregation of the additional info types. For more information, refer to [Additional Settings](<#additional-settings>). For the SAP HR source there are two important attributes based on which the aggregation is executed: - Employee Number: This is a personnel number which is used to uniquely identify an employee in SAP. This number is system generated and is assigned to an employee during the hiring process. Previously, the aggregation was based on the employee number for the SAP HR source. - Central Person ID: The central person identity links an employee to a business partner. For each employee, a central person is created and linked to the employee. Then, a business partner is created for the central person. In a global employment/ job assignment environment, an employee may potentially have multiple personnel numbers assigned to them with every personnel number linked to the same central person identity. Now, the aggregation is based on the Central Person ID. > [!NOTE] > > **Screenshot** > > [![Aggregation Settings]()]() 1. Enter the **Future Dated Hired Offset (In Days)** to aggregate all future hires within the specified day range. You can enter the following values for the offset: - **0** - The system does not aggregate future hires. - **Blank** - The system aggregates all future hires until 9999-12-31. - **Any Positive Value** - The system aggregates all future hires within the specified number of days. 2. Enable **Aggregate Inactive Employees** to aggregate inactive employees. 3. Enter the **Termination Offset (In Days)** to aggregate all inactive employees within the specified day range. This option is only available if you enable **Aggregate Inactive Employees**. You can enter the following values for the offset: - **0** - The system only aggregates active employees. - **Blank** - The system aggregates all inactive employees. - **Any positive value** - The system aggregates all inactive employees within the specified number of days (in the past) since the terminations. 4. Select the **Manager Relationship Model** by selecting one the of radio buttons. - **Organization Chief Manager Model (O-O-S-P)** - Organization(O)-Organization(O)-Position(S)-Person(P) - (O-O-S-P) Model. This model deals with the chief of organization model wherein the employee's relation between position of employee and organization unit is detected with the relationship code 012. - **Supervisory Model (S-S)** - Position(S)-Position(S) - (S-S) Model. This model deals with the position-position manager relationship model wherein the two positions are connected with the relationship code 002. 5. Enter the **Page Size** to specify the number of records fetched per page for your function module configuration. The default is 500. > **Note** > > This field is only applicable if you have selected the **/SAILPOIN/SAIL\_READ\_TABLE** or **/SAILPOIN/SAIL\_READ\_TABLE\_LEG** on the **Connection Settings** page. 6. Select **Save**. ### Configuring the Plan Version A *plan version* (`PLVAR`) represents a specific scenario or subset in which the SAP HR system creates organizational data. The SAP HR connector uses plan version `01` by default during aggregation queries. **To configure a custom plan version:** 1. Send a `PATCH` request to update the SAP HR source: ```text PATCH https://{orgName}.api.identitynow.com/v3/sources/{SAPHRSourceId} ``` 2. Add the `planVersion` attribute to `connectorAttributes` in the request body. Use the `planVersion` attribute to set the SAP HR plan version (`PLVAR`) for aggregation queries. When you set this attribute, the connector uses your value instead of the default `01`. Example: To use plan version `Z1`, include the following in the request body: > [!NOTE] > > For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication]() and [REST API - Update Source (Partial)]() in the SailPoint Developer Community. ```json [ { "op": "add", "path": "/connectorAttributes/planVersion", "value": "Z1" } ] ``` ## Additional Settings Use the additional settings to configure delta aggregation and BAPI aggregation settings. > [!NOTE] > > **Screenshot** > > [![Delta Aggregation and Action Types]()]() To configure Delta Aggregation and Action Types, complete the following: 1. Enable **Delta Aggregation** to aggregate accounts that have changed since the last execution. Delta aggregation supports the following features: - All changes in the Effective Dates attribute of the employee already aggregated. - Any changes for the employment status (STAT2) of the employee already aggregated. - Any changes in the following employee attributes: - Organization data - Communication details - Personal data - Address information data - Supervisor Changes: If the supervisor has modified the organization structure using the Info Type 0001-Org Assignment (Cost Centre or Position) from the SAP HR/HCM system, the SAP HR source also aggregates the employees directly reporting to the supervisor. 2. Enter the comma-separated value of **Action Types** to be aggregated for each SAP HR entity. It is aggregated as part of the `Infotype0000JSON` schema attribute. For more information, refer to [Infotype0000JSON](). 3. Select **Save**. ### Custom BAPI Configuration > [!NOTE] > > **Screenshot** > > [![BAPI Settings]()]() You can configure a custom BAPI (Business Application Programming Interface) invocation for the SAP HR source. You must write the code based on your requirement for the custom BAPI, and the SAP HR source invokes that code accordingly. The custom BAPI input and output parameters must be based on the guidelines as specified below. There are two types of BAPI: - Custom BAPI for Aggregation - To aggregate the filtered list of employees from the SAP HR system. - Custom BAPI for Additional Attributes - To aggregate the additional attributes or overwrite the values for standard attributes returned by the source, as required. > [!NOTE] > > For more information on aggregating custom BAPI and custom BAPI for additional attributes, refer to [Support for Custom BAPI Invocation](). To configure BAPI for aggregation processes: 1. Enter an **Aggregate Filter BAPI** to aggregate the filtered list of employees from the SAP HR system. The aggregate filter BAPI has the following four input attributes. The values of these attributes will be determined from the values specified in the source configuration: - Status - Termination Offset - Future Offset - Mode of Aggregation 2. To pass more input parameters to a BAPI in addition to the mandatory ones, define them in **Custom Parameter for Aggregation Filter BAPI**. For example, if you need to filter data by `KOSTL` (Cost Center) from the CSKS table (Cost Center Master Data), include `KOSTL` as a key and specify the corresponding value in a key-value pair. For more information, refer to [Input and Output Parameters for BAPI](). > **Note** > > Ensure that `KOSTL` is defined as a component within the input structure of the custom BAPI. Additionally, the BAPI should contain logic to filter accounts based on the provided key and value. Select **Add Another** to add more entries. > **Warning** > > Depending on your Custom BAPI code in the SAP HR/HCM source, other additional permissions need to be provided and should be finalized before testing. 3. In the **Additional Attribute BAPI** field, specify the name of the custom BAPI. All of the additional attributes returned from the custom BAPI must be manually added to the schema. 4. If you need to pass additional input parameters to the Additional Attribute BAPI, enter a **Custom Parameter For Additional Attribute BAPI** as a key-value pair. For example, you can use the custom parameter for additional attribute BAPI to add the following: - A Manager with the value as "John" (`name`). Here, `Manager` should be a field of the EMPLOYEE\_DETAILS structure in the `additionalAttrBAPI` list. - The attribute, `schema.title` whose the value is `name`. Here, `title` is the default schema attribute and the value is `name`, which is a corresponding field of the EMPLOYEE\_DETAILS structure in `additionalAttrBAPI`. The attribute, `name` is mapped with the value of `title` at run time and passed as the input parameter of `additionalAttrBAPI`. > **Note** > > All additional attributes must be added manually in the SAP HR/HCM source schema. These attributes must have the same name as that of the fields returned from the BAPI. Select **Add Another** to add more entries. 5. Select **Save**. > [!NOTE] > > If there is an error in the custom BAPI invocation, use **Exceptions To Ignore** to troubleshoot. Add an entry by entering your exception, then press Enter to add it to a rolling list. ## Advanced Settings Use the advanced settings tab to configure the load balancer, communication settings, and SAP Secure Network Communication (SNC). ### Load Balancer Configuration > [!NOTE] > > **Screenshot** > > [![Load Balancer Configuration]()]() 1. Enable Load Balancer to enable the feature and display additional configuration for load balancing with the source. 2. Enter the SAP message server's hostname or IP address in **Host**. 3. Enter the SAP message server's logon group name in **Client Group**. 4. Enter the SAP message server's port number or logical name in **Port Number**. ### Communication Configuration > [!NOTE] > > **Screenshot** > > [![Communication Configuration]()]() 1. Enter valid mapping for the **Subtype Code** and the **Name of Communication type** fields to aggregate attributes during account aggregation and single account aggregation processes. The mapping should match the Subtype codes and their associated communication type names in the SAP managed system. Expand the following screenshot for an example of subtype codes (**STyp**) and their associated communication type names (**Name**) in the SAP managed system, and then a sample mapping of the codes in SailPoint. > **Screenshot** > > **Subtype Codes in the SAP Managed System** > > [![Subtype Codes in the SAP Managed System]()]() > > **Corresponding configuration in SailPoint** > > [![Corresponding configuration in SailPoint]()]() > **Note** > > If the SAP tables have different subtype codes values, you must update the value for each subtype accordingly. 2. Select **Save**. ### Secure Network Communication Configure SAP Secure Network Communication (SNC) to protect the logical link between the end points during communication. > [!IMPORTANT] > > For prerequisite information, refer to [SAP Secure Network Communication (SNC) For SAP Source]() in the Compass community. > [!NOTE] > > **Screenshot** > > [![Secure Network Communication]()]() 1. Select **SNC Mode** to enable the feature. 2. Select a **Level of Security** to define the Quality of Protection (QOP) level. In the SAP source, this settings relates to `jco.client.snc_qop`. 3. In the **SNC Partner Name** field, enter the SNC Name of the SAP Application Server. If SNC is configured in the SAP source, this setting relates to `jco.client.snc_partnername`. For example, `p:CN=R3, O=XYZ-INC, C=EN`. 4. In the **SNC Name** field, enter a unique name to internally identify the source. In the SAP source, this setting relates to `jco.client.snc_myname`. 5. In the **SNC Library** field, enter the path to the library that provides the SNC service in SNC Library Path. In the SAP source, this setting relates to `jco.client.snc_lib`. 6. Select **Save**. ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation.