Skip to content

Integrating SailPoint with SAP HR/HCM

Integration

This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

This guide is designed to give specific information about the requirements and field definitions needed to get a working instance of a SAP HR source.

Note

The RFC_READ_TABLE integration function module has been deprecated, and replaced with the ABAP Function module. For more information on configuration, refer to SailPoint Add-On to Replace the Use of RFC_READ_TABLE.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

SailPoint SAP HR/HCM connector supports the following features:

Note

Before you can use any item marked with an asterisk (*), SailPoint must activate the feature for your site. For more information on opening a support ticket, refer to Working With Services.

Account Management

  • Loads SAP HR/HCM employees as accounts (active, terminated, and future hires).
  • *Provisioning (with the help of rule). For more information, refer to the SAP HR Provisioning Modify Rule.
  • Delta aggregation to sync changes from SAP HR.
  • Delete Account

Note

For more information on SailPoint features, refer to Source Features.

The SAP HR source supports the following SAP Info Types:

  • Action (0000)
  • Organizational Assignment (0001)
  • Personal Data (0002)
  • Addresses (0006)
  • Communication (0105)

Supported Managed Systems

The following versions of the SAP HR/HCM systems are supported by the SAP HR/HCM connector:

  • SAP ECC 6.0 on SAP NetWeaver 7.5, 7.4, 7.3, 7.2, 7.1 and 7.0
  • SAP Central Component (ECC) 6.0 with Enhancement package 8 (EHP8)
  • SAP S/4HANA (On-premise)
    • Version 2021 up to FP/SP Stack 05
    • Version 2022 up to FP/SP Stack 04
    • Version 2023 up to FP/SP Stack 02

    • Version 2025 Initial shipment stack

      Note

      Ensure that notes 3634503 and 3653359 are implemented in the SAP S/4HANA 2025 Initial Shipment Stack.

Prerequisites

Important

SailPoint strongly recommends installing the SAP-certified add-on in the SAP environment and then using /SAILPOIN/SAIL_READ_TABLE instead of RFC_READ_TABLE.

  • Configure at least one virtual appliance cluster and successfully test the connection. For instructions, refer to the Virtual Appliance Reference Guide.
  • Create a service account on SAP HR with the Required Permissions.

  • The JCO libraries (JCO Release 3.1.X) must be downloaded from the SAP website by going to the customer service marketplace and downloading the Java Integration Module.

    SAP JCO version 3.1.X libraries, libsapjco3.so (on UNIX), must be present in the java.library.path (WEB-INF/lib) directory on the host. Upload these .jar and .so files on the Basic Configuration page.

    For more information on downloading the .jar files, refer to Obtaining the Custom Connector Files. Ensure these jar files are compatible with the VA.

  • The following ports must be open on the SAP System, where <NN> represents the system number:

    Port Name Service in etc/services Default Range Rule
    SAP Dispatcher sapdp\<NN> 3200 3200-3299 32\<NN>
    Gateway sapgw\<NN> 3300 3300-3399 33\<NN>
    Gateway secured sapgw\<NN>s 4800 4800-4899 48\<NN>

Required Permissions

Note

The RFC_READ_TABLE integration function module has been deprecated, and replaced with the ABAP Function module. For more information on configuration, refer to SailPoint Add-On to Replace the Use of RFC_READ_TABLE.

The following table lists the required permissions for the specific operations mentioned in this section:

Operation Required Permissions
Test Connection Test Connection
Account Aggregation Test Connection and Account Aggregation
Delta Aggregation Test Connection, Account Aggregation, and Delta Aggregation
Provisioning Rule Test Connection, Account Aggregation, and Provisioning Rule

The role assigned to the SAP Administrative user must have the authorization objects as mentioned in the following tables.

Permissions by Operation

Test Connection

Authorization Objects Field Name Field Description Field Value
S_RFC ACTVT Activity 16-Execute
S_RFC RFC_NAME Name of RFC object RFCPING
S_RFC RFC_TYPE Type of RFC object FUGR, FUNC

Account Aggregation

Authorization Objects Field name Field description Field value
S_RFC Activity: 16, RFC_NAME Name of RFC object 0PBAPI0105, BAPI_ADDRESSEMPGETDETAILEDLIST, BAPI_EMPLCOMM_GETDETAILEDLIST, BAPI_EMPLOYEE_GETDATA, BAPI_EMPLOYEE_GETLIST, BAPI_PERSDATA_GETLIST, MSS_GET_SY_DATE_TIME, BAPI_PERSDATA_GETDETAIL, RFC_READ_TABLE, SMSSDATA1, PERS,PADR,RFC_GET_FUNCTION_INTERFACE, DDIF_FIELDINFO_GET, BAPI_COMPANYCODE_GETDETAIL, 0002, RFC_METADATA_GET
S_TABU_DIS ACTVT Activity 03 Display
S_TABU_DIS DICBERCLS DICBERCLS FC01
S_TABU_NAM ACTVT Activity 03 Display
S_TABU_NAM TABLE Name TABLE HRP1001, HRP1000, PA0000, PA0001, PA0002
T530T, T529T - Only add these table names if you want to populate the following account schema attributes:
- Infotype0000 (for older SAP HR sources)
- Infotype0000JSON (for recently set up SAP HR sources)
PA0006, PA0105 - Add these tables if the Delta Aggregation Enabled checkbox is selected.
P_Orgin AUTHC Authorization Level R
P_Orgin INFTY INFOTYPE 0001, 0002, 0003, 0006, 0032, 0105
P_Orgin PERSA Personal area (Depending on the organizational area you have assigned to user while creating)
P_Orgin PERSG Employee group (Depending on the organizational area you have assigned to user while creating)
P_Orgin SUBTYPE SUBTY * - If you want to get data for all the subtypes. If you want to get data for specific info types, then add specific subtypes as per data in your environment. For example: for Addresses (Infotype 0006) add subtype - 1,2,3,4,5,6; for Communication (Infotype 0105) add subtype - 0001,0010, 0020, 0030
P_Orgin PERSK Employee subgroup (Depending on the organizational area you have assigned to user while creating)
P_Orgin VDSK1 Organization Key (Depending on the organizational area you have assigned to user while creating)

Note

Based on the option selected in the Connections > Function Module Configuration > Name dropdown, select one of the following options.

  • RFC_READ_TABLE

    Note

    SailPoint will continue to support the RFC_READ_TABLE in accordance with our depreciation policies. SailPoint recommends that you start planning to move to use SailPoint's Function Module.

  • /SAILPOIN/SAIL_READ_TABLE_LEG

    Add this permission to use SailPoint's Function Module over RFC_READ_TABLE if your SAP_BASIS version is 740, Support Package 08, up to BASIS 750.

  • /SAILPOIN/SAIL_READ_TABLE

    Add this permission to use SailPoint's Function Module over RFC_READ_TABLE if your SAP_BASIS version is 751 and later.

    Note

    /SAILPOIN/SAIL_READ_TABLE_LEG and /SAILPOIN/SAIL_READ_TABLE fully replace the RFC_READ_TABLE module. Update the service account permissions to configure the function module in your SAP environment.

    You do not have to assign permissions for RFC_READ_TABLE once you configure it for /SAILPOIN/SAIL_READ_TABLE_LEG or /SAILPOIN/SAIL_READ_TABLE. For more information, refer to SailPoint Add-On to Replace the Use of RFC_READ_TABLE.

Provisioning Rule Permissions

The administrator permissions mentioned in the following table are only applicable to the provisioning operations specified in the Example SAP HRMS Modify Rule (email, phone number, and system user name) rule.

Authorization Objects Field name Field description Field value
S_RFC RFC_NAME Name of RFC object RFC1, 1065, BAPI_EMPLOYEE_ENQUEU, SYSU, SYSTEM_RESET_RFC_SERVER, SDIFRUNTIME, BAPI_EMPLCOMM_CHANGE, BAPI_EMPLCOMM_CREATE
P_Orgin AUTHC Authorization Level E, S, W

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.