# Integrating SailPoint with SAP HR/HCM

> [!NOTE]
>
> **Integration**
>
> This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

This guide is designed to give specific information about the requirements and field definitions needed to get a working instance of a SAP HR source.

> [!NOTE]
>
> The RFC\_READ\_TABLE integration function module has been deprecated, and replaced with the ABAP Function module. For more information on configuration, refer to [SailPoint Add-On to Replace the Use of RFC\_READ\_TABLE](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/sailpoint_add_on.html>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

SailPoint SAP HR/HCM connector supports the following features:

> [!NOTE]
>
> Before you can use any item marked with an asterisk (\*), SailPoint must activate the feature for your site. For more information on opening a support ticket, refer to [Working With Services](<https://community.sailpoint.com/knowledge/collection/working-with-services>).

### Account Management

- Loads SAP HR/HCM employees as accounts (active, terminated, and future hires).
- \*Provisioning (with the help of rule). For more information, refer to the [SAP HR Provisioning Modify Rule](<https://community.sailpoint.com/knowledge/IdentityNow-Rule-Guide-SAP-HR-Provisioning-Modify-Rule>).
- Delta aggregation to sync changes from SAP HR.
- Delete Account

> [!NOTE]
>
> For more information on SailPoint features, refer to [Source Features](<https://community.sailpoint.com/knowledge/Identity-Security-Cloud-Source-Features>).

The SAP HR source supports the following SAP Info Types:

- Action (0000)
- Organizational Assignment (0001)
- Personal Data (0002)
- Addresses (0006)
- Communication (0105)

## Supported Managed Systems

The following versions of the SAP HR/HCM systems are supported by the SAP HR/HCM connector:

- SAP ECC 6.0 on SAP NetWeaver 7.5, 7.4, 7.3, 7.2, 7.1 and 7.0
- SAP Central Component (ECC) 6.0 with Enhancement package 8 (EHP8)
- SAP S/4HANA (On-premise)

  - Version 2021 up to FP/SP Stack 05
  - Version 2022 up to FP/SP Stack 04
  - Version 2023 up to FP/SP Stack 02
  - Version 2025 Initial shipment stack

    > **Note**
    >
    > Ensure that notes 3634503 and 3653359 are implemented in the SAP S/4HANA 2025 Initial Shipment Stack.

## Prerequisites

> [!IMPORTANT]
>
> SailPoint strongly recommends installing the SAP-certified add-on in the SAP environment and then using /SAILPOIN/SAIL\_READ\_TABLE instead of RFC\_READ\_TABLE.

- Configure at least one virtual appliance cluster and successfully test the connection. For instructions, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
- Create a service account on SAP HR with the [Required Permissions](<#required-permissions>).
- The JCO libraries (JCO Release 3.1.X) must be downloaded from the SAP website by going to the customer service marketplace and downloading the Java Integration Module.

  SAP JCO version 3.1.X libraries, `libsapjco3.so` (on UNIX), must be present in the `java.library.path` (*WEB-INF/lib*) directory on the host. Upload these `.jar` and `.so` files on the Basic Configuration page.

  For more information on downloading the `.jar` files, refer to [Obtaining the Custom Connector Files](<https://community.sailpoint.com/knowledge/Obtaining-the-Custom-Connector-Files-Required-for-SAP-and-SAP-HR>). Ensure these jar files are compatible with the VA.
- The following ports must be open on the SAP System, where `<NN>` represents the system number:

  | Port Name | Service in `etc/services` | Default | Range | Rule |
  | --- | --- | --- | --- | --- |
  | SAP Dispatcher | sapdp\\\<NN\> | 3200 | 3200-3299 | 32\\\<NN\> |
  | Gateway | sapgw\\\<NN\> | 3300 | 3300-3399 | 33\\\<NN\> |
  | Gateway secured | sapgw\\\<NN\>s | 4800 | 4800-4899 | 48\\\<NN\> |

## Required Permissions

> [!NOTE]
>
> The RFC\_READ\_TABLE integration function module has been deprecated, and replaced with the ABAP Function module. For more information on configuration, refer to [SailPoint Add-On to Replace the Use of RFC\_READ\_TABLE](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/sailpoint_add_on.html>).

The following table lists the required permissions for the specific operations mentioned in this section:

| Operation | Required Permissions |
| --- | --- |
| Test Connection | [Test Connection](<#test-connection>) |
| Account Aggregation | [Test Connection](<#test-connection>) and [Account Aggregation](<#account-aggregation>) |
| Delta Aggregation | [Test Connection](<#test-connection>), [Account Aggregation](<#account-aggregation>), and Delta Aggregation |
| Provisioning Rule | [Test Connection](<#test-connection>), [Account Aggregation](<#account-aggregation>), and [Provisioning Rule](<#provisioning-rule-permissions>) |

The role assigned to the SAP Administrative user must have the authorization objects as mentioned in the following tables.

### Permissions by Operation

#### Test Connection

| Authorization Objects | Field Name | Field Description | Field Value |
| --- | --- | --- | --- |
| S\_RFC | ACTVT | Activity | 16-Execute |
| S\_RFC | RFC\_NAME | Name of RFC object | RFCPING |
| S\_RFC | RFC\_TYPE | Type of RFC object | FUGR, FUNC |

#### Account Aggregation

| Authorization Objects | Field name | Field description | Field value |
| --- | --- | --- | --- |
| S\_RFC | Activity: 16, RFC\_NAME | Name of RFC object | 0PBAPI0105, BAPI\_ADDRESSEMPGETDETAILEDLIST, BAPI\_EMPLCOMM\_GETDETAILEDLIST, BAPI\_EMPLOYEE\_GETDATA, BAPI\_EMPLOYEE\_GETLIST, BAPI\_PERSDATA\_GETLIST, MSS\_GET\_SY\_DATE\_TIME, BAPI\_PERSDATA\_GETDETAIL, RFC\_READ\_TABLE, SMSSDATA1, PERS,PADR,RFC\_GET\_FUNCTION\_INTERFACE, DDIF\_FIELDINFO\_GET, BAPI\_COMPANYCODE\_GETDETAIL, 0002, RFC\_METADATA\_GET |
| S\_TABU\_DIS | ACTVT | Activity | 03 Display |
| S\_TABU\_DIS | DICBERCLS | DICBERCLS | FC01 |
| S\_TABU\_NAM | ACTVT | Activity | 03 Display |
| S\_TABU\_NAM | TABLE Name | TABLE | HRP1001, HRP1000, PA0000, PA0001, PA0002<br>T530T, T529T - Only add these table names if you want to populate the following account schema attributes:<br>\- Infotype0000 (for older SAP HR sources)<br>\- Infotype0000JSON (for recently set up SAP HR sources)<br>PA0006, PA0105 - Add these tables if the **Delta Aggregation Enabled** checkbox is selected. |
| P\_Orgin | AUTHC | Authorization Level | R |
| P\_Orgin | INFTY | INFOTYPE | 0001, 0002, 0003, 0006, 0032, 0105 |
| P\_Orgin | PERSA | Personal area | (Depending on the organizational area you have assigned to user while creating) |
| P\_Orgin | PERSG | Employee group | (Depending on the organizational area you have assigned to user while creating) |
| P\_Orgin | SUBTYPE | SUBTY | `*` - If you want to get data for all the subtypes. If you want to get data for specific info types, then add specific subtypes as per data in your environment. For example: for Addresses (Infotype 0006) add subtype - 1,2,3,4,5,6; for Communication (Infotype 0105) add subtype - 0001,0010, 0020, 0030 |
| P\_Orgin | PERSK | Employee subgroup | (Depending on the organizational area you have assigned to user while creating) |
| P\_Orgin | VDSK1 | Organization Key | (Depending on the organizational area you have assigned to user while creating) |

> [!NOTE]
>
> Based on the option selected in the **Connections \> Function Module Configuration \> Name** dropdown, select one of the following options.
>
> - RFC\_READ\_TABLE
>
>   > **Note**
>   >
>   > SailPoint will continue to support the RFC\_READ\_TABLE in accordance with our depreciation policies. SailPoint recommends that you start planning to move to use SailPoint's Function Module.
> - /SAILPOIN/SAIL\_READ\_TABLE\_LEG
>
>   Add this permission to use SailPoint's Function Module over RFC\_READ\_TABLE if your SAP\_BASIS version is 740, Support Package 08, up to BASIS 750.
> - /SAILPOIN/SAIL\_READ\_TABLE
>
>   Add this permission to use SailPoint's Function Module over RFC\_READ\_TABLE if your SAP\_BASIS version is 751 and later.
>
>   > **Note**
>   >
>   > /SAILPOIN/SAIL\_READ\_TABLE\_LEG and /SAILPOIN/SAIL\_READ\_TABLE fully replace the RFC\_READ\_TABLE module. Update the service account permissions to configure the function module in your SAP environment.
>   >
>   > You do not have to assign permissions for RFC\_READ\_TABLE once you configure it for /SAILPOIN/SAIL\_READ\_TABLE\_LEG or /SAILPOIN/SAIL\_READ\_TABLE. For more information, refer to [SailPoint Add-On to Replace the Use of RFC\_READ\_TABLE](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/sailpoint_add_on.html>).

#### Provisioning Rule Permissions

The administrator permissions mentioned in the following table are only applicable to the provisioning operations specified in the **Example SAP HRMS Modify Rule** (email, phone number, and system user name) rule.

| Authorization Objects | Field name | Field description | Field value |
| --- | --- | --- | --- |
| S\_RFC | RFC\_NAME | Name of RFC object | RFC1, 1065, BAPI\_EMPLOYEE\_ENQUEU, SYSU, SYSTEM\_RESET\_RFC\_SERVER, SDIFRUNTIME, BAPI\_EMPLCOMM\_CHANGE, BAPI\_EMPLCOMM\_CREATE |
| P\_Orgin | AUTHC | Authorization Level | E, S, W |