# SailPoint SAP HR/HCM Connector Documentation

> SAP HR/HCM Connector Documentation

# Documentation

# Additional Information

This section describes the additional information related to the SAP HR/HCM source.

## Support for Central Person ID As Default Identity Attribute

The SAP HR source aggregation is improved when the Central Person ID is set as the default identity attribute for the SAP HR source. The SAP HR source supports the Central Person ID as the default Identity Attribute for new sources. For existing and new sources, the Central Person ID attribute can be used as an Account ID and can be added in the schema (Type as String).

Additionally, multiple assignment for a single employee can be managed effectively with the Central Person ID attribute. For example, if there is global assignment for an employee and there are multiple countries implemented in the system, then the employee needs to be reassigned to a country other than their home country. You can manage this with the Central Person ID attribute.

### Schema Attributes

Add a new Schema attribute "Central Person ID" with the description as Central Person ID associated with an employee. For more information, refer to [Editing an Account Schema](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>).

## Support for Person External ID

The SAP HR/HCM source supports the Person External ID being associated with the employee. By default, the Person External ID attribute is not present in the schema. To aggregate the Person External ID, complete the following:

1. Add the Person External ID attribute in the schema and type it as string with the description as follows:

   `PersonIDExternal` associated with employee.
2. Update the service account permission as follows:

   | Authorization Objects | Field Name | Field Description | Field Value |
   | --- | --- | --- | --- |
   | S\_TABU\_NAM | TABLE | TABLE name | PA0709 |

## Custom BAPI Invocation

The SAP HR/HCM connector can invoke custom BAPIs which are used for the following purposes:

- To filter the employees.
- To aggregate the additional attributes.

> [!NOTE]
>
> The custom BAPI code for the BAPI filter should filter out the accounts, as required, for both full and delta aggregation. The delta logic should be managed in the BAPI itself when delta mode is selected.

### Prerequisites

Based on your requirements, write a custom BAPI code which follows the Input and Output parameters standard specified by SailPoint.

For more information on the input and output parameters, refer to [Input and Output Parameters for BAPI](<#input-and-output-parameters-for-bapi>).

Add the required entry key in the application.xml file as follows:

> [!NOTE]
>
> **To apply a filter:**
>
> Use the entry key as follows:
>
> ```xml
> <entry key="aggregateFilterBAPI" value="name of the BAPI"/>
> ```
>
> The Aggregate Filter BAPI has the following input attributes, whose values will be determined from the values specified in the SAP HR/HCM connector:
>
> - Status
> - Termination offset
> - Future offset
> - Mode of aggregation
>
> In addition to the attributes already mentioned, additional input parameters can be specified using the following entry key:
>
> ```xml
> <entry key="customParameterForAggregationFilterBAPI">
>   <value>
>    <Map>
>     <entry key="<name of attribute> " value ="<value of attribute>"/>
>    </Map>
>   </value>
> </entry>
> ```
>
> For example, if you need to filter data by `KOSTL` (Cost Center) from the CSKS table (Cost Center Master Data), include `KOSTL` as a key and specify the corresponding value in a key-value pair, as shown below:
>
> > **Note**
> >
> > Ensure that `KOSTL` is defined as a component within the input structure of the custom BAPI. Additionally, the BAPI should contain logic to filter accounts based on the provided key and value.
>
> ```xml
> <entry key="customParameterForAggregationFilterBAPI">
>   <value>
>     <Map>
>       <entry key="KOSTL" value ="USA"/>
>     </Map>
>   </value>
> </entry>
> ```

> [!NOTE]
>
> **For the BAPI which will be used for the aggregating additional attributes:**
>
> Use the entry key as `<entry key="additionalAttrBAPI" value="name of the BAPI"/>`
>
> All additional attributes must be added manually in the SAP HR/HCM application schema. These additional attributes must have the same name as that of the fields returned from BAPI.

> [!NOTE]
>
> **To add additional input parameters to additionalAttrBAPI:**
>
> Use the `customParameterForAdditionalAttrBAPI` entry key as follows:
>
> ```xml
> <entry key="customParameterForAdditionalAttrBAPI">
>   <value>
>      <Map>
>       <entry key="CustAttrName" value ="<value of custom attribute>"/>
>      </Map>
>   </value>
> </entry>
> For example,
> <entry key="customParameterForAdditionalAttrBAPI">
>   <value>
>    <Map>
>     <entry key="Manager" value ="John"/>
>    </Map>
>   </value>
> </entry>
> ```
>
> In this example, `Manager` must be a field of the `EMPLOYEE_DETAILS` structure within `additionalAttrBAPI`.

> [!NOTE]
>
> **To pass additional input parameters to the Custom BAPI from the schema:**
>
> Use the following entry key:
>
> ```xml
> <entry key="customParameterForAdditionalAttrBAPI">
>   <value>
>    <Map>
>     <entry key="schema.AttrName" value ="<value>"/>
>    </Map>
>   </value>
> </entry>
> ```
>
> For example:
>
> ```xml
> <entry key="customParameterForAdditionalAttrBAPI">
>   <value>
>    <Map>
>     <entry key="schema.Title" value ="Name"/>
>    </Map>
>   </value>
> </entry>
> ```
>
> In this example, `Title` is a default schema attribute, and the value is the `Name` of the field in the `EMPLOYEE_DETAILS` structure of `additionalAttrBAPI`. Here, the `Name` is mapped with the value of the `Title` at run time and passed as the input parameter of `additionalAttrBAPI`.

> [!NOTE]
>
> If any attribute returned from this BAPI matches with the out of the box schema attribute, then the value of the attribute returned from BAPI is overwritten.

## Input and Output Parameters for BAPI

This section describes the parameters required to configure the BAPIs used for aggregation filtering and to fetch additional attributes.

### BAPI for Aggregation Filters

This section describes the input and output of the aggregation filter BAPI.

#### Input of the Aggregation Filter BAPI

The input of this BAPI must be a structure.

The name of the structure is `AGGREGATION_FILTER`.

[![Aggregation Filter Structure](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/agg_filter_structure.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/agg_filter_structure.png>)

This structure must have the components listed below. The connector provides the input values for the BAPI input structure, and they are based on the values specified in the source.

> [!NOTE]
>
> **EMPLOYEE\_STATUS**
>
> This aggregation is based on the various statuses of the employee.
>
> Possible values:
>
> - ACTIVE
> - FUTURE
> - INACTIVE
> - RETIREE
> - WITHDRAWN
>
> > **Note**
> >
> > - If the **Aggregate Inactive Employees** on the **Aggregation Settings** page is not disabled, then the EMPLOYEE\_STATUS value is set as ACTIVE and FUTURE.
> > - If the **Aggregate Inactive Employees** on the **Aggregation Settings** page is enabled, then the EMPLOYEE\_STATUS value is set as ACTIVE, FUTURE, INACTIVE, RETIREE, and WITHDRAWN.

> [!NOTE]
>
> **INACTIVE\_OFFSET**
>
> Indicates the number of past days to aggregate inactive (INACTIVE, RETIREE, and WITHDRAWN) employees. The inactive offset value is referred to from the `terminationOffset` attribute and is effective only if the **Aggregate Inactive Employees** is enabled.
>
> The following table gives an example of this offset:
>
> | Value from configuration | Description | Value passed on to BAPI |
> | --- | --- | --- |
> | 0 | No Inactive employees are aggregated. | 0 |
> | Positive Value | The number of days past from when the inactive employees must be aggregated. | For example, 30 |
> | No input provided (BLANK) | Aggregation of all the employees based on status: INACTIVE, RETIREE, WITHDRAWN | \-1 |

> [!NOTE]
>
> **FUTURE\_HIRE\_OFFSET**
>
> Indicates the number of days to aggregate the future hires. The future offset values are referred to from the attribute `Future Dated Hires Offset`.
>
> The following table gives an example of this offset:
>
> | Value from configuration | Description | Value passed on to BAPI |
> | --- | --- | --- |
> | 0 | No future hires are aggregated. | 0 |
> | Positive Value | Aggregates future hires within the specified number of days. | For example, 30 |
> | No input provided (BLANK) | Aggregates all future hires until 9999-12-31 | \-1 |
>
> > **Note**
> >
> > With every EMPLOYEE\_STATUS, offset values will be passed as specified in the configuration attributes.

> [!NOTE]
>
> **AGGREGATION\_MODE**
>
> The values for AGGREGATION\_MODE can be FULL or DELTA.
>
> > **Note**
> >
> > By default, AGGREGATION\_MODE is FULL. If the **Delta Aggregation** checkbox is selected on the Source UI, the mode is DELTA.

#### Output of the Aggregation Filter BAPI

The output of this value must be in the form of a JCOTable.

A JCOTable is an interface that describes internal tables used in the parameter lists of function modules. It is a data container, which can have multiple rows of the same fields.

The table name is `AGGREGATION_FILTERED_LIST`. The Output table must be a structure as described in the following figure:

[![Aggregation Filter Output Structure](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/agg_filter_output_structure.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/agg_filter_output_structure.png>)

The table must have the following components:

- PERNR
- BEGDA
- ENDDA
- STAT2

For example:

| PERNR | BEGDA | ENDDA | STAT2 |
| --- | --- | --- | --- |
| 00000001 | 20170505 | 99991231 | 3 |
| 00000002 | 2017050'6 | 99991231 | 2 |
| 00000003 | 20170508 | 20181231 | 1 |

> [!NOTE]
>
> - PERNR - Personnel Number, BEGDA - Beginning Date, ENDDA - End Date, STAT2 - Employment Status
> - The SAP-HR connector expects only one PERNR for one employee. If multiple person IDs are returned, the connector creates two separate identities for the person IDs as the default native identity is Employee Number.

### Return Table

BAPIs used for aggregation filtering and fetching additional attributes must return an additional JCOTable.

- Table Name: RETURN
- The table must have the following components:

  - TYPE: Possible values are as follows:

    - S (success)
    - E (error)
    - W (warning)
  - MESSAGE

### Custom BAPI for Additional Attributes

You must write the code based on your requirement for the Custom BAPI, and the SAP HR Source invokes that code accordingly. The Custom BAPI input and output parameters must be based on the guidelines as specified in this section.

> [!NOTE]
>
> This is the second custom BAPI for additional attributes. The first custom BAPI is for aggregation filters.

#### Prerequisite

All the additional attributes returned from the Custom BAPI must be added to the schema manually.

#### Input of the BAPI to Fetching Additional Attributes

The input of this BAPI must be a structure.

The name of the structure is EMPLOYEE\_DETAILS.

[![Employee Details Structure](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/employee_details.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/employee_details.png>)

This structure must have the PERNR field.

#### Output of the BAPI to Fetch Additional Attributes

The output for the custom BAPI should be a JCOTable with a name of ADDITIONAL\_ATTRIBUTE\_LIST.

> [!NOTE]
>
> - All attributes returned by the BAPI are treated as additional attributes. The attributes returned from the custom BAPI must be manually added to the schema to manage them.
> - The connector processes all returned additional attributes as single-valued. It does not support multiple values for additional attributes.
> - If the attribute names returned by the ADDITIONAL\_ATTRIBUTE\_LIST match those in the default schema, the default values are overwritten by the values returned from the custom BAPI.

The table must have all the additional attributes based on your requirements.

Example:

| MANAGER | REGION | LAST\_DAY\_WORK | GLOBAL\_ID |
| --- | --- | --- | --- |
| John | Pune | 2018-5-1 | 11111 |

In this example, `MANAGER`, `REGION`, `LAST_DAY_WORK`, and `GLOBAL_ID` are additional attributes.

# Connecting SailPoint and SAP HR/HCM

To connect SailPoint with SAP HR/HCM, perform the following tasks:

## Adding the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

> [!IMPORTANT]
>
> By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration.

**To configure a new source:**

1. Sign in to SailPoint.
2. Go to **Admin \> Connections \> Sources**.
3. Select **Create New**.
4. Search for the connector by entering the name in the search box, and then select **Configure**.
5. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
6. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
7. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](<https://documentation.sailpoint.com/saas/help/sources/index.html#assigning-a-source-owner>).
8. Under **Connection Type**, select **Direct Connection** or **Flat File**.

   - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
   - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable.
9. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source.
10. (Optional) Select a governance group to grant its members [source](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#source-sub-admin-user-level>) or [role](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#role-sub-admin-user-level>) sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html>).
11. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](<https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html>).
12. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there.

## Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a unique name and description for the source.
2. In the **Source Owner** dropdown list, select the identity that owns this source.

   - To find a source owner, begin entering their name.
3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](<https://documentation.sailpoint.com/saas/help/va/index.html>).
4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information.
6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html#associating-a-governance-group-with-a-source>).
7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default.

   - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system.
   - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source.
8. Drag and drop the required files into the **Upload Files** box, or upload them from your computer.

   > **Warning**
   >
   > Ensure that the file you upload is not vulnerable or malicious.

   Upload the `sapjco3.jar` and `libsapjco3.so` files. Download the JCO libraries (JCO Release 3.1.x) from the SAP customer service marketplace.
9. Select **Save**.

## Connection Settings

Provide the information required to connect and interact with the source.

> [!NOTE]
>
> **Screenshot**
>
> [![Connection Settings](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/connection_settings.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/connection_settings.png>)

1. Enter the **User Name** (service account) and **Password** for making the connection to the SAP server.
2. In **Host**, enter the SAP connection string on which the SAP server is running. For example, H/router/S/3299/backend/3246
3. Enter the two-digit SAP **System Number**. The default is 00.
4. Enter the three-digit **Client Number**. The default is 001
5. Enter the two-letter language code for the SAP **Client Language**. If SAP has been patched to SP 17 or later, change the client language to a single character. For example, if the client language is `EN`, change it to `E`. For more information on the One Character Code for Language, refer to the [SAP KB article](<https://userapps.support.sap.com/sap/support/knowledge/en/2633548>).
6. Select the **Name** of the function module configuration as per your SAP Basis version.

   Select **/SAILPOIN/SAIL\_READ\_TABLE** for SAP Basis version 751 and later, or **/SAILPOIN/SAIL\_READ\_TABLE\_LEG** for SAP Basis version 740, Support Package 08 and later.

   For more information on configuring SailPoint's replacement for the RFC\_READ\_TABLE, refer to [SailPoint Add-On to replace the use of RFC\_READ\_TABLE](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/sailpoint_add_on.html>).
7. Select **Save**.

## Aggregation Settings

For more information about aggregation, refer to [Loading Account Data](<https://documentation.sailpoint.com/saas/help/accounts/loading_data.html>).

Provide the settings for your aggregation. The SAP HR source supports aggregation of the following SAP Info Types:

- Action (0000)
- Organizational Assignment (0001)
- Personal Data (0002)
- Addresses (0006)
- Communication (0105)
- PersonalIDExternal (0709)

> [!NOTE]
>
> - To add the `Person External ID` attribute, you must configure it on the managed target system.
> - You can use Custom BAPI for additional attributes to support aggregation of the additional info types. For more information, refer to [Additional Settings](<#additional-settings>).

For the SAP HR source there are two important attributes based on which the aggregation is executed:

- Employee Number: This is a personnel number which is used to uniquely identify an employee in SAP. This number is system generated and is assigned to an employee during the hiring process. Previously, the aggregation was based on the employee number for the SAP HR source.
- Central Person ID: The central person identity links an employee to a business partner. For each employee, a central person is created and linked to the employee. Then, a business partner is created for the central person. In a global employment/ job assignment environment, an employee may potentially have multiple personnel numbers assigned to them with every personnel number linked to the same central person identity. Now, the aggregation is based on the Central Person ID.

> [!NOTE]
>
> **Screenshot**
>
> [![Aggregation Settings](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/aggregation_settings.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/aggregation_settings.png>)

1. Enter the **Future Dated Hired Offset (In Days)** to aggregate all future hires within the specified day range.

   You can enter the following values for the offset:

   - **0** - The system does not aggregate future hires.
   - **Blank** - The system aggregates all future hires until 9999-12-31.
   - **Any Positive Value** - The system aggregates all future hires within the specified number of days.
2. Enable **Aggregate Inactive Employees** to aggregate inactive employees.
3. Enter the **Termination Offset (In Days)** to aggregate all inactive employees within the specified day range. This option is only available if you enable **Aggregate Inactive Employees**.

   You can enter the following values for the offset:

   - **0** - The system only aggregates active employees.
   - **Blank** - The system aggregates all inactive employees.
   - **Any positive value** - The system aggregates all inactive employees within the specified number of days (in the past) since the terminations.
4. Select the **Manager Relationship Model** by selecting one the of radio buttons.

   - **Organization Chief Manager Model (O-O-S-P)** - Organization(O)-Organization(O)-Position(S)-Person(P) - (O-O-S-P) Model. This model deals with the chief of organization model wherein the employee's relation between position of employee and organization unit is detected with the relationship code 012.
   - **Supervisory Model (S-S)** - Position(S)-Position(S) - (S-S) Model. This model deals with the position-position manager relationship model wherein the two positions are connected with the relationship code 002.
5. Enter the **Page Size** to specify the number of records fetched per page for your function module configuration. The default is 500.

   > **Note**
   >
   > This field is only applicable if you have selected the **/SAILPOIN/SAIL\_READ\_TABLE** or **/SAILPOIN/SAIL\_READ\_TABLE\_LEG** on the **Connection Settings** page.
6. Select **Save**.

### Configuring the Plan Version

A *plan version* (`PLVAR`) represents a specific scenario or subset in which the SAP HR system creates organizational data. The SAP HR connector uses plan version `01` by default during aggregation queries.

**To configure a custom plan version:**

1. Send a `PATCH` request to update the SAP HR source:

   ```text
   PATCH https://{orgName}.api.identitynow.com/v3/sources/{SAPHRSourceId}
   ```
2. Add the `planVersion` attribute to `connectorAttributes` in the request body.

Use the `planVersion` attribute to set the SAP HR plan version (`PLVAR`) for aggregation queries. When you set this attribute, the connector uses your value instead of the default `01`.

Example: To use plan version `Z1`, include the following in the request body:

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/>) in the SailPoint Developer Community.

```json
[
    {
        "op": "add",
        "path": "/connectorAttributes/planVersion",
        "value": "Z1"
    }
]
```

## Additional Settings

Use the additional settings to configure delta aggregation and BAPI aggregation settings.

> [!NOTE]
>
> **Screenshot**
>
> [![Delta Aggregation and Action Types](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/delta_aggregation_and_action_types.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/delta_aggregation_and_action_types.png>)

To configure Delta Aggregation and Action Types, complete the following:

1. Enable **Delta Aggregation** to aggregate accounts that have changed since the last execution. Delta aggregation supports the following features:

   - All changes in the Effective Dates attribute of the employee already aggregated.
   - Any changes for the employment status (STAT2) of the employee already aggregated.
   - Any changes in the following employee attributes:

     - Organization data
     - Communication details
     - Personal data
     - Address information data
     - Supervisor Changes: If the supervisor has modified the organization structure using the Info Type 0001-Org Assignment (Cost Centre or Position) from the SAP HR/HCM system, the SAP HR source also aggregates the employees directly reporting to the supervisor.
2. Enter the comma-separated value of **Action Types** to be aggregated for each SAP HR entity. It is aggregated as part of the `Infotype0000JSON` schema attribute. For more information, refer to [Infotype0000JSON](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/schema.html#infotype0000json>).
3. Select **Save**.

### Custom BAPI Configuration

> [!NOTE]
>
> **Screenshot**
>
> [![BAPI Settings](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/bapi_settings.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/bapi_settings.png>)

You can configure a custom BAPI (Business Application Programming Interface) invocation for the SAP HR source. You must write the code based on your requirement for the custom BAPI, and the SAP HR source invokes that code accordingly. The custom BAPI input and output parameters must be based on the guidelines as specified below.

There are two types of BAPI:

- Custom BAPI for Aggregation - To aggregate the filtered list of employees from the SAP HR system.
- Custom BAPI for Additional Attributes - To aggregate the additional attributes or overwrite the values for standard attributes returned by the source, as required.

> [!NOTE]
>
> For more information on aggregating custom BAPI and custom BAPI for additional attributes, refer to [Support for Custom BAPI Invocation](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/additional_information.html#custom-bapi-invocation>).

To configure BAPI for aggregation processes:

1. Enter an **Aggregate Filter BAPI** to aggregate the filtered list of employees from the SAP HR system.

   The aggregate filter BAPI has the following four input attributes. The values of these attributes will be determined from the values specified in the source configuration:

   - Status
   - Termination Offset
   - Future Offset
   - Mode of Aggregation
2. To pass more input parameters to a BAPI in addition to the mandatory ones, define them in **Custom Parameter for Aggregation Filter BAPI**.

   For example, if you need to filter data by `KOSTL` (Cost Center) from the CSKS table (Cost Center Master Data), include `KOSTL` as a key and specify the corresponding value in a key-value pair. For more information, refer to [Input and Output Parameters for BAPI](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/additional_information.html#input-and-output-parameters-for-bapi>).

   > **Note**
   >
   > Ensure that `KOSTL` is defined as a component within the input structure of the custom BAPI. Additionally, the BAPI should contain logic to filter accounts based on the provided key and value.

   Select **Add Another** to add more entries.

   > **Warning**
   >
   > Depending on your Custom BAPI code in the SAP HR/HCM source, other additional permissions need to be provided and should be finalized before testing.
3. In the **Additional Attribute BAPI** field, specify the name of the custom BAPI.

   All of the additional attributes returned from the custom BAPI must be manually added to the schema.
4. If you need to pass additional input parameters to the Additional Attribute BAPI, enter a **Custom Parameter For Additional Attribute BAPI** as a key-value pair. For example, you can use the custom parameter for additional attribute BAPI to add the following:

   - A Manager with the value as "John" (`name`). Here, `Manager` should be a field of the EMPLOYEE\_DETAILS structure in the `additionalAttrBAPI` list.
   - The attribute, `schema.title` whose the value is `name`. Here, `title` is the default schema attribute and the value is `name`, which is a corresponding field of the EMPLOYEE\_DETAILS structure in `additionalAttrBAPI`. The attribute, `name` is mapped with the value of `title` at run time and passed as the input parameter of `additionalAttrBAPI`.

   > **Note**
   >
   > All additional attributes must be added manually in the SAP HR/HCM source schema. These attributes must have the same name as that of the fields returned from the BAPI.

   Select **Add Another** to add more entries.
5. Select **Save**.

> [!NOTE]
>
> If there is an error in the custom BAPI invocation, use **Exceptions To Ignore** to troubleshoot. Add an entry by entering your exception, then press Enter to add it to a rolling list.

## Advanced Settings

Use the advanced settings tab to configure the load balancer, communication settings, and SAP Secure Network Communication (SNC).

### Load Balancer Configuration

> [!NOTE]
>
> **Screenshot**
>
> [![Load Balancer Configuration](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/sap_adv2_new.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/sap_adv2_new.png>)

1. Enable Load Balancer to enable the feature and display additional configuration for load balancing with the source.
2. Enter the SAP message server's hostname or IP address in **Host**.
3. Enter the SAP message server's logon group name in **Client Group**.
4. Enter the SAP message server's port number or logical name in **Port Number**.

### Communication Configuration

> [!NOTE]
>
> **Screenshot**
>
> [![Communication Configuration](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/advanced_settings_2.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/advanced_settings_2.png>)

1. Enter valid mapping for the **Subtype Code** and the **Name of Communication type** fields to aggregate attributes during account aggregation and single account aggregation processes. The mapping should match the Subtype codes and their associated communication type names in the SAP managed system.

   Expand the following screenshot for an example of subtype codes (**STyp**) and their associated communication type names (**Name**) in the SAP managed system, and then a sample mapping of the codes in SailPoint.

   > **Screenshot**
   >
   > **Subtype Codes in the SAP Managed System**
   >
   > [![Subtype Codes in the SAP Managed System](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/sap_subtypes.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/sap_subtypes.png>)
   >
   > **Corresponding configuration in SailPoint**
   >
   > [![Corresponding configuration in SailPoint](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/sap_subtypes_map_example.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/sap_subtypes_map_example.png>)

   > **Note**
   >
   > If the SAP tables have different subtype codes values, you must update the value for each subtype accordingly.
2. Select **Save**.

### Secure Network Communication

Configure SAP Secure Network Communication (SNC) to protect the logical link between the end points during communication.

> [!IMPORTANT]
>
> For prerequisite information, refer to [SAP Secure Network Communication (SNC) For SAP Source](<https://community.sailpoint.com/knowledge/SAP-Secure-Network-Communication-SNC-For-SAP-Source-in>) in the Compass community.

> [!NOTE]
>
> **Screenshot**
>
> [![Secure Network Communication](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/snc_config.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/snc_config.png>)

1. Select **SNC Mode** to enable the feature.
2. Select a **Level of Security** to define the Quality of Protection (QOP) level.

   In the SAP source, this settings relates to `jco.client.snc_qop`.
3. In the **SNC Partner Name** field, enter the SNC Name of the SAP Application Server.

   If SNC is configured in the SAP source, this setting relates to `jco.client.snc_partnername`.

   For example, `p:CN=R3, O=XYZ-INC, C=EN`.
4. In the **SNC Name** field, enter a unique name to internally identify the source.

   In the SAP source, this setting relates to `jco.client.snc_myname`.
5. In the **SNC Library** field, enter the path to the library that provides the SNC service in SNC Library Path.

   In the SAP source, this setting relates to `jco.client.snc_lib`.
6. Select **Save**.

## Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to **Review and Test**.
2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.
3. Select **Test Connection**.

## SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface.

For more information, refer to [Application Onboarding](<https://documentation.sailpoint.com/saas/help/ai/app_onboarding/index.html>) in the SailPoint SaaS documentation.

# Frequently Asked Questions

The following are Frequently Asked Questions (FAQs) for this connector.

## Does SailPoint's SAP HR connector support connection via SAP Router?

**Answer**: Yes, it is working for most customers. For implementation, connect with the PS team.

## Where can I find more information about SAP HR attributes and BAPI mapping?

**Answer**: Refer to [SAP HR Attributes and BAPI Mapping](<https://community.sailpoint.com/knowledge/SAP-HR-Attributes-and-BAPI-mapping>) in Compass.

## Can you overwrite default schema attribute values with those returned by the Additional Attribute BAPI if the attribute names are different?

**Answer**: No. Remove the attribute from the default schema if you do not want the connector to aggregate its value.

# Integrating SailPoint with SAP HR/HCM

> [!NOTE]
>
> **Integration**
>
> This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

This guide is designed to give specific information about the requirements and field definitions needed to get a working instance of a SAP HR source.

> [!NOTE]
>
> The RFC\_READ\_TABLE integration function module has been deprecated, and replaced with the ABAP Function module. For more information on configuration, refer to [SailPoint Add-On to Replace the Use of RFC\_READ\_TABLE](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/sailpoint_add_on.html>).

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

SailPoint SAP HR/HCM connector supports the following features:

> [!NOTE]
>
> Before you can use any item marked with an asterisk (\*), SailPoint must activate the feature for your site. For more information on opening a support ticket, refer to [Working With Services](<https://community.sailpoint.com/knowledge/collection/working-with-services>).

### Account Management

- Loads SAP HR/HCM employees as accounts (active, terminated, and future hires).
- \*Provisioning (with the help of rule). For more information, refer to the [SAP HR Provisioning Modify Rule](<https://community.sailpoint.com/knowledge/IdentityNow-Rule-Guide-SAP-HR-Provisioning-Modify-Rule>).
- Delta aggregation to sync changes from SAP HR.
- Delete Account

> [!NOTE]
>
> For more information on SailPoint features, refer to [Source Features](<https://community.sailpoint.com/knowledge/Identity-Security-Cloud-Source-Features>).

The SAP HR source supports the following SAP Info Types:

- Action (0000)
- Organizational Assignment (0001)
- Personal Data (0002)
- Addresses (0006)
- Communication (0105)

## Supported Managed Systems

The following versions of the SAP HR/HCM systems are supported by the SAP HR/HCM connector:

- SAP ECC 6.0 on SAP NetWeaver 7.5, 7.4, 7.3, 7.2, 7.1 and 7.0
- SAP Central Component (ECC) 6.0 with Enhancement package 8 (EHP8)
- SAP S/4HANA (On-premise)

  - Version 2021 up to FP/SP Stack 05
  - Version 2022 up to FP/SP Stack 04
  - Version 2023 up to FP/SP Stack 02
  - Version 2025 Initial shipment stack

    > **Note**
    >
    > Ensure that notes 3634503 and 3653359 are implemented in the SAP S/4HANA 2025 Initial Shipment Stack.

## Prerequisites

> [!IMPORTANT]
>
> SailPoint strongly recommends installing the SAP-certified add-on in the SAP environment and then using /SAILPOIN/SAIL\_READ\_TABLE instead of RFC\_READ\_TABLE.

- Configure at least one virtual appliance cluster and successfully test the connection. For instructions, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
- Create a service account on SAP HR with the [Required Permissions](<#required-permissions>).
- The JCO libraries (JCO Release 3.1.X) must be downloaded from the SAP website by going to the customer service marketplace and downloading the Java Integration Module.

  SAP JCO version 3.1.X libraries, `libsapjco3.so` (on UNIX), must be present in the `java.library.path` (*WEB-INF/lib*) directory on the host. Upload these `.jar` and `.so` files on the Basic Configuration page.

  For more information on downloading the `.jar` files, refer to [Obtaining the Custom Connector Files](<https://community.sailpoint.com/knowledge/Obtaining-the-Custom-Connector-Files-Required-for-SAP-and-SAP-HR>). Ensure these jar files are compatible with the VA.
- The following ports must be open on the SAP System, where `<NN>` represents the system number:

  | Port Name | Service in `etc/services` | Default | Range | Rule |
  | --- | --- | --- | --- | --- |
  | SAP Dispatcher | sapdp\\\<NN\> | 3200 | 3200-3299 | 32\\\<NN\> |
  | Gateway | sapgw\\\<NN\> | 3300 | 3300-3399 | 33\\\<NN\> |
  | Gateway secured | sapgw\\\<NN\>s | 4800 | 4800-4899 | 48\\\<NN\> |

## Required Permissions

> [!NOTE]
>
> The RFC\_READ\_TABLE integration function module has been deprecated, and replaced with the ABAP Function module. For more information on configuration, refer to [SailPoint Add-On to Replace the Use of RFC\_READ\_TABLE](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/sailpoint_add_on.html>).

The following table lists the required permissions for the specific operations mentioned in this section:

| Operation | Required Permissions |
| --- | --- |
| Test Connection | [Test Connection](<#test-connection>) |
| Account Aggregation | [Test Connection](<#test-connection>) and [Account Aggregation](<#account-aggregation>) |
| Delta Aggregation | [Test Connection](<#test-connection>), [Account Aggregation](<#account-aggregation>), and Delta Aggregation |
| Provisioning Rule | [Test Connection](<#test-connection>), [Account Aggregation](<#account-aggregation>), and [Provisioning Rule](<#provisioning-rule-permissions>) |

The role assigned to the SAP Administrative user must have the authorization objects as mentioned in the following tables.

### Permissions by Operation

#### Test Connection

| Authorization Objects | Field Name | Field Description | Field Value |
| --- | --- | --- | --- |
| S\_RFC | ACTVT | Activity | 16-Execute |
| S\_RFC | RFC\_NAME | Name of RFC object | RFCPING |
| S\_RFC | RFC\_TYPE | Type of RFC object | FUGR, FUNC |

#### Account Aggregation

| Authorization Objects | Field name | Field description | Field value |
| --- | --- | --- | --- |
| S\_RFC | Activity: 16, RFC\_NAME | Name of RFC object | 0PBAPI0105, BAPI\_ADDRESSEMPGETDETAILEDLIST, BAPI\_EMPLCOMM\_GETDETAILEDLIST, BAPI\_EMPLOYEE\_GETDATA, BAPI\_EMPLOYEE\_GETLIST, BAPI\_PERSDATA\_GETLIST, MSS\_GET\_SY\_DATE\_TIME, BAPI\_PERSDATA\_GETDETAIL, RFC\_READ\_TABLE, SMSSDATA1, PERS,PADR,RFC\_GET\_FUNCTION\_INTERFACE, DDIF\_FIELDINFO\_GET, BAPI\_COMPANYCODE\_GETDETAIL, 0002, RFC\_METADATA\_GET |
| S\_TABU\_DIS | ACTVT | Activity | 03 Display |
| S\_TABU\_DIS | DICBERCLS | DICBERCLS | FC01 |
| S\_TABU\_NAM | ACTVT | Activity | 03 Display |
| S\_TABU\_NAM | TABLE Name | TABLE | HRP1001, HRP1000, PA0000, PA0001, PA0002<br>T530T, T529T - Only add these table names if you want to populate the following account schema attributes:<br>\- Infotype0000 (for older SAP HR sources)<br>\- Infotype0000JSON (for recently set up SAP HR sources)<br>PA0006, PA0105 - Add these tables if the **Delta Aggregation Enabled** checkbox is selected. |
| P\_Orgin | AUTHC | Authorization Level | R |
| P\_Orgin | INFTY | INFOTYPE | 0001, 0002, 0003, 0006, 0032, 0105 |
| P\_Orgin | PERSA | Personal area | (Depending on the organizational area you have assigned to user while creating) |
| P\_Orgin | PERSG | Employee group | (Depending on the organizational area you have assigned to user while creating) |
| P\_Orgin | SUBTYPE | SUBTY | `*` - If you want to get data for all the subtypes. If you want to get data for specific info types, then add specific subtypes as per data in your environment. For example: for Addresses (Infotype 0006) add subtype - 1,2,3,4,5,6; for Communication (Infotype 0105) add subtype - 0001,0010, 0020, 0030 |
| P\_Orgin | PERSK | Employee subgroup | (Depending on the organizational area you have assigned to user while creating) |
| P\_Orgin | VDSK1 | Organization Key | (Depending on the organizational area you have assigned to user while creating) |

> [!NOTE]
>
> Based on the option selected in the **Connections \> Function Module Configuration \> Name** dropdown, select one of the following options.
>
> - RFC\_READ\_TABLE
>
>   > **Note**
>   >
>   > SailPoint will continue to support the RFC\_READ\_TABLE in accordance with our depreciation policies. SailPoint recommends that you start planning to move to use SailPoint's Function Module.
> - /SAILPOIN/SAIL\_READ\_TABLE\_LEG
>
>   Add this permission to use SailPoint's Function Module over RFC\_READ\_TABLE if your SAP\_BASIS version is 740, Support Package 08, up to BASIS 750.
> - /SAILPOIN/SAIL\_READ\_TABLE
>
>   Add this permission to use SailPoint's Function Module over RFC\_READ\_TABLE if your SAP\_BASIS version is 751 and later.
>
>   > **Note**
>   >
>   > /SAILPOIN/SAIL\_READ\_TABLE\_LEG and /SAILPOIN/SAIL\_READ\_TABLE fully replace the RFC\_READ\_TABLE module. Update the service account permissions to configure the function module in your SAP environment.
>   >
>   > You do not have to assign permissions for RFC\_READ\_TABLE once you configure it for /SAILPOIN/SAIL\_READ\_TABLE\_LEG or /SAILPOIN/SAIL\_READ\_TABLE. For more information, refer to [SailPoint Add-On to Replace the Use of RFC\_READ\_TABLE](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/sailpoint_add_on.html>).

#### Provisioning Rule Permissions

The administrator permissions mentioned in the following table are only applicable to the provisioning operations specified in the **Example SAP HRMS Modify Rule** (email, phone number, and system user name) rule.

| Authorization Objects | Field name | Field description | Field value |
| --- | --- | --- | --- |
| S\_RFC | RFC\_NAME | Name of RFC object | RFC1, 1065, BAPI\_EMPLOYEE\_ENQUEU, SYSU, SYSTEM\_RESET\_RFC\_SERVER, SDIFRUNTIME, BAPI\_EMPLCOMM\_CHANGE, BAPI\_EMPLCOMM\_CREATE |
| P\_Orgin | AUTHC | Authorization Level | E, S, W |

# Provisioning Reference

This section contains information for configuring provisioning operations.

## Provisioning with the Help of Rule

The modification in the values of email, name, and phone number is supported on the SAP HR source. This support is through a provisioning rule. The rule name is defined as Example "SAP HRMS Modify Rule".

### Modify Rule

The rule name is defined as Example "SAP HRMS Modify Rule". This is a sample rule to assign and update the following parameters:

- Email Address
- Phone Number
- Account's System User Name

For the description of the modify rule, refer to [SAP HR Provisioning Modify Rule](<https://community.sailpoint.com/knowledge/IdentityNow-Rule-Guide-SAP-HR-Provisioning-Modify-Rule>).

## Provisioning Rule Update

If you set the Central Person ID attribute as a Account ID, for provisioning you must use the updated rule. The updated rule is published at [SAP HR Provisioning Modify Rule](<https://community.sailpoint.com/knowledge/IdentityNow-Rule-Guide-SAP-HR-Provisioning-Modify-Rule>).

If the Employee number is used as an Account ID, the previous rule will work.

> [!NOTE]
>
> If you want to update the Correlation Configuration rule, you must map the relevant Identity Attribute to the Central Person ID by going to **Import Data \> Correlation** for that specific source. For more information, refer to [Configuring Account Correlation](<https://documentation.sailpoint.com/saas/help/accounts/correlation.html>).

# SailPoint Add-On to Replace the Use of RFC\_READ\_TABLE

SailPoint's ABAP Integration is designed to replace the functionality of SAP's RFC\_READ\_TABLE to securely access the information in the SAP system required for deeper governance.

This integration needs to be deployed on the SAP system for querying the tables. For the deployment process follow these links in order:

- [Prerequisites](<#prerequisites>)
- [Installation of SAILPOIN Add-On](<#installation-of-sailpoin-add-on>)
- [Configuring SailPoint's Function Module](<#configuring-sailpoints-function-module>)
- [Configuration Table For SAP HR/HCM](<#configuration-table-for-sap-hrhcm>)
- [Importing Support Packages for Add-On SAILPOIN](<#importing-support-packages-for-add-on-sailpoin>)
- [New Package Download Matrix](<#new-package-download-matrix>)
- [Uninstall SAILPOIN Add-On](<#uninstall-sailpoin-add-on>)

## Prerequisites

To install the Add-On and support packages using the SAINT transaction code (t-code), follow these steps:

1. Log into client 000.
2. Ensure that you have installed at least **SPAM/SAINT** version 0053 to be able to uninstall Add-Ons using the **SAINT** t-code.
3. Deselect the digital signature setting in **SAINT** t-code:

   1. Go to **SAINT** t-code.
   2. Select **Extras**.
   3. Choose **Setting**.
   4. Deselect the **Check for digital signature of to be imported OCS Packages**.
4. Proceed with installing the Add-On and support packages using the **SAINT** t-code.

> [!NOTE]
>
> **Screenshot**
>
> [![SAINT t-code](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/sap_d_saint.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/sap_d_saint.png>) [![Add-on prerequisites](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/add_on_prereq.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/add_on_prereq.png>)

## Installation of SAILPOIN Add-On

> [!NOTE]
>
> If Add-on is already installed, reference [Importing Support Packages for Add-On SAILPOIN](<#importing-support-packages-for-add-on-sailpoin>).

1. Download the PAT file(s) for the Add-On and all the required support packages from the [New Package Download Matrix](<#new-package-download-matrix>).

   > **Note**
   >
   > The PAT file is a special file used to package the SAP Add-on. If you install the add-on using SPAM/SAINT, the contents of the PAT file will be extracted (disassembled) to your transport directory.
2. Copy the .PAT file on your server location for the Add-On *and* all the required support packages:

   Server Location: (Windows : `<DRIVE>:\usr\sap\trans\EPS\in` ; Linux/Unix : `/usr/sap/trans/EPS/in`).
3. Login to SAP GUI , and then execute the Tcode **SAINT**.

   > **Screenshot**
   >
   > [![SAINT t-code](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/sap_grc_saint.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/sap_grc_saint.png>)
4. Go to **Installation Package \> Load Packages \> EPS Files From Application Server**.

   > **Screenshot**
   >
   > [![EPS files from application server](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/sapgui1.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/sapgui1.png>)
5. Ensure the following PAT file(s) uploaded successfully:

   > **Screenshot**
   >
   > [![PAT files uploaded](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/copy_of_1b.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/copy_of_1b.png>)
6. Select **Start**.
7. Select **SAILPOIN** from the **Installable Add-on Package packages for your system** grid.

   > **Screenshot**
   >
   > [![Installable Add-on Package packages](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/sap_grc_pat.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/sap_grc_pat.png>)
8. Select **Continue**.
9. To install the Add-On and support package(s), perform the following:

   1. Select the highest version from the available support package(s) under the **Target Support Package** drop down of the component **SAILPOIN**.

      > **Screenshot**
      >
      > [![Target Support Package](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/copy_of_3b.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/copy_of_3b.png>)
   2. The column **Level** should indicate the chosen target support package.

      > **Screenshot**
      >
      > [![Level column](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/copy_of_4b.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/copy_of_4b.png>)
10. Select **Continue**.
11. On the **Add Modification Adjustment Transports to the Queue** dialog, select **No**.

    > **Screenshot**
    >
    > [![Add Modification Adjustment Transports to the Queue](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/sapgui3.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/sapgui3.png>)
12. If prompted on the **Start Options** dialog box, select **Continue**.

    > **Screenshot**
    >
    > [![Start Options dialog box](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/copy_of_6b.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/copy_of_6b.png>)

    > **Note**
    >
    > The Add-on and the support package(s) will begin installing, and the progress can be seen at the bottom of the window.
13. Select **Finish**. If prompted to send Runtime Analysis, select **Do not send**.
14. Go to **System \> Status \> Details \> Installed Software Component Versions** to confirm the following:

    1. The Add-On *and* the support packages have been added in the system component.

       > **Screenshot**
       >
       > [![Installed Software Component Versions](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/copy_of_7b.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/copy_of_7b.png>)

## Configuring SailPoint's Function Module

- The /SAILPOIN/SAIL\_READ\_TABLE function module supports SAP BASIS version 751 and later.

  This is an SAP-certified function module provided by SailPoint to replace the use of SAP's RFC\_READ\_TABLE function module, according to SAP recommendations, for reading data from SAP tables required for governance.

  /SAILPOIN/SAIL\_READ\_TABLE provides enhanced security, support for pagination, and performance improvements over the RFC\_READ\_TABLE. For the deployment process, refer to [Install SAILPOIN Add-On](<#installation-of-sailpoin-add-on>).

  > **Important**
  >
  > - SailPoint recommends having SAP BASIS version 751 and above for seamless functionality of the ABAP add-on. However, for lower BASIS versions, /SAILPOIN/SAIL\_READ\_TABLE\_LEG can be tried with limited support from SailPoint.
  > - RFC\_READ\_TABLE-based connections are deprecated, and it is recommended to use the SAP-certified add-on instead.

## Configuration Table for SAP HR/HCM

Insert the following data into the '/SAILPOIN/CONF' table:

- **SERVICE\_ACCOUNT**: This is the allowed service account to be used for accessing FM.
- **NAME**: The name of entity from which data is fetched. For now we can consider it as a table name.
- **COLUMN\_NAME**: The column allowed for fetching data.
- **ENTITY\_TYPE**: The type of entity such as table, join, or any other. This is for a future purpose.
- **COLUMN\_DTYPE**: The data type of the column that is allowed.
- **COLUMN\_DENAME**: Data element type of the column.

  The "Data element type" can be found by using t-code "SE11" when viewing the table details, under the **Fields** tab.
- **COLUMN\_LENGTH**: The length of the column that is allowed.

  The "Length" can be found by using t-code "SE11" when viewing the table's details, under the **Fields** tab.

> [!NOTE]
>
> Validate that the values for "COLUMN\_DENAME" and "COLUMN\_LENGTH" are correct as per your system. These can be validated through the t-code "SE11" while viewing the table details under the **Fields** tab.

> [!NOTE]
>
> **Insert the following data into the '/SAILPOIN/CONF' table through the t-code \\"SE16\\":**
>
> Enter **Se16 \> Table Name: /SAILPOIN/CONF \> Create Entries**
>
> > **Screenshot**
> >
> > [![SE16 create entries](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/tc1.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/tc1.png>)
>
> The option to enter the data into the table will appear.
>
> > **Screenshot**
> >
> > [![SE16 entry option](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/tc3.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/tc3.png>)

> [!NOTE]
>
> **Insert the following data into the '/SAILPOIN/CONF' table using script:**
>
> **Setup**
>
> - Enter t-code SE38 and then create program 'Z\_CONFIGURE\_SERVICEACCOUNT' in the local object package and type as an executable program.
> - Copy and paste the script provided [HERE](<https://community.sailpoint.com/knowledge/SailPoint-SAP-ABAP-Add-on-Table-Configuration>), and activate the program.
> - For better readability of the input parameters edit the selection text from **Go to \> Text Element \> Selection Text** and update it as shown in the following image.
>
> > **Screenshot**
> >
> > [![Selection text example](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/script1.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/script1.png>)
>
> - **Save** and then **activate** the program.
>
> **How it works**
>
> - Enter t-code SE38 and then search for program 'Z\_CONFIGURE\_SERVICEACCOUNT'. Select **execute**.
> - Enter the service account and integration module to be populated respectively.
>
> > **Screenshot**
> >
> > [![Enter service account and integration module](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/script3.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/script3.png>)
>
> - Once you have entered the details correctly, select **execute** and you will see a success message.
>
> > **Screenshot**
> >
> > [![Success message](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/script2.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/script2.png>)

The table below contains the full set of `/SAILPOIN/CONF` entries required for SAP HR/HCM:

| SERVICE\_ACCOUNT | NAME | COLUMNNAME | ENTITY\_TYPE | COLUMN\_DTYPE | COLUMN\_DNAME | COLUMN\_LENGTH |
| --- | --- | --- | --- | --- | --- | --- |
| `<your-service-account-name>` | PA0000 | PERNR | TABLE | N | PERSNO | 8 |
| `<your-service-account-name>` | PA0000 | STAT2 | TABLE | C | STAT2 | 1 |
| `<your-service-account-name>` | PA0000 | BEGDA | TABLE | D | BEGDA | 8 |
| `<your-service-account-name>` | PA0000 | ENDDA | TABLE | D | ENDDA | 8 |
| `<your-service-account-name>` | PA0000 | AEDTM | TABLE | D | AEDAT | 8 |
| `<your-service-account-name>` | PA0000 | MASSN | TABLE | C | MASSN | 2 |
| `<your-service-account-name>` | PA0000 | MASSG | TABLE | C | MASSG | 2 |
| `<your-service-account-name>` | HRP1001 | OTYPE | TABLE | C | OTYPE | 2 |
| `<your-service-account-name>` | HRP1001 | PLVAR | TABLE | C | PLVAR | 2 |
| `<your-service-account-name>` | HRP1001 | SUBTY | TABLE | C | SUBTYP | 4 |
| `<your-service-account-name>` | HRP1001 | OBJID | TABLE | N | HROBJID | 10 |
| `<your-service-account-name>` | HRP1001 | SOBID | TABLE | C | SOBID | 45 |
| `<your-service-account-name>` | HRP1001 | BEGDA | TABLE | D | BEGDATUM | 8 |
| `<your-service-account-name>` | HRP1001 | ENDDA | TABLE | D | ENDDATUM | 8 |
| `<your-service-account-name>` | HRP1001 | RELAT | TABLE | C | RELAT | 3 |
| `<your-service-account-name>` | HRP1001 | ISTAT | TABLE | C | ISTAT\_D | 1 |
| `<your-service-account-name>` | HRP1001 | RSIGN | TABLE | C | RSIGN | 1 |
| `<your-service-account-name>` | HRP1001 | SCLAS | TABLE | C | SCLAS | 2 |
| `<your-service-account-name>` | HRP1001 | AEDTM | TABLE | D | AEDTM | 8 |
| `<your-service-account-name>` | PA0002 | PERNR | TABLE | N | PERSNO | 16 |
| `<your-service-account-name>` | PA0002 | NACHN | TABLE | C | PAD\_NACHN | 40 |
| `<your-service-account-name>` | PA0002 | BEGDA | TABLE | D | BEGDA | 8 |
| `<your-service-account-name>` | PA0002 | AEDTM | TABLE | D | AEDAT | 8 |
| `<your-service-account-name>` | HRP1000 | STEXT | TABLE | C | STEXT | 40 |
| `<your-service-account-name>` | HRP1000 | OTYPE | TABLE | C | OTYPE | 2 |
| `<your-service-account-name>` | HRP1000 | PLVAR | TABLE | C | PLVAR | 2 |
| `<your-service-account-name>` | HRP1000 | OBJID | TABLE | N | HROBJID | 8 |
| `<your-service-account-name>` | HRP1000 | ENDDA | TABLE | D | ENDDATUM | 8 |
| `<your-service-account-name>` | HRP1000 | LANGU | TABLE | C | LANGU | 1 |
| `<your-service-account-name>` | PA0001 | ORGEH | TABLE | N | ORGEH | 8 |
| `<your-service-account-name>` | PA0001 | VDSK1 | TABLE | C | VDSK1 | 14 |
| `<your-service-account-name>` | PA0001 | ABKRS | TABLE | C | ABKRS | 2 |
| `<your-service-account-name>` | PA0001 | SACHA | TABLE | C | SACHA | 3 |
| `<your-service-account-name>` | PA0001 | SACHP | TABLE | C | SACHP | 3 |
| `<your-service-account-name>` | PA0001 | WERKS | TABLE | C | PERSA | 4 |
| `<your-service-account-name>` | PA0001 | PLANS | TABLE | N | PLANS | 8 |
| `<your-service-account-name>` | PA0001 | GSBER | TABLE | C | GSBER | 4 |
| `<your-service-account-name>` | PA0001 | BUKRS | TABLE | C | BUKRS | 4 |
| `<your-service-account-name>` | PA0001 | KOSTL | TABLE | C | KOSTL | 10 |
| `<your-service-account-name>` | PA0001 | PERSG | TABLE | C | PERSG | 1 |
| `<your-service-account-name>` | PA0001 | PERSK | TABLE | C | PERSK | 2 |
| `<your-service-account-name>` | PA0001 | STELL | TABLE | N | STELL | 8 |
| `<your-service-account-name>` | PA0001 | JUPER | TABLE | C | JUPER | 4 |
| `<your-service-account-name>` | PA0001 | ENAME | TABLE | C | EMNAM | 40 |
| `<your-service-account-name>` | PA0001 | BTRTL | TABLE | C | BTRTL | 4 |
| `<your-service-account-name>` | PA0001 | ANSVH | TABLE | C | ANSVH | 2 |
| `<your-service-account-name>` | PA0001 | SACHZ | TABLE | C | SACHZ | 3 |
| `<your-service-account-name>` | PA0001 | SBMOD | TABLE | C | SBMOD | 4 |
| `<your-service-account-name>` | PA0001 | KOKRS | TABLE | C | KOKRS | 4 |
| `<your-service-account-name>` | PA0001 | BEGDA | TABLE | D | BEGDA | 8 |
| `<your-service-account-name>` | PA0001 | ENDDA | TABLE | D | ENDDA | 8 |
| `<your-service-account-name>` | PA0001 | PERNR | TABLE | N | PERSNO | 8 |
| `<your-service-account-name>` | PA0001 | AEDTM | TABLE | D | AEDAT | 8 |
| `<your-service-account-name>` | T529T | MASSN | TABLE | C | MASSN | 2 |
| `<your-service-account-name>` | T529T | MNTXT | TABLE | C | MNTXT | 30 |
| `<your-service-account-name>` | T529T | SPRSL | TABLE | C | SPRAS | 1 |
| `<your-service-account-name>` | T530T | MASSN | TABLE | C | MASSN | 2 |
| `<your-service-account-name>` | T530T | MGTXT | TABLE | C | MGTXT | 30 |
| `<your-service-account-name>` | T530T | SPRSL | TABLE | C | SPRAS | 1 |
| `<your-service-account-name>` | T530T | MASSG | TABLE | C | MASSG | 2 |
| `<your-service-account-name>` | PA0105 | AEDTM | TABLE | D | AEDAT | 8 |
| `<your-service-account-name>` | PA0105 | BEGDA | TABLE | D | BEGDA | 8 |
| `<your-service-account-name>` | PA0105 | PERNR | TABLE | N | PERSNO | 8 |
| `<your-service-account-name>` | PA0006 | AEDTM | TABLE | D | AEDAT | 8 |
| `<your-service-account-name>` | PA0006 | BEGDA | TABLE | D | BEGDA | 8 |
| `<your-service-account-name>` | PA0006 | PERNR | TABLE | N | PERSNO | 8 |
| `<your-service-account-name>` | PA0709 | AEDTM | TABLE | D | AEDAT | 8 |
| `<your-service-account-name>` | PA0709 | BEGDA | TABLE | D | BEGDA | 8 |
| `<your-service-account-name>` | PA0709 | PERNR | TABLE | N | PERSNO | 8 |
| `<your-service-account-name>` | PA0709 | PERSONID\_EXT | TABLE | C | PERSONID\_EXT | 20 |

## Importing Support Packages for Add-On SAILPOIN

### Installation

1. Download the PAT file(s) for the support packages from the [New Package Download Matrix](<#new-package-download-matrix>).
2. Copy the PAT file(s) on your server location:

   (Windows : `<DRIVE>:\usr\sap\trans\EPS\in` ; Linux/Unix : `/usr/sap/trans/EPS/in`).
3. Sign in to SAP GUI and execute the SPAM t-code. The status of the queue for importing support packages should be green as shown.

   > **Screenshot**
   >
   > [![SPAM queue status](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_0.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_0.png>)
4. Go to **Installation Package \> Load Packages \> EPS Files From Application Server**.

   > **Screenshot**
   >
   > [![EPS files from application server](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_1.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_1.png>)
5. Select **Yes** when prompted to upload OCS packages from the EPS inbox.

   > **Screenshot**
   >
   > [![Upload OCS packages prompt](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_2.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_2.png>)
6. Verify that the upload was successful.

   > **Screenshot**
   >
   > [![Upload successful](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_3.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_3.png>)
7. Select **Display/Define** to choose the software component for which you want to import Support Packages.

   > **Screenshot**
   >
   > [![Display/Define](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_4.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_4.png>)
8. Choose the **SAILPOIN** component.

   > **Screenshot**
   >
   > [![Choose SAILPOIN component](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_5.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_5.png>)
9. Confirm the queue by selecting **Continue**.

   > **Note**
   >
   > The queue in the image shows the number of support packages that can be installed based on the PAT files placed on your server location. This example shows importing 2 support packages.

   > **Screenshot**
   >
   > [![Confirm queue](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_6.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_6.png>)
10. Select **No** when prompted to add Modification Adjustment Transports to the queue.

    > **Screenshot**
    >
    > [![Modification Adjustment Transports prompt](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_7.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_7.png>)
11. Verify that the queue contains the intended support packages for import that were added/defined in the queue in the previous steps.

    > **Screenshot**
    >
    > [![Queue verification](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_8.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_8.png>)
12. Go to **Support Package \> Import Queue**.

    > **Screenshot**
    >
    > [![Support Package Import Queue](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_9.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_9.png>)
13. Select **Continue** to import the queue.

    > **Screenshot**
    >
    > [![Import the queue](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_10.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_10.png>)

    > **Note**
    >
    > The support package begins installing, and you can view the progress at the bottom of the window.
14. After the support package(s) are successfully imported, the below prompt should display. Select **Continue** to proceed with the import.

    > **Screenshot**
    >
    > [![Continue with the import](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_11.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_11.png>)
15. Confirm the queue by going to **Support Package \> Confirm**.

    > **Screenshot**
    >
    > [![Confirm the queue](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_12.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_12.png>)
16. When prompted to send Runtime Analysis, select **Do not send**.
17. Go to **System \> Status \> Details \> Installed Software Component Versions** to confirm that the Add-on's support package is now set to the desired support package level. For example, `0002`.

    > **Screenshot**
    >
    > [![Support package level confirmation](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_13.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/support_packages_13.png>)

## New Package Download Matrix

Refer the [SailPoint SAP ABAP Add-on PAT Files](<https://community.sailpoint.com/knowledge/SailPoint-SAP-ABAP-Add-on-PAT-Files>) for downloading the new package.

| Release | Installed Software Component Level and Support Package Name | Downloadable Package Type | PAT File Name | Download Link |
| --- | --- | --- | --- | --- |
| 100\_2022 | Base Component | AOI (Add-On Installation Package) | G750020862508\_0000028.PAT | [https://community.sailpoint.com/knowledge/SailPoint-SAP-ABAP-Add-on-PAT-Files](<https://community.sailpoint.com/knowledge/SailPoint-SAP-ABAP-Add-on-PAT-Files>) |
| 100\_2022 | SP-Level: 0001<br>Support Package:<br>SAPK-12201INSAILPOIN | CSP (Component Support Package) | G750020862508\_0000032.PAT | [https://community.sailpoint.com/knowledge/SailPoint-SAP-ABAP-Add-on-PAT-Files](<https://community.sailpoint.com/knowledge/SailPoint-SAP-ABAP-Add-on-PAT-Files>) |
| 100\_2022 | SP-Level: 0002<br>Support Package:<br>SAPK-12202INSAILPOIN | CSP (Component Support Package) | G750020862508\_0000033.PAT | [https://community.sailpoint.com/knowledge/SailPoint-SAP-ABAP-Add-on-PAT-Files](<https://community.sailpoint.com/knowledge/SailPoint-SAP-ABAP-Add-on-PAT-Files>) |

To overcome dependency errors during Add-on installation, use these Attribute Change Package (ACP) files:

| Installed Software Component Level and Support Package Name | PAT File Name |
| --- | --- |
| DW4CORE, S4CORE, SAP\_GWFND | G750020862508\_0000076.PAT |
| S4FND, MDG\_FND, SAP\_GWFND | G750020862508\_0000077.PAT |

## Uninstall SAILPOIN Add-On

1. In the SAP GUI, execute the Tcode **SAINT**.
2. Ensure that the Add-on **SAILPOIN** was successfully installed by confirming that it is visible in the **Installed Components** list.

   > **Screenshot**
   >
   > [![Installed Components list](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/sap_grc_pat2.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/sap_grc_pat2.png>)
3. Select **Uninstallable Components**. The Add-on **SAILPOIN** should be visible.

   > **Screenshot**
   >
   > [![Uninstallable Components](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/sap_d_pat_uninstall.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/sap_d_pat_uninstall.png>)
4. Select **SAILPOIN** from the grid, and then select **Start**.
5. Select **Continue** when prompted on the **Start Options** dialog box.

   > **Screenshot**
   >
   > [![Start Options dialog box](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/sapgui8.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/sapgui8.png>)

   > **Note**
   >
   > If there are any specific preferences for any of the start options, they can be selected as per your requirement.
6. Select **Finish**.
7. When prompted to send Runtime Analysis, select **Do not send**.

   > **Screenshot**
   >
   > [![Runtime Analysis prompt](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/copy_of_sapd_donotsend.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/copy_of_sapd_donotsend.png>)
8. Perform the following to confirm that the Add-on **SAILPOIN** was uninstalled:

   1. Select **Installable Components** and scroll through the list to ensure **SAILPOIN** is not found.
   2. Select **Uninstallable Components** and scroll through the list to ensure **SAILPOIN** is not found.
   3. Go to **System \> Status**. Under SAP System data go to **Product Version \> Details \> Installed Software Component Versions** and ensure the Add-on **SAILPOIN** is not found.

# Schema Reference

The application schema is used to configure the objects returned from a connector.

> [!NOTE]
>
> - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.
> - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified.

The SAP HR/HCM connector uses the following default correlation and object configurations.

## Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.

### Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*.

> [!CAUTION]
>
> Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.
>
> To resolve issues caused by changing account IDs, reconfigure them to their default values.

The following table lists the default account IDs for this connector:

| Account ID | Schema Object Type |
| --- | --- |
| Central Person ID | Account |
| Employee Number | Account |

### Default Account Attributes

The SAP HR/HCM connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

| Attribute Name | Description |
| --- | --- |
| Academic Grade | The academic grade attained by the employee. This is the "Title" associated with the person. |
| Address | The address of the employee. |
| Address Type | The address type of the employee. For example, home/work.<br>Short text: Subtype |
| Address Type Code | The address type code of the employee. |
| Admin Group | The administrative group to which the employee belongs. |
| Aristocratic Title | The name supplement. For example, Lord/Lady.<br>Short text: other title |
| Business Area | The business area. |
| Central Person ID | The central person ID associated with the employee. |
| Co Area | The controlling area. |
| Comp Code | The company code. |
| Company Name | The company name associated with the employee. |
| Contract | Work contract information |
| Cost Center | The cost center to which the employee is associated. |
| Country | The country in which the employee is located.<br>Short text: Country key |
| Country Code | The country code. |
| E Group | The Employee Group to which the employee belongs.<br>An Employee Group is a subdivision of a Personnel Subarea that determines benefits based on hours worked. |
| Email | The email address associated with the account |
| Employee Number | The employee number. |
| FirstName | The first name. |
| FullName | The full legal name. |
| Effective Dates | Stores the Effective Dates for manager change and last name change in the following format:<br>`{ "LastNameChanges": [ { "EffectiveDate": "yyyy-MM-dd", "LastName": "<lastname>" } ], "SupervisorChanges": [ { "EffectiveDate": "yyyy-MM-dd", "Supervisor": "<supervisor-id>" } ] }`<br>For example:<br>`{ "LastNameChanges": [ { "EffectiveDate": "1998-07-30", "LastName": "Jones" } ], "SupervisorChanges": [ { "EffectiveDate": "2025-05-01", "Supervisor": "00000428" } ] }` |
| Id Number | The personnel identification number. For example, Social Security Number. |
| Initials | The initials of the employee. |
| Job | The job title. |
| Job Description | The job Description. |
| Known As | The nickname or preferred name of the employee. |
| Language | The primary language.<br>Short text: Language key |
| Language Code | The language code. |
| Language ISO | The primary language ISO 639 code.<br>Short text: Language according to ISO 639 |
| LastName | The surname. |
| LegPerson | The legal person assigned to the account |
| MiddleName | The middle name. |
| Name | The full employee name. |
| Name Format Indicator | The name format indicator.<br>Parameter Name: `NAME_FORMAT_INDICATOR` |
| Org Key | The organizational key. |
| Org Unit | The organizational unit. |
| Organization Description | The organization description. |
| P subArea | The personnel sub area. |
| Payarea | The payroll area. |
| Payroll Admin | The payroll Administrator. |
| Personnel Admin | The administrator for the HR master D=data. |
| Personnel Area | The personnel area to which the employee reports. |
| Personnel Number | The employees personnel number. |
| Position | The title of the position. |
| Position Description | The description of the job function. |
| Reason Code | The reason for changing the master data. |
| SecondName | The second name. |
| State Abbreviation | The state abbreviation. |
| STAT2\_Current | The current employment status. |
| STAT2\_Next | The future employment status. |
| STAT2\_Next\_Start\_Date | The effective start date of the future employment status. |
| Sub E Group | The employee Subgroup information. |
| Supervisor | The supervisor area. |
| Surname Prefix | The last name prefix. |
| System user name (SY-UNAME) | The user ID. |
| Telephone | The telephone number and dialing code. |
| Time Admin | The name of the administrator for time recording. |
| Title | The function. |
| Zip Code | The zip code. |
| Infotype0000JSON | Information about the actions InfoType. This attribute aggregates past, present, and future data. |

## Support for Future Data

The SAP HR/HCM connector supports aggregation for future data for all accounts.

### Additional Schema Attributes

Use the following parameters for future data:

- **STAT2\_Current**: The current employment status with the following values:

  - **Inactive**: For a terminated employee.
  - **Active**: For an active employee.
- **STAT2\_Next**: The future employment status with the following values:

  - **Inactive**: For a terminated employee.
  - **Active**: For an active employee.
- **STAT2\_Next\_Start\_Date**: The effective start date of future employment status in the following format:

  `yyyy-MM-dd`
- **Effective Dates**: Stores the effective dates for a manager change and a last name change in the following format:

  ```json
  {
    "LastNameChanges": [
      {
        "EffectiveDate": "*******",
        "LastName": "Jones"
      },
      {
        "EffectiveDate": "2025-05-01",
        "LastName": "Taylor"
      }
    ],
    "SupervisorChanges": [
      {
        "EffectiveDate": "2025-05-01",
        "Supervisor": "00000428"
      }
    ]
  }
  ```

  > **Note**
  >
  > First `EffectiveDate` under "`LastNameChanges`" is masked as it reveals birth date of the employee.

> [!NOTE]
>
> By default, these attributes will be a part of the schema attributes for the new application. If required for the upgraded application, these attributes must be added manually. If the attribute is not present, then no valid event exists for that attribute.

## Infotype0000JSON

The `Infotype0000JSON` schema attribute allows you to aggregate data related to Action Type configuration parameters in JSON format, as follows:

```text
Infotype0000JSON : { "Actions": [{ "ActionTypeCode" : "<Value>","ActionTypeName": "<Value>","ReasonCode" : "<Value>","ReasonTypeText": "<Value>","ActionStartDate" : "<Value>","ActionEndDate" : "<Value>" }] }
```

The specific details are as follows:

- ActionTypeCode - A value of action to use (a numeric value).
- ActionTypeName - The name of the action (a text value).
- ReasonCode - The code of reason to use (a numeric value).
- ReasonTypeText - The name of the reason (a text value).
- ActionStartDate - Format: YYYY-MM-DD
- ActionEndDate - Format: YYYY-MM-DD

The empty attribute value for `infotype0000JSON` indicates no future events for an identity, displayed as `Infotype0000JSON: { "Actions": [ ] }`

> [!NOTE]
>
> By default, these attributes will be a part of the schema attributes for the new application. If required for the upgraded application, these attributes must be added manually. If the attribute is not present, then no valid event exists for that attribute.

# Enable Connector Logging

This topic provides the steps needed to enable logging on SailPoint using REST APIs.

> [!NOTE]
>
> This topic only applies to VA-based integrations.

> [!NOTE]
>
> The examples provided might not match your configuration. Use the logging levels and logging classes reference at the bottom of the topic to configure your API responses to match your connector.

This process is broken up into four steps:

1. Identify the Virtual Appliance (VA) cluster on which you want to enable logging.
2. Get the logging configuration for the existing VA cluster.
3. Update the VA cluster to enable logging levels.
4. Observe logging changes to the logging levels.

### Identify the Virtual Appliance Cluster

Select the VA on which you need to enable logging using REST API. If you already know the VA application's `id`, proceed to [Get the Logging Configuration](<#get-the-logging-configuration>).

1. Make the following call to the REST API to return a list of available VA clusters:

   GET /v3/managed-clusters

   The REST API returns a response that looks similar to the following:

   ```json
   [
       {
           "id": "2c9180866166b5b0016167c32ef31a66",
           "name": "Development Cluster",
           "description": "Development Cluster",
           "clientType": "CCG",
           "ccgVersion": "373_535_70.2.0",
           "pinnedConfig": true,
           "logConfiguration": null
       },
       {
           "id": "2c9180846a93ce60016ab29f039944de",
           "name": "Cloud Cluster",
           "description": "Cloud Cluster",
           "clientType": "CCG",
           "ccgVersion": "373_535_70.2.0",
           "pinnedConfig": true,
           "logConfiguration": {
               "clientId": null,
               "durationMinutes": 60,
               "expiration": "2020-12-15T19:13:36.079Z",
               "rootLevel": "DEBUG",
               "logLevels": {
                   "sailpoint.connector.ADLDAPConnector": "DEBUG"
               }
           }
       }
   ]
   ```

   > **Note**
   >
   > The previous example code shows two VA clusters. One VA cluster has a log configuration and the other does not (refer to the `logConfiguration` value in each returned VA cluster). This is because one of the clusters already has logging enabled. This is just an example configuration, and your environment may not have logging enabled on a cluster.
2. Identify the VA cluster that you want to enable logging on by its name or description and record its `id` attribute.

### Get the Logging Configuration

Get your selected VA's cluster logging configuration and identify the values you need to update.

1. Make the following call to the REST API to return the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier.

   GET /v3/managed-clusters/{id}/log-config

   - If the VA doesn't have a logging configuration currently set, it returns `204 No Content` as a response.
   - If the VA has an existing logging configuration, it returns something similar to the following:

     ```json
     {
         "clientId": null,
         "durationMinutes": 60,
         "expiration": "2020-12-15T19:13:36.079Z",
         "rootLevel": "DEBUG",
         "logLevels": {
             "sailpoint.connector.ADLDAPConnector": "DEBUG"
         }
     }
     ```

     You'll need to configure the following information in the response:

     - `durationMinutes` is the number of minutes logging should remain enabled.
     - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>).
     - `logLevels` is a map object with logging classes as keys and logging levels as values.

       - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes.
       - For a list of available values, refer to [Logging Levels](<#logging-levels>).

### Update Logging Configuration

Update the VA cluster configuration returned by the REST API to update the logging settings as needed.

1. Make the following call to the REST API to update the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier.

   PUT /v3/managed-clusters/{id}/log-config
2. Submit your configuration changes to the REST API in a JSON body.

   - If the VA cluster did not already have a logging configuration and you received a `204 No Content` response, you can create a new one.
   - If the VA returned a configuration, you can edit it to include the changes.

   The JSON body should be as follows:

   ```json
   {
       "durationMinutes": 60,
       "rootLevel": "DEBUG",
       "logLevels": {
           "sailpoint.connector.ADLDAPConnector": "DEBUG"
       }
   }
   ```

   Consider the following as you edit the JSON:

   - `durationMinutes` is the number of minutes logging should remain enabled.
   - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>).
   - `logLevels` is a map object with logging classes as keys and logging levels as values.

     - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes.
     - For a list of available values, refer to [Logging Levels](<#logging-levels>).

   If the update was successful, the REST API should return a response similar to the following:

   ```json
   {
       "clientId": null,
       "durationMinutes": 60,
       "expiration": "2020-12-15T19:13:36.079Z",
       "rootLevel": "DEBUG",
       "logLevels": {
           "sailpoint.connector.ADLDAPConnector": "DEBUG"
       }
   }
   ```

### Observe Logging Changes

Approximately five minutes after you update the configuration, the VA cluster starts generating log files you can review. You can view the log files in **ccg.log**.

### References

The tables in this reference section list information that can be helpful when creating the JSON body you'll use to configure the VA cluster's configuration file.

#### Logging Levels

| Logging Level | Description |
| --- | --- |
| ERROR | Designates error events that might still allow the connector to continue. |
| WARN | Designates potentially harmful situations. |
| INFO | Designates information messages that highlight process at a coarse-grain level. |
| DEBUG | Very verbose. Fine grain logging levels used for development and debugging. |
| TRACE | Most verbose. Finer grain logging levels than debugging. |

#### Logging Classes

| Connector | Logging Class |
| --- | --- |
| Active Directory | sailpoint.connector.ADLDAPConnector sailpoint.connector.LDAPConnector |
| AIX | openconnector.connector.unix.AIXConnector openconnector.connector.unix.UnixConnector |
| Amazon Web Services | logger.aws.name=openconnector.connector.aws logger.aws.level=trace logger.aws.additivity = false logger.aws.appenderRef.rolling.ref = STDOUT |
| Atlassian Suite Cloud | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianConnector |
| Atlassian Data Center | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianDataCenterConnector |
| Microsoft Entra ID | sailpoint.connector.AzureADConnector |
| Box | openconnector.connector.BoxNetConnector sailpoint.connector.OpenConnectorAdapter |
| Cerner | openconnector.connector.CernerConnector sailpoint.connector.OpenConnectorAdapter |
| Delimited File | logger.DelimitedFileConnector.name = sailpoint.connector.DelimitedFileConnector logger.DelimitedFileConnector.level = debug logger.DelimitedFileConnector.additivity = false logger.DelimitedFileConnector.appenderRef.rolling.ref = STDOUT |
| Dropbox | openconnector.connector.DropBoxConnector sailpoint.connector.OpenConnectorAdapter |
| Epic | openconnector.connector.EPICConnector sailpoint.connector.OpenConnectorAdapter |
| GE Centricity | openconnector.connector.GECentricity sailpoint.connector.OpenConnectorAdapter |
| Google Apps / G Suite | openconnector.connector.GoogleAppsDirect sailpoint.connector.OpenConnectorAdapter |
| IBM i | openconnector.connector.IBMiConnector |
| Lotus Domino | sailpoint.connector.LotusDomino |
| JDBC | sailpoint.connector.JDBCConnector |
| Sun One LDAP | sailpoint.connector.LDAPConnector |
| Linux | openconnector.connector.unix.LinuxConnector sailpoint.connector.OpenConnectorAdapter sailpoint.connector.UnixConnector |
| Microsoft Office365 | sailpoint.connector.Office365Connector |
| Microsoft SQL Server | sailpoint.connector.mssql.serviceimpl.MSSQLServerConnectorV2 |
| Okta | logger.openconnector.name = openconnector.connector.okta.OktaConnector logger.openconnector.level = debug logger.openconnector.additivity = false logger.openconnector.appenderRef.rolling.ref = STDOUT |
| Oracle Database | sailpoint.connector.OracleDBConnector sailpoint.connector.JDBCConnector |
| Oracle E-Business | sailpoint.connector.OracleEBSConnector sailpoint.connector.JDBCConnector |
| Oracle Fusion HCM | openconnector.connector.oraclefusionhcm.OracleFusionHCMConnector sailpoint.connector.OpenConnectorAdapter |
| Oracle HCM Cloud | sailpoint.connector.oraclehcmcloud.OracleHCMCloudConnector |
| Oracle HRMS | sailpoint.connector.OracleAppsHRMSConnector sailpoint.connector.JDBCConnector |
| Oracle Netsuite | openconnector.connector.netsuite.NetsuiteConnector |
| PeopleSoft ERP | openconnector.connector.PeopleSoftConnector sailpoint.connector.OpenConnectorAdapter |
| PeopleSoft HRMS | sailpoint.connector.PeopleSoftHRMSConnector |
| RemedyForce | sailpoint.connector.ForceConnector |
| RSA Authentication Manager | openconnector.connector.RSAConnector openconnector.connector.rsa.RSAHTTPClient sailpoint.connector.OpenConnectorAdapter |
| Salesforce | sailpoint.connector.ForceConnector |
| SAP Concur | openconnector.connector.sapconcur.SAPConcurConnector |
| SAP - Direct | sailpoint.connector.SAPConnector sailpoint.connector.SAPInternalConnector |
| SAP GRC | logger.SAPGRCConnector.name = sailpoint.connector.sapgrc logger.SAPGRCConnector.level = debug logger.SAPGRCConnector.additivity = false logger.SAPGRCConnector.appenderRef.rolling.ref = STDOUT |
| SAP HR/HCM | sailpoint.connector.SAPHRInternalConnector |
| SCIM 1.1 | openconnector.connector.SCIMConnector sailpoint.connector.OpenConnectorAdapter |
| SCIM 2.0 | openconnector.connector.scim2.SCIM2Connector sailpoint.connector.OpenConnectorAdapter |
| ServiceNow | openconnector.connector.servicenow.ServiceNowConnector openconnector.connector.servicenow.ServiceNowRestClient sailpoint.connector.OpenConnectorAdapter |
| ServiceNow Service Desk Integration | openconnector.connector.servicedesk.ServiceNowServiceDeskConnector sailpoint.connector.OpenConnectorAdapter |
| Siebel | openconnector.connector.SiebelConnector sailpoint.connector.OpenConnectorAdapter |
| Snowflake | openconnector.connector.snowflake.SnowflakeConnector sailpoint.connector.OpenConnectorAdapter |
| Solaris | openconnector.connector.unix.SolarisConnector openconnector.connector.unix.UnixConnector sailpoint.connector.OpenConnectorAdapter |
| SuccessFactors | sailpoint.connector.SuccessFactorsConnector |
| Sybase | sailpoint.connector.SybaseDirectConnector sailpoint.connector.JDBCConnector |
| Webex | openconnector.connector.Webex sailpoint.connector.OpenConnectorAdapter |
| Workday | openconnector.connector.WorkDay sailpoint.connector.OpenConnectorAdapter |
| Workday Accounts | openconnector.connector.workdayaccounts openconnector.connector.workdayaccounts.WorkdayAccountsConnector sailpoint.connector.OpenConnectorAdapter |
| Web Services | sailpoint.connector.WebServices |
| XML | openconnector.connector.XMLConnector sailpoint.connector.OpenConnectorAdapter |
| Yammer | openconnector.connector.YammerConnector sailpoint.connector.OpenConnectorAdapter |
| Zoom | openconnector.connector.zoom.ZoomConnector sailpoint.connector.OpenConnectorAdapter |

# Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

- [SailPoint Identity Services Documentation](<https://documentation.sailpoint.com/saas/help/index.html>)
- [SailPoint Support Knowledge Base](<https://support.sailpoint.com/csm?id=kb_view2&amp;kb_id=05ff44289f011200550bf7b6077fcfa3>)
- [SailPoint Developer Community](<https://developer.sailpoint.com/>)

## Aggregation fails for STAT2\_Next and STAT2\_Next\_Start\_Date for Pre-Hire Records

**Issue**: Unable to aggregate [STAT2\_Next](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/schema.html#support-for-future-data>) and [STAT2\_Next\_Start\_Date](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/schema.html#support-for-future-data>) values for pre-hire type of records.

**Resolution**: Confirm that action type code 01 (default code for hiring) is added in the **Action types** field on the **Additional Settings** tab in SailPoint, along with other required action type codes.

## Aggregation completed with errors

```text
Error: Unparseable date: "DD.MM.yyyy"
```

**Resolution**: Check the permissions for /SAILPOIN/CONF as mentioned in the document for table PA0000, [Configuration Table For SAP HR/HCM](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/sailpoint_add_on.html#configuration-table-for-sap-hrhcm>).

## Additional attributes added in account schema to be fetched using additional attribute BAPI are not aggregated.

**Resolution**: Make sure that the additional attribute description in the account schema matches the name of the attribute configured in additional attribute BAPI.

## While performing Test Connection through SAP router strings, an error message is displayed

```text
ERROR SPSAPROUTER: route permission denied (xxx.xx.X.X to xxx.xxx.Y.Y, 3300.)
```

**Resolution**: Add the following entry in the **saprouttab** of your SAProuter:

```text
P xxx.xx.X.X xxx.xxx.Y.Y 3300
```

Activate the new saprouttab with the following command or restart the SAProuter:

```text
saprouter -n
```

## Test Connection fails with an error even when all the required jars are there in the required path

```text
_JCo initialization failed with java.lang.UnsatisfiedLinkError: C:\apache-tomcat-9.0.35\webapps\identityiq\WEB-INF\lib\sapjco3.dll: Can't find dependent libraries
```

**Resolution**: To resolve the issue, install the Microsoft Visual Studio 2005 C/C++ runtime libraries (version 8.0.50727.6195). The VC++ 2013 can be downloaded from [https://support.microsoft.com/en-us/help/4032938/update-for-visual-c-2013-redistributable-package](<https://support.microsoft.com/en-us/help/4032938/update-for-visual-c-2013-redistributable-package>).

## Test connection and aggregation fail with a JCoRuntimeFactory initialization error

```text
Error: Could not initialize class com.sap.conn.jco.rt.JCoRuntimeFactory" in Test Connection and Aggregation in IdentityNow
```

**Resolution**: The host value must be updated on the VA with the FQDN of the SAP server. Reupload the sapjco and libsapjco jars on the UI.

## Could not initialize class com.sap.conn.jco.rt.JCoRuntimeFactory error on test connection and aggregations in SailPoint

```text
Could not initialize class com.sap.conn.jco.rt.JCoRuntimeFactory
```

**Resolution**: The host value must be updated on VA with the FQDN of the SAP server. Re-upload the `sapjco` and `libsapjco` jars on the UI.

> [!NOTE]
>
> Ensure that all SAP sources pointing to the same VA cluster have the latest and identical versions of SAP JARs uploaded.

## SAP source config test connection fails when the VA is configured with a secure tunnel or VA, and the manage system are in different networks

```text
"sailpoint.connector.ConnectionFailedException: Server is DOWN or Connection parameters are incorrect.
```

OR

```text
ERROR       hostname 'sailpoint-va' unknown\nTIME
```

OR

```text
JCO_ERROR_COMMUNICATION: Connect to SAP gateway failed
```

**Resolution**: There are three possible options to solve this error.

**Option 1**: One of the reasons for the issue to occur is the IP address of the VA is not recognized by the connector. To resolve this, you need to make an entry in hosts.yaml file with the IP address of the VA as well as the managed source (SAP server).

> [!NOTE]
>
> For information on creating a hosts.yaml file, refer to [Configuring a Hosts.yaml File](<https://documentation.sailpoint.com/saas/help/va/config_va.html#configuring-a-hostsyaml-file>).

Example:

```text
hosts:
10.200.80.60: -SAPSER4
10.22.131.14: -sailpoint-va
```

Where `10.200.80.60` is the IP, `SAPSER4` is the hostname of the SAP server, `10.22.131.14` is the IP of the VA, and `sailpoint-va` is the default name of the VA. Ensure that SAP is installed with JCO enabled.

Similarly, add the IP and hostname of the VA being used in the file. Restart CCG/ Reboot the VA after the update.

**Option 2**: Add a Route entry in the static.network file to persist routing the table entry of the VA hostname. To do so, perform the following steps:

1. In your VA, go to `../etc/systemd/network/static.network`
2. Add the following entry:

   ```text
   [Route]
   Gateway=<10.0.0.1>
   Destination=<public_ip>/<netmask>
   ```
3. Run `sudo systemctl restart systemd-networkd` to apply the configuration.
4. Run `route -n` to show the routes.
5. Restart CCG/ Reboot the VA and check if the entry still persisted.

**Option 3**: Update DNS entries for VAs on your network so that FQDN resolves for each VA. To do so, perform the following steps:

1. Run `sudo hostnamectl set-hostname <hostname of your choice>` to set the VA hostname.
2. Run the `hostname` command to validate.
3. Run `sudo reboot` to reboot the VA.

The VA should reflect the new hostname.

## Account aggregation is taking a long time to complete (approx. 2 to 3 days)

**Resolution**: Account aggregation takes a longer time if the SAP target system and the VA are in two separate regions. To resolve the issue, move the VA region to the SAP region to reduce the aggregation time.

## Assign type conflict exception occurs in the UI during connector operations

The following error message is displayed when using the /SAILPOIN/SAIL\_READ\_TABLE or /SAILPOIN/SAIL\_READ\_TABLE\_LEG function modules:

```text
Exception during aggregation. Reason: java.lang.RuntimeException: ASSIGN_TYPE_CONFLICT while querying table *Table_Name*. One of the fields queried (field1,field2,field3… ) may have incorrect COLUMN_LENGTH or COLUMN_DTYPE set in /SAILPOIN/CONF table. Please refer ASSIGN_TYPE_CONFLICT in troubleshooting section of documentation for more details.
```

**Resolution**: Ensure COLUMN\_LENGTH/COLUMN\_DTYPE is correctly configured for the fields of *Table\_Name* in the /SAILPOIN/CONF table. This can be validated through the t-code "SE11" while viewing the table details, under the Fields tab.

## Function `[/SAILPOIN/SAIL_READ_TABLE]` was not found

**Resolution**: Ensure that SailPoint's function module is installed on the SAP system as per [Installation of SAILPOIN Add-On](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/sailpoint_add_on.html#installation-of-sailpoin-add-on>).

## Aggregation fails with error : Data was lost while copying a value : Message 341 of class 00 type X

This error is Caused by class `com.sap.conn.jco.JCoException`: (104) Data was lost while copying a value.: Message 341 of class 00 type X: `SAPSQL_DATA_LOSS`.

**Resolution**: If SAP has been patched to SP 17 or later, change the client language to a single character. For example, if the client language is `EN`, change it to `E`,as shown below:

```text
<entry key="clientLanguage" value="E"/>
```

## SAP connector throws "Unencrypted communication is rejected by this system" error when snc/only\_encrypted\_rfc is set to 1 on SAP server

```text
[ ConnectorException ] [ Error details ] Exception occurred while test configuration operation, refer logs for more details. Initialization of repository destination SAP FS failed: Unencrypted communication is rejected by this system.
```

**Resolution**: Please check the 'snc/only\_encrypted\_rfc' parameter on SAP server, if set to 1, SAP server expects encrypted connections to it. We need to either set the value for this parameter to 0 or setup SNC connection both on SailPoint UI and SAP server to communicate.

## SAP HR connector throws error: `"[ ConnectorException ] [ Error details ] Exception occurred while iterate operation, refer logs for more details. Field 'RETURN' is not a member of record 'TABLES'`

```text
"[ ConnectorException ] [ Error details ] Exception occurred while iterate operation, refer logs for more details. Field 'RETURN' is not a member of record 'TABLES'
```

**Resolution**:

1. Ensure the output of the custom BAPI includes the table `JCOTables` with the following names:

   - `ADDITIONAL_ATTRIBUTE_LIST`
   - `RETURN`
2. Both `ADDITIONAL_ATTRIBUTE_LIST` and `RETURN` tables must be placed under the TABLES tab of the custom BAPI definition. These tables are not included under the Export Tab.
3. The Export tab should be left empty.

## Provisioning fails with an error message when trying to configure SNC using SAP JCO version 3.1

Provisioning fails with the following error message when trying to configure SNC using SAP JCO version 3.1 and when the **client.snc\_sso** parameter is set to `0` in the application debug page:

```text
"WARN: Warning from SAP while executing function [BAPI_USER_CHANGE]Password for user XXXX changed, but not set as productive"
```

**Resolution**: The value of **client.snc\_sso** parameter must be set to 1 (that is, **client.snc\_sso = 1**) or not defined (default is 1) in the SAP application. On the SAP managed system, JCO (SNC Name) value must not be specified in JCO ACL, that is JCO entry must be deleted from SNC0 tcode (table SNCSYSACL). Refer to SAP Note \# 3016480 as recommended by SAP and only specific to SAP JCO 3.1.x.

## Change password is not working with SNC when PRODUCTIVE\_PWD attribute is X

The change password feature is not working with SNC, when PRODUCTIVE\_PWD attribute is X.

**Resolution**: Define the `productivePasswordValue` in a POST via REST API.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

In the body of the POST, set form-data values as follows:

```json
[
    {
        "op": "add",
        "path": "/connectorAttributes/connector_productivePasswordValue",
        "value": "1"
    }
]
```

> [!NOTE]
>
> In the sample above, the value is 1. By default, the value is *X*.

**Resolution 2**: Check the following JCO parameters and add them in the source XML as per your environment requirements:

```text
<entry key="jco.client.snc_mode">
 <value>
 <Boolean>true</Boolean>
</value>
```

```text
<entry key="jco.client.snc_qop" value="X"/>
```

The possible values of *X* are:

- `1`: Authentication only
- `2`: Integrity protection
- `3`: Privacy protection
- `8`: Use the value from `snc/data_protection/use` on the SAP Application Server.

```text
<entry key="jco.client.snc_qop" value="X"/>
```

The possible values of *X* are:

- `0`: Single Sign-On protocol disabled
- `1`: Single Sign-On protocol enabled

> [!NOTE]
>
> Set the value to 0 as of JCO 3.0.9

**Resolution 3**: Ensure the SNC name in table SNCSYSACL (transaction SNC0), is not maintained. If it is present, remove the entry from the table.

## Attributes are not aggregated during account aggregation or Get object processes

**Resolution**: Ensure that the subtype codes and the communication names are mapped properly. For more information, refer to [Advanced Settings](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/connecting.html#advanced-settings>).

## Aggregation failure with exception when fetching additional attributes using a custom BAPI

Aggregation fails as an exception under `fetchAdditionalAttributes` with a `java.lang.NullPointerException` error using a custom BAPI.

**Resolution**: Ensure you have the required permissions set. In the source, check the **Input** in the **Import** tab. Also check the **Output** and **RETURN** in the **Tables** tab. Refer to the second screenshot below for a Custom BAPI entry using SE37.

> [!NOTE]
>
> **Expand for correct configuration examples**
>
> **Input under Import**
>
> [![Input under Import](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/input_under_import.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/input_under_import.png>)
>
> **Output and Return under Tables column**
>
> [![Output and Return under Tables column](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/output_under_export.png>)](<https://documentation.sailpoint.com/connectors/sap/hr_hcm/va/help/img/output_under_export.png>)

# Timeout Errors and Settings

Timeout errors might occur when SailPoint is waiting for a response from the Virtual Appliance (VA). These errors are applicable to all connectors and tend to occur during the setup of sources or when sources are down.

This document is designed to give specific information that can be used to resolve these errors.

Each timeout attribute has a default time value that is listed in seconds or minutes. Increasing the time value may resolve the error as it will allow for longer communication time between the two systems, thus avoiding the timeout error.

> [!IMPORTANT]
>
> Add the necessary attributes or values before performing the "replace" operation, as missing attributes will cause the operation to fail.

To increase the communication time, increase the value of the appropriate timeout attribute. Then submit the change to the VA using the SailPoint REST API.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

### aggregateTimeout

**Description:** This parameter is set for the aggregation timeout, measured in seconds.

**Resolution:** Increase the `aggregateTimeout` value gradually to optimize aggregation. Start with 180, then increase to 600, 900, and finally 1800. The maximum value is 3600 seconds.

For example:

If your current time value is 180 seconds, update the `aggregateTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/aggregateTimeout",
        "value": 600
    }
]
```

### healthCheckTimeout

**Description:** This parameter is set for the test connection and health check timeout.

**Resolution:** The default value is 30 seconds. If the timeout error continues, increase the value in 15 second increments and try again.

For example:

If your current time value is 30 seconds, update the `healthCheckTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/healthCheckTimeout",
        "value": 45
    }
]
```

### provisioningTimeout

**Description:** This parameter is set for provisioning timeout.

**Resolution:** Increase the `provisioningTimeout` value gradually to optimize provisioning. Start with 180, then increase to 360, and finally 600. The maximum value is 600 seconds.

For example:

If your current time value is 180 seconds, update the `provisioningTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/provisioningTimeout",
        "value": 360
    }
]
```

### timeout

**Description:** This parameter is set for pass-through authentication timeout.

**Resolution:** The default value is 15 seconds. If the timeout error continues, increase this value in 15 second increments and try again.

For example:

If your current time value is 15 seconds, update the `timeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/timeout",
        "value": 30
    }
]
```

### apiTimeout

**Description:** This parameter is set for API time tracking; customers can check it using an external tool.

**Resolution:** The default value is 60 seconds. If the error continues, increase the value by 15 second increments and try again.

For example:

If your current time value is 60 seconds, update the `apiTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/apiTimeout",
        "value": "75"
    }
]
```

### timeoutInSeconds

**Description:** This parameter helps prevent the VA from waiting indefinitely for an API response, ensuring efficient handling of API requests.

For example:

If your current time value is 30 seconds, update the `timeoutInSeconds` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/timeoutInSeconds",
        "value": "15"
    }
]
```