# SAP Integrated Business Planning SaaS Connector > SailPoint SAP Integrated Business Planning SaaS Connector Documentation # Documentation # Connecting SailPoint and SAP Integrated Business Planning SaaS To connect SailPoint with SAP Integrated Business Planning, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. > [!IMPORTANT] > > By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration. **To configure a new source:** 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Actions**. 5. In the **Actions** dropdown list, select the setup method: - [**Express Setup**](<#configuring-a-source-using-express-setup>) - Quickly create a read-only connection to your target system by providing minimal configurations and authentication. On completion, aggregation is automatically started. > **Note** > > Express Setup supports Credential Providers. For information on supported credential providers and configuration, refer to [Credential Providers](). For more information, contact your SailPoint Customer Service Manager. - [**Standard Setup**](<#configuring-a-source-using-standard-setup>) - Provide detailed basic configuration to create the source. Once the source is created, continue with source setup. ### Configuring a Source Using Express Setup Express Setup minimizes the initial configuration process so you can quickly connect the application and immediately begin aggregating user account and entitlement data. 1. Review the directions and select **Start Express Setup**. 2. Review the pre-populated **Source Name**, **Source Owner**, and **Description**. To update, select **Edit**. > **Note** > > The source name must be unique. You can change these settings later in the source configuration. 3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 4. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** section. 5. Select **Finish**. After a successful test connection, the system creates your source and prompts you to run an aggregation. - If you want to aggregate now, select **Aggregate**. - To see the latest account aggregation history, go to **Account Management \> Account Aggregation**. - To see the list of aggregated source accounts, go to **Account Management \> Accounts**. - If you want to aggregate later, select **Exit**. This returns you to the **Sources** page. Your new source is listed, but contains no accounts or aggregation history yet. ### Configuring a Source Using Standard Setup Use Standard Setup to configure the connector for full feature support. 1. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 2. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 3. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 4. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 5. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 6. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 4. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 5. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 6. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default. - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system. - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source. 7. Select **Save**. ## Connection Settings Provide the information required to connect and interact with the source. To configure SAP Integrated Business Planning (SAP IBP) via Identity Provisioning Services (IPS) proxy system, complete the following: > [!NOTE] > > **Screenshot** > > [![Connection Settings]()]() 1. Enter the **Base URL** of the Cloud Identity Services. 2. Enter the **System ID** of the IPS Proxy Source for SAP IBP system. 3. Enter the **Client ID** of a technical user to authenticate to SAP IPS Proxy Source. 4. Enter the **Client Secret** of a technical user to authenticate to SAP IPS Proxy Source. ### Additional Connection Settings This is an optional setting, only required if you want to aggregate the business catalogs assigned to the business roles as a part of entitlement aggregation. For more information on the required prerequisites steps for aggregating permission filters, refer to [Aggregation Prerequisites](). > [!NOTE] > > **Screenshot** > > [![Additional Connection Settings]()]() 1. Select the **Authentication Type** used by the SAP IBP system as `Basic Authentication`. 2. Enter the SAP IBP **Host URL** of the SAP Integrated Business Planning system. For more information, refer to [Steps for finding Host URL required for SAP\_COM\_xxxx](). 3. Enter the **Username** of the communication user to authenticate with the SAP Integrated Business Planning system. 4. Enter the **Password** of the communication user to authenticate with the SAP Integrated Business Planning system. 5. Select **Save**. ## Aggregation Settings Provide the following settings requirement for aggregation: For more information about aggregation, refer to [Loading Account Data](). ### Page Size Settings > [!NOTE] > > **Screenshot** > > [![Aggregation Settings]()]() 1. Enter the number of records in the **Page Size** to aggregate in a single page when iterating over large datasets. The default is 100 records. 2. Select **Save**. ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation. # Enable/Disable Account > [!NOTE] > > `Username` of the user and associated `Employee ID (Person External ID)` must be same for enable/disable operation to work correctly. The following table outlines the use cases, the SAP IBP SaaS connector manages for enable/disable operations: ## For Enable Operation | Locked | Validity | Status Before Enable Operation - At IBP System | Status Before Enable Operation - At SailPoint System | Status After Enable Operation - At IBP System | Status After Enable Operation - At SailPoint System | | --- | --- | --- | --- | --- | --- | | True | startdate \< currentdate
enddate \> currentdate | Locked | Disabled | User is unlocked | Enabled | | False | startdate \> currentdate
enddate \> currentdate | Out of validity period | Disabled | Exception will be thrown | Enabled operation is not supported for users whose "Valid from" date is greater than the current date | | True | startdate \> currentdate
enddate \> currentdate | Locked and out of validity period | Disabled | User is unlocked. No action on dates | Disabled | | False | startdate \< currentdate
enddate \< currentdate | Out of validity period | Disabled | "Valid to" date will get changed to 31-12-9999 | Enabled | | True | startdate \< currentdate
enddate \< currentdate | Locked and out of validity period | Disabled | User is unlocked and "Valid to" date will get changed to 31-12-9999 | Enabled | ## For Disable Operation | Locked | Validity | Status Before Disable Operation | Status After Disable Operation - At IBP System | Status After Disable Operation - At SailPoint System | | --- | --- | --- | --- | --- | | False | startdate \< currentdate
enddate \> currentdate | Enabled | Lock user | Disabled | # Integrating SailPoint with SAP Integrated Business Planning SaaS > [!NOTE] > > **Integration** > > This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager. The SAP Integrated Business Planning for Supply Chain (SAP IBP) solution is a cloud-based supply chain planning solution that scales to accommodate business growth and integrates with other SAP and third-party systems. It integrates key aspects of the planning process including demand, supply, inventory, and sales and operations planning (S&OP). SAP IBP Identity Governance is a new SailPoint SAP Cloud integration that will aggregate and provision business users, business roles. The SAP IBP Integration has been built using SAP Identity Provisioning Services (IPS) and IBP REST APIs. The credentials used to connect to SAP IBP are - SAP Cloud Identity Services Technical User and REST API credentials from the SAP IBP System. For more information, refer to [Required Permissions](<#required-permissions>). > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features The SAP IBP SaaS connector supports the following features: - Aggregation - Account Aggregation (Business Users, Permission Filters, User Groups) - Groups Aggregation (Business Roles, Permission Filters, User Groups) - Add/Remove Entitlement - Groups (Business Roles, Permission Filters, User Groups) - Account Provisioning (Business User) - Create User - Update User (Attributes) - Enable/Disable User - Delete User ## Supported Managed Systems The connector supports the following managed systems: - SAP Integrated Business Planning for Supply Chain (SAP IBP) ## Prerequisites - The SAP IBP supply chain proxy application must be registered on the IPS tenant. For more information, refer to the [SAP IBP documentation](). ### Aggregation Prerequisites To aggregate business catalogs, User Groups or permission filters during aggregation, complete these steps first. After that, you can proceed with the configuration on [Additional Connection Settings](). #### Supported Capabilities | Supported Entitlements | Aggregation Capabilities | | --- | --- | | Business catalogs | Entitlement aggregation | | Permission filters | Account aggregation, Entitlement aggregation | | User Groups | Account aggregation, Entitlement aggregation | Complete the following prerequisites steps to aggregate the required entitlements: 1. Create a communication user including communication system and communication arrangement. If you have used certificate based authentication, you will need to follow all the steps to create a communication user with basic authentication for aggregating business catalogs or permission filters, including communication system and communication arrangement with SAP\_COM\_xxxx communication scenario. For more information, refer to [Required Permissions](<#required-permissions>). If you have already created a communication user with basic authentication, you can use the same communication user and communication system for these entitlements. > **Note** > > Ensure to create a new communication arrangement with SAP\_COM\_xxxx communication scenario for aggregating business catalogs or permission filters. For more information, refer to [Create communication arrangement with SAP\_COM\_xxxx communication scenario](<#create-comm-arrangement>). 2. Create communication arrangement with SAP\_COM\_xxxx communication scenario. Follow the steps for creating communication arrangement with communication scenario SAP\_COM\_xxxx for aggregating required attributes: 1. Search and select the **Communications Arrangements** tile on the homepage. 2. Select **New** to create a new communication arrangement. 3. Select appropriate communication scenario **SAP\_COM\_xxxx**. | Attributes | Required Communication Scenario | | --- | --- | | Business catalogs | SAP\_COM\_0A04 | | Permission filters | SAP\_COM\_0069 | | User Groups | SAP\_COM\_0777 | 3. Select **Create** and update the arrangements in accordance with your requirements. 4. Select the **Communication System** you previously created in [Steps for creating a communication system](<#create-comm-system>). > **Note** > > You can configure both SAP\_COM\_0A04 and SAP\_COM\_0069 communication arrangements within a single communication system. Separate system creation is not required if both are needed. 5. Select **Save**. #### Steps for finding Host URL required for SAP\_COM\_xxxx 1. Go to the SAP IBP managed system interface. 2. Locate the communication arrangement with SAP\_COM\_xxxx, where xxxx represents the specific entitlement communication scenario. 3. Within the communication arrangement, go to the **Inbound Services** section. 4. Find the **Service URL/ Service Interface** that corresponds to the desired **Service** and use it up to the `ondemand.com`. For example, if the Service URL is `https://my1234-api.scmibp1.ondemand.com/sap/opu/odata4/sap/aps_iam_api_brole_read/srvd_a2x/sap/businessrole/0001/` then, the Host URL will be: `https://my1234-api.scmibp1.ondemand.com` ## Required Permissions ### Settings Required for IPS Proxy System Connection - Configuration required from the IBP system. Following are the steps for creating a communication user, including communication system and communication arrangement to be used in IPS proxy system: > **Steps for creating a communication user** > > Following are the steps to create a communication user from the SAP IBP system: > > 1. Search and select the **Maintain Communication Users** tile on the homepage. > 2. Select **New** to create a new communication user. > 3. Enter a unique **User Name** and relative **Description**. > 4. - For basic authentication, provide a password for the user. > - For certificate-based authentication, upload the certificate you have generated in the Identity Provisioning UI. > > Either provide a password (basic authentication) or upload certificates for certificate-based authentication. > > **Steps for generating the certificate for certificate-based authentication** > > In your newly added SAP Integrated Business Planning for Supply Chain proxy system, select the **Certificate** tab and choose **Generate Download**, as described in [Generate and Manage Certificates for Outbound Connection](). For more information, refer to [SAP Integrated Business Planning for Supply Chain](). > 5. Select **Save**. > **Steps for creating a communication system** > > Following are the steps to create a communication system from the SAP IBP system: > > 1. Search and select the **Communication System** tile on the homepage. > 2. Select **New** to create a new communication system. > 3. Enter the **System ID** and **System Name** (Provide any system relative name). > 4. Enter the **Host Name** (Host Name of the IPS system). > 5. Go to **Users for Inbound Communication**. > 6. Select the **\+** (plus) button. > 7. Select the **Authentication Method** as `User Name and Password` or `SSL Client Certificate`. > 8. Enter the **User Name** or the **Client ID** by selecting a communication user created in the [Steps for creating a communication user](<#create-comm-system>). > 9. Select **OK** and then **Save**. > **Steps for creating a communication arrangement** > > Following are the steps to create a communication arrangement from the SAP IBP system: > > 1. Search and select the **Communication Arrangements** tile on the homepage. > 2. Select **New** to create new communication arrangements. > 3. Select communication scenario **SAP\_COM\_0193** (Identity Provisioning Integration). > 4. Select **Create** and update the arrangements as per your choice. > 5. Select the **Communication System** created in the [Steps for creating a communication system](<#create-comm-system>). > 6. Select **Save**. - Configuration required from the IPS system. Following are the steps for creating a technical user including the proxy system. > **Steps for creating a technical user** > > Following are the steps to create the technical user from the SAP IPS system: > > 1. To enable basic authentication, sign in to the SAP Cloud Identity Services admin console, and go to **Users and Authorizations \> Administrators**. > 2. Add an administrator user of the type **System**, and then provide the name of the user. > 3. In the **Configure Authorizations**, select **Access Proxy System API** permission, and then select **Save**. > 4. Go to **Configure System Authentication \> Secrets \> Add**, provide **Description** and **expires in**, and then select **Save**. > 5. Copy and save the **Client Secret** and **Client ID**. These are the technical user credentials that you will use to communicate with SAP. > **Steps for creating a proxy system** > > > **Important** > > > > SailPoint recommends [using the import file](<#using-the-import-file>) for creating the proxy system from the SAP IBP system. > > You can create the proxy system from the SAP IPS system in two ways: > > **Using the import file** > > 1. Sign in to the SAP Cloud Identity Services admin console. Go to **Identity Provisioning \> Proxy Systems**, and then select **\+Add**. > 2. Go to **Define from File** section, select **Browse** to upload the [SAP IBP Proxy System JSON file](). > 3. Provide the **System Name** as per your preference, go to **Properties** tab and update the properties from the [SAP IBP Proxy System Properties](<#sap-ibp-proxy-system-properties>) table containing properties of the SAP IBP proxy system. > 4. Select **Save**. > > **Using the manual process** > > 1. Sign in to the SAP Cloud Identity Services admin console. Go to **Identity Provisioning \> Proxy Systems**, and then select **\+Add**. > 2. Enter the following values on the configuration details page. > > - **Type**: SAP Integrated Business Planning for Supply Chain > - **System Name**: User defined name > - **Description**: User defined description > 3. Select **Save**. > 4. Set the **Read Transform** to exchange data within the target system in the SCIM2 compliant format. > > 1. Select **Read Transformation**, and switch to the JSON editor. > 2. Select **Edit**, and replace the transformation content with the provided [read transform JSON file](). > 3. Select **Save**. > 5. Set the **Write Transform** to exchange data within the target system in the SCIM2 compliant format. > > 1. Select **Write Transformation**, and switch to the JSON editor. > 2. Select **Edit**, and replace the transformation content with the provided [write transform JSON file](). > 3. Select **Save**. > 6. Select **Properties**. It is mandatory to set properties to configure the proxy connection to target systems. Enter the values from the [SAP IBP Proxy System Properties](<#sap-ibp-proxy-system-properties>) table containing properties of the SAP IBP proxy system and then, select **Save**. > > #### SAP IBP Proxy System Properties > > The table below outlines the properties of the SAP IBP proxy system with required description and values: > > | Property Name | Description and Values | > | --- | --- | > | Type | Enter `HTTP` | > | URL | Enter the URL to your SAP IBP system. For example, `https://-api.scimbp1.ondemand.com` | > | ProxyType | Enter `Internet` | > | Authentication | Enter your authentication method:
\- BasicAuthentication
\- ClientCertificateAuthentication | > | User | Valid if using the basic authentication method.
Enter the user name from the communication arrangement. This is the user name created in the [Steps for creating a communication user](<#create-comm-system>) section.

Do not use commas (,) as they are not supported. | > | Password | Valid if using the basic authentication method.
Enter the password for the communication user.

Do not use commas (,) as they are not supported. | > | ibp.skip.read.archived | In the event of archived (disabled) entities in your SAP IBP system, choose whether the provisioning jobs continue reading those entities or skip them.
By default, this is enabled. If you want to always read disabled identities, set the property to `false` or delete it. | > | ibp.user.roles.overwrite | This property defines whether the current roles of a user are preserved or overwritten by the identity provisioning service within the SAP IBP proxy system in a hybrid scenario.
\- If set to `true`, the current user roles will be deleted in the proxy system, and the user will be updated only with the roles provisioned by the service.
\- If set to `false`, the current user roles will be preserved and the new roles (if any) will be added for the relevant user in the proxy system. | > | ips.date.variable.format | `yyyy-MM-dd` | > > For more information, refer to the [SAP IBP documentation](). # Provisioning The SAP Integrated Business Planning SaaS connector supports provisioning, allowing you to create and manage accounts and entitlements in SAP Integrated Business Planning directly from SailPoint. **Prerequisite:** Your system is configured for provisioning. When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*. When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment. For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account. > [!IMPORTANT] > > This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail. ## Default Create Account Attributes The following list outlines which account attributes SailPoint uses to create a profile for new SAP IBP SaaS connector accounts: > [!IMPORTANT] > > - With business user creation, its associated employee will also get created. > - The `Username` provided during account creation will be used as the `Employee ID` for employee creation. > - `phoneType`, `phoneNumberExtension`, `phoneNumber`, and `countryDialingCode` are attributes related to business phone type. | Account Attribute | Type | Generator | Description | | --- | --- | --- | --- | | Username | String | Identity Attribute - User Name | The user's username | | First Name | String | Identity Attribute - Given Name | The user's first name | | Last Name | String | Identity Attribute - Family Name | The user's last name | | Email | String | Identity Attribute - Work Email | The user's email address | | name.middleName | String | Disable | The user's middle name | | active | Boolean | Disable | The user's active status | | academicTitle | String | Disable | The user's academic title | | function | String | Disable | The user's functional title name | | building | String | Disable | Building name | | roomNumber | String | Disable | Room number | | lastNamePrefix | String | Disable | The user's last name prefix | | Initials | String | Disable | The user's initials | | nameSupplement | String | Disable | Name Supplement | | startDate | String | Disable | Validity start date of user | | endDate | String | Disable | Validity end date of user | | empStartDate | String | Disable | Start date of employee | | empEndDate | String | Disable | End date of employee | | timezone | String | Disable | The user's timezone | | locale | String | Disable | Log on language code | | timeFormatCode | String | Disable | Time format code | | dateFormatCode | String | Disable | Date format code | | decimalFormatCode | String | Disable | Decimal format code | | birthName | String | Disable | User's name at birth | | nickName | String | Disable | The user's nick name | | department | String | Disable | The user's department | | additionalLastName | String | Disable | Additional last name | | lastNameSecondPrefix | String | Disable | Additional last name prefix | | academicSecondTitle | String | Disable | Academic second title | | phoneType | String | Disable | Phone type | | phoneNumberExtension | String | Disable | The extension for the user's phone number | | phoneNumber | String | Disable | The user's phone number | | countryDialingCode | String | Disable | The country code for the user's phone number | # Schema Reference The application schema is used to configure the objects returned from a connector. > [!NOTE] > > - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas]() for more information. > - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified. The SAP Integrated Business Planning SaaS connector uses the following default correlation and object configurations. ## Default Correlation Configuration Before you aggregate accounts from this source, you can map account attributes with their corresponding identity attributes based on your requirements. You can customize the correlation configuration. Refer to [Assigning Source Accounts to Identities]() for more information. When you first create the SAP Integrated Business Planning SaaS source, the default correlation mapping is: | Account Attribute | Operation | Identity Attribute | | --- | --- | --- | | ID | Equals | Username | | Email | Equals | Work Email | ## Default Account Schema Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location. The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas]() for more information. ### Default Account ID SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*. > [!CAUTION] > > Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts. > > To resolve issues caused by changing account IDs, reconfigure them to their default values. The following table lists the default account IDs for this connector: | Account ID | Schema Object Type | | --- | --- | | ID | Account | | ID | Group | | ID | Role | | ID | uwAuthorityProfile | ### Default Account Attributes The SAP Integrated Business Planning SaaS connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified. | Attribute Name | Description | | --- | --- | | ID | ID of the business partner. | | Active | The user's active status. | | User Name | The user's user name. | | User ID | User ID. | | Person UUID | Unique ID of the business partner. | | Global User ID | Global User ID. | | Person External ID | Employee ID of the business partner. | | First Name | The user's first name. | | Last Name | The user's last name. | | Middle Name | The user's middle name. | | Department | Department of employee. | | Function | Functional title name. | | Full Name | The user's full name. This is an Account Name. | | Last Name Prefix | The user's last name prefix. | | Initials | The user's initials. | | Name Supplement | Name supplement. | | Email | The user's email address. | | User Start Date | Validity start date of user. | | User End Date | Validity end date of user. | | Employee Start Date | Start date of employee. | | Employee End Date | End date of employee. | | Timezone | User's timezone. | | Logon Language Code | Logon language code. | | Time Format Code | Time format code. | | Date Format Code | Date format code. | | Decimal Format Code | Decimal format code. | | Groups | Business roles assigned to user. Type: group. Properties: Entitlement, Multi-Valued | | Locked | Indicates the user's locked status | | Permission Filters | Permission filters assigned to business users. Properties: Entitlement, Multi-Valued | | User Groups | User Groups assigned to business users. Type: userGroups. Properties: Entitlement, Multi-Valued | ### Additional Account Attributes The following lists the additional supported account attributes that you can configure as per your requirement: > [!NOTE] > > Use the attribute name as indicated for aggregation. | Attribute Name | Description | | --- | --- | | birthName | The user's birth name. | | nickName | The user's nick name. | | lastNameSecondPrefix | The user's last name second prefix. | | additionalLastName | The user's additional last name, if any. | | academicSecondTitle | The user's academic second title. | | academicTitle | The user's academic title. | | building | Building name. | | roomNumber | Room number. | | phoneNumberExtension | Phone Number Extension. | | phoneNumber | Phone number. | | countryDialingCode | Country dialing code. | ## Default Entitlement Attributes Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements]() for more information. > [!CAUTION] > > Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations. ### Default Group Attributes The SAP Integrated Business Planning SaaS connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups. | Attribute Name | Description | | --- | --- | | ID | The ID of the group. This is an Entitlement ID which must not be changed. | | Group Name | The name of the group. This is an Entitlement Name. | | Members | The members of the group. | | Description | The group's description. | | Catalogs | The catalogs assigned to business role. | ### Permission Filters The following lists the permission filters attributes. #### Object Type: `permissionFilters` | Attribute Name | Description | | --- | --- | | Permission Filter | The unique identifier of the Permission Filter. | | Planning Area | The unique identifier of the associated Planning Area. | | Planning Area Description | The description of the Permission Filter's planning area. | | Description | The user-defined text description of the Permission Filter. | | RfcRestrType | Indicates whether read access to attributes is (R)estricted or (U)nrestricted. | | WfcRestrType | Indicates the level of write access to attributes: (N)o Access, (R)estricted, or (U)nrestricted. | | WkfRestrType | Indicates whether write access to key figures is (R)estricted or (U)nrestricted. | #### Additional Supported Permission Filter attributes list includes: | Attribute Name | Description | | --- | --- | | ChangedAt | Timestamp indicating when the Permission Filter was last modified. | | ChangedBy | Username of the user who last modified the Permission Filter. | | CreatedAt | Timestamp indicating when the Permission Filter was originally created. | | CreatedBy | Username of the user who originally created the Permission Filter. | | NumUsers | The number of users assigned to the Permission Filter. | | NumGroups | The number of user groups associated with the Permission Filter. | | NumRoles | The number of business roles assigned to the Permission Filter. | | Autocomplete | Flag indicating whether missing filter criteria from the planning level should be automatically added to the Permission Filter. | | CreatedByEmailAddress | Email address of the user who originally created the Permission Filter. | | CreatedByPhoneNumber | Phone number of the user who originally created the Permission Filter. | | ChangedByEmailAddress | Email address of the user who last modified the Permission Filter. | | ChangedByPhoneNumber | Phone number of the user who last modified the Permission Filter. | ### User Groups The following lists the User Groups attributes. | Attribute Name | Description | | --- | --- | | GroupID | The unique identifier of the User Group. | | Group Description | The description of the User Group. | | CategoryID | The Category ID of the User Group. | | UserCount | The number of users associated with the User Group. | #### Additional Supported User Groups attributes The following is a list of additional supported attributes for the User Group: | Attribute Name | Description | | --- | --- | | CreatedBy | UserID of the user who last modified the User Group. | | CreatedAt | Timestamp indicating when the User Group was originally created. | | ChangedBy | UserID of the user who last modified the User Group. | | ChangedAt | Timestamp indicating when the User Group was last modified. | # Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Debug Logs For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](). ## 422 error during test connection The following error message appears during test connection: ```text [ ConnectorException ] [ Error details ] Error while performing operation : Test Connection Error code : 422 {"schemas":["urn:ietf:params:scim:api:messages:2.0:Error"],"detail":"No system found for id 532bf634-c86d-55-b0d9-4204f1273349c","status":422}} ``` **Resolution**: Ensure to enter the correct IBP Proxy system ID in the SAP IBP source. ## 500 error during test connection The following error message appears during test connection: ```text [ ConnectorException ] [ Error details ] Error while performing operation : Test Connection Error code : 500 {"schemas":["urn:ietf:params:scim:api:messages:2.0:Error"],"detail":"org.apache.cxf.interceptor.Fault: Could not send Message.","status":500}} ``` **Resolution**: Ensure that the provided communication user, in the proxy system, is not locked or has a deactivated password on the IPS system. ## Host error is displayed The following error message appears during test connection: ```text [ ConnectorException ] [ Error details ] Host is null or incorrectly formed. } ``` **Resolution**: On the **Connection Settings** page, ensure that the provided **Base URL** is correct. ## Update account error The following error message appears during provisioning: ```text [ ConnectorException ] \n [ Error details ] Error while performing operation : Update Account Error code : 500 {\"schemas\":[\"urn:ietf:params:scim:api:messages:2.0:Error\"],\"detail\":\"Failed to update entity.\",\"status\":500}} (requestId: 385578afc7c644a0a31a360c1f0ed636)“] ``` **Resolution**: Ensure that the entered `Username` and `Employee ID (Person External ID)` of a user is same. ## Create operation fails with 405 method not allowed error The following error message appears during create operation: ```text [ ConnectorException ] [ Error details ] [ InvalidRequestException ] [ Possible suggestions ] err_scim_msg_405 [ Error details ] Error while performing operation : Create Account Error code : 405 Method Not Allowed ``` **Resolution**: The SAP IBP managed system appears to have a character length limitation for certain attributes, such as FUNCTION and DEPARTMENT. To resolve this issue, ensure that the values for the FUNCTION and DEPARTMENT attributes have a character length of less than 40. # Update Account > [!NOTE] > > - `Username` of the user and associated `Employee ID (Person External ID)` must be same for the update operation to work correctly. > - `phoneType`, `phoneNumberExtension`, `phoneNumber`, and `countryDialingCode` are attributes related to business phone type. The following table lists the attributes that can be updated for accounts: | Account Attribute | Type | Generator | Description | | --- | --- | --- | --- | | First Name | String | Identity Attribute - Given Name | The user's first name | | Last Name | String | Identity Attribute - Family Name | The user's last name | | Email | String | Identity Attribute - Work Email | The user's email address | | name.middleName | String | Disable | The user's middle name | | active | Boolean | Disable | The user's active status | | academicTitle | String | Disable | The user's academic title | | function | String | Disable | The user's functional title name | | building | String | Disable | Building name | | roomNumber | String | Disable | Room number | | lastNamePrefix | String | Disable | The user's last name prefix | | Initials | String | Disable | The user's initials | | nameSupplement | String | Disable | Name Supplement | | startDate | String | Disable | Validity start date of user | | endDate | String | Disable | Validity end date of user | | empStartDate | String | Disable | Start date of employee | | empEndDate | String | Disable | End date of employee | | timezone | String | Disable | The user's timezone | | locale | String | Disable | Log on language code | | timeFormatCode | String | Disable | Time format code | | dateFormatCode | String | Disable | Date format code | | decimalFormatCode | String | Disable | Decimal format code | | birthName | String | Disable | User's name at birth | | nickName | String | Disable | The user's nick name | | department | String | Disable | The user's department | | additionalLastName | String | Disable | Additional last name | | lastNameSecondPrefix | String | Disable | Additional last name prefix | | academicSecondTitle | String | Disable | Academic second title | | phoneType | String | Disable | Phone type | | phoneNumberExtension | String | Disable | The extension for the user's phone number | | phoneNumber | String | Disable | The user's phone number | | countryDialingCode | String | Disable | The country code for the user's phone number |