Skip to content

Integrating SailPoint with SAP Identity Directory SaaS

Integration

This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

SAP introduced the persistent layer called as Identity Directory to store and manage users, groups, and custom schemas in a central location for SAP Cloud Identity Services.

The SAP Identity Directory provides a system for Cross-domain Identity Management (SCIM) 2.0 REST API for managing resources (users, groups and custom schemas) & follows RFC 7643.

Provisioning of users and managing the entitlements in the SAP Identity Directory to ensure correct access and managing joiner-mover-leaver workflow is achieved through the SailPoint's SAP Identity Directory integration.

To know more about SAP Identity Directory based Integration scenarios, refer to SAP Identity Directory.

This document is designed to give specific information about the requirements and field definitions needed to get a working instance of a SAP Identity Directory SaaS connector.

Note

To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.

Supported Features

The SAP Identity Directory SaaS connector supports the following features:

Aggregation

  • Account Aggregation
  • Groups Aggregation

Add/Remove Entitlement

  • Groups

Account Provisioning

  • Create User
  • Update User (Attributes)
  • Enable/Disable User

Supported Managed Systems

The SAP Identity Directory SaaS connector supports the following managed systems:

  • Cloud Identity Services (SAP Identity Directory)

Prerequisites

Following are the prerequisites to use SailPoint SAP Identity Directory SaaS connector:

  • System administrator must have access to Cloud Identity Services (bundled or standalone) tenant.
  • The Identity Directory SCIM 2.0 API can only manage resources stored in the Identity Directory persistency layer. To utilize the Identity Directory for identity governance, it is necessary to load identities into it through provisioning from an external IdP or HR source, CSV import, or manual creation.

Steps for creating a technical user and its credentials

Following are the steps for creating a technical user and its credentials that you can use to communicate with SAP Identity Directory:

  1. In the SAP Cloud Identity Services admin console, go to Users & Authorizations > Administrators.
  2. Add an administrator user of type System, provide name of the user.
  3. Select Read Users, Manage Users, and Manage Groups permission in Configure Authorizations.
  4. Select Save.
  5. Go to Configure System Authentication > Secrets > Add.
  6. Copy and save the Client Secret and Client ID.

Required Permissions

In the SAP Identity Directory, create a technical user (System User) and its credentials with the following permissions:

  • Read Users
  • Manage Users
  • Manage Groups

For more information, refer to Steps for creating a technical user and its credentials.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.