Configuring SAP Portal - User Management Web Service for Integration

This section describes the configurations to be performed on SAP Server to support the following authentication types:

• Basic Authentication
• OAuth 2.0 Authentication

Configurations on SAP Server for Basic Authentication

Perform the following configurations:

• Installation of SDA
• Authentication Mechanism in SDA

Authentication Mechanism in SDA

1. On the SAP NetWeaver Application Server Java page, go to SAP NetWeaver Administrator.
2. Go to Configuration > Security > Authentication and Single Sign-On.
3. On the Portal Authschemas Migration Status page, search for SailPoint under Policy Configuration Name.
4. Select the SailPoint prefixed policy configuration name and select Edit.

5. On the details of policy configuration page, provide the following values:

   • Login Modules:

     • (For Basic Authentication) BasicPasswordLoginModule
     • (For OAuth 2.0 Authentication) OAuth2Login Module

   • FLAG:

     • SUFFICIENT

     Or

     • REQUIRED

   Note

   Only one Login Module must be specified at a time.

Configurations on SAP Server for OAuth 2.0 Authentication

Perform the following configurations:

• Installation of SDA
• Authentication Mechanism in SDA
• Register a Client Application
• Generation of Authorization Code

Authentication Mechanism in SDA

1. On the SAP NetWeaver Application Server Java page, go to SAP NetWeaver Administrator.
2. Go to Configuration > Security > Authentication and Single Sign-On.
3. On the Portal Authschemas Migration Status page, search for SailPoint under Policy Configuration Name.
4. Select the SailPoint prefixed policy configuration name and select Edit.

5. On the details of policy configuration page, provide the following values:

   • Login Modules:

     • (For Basic Authentication) BasicPasswordLoginModule
     • (For OAuth 2.0 Authentication) OAuth2Login Module

   • FLAG:

     • SUFFICIENT

     Or

     • REQUIRED

   Note

   Only one Login Module must be specified at a time.

Register a Client Application

Following are the required authorizations for registering a client application:

• OAuth Administrator Role: To use administration tools, an OAuth administrator must have the SAP_OAUTH_ADMIN role assigned.
• OAuth User Role: To use end user tools and to grant access of user resources to a client, a user must have the SAP_OAUTH_USER role.

Perform the following to register a client application:

1. Access the administration UI at http://<host>:<port>/oauth/admin.

2. Open the CLIENTS view to manage or register your client.

   1. Go to the Data tab and select the Register New Client button.

      To edit an existing client, select the table row and select the edit icon.

   2. Enter the following data as required.

      Parameter	Description
      Name*	The default name of the client. If no translation for any language is provided, or no translation for the desired locale is found, the default client's name would be used.
      Description	The default description of the client. If no translation for any language is provided, or no translation for the desired locale is found, the default client's description would be used.
      ID*	The Client's ID is automatically generated upon client registration. Note: The Client ID can contain only alphanumeric characters, underscores, and hyphens, and is up to 255 characters long.
      Authorization Grant*	Only authorization code is supported as an authorization grant type.
      Secret	The client secret can only be entered for confidential clients. If a client is marked as confidential, the Secret field is required.
      URL	The client's web site URL.
      Redirect URI*	The redirection endpoint to which the authorization server redirects the user agent after completing its interaction with the resource owner. Enter the value as follows: https://<host>:<port>/SailpointSapEPArchive/ Or http://<host>:<port>/SailpointSapEPArchive/
      Token Lifetime	The lifetime of the access tokens issued for this client. The default value is infinite lifetime.
      Refresh Token Lifetime	The lifetime of the refresh tokens issued for this client. The default value is infinite lifetime. If the value is changed, it must be greater than the value of Token Lifetime.
      Authorization Code Lifetime	The lifetime of the authorization codes issued for this client. The default value is 30 minutes.

      Note

      Only positive numbers are allowed for Token Lifetime, Refresh Token Lifetime and Authorization Code Lifetime.

   3. Save the configuration.

Generation of Authorization Code

1. Go to https://<host>:<port>/oauth/authorize?response_type=code&client_id=<client_id>&scope=<scope>&redirect_uri=https://<host>:<port>/SailpointSapEPArchive/.
2. Login with Service Account having required permission and Scope and select Authorize.

3. Copy the code which is obtained from the above step as follows and save it:

   https://<host>:<port>/SailpointSapEPArchive?code=54aa06c8c43c11eb84a20000006b0896

4. Go to postman and perform a post request using the following:

   Request URL: https://<host>:<port>/oauth/token

   1. In the Authorization tab for a request, select OAuth 2.0 from the Type dropdown list. Specify if you want to pass the auth details in the request URL or headers.

      Note

      By default Postman will append the access token to Bearer in the Authorization header for your request, but if your server implementation requires a different prefix, you can specify it in the Header Prefix field.

   2. To request an access token, fill out the fields in the Configure New Token section, and select Get New Access Token. You can save both the token and the details to generate a token with your request or collection.

      Note

      Once you have a token value generated and added, it will appear in the request Headers.

   3. Enter the details for your client application, and any auth details from the service provider. This allows you to replicate your application auth flow inside Postman in order to test authenticated requests.

   4. Postman will prompt you to supply specific details depending on the OAuth 2.0 grant type. Enter the details, and press Save.
   5. Press Send to send the request. The response should show authenticated:true

   6. Select the Console icon. The Request Header should say Authorization.

      Note

      Authorization passes the client's ID and client's Secret.

   Use the Body type as x-www-form-urlencoded and pass the following attributes:

   Attributes	Value
   client_id	Obtain the value from Register a Client Application.
   grant_type	authorization_code
   code	Obtain the value from step 3 above.
   redirect_uri	Obtain the value from Register a Client Application.
   response_type	token
   scope	Obtain the value from Register a Client Application.

5. Save the Access and Refresh Token.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.