# Configuring SAP Portal - User Management Web Service for Integration This section describes the configurations to be performed on SAP Server to support the following authentication types: - Basic Authentication - OAuth 2.0 Authentication ## Configurations on SAP Server for Basic Authentication Perform the following configurations: - [Installation of SDA]() - Authentication Mechanism in SDA ### Authentication Mechanism in SDA 1. On the **SAP NetWeaver Application Server Java** page, go to **SAP NetWeaver Administrator**. 2. Go to **Configuration \> Security \> Authentication and Single Sign-On**. 3. On the **Portal Authschemas Migration Status** page, search for **SailPoint** under **Policy Configuration Name**. 4. Select the SailPoint prefixed policy configuration name and select **Edit**. 5. On the details of policy configuration page, provide the following values: - **Login Modules**: - (*For Basic Authentication*) BasicPasswordLoginModule - (*For OAuth 2.0 Authentication*) OAuth2Login Module - **FLAG**: - SUFFICIENT Or - REQUIRED > **Note** > > Only one Login Module must be specified at a time. ## Configurations on SAP Server for OAuth 2.0 Authentication Perform the following configurations: - [Installation of SDA]() - Authentication Mechanism in SDA - Register a Client Application - Generation of Authorization Code ### Authentication Mechanism in SDA 1. On the **SAP NetWeaver Application Server Java** page, go to **SAP NetWeaver Administrator**. 2. Go to **Configuration \> Security \> Authentication and Single Sign-On**. 3. On the **Portal Authschemas Migration Status** page, search for **SailPoint** under **Policy Configuration Name**. 4. Select the SailPoint prefixed policy configuration name and select **Edit**. 5. On the details of policy configuration page, provide the following values: - **Login Modules**: - (*For Basic Authentication*) BasicPasswordLoginModule - (*For OAuth 2.0 Authentication*) OAuth2Login Module - **FLAG**: - SUFFICIENT Or - REQUIRED > **Note** > > Only one Login Module must be specified at a time. ### Register a Client Application Following are the required authorizations for registering a client application: - **OAuth Administrator Role**: To use administration tools, an OAuth administrator must have the SAP\_OAUTH\_ADMIN role assigned. - **OAuth User Role**: To use end user tools and to grant access of user resources to a client, a user must have the SAP\_OAUTH\_USER role. Perform the following to register a client application: 1. Access the administration UI at `http://:/oauth/admin`. 2. Open the **CLIENTS** view to manage or register your client. 1. Go to the **Data** tab and select the **Register New Client** button. To edit an existing client, select the table row and select the edit icon. 2. Enter the following data as required. | Parameter | Description | | --- | --- | | Name\* | The default name of the client. If no translation for any language is provided, or no translation for the desired locale is found, the default client's name would be used. | | Description | The default description of the client. If no translation for any language is provided, or no translation for the desired locale is found, the default client's description would be used. | | ID\* | The Client's ID is automatically generated upon client registration.
**Note**: The Client ID can contain only alphanumeric characters, underscores, and hyphens, and is up to 255 characters long. | | Authorization Grant\* | Only **authorization code** is supported as an authorization grant type. | | Secret | The client secret can only be entered for confidential clients. If a client is marked as confidential, the **Secret** field is required. | | URL | The client's web site URL. | | Redirect URI\* | The redirection endpoint to which the authorization server redirects the user agent after completing its interaction with the resource owner.
Enter the value as follows:
`https://:/SailpointSapEPArchive/`
Or
`http://:/SailpointSapEPArchive/` | | Token Lifetime | The lifetime of the access tokens issued for this client. The default value is infinite lifetime. | | Refresh Token Lifetime | The lifetime of the refresh tokens issued for this client. The default value is infinite lifetime. If the value is changed, it must be greater than the value of **Token Lifetime**. | | Authorization Code Lifetime | The lifetime of the authorization codes issued for this client. The default value is 30 minutes. | > **Note** > > Only positive numbers are allowed for **Token Lifetime**, **Refresh Token Lifetime** and **Authorization Code Lifetime**. 3. Save the configuration. ### Generation of Authorization Code 1. Go to `https://:/oauth/authorize?response_type=code&client_id=&scope=&redirect_uri=https://:/SailpointSapEPArchive/`. 2. Login with Service Account having required permission and Scope and select **Authorize**. 3. Copy the code which is obtained from the above step as follows and save it: `https://:/SailpointSapEPArchive?code=54aa06c8c43c11eb84a20000006b0896` 4. Go to postman and perform a post request using the following: Request URL: `https://:/oauth/token` 1. In the **Authorization** tab for a request, select **OAuth 2.0** from the **Type** dropdown list. Specify if you want to pass the auth details in the request URL or headers. > **Note** > > By default Postman will append the access token to Bearer in the Authorization header for your request, but if your server implementation requires a different prefix, you can specify it in the Header Prefix field. 2. To request an access token, fill out the fields in the **Configure New Token** section, and select **Get New Access Token**. You can save both the token and the details to generate a token with your request or collection. > **Note** > > Once you have a token value generated and added, it will appear in the request Headers. 3. Enter the details for your client application, and any auth details from the service provider. This allows you to replicate your application auth flow inside Postman in order to test authenticated requests. 4. Postman will prompt you to supply specific details depending on the OAuth 2.0 **grant** type. Enter the details, and press **Save**. 5. Press **Send** to send the request. The response should show `authenticated:true` 6. Select the Console icon. The Request Header should say Authorization. > **Note** > > Authorization passes the client's ID and client's Secret. Use the Body type as **x-www-form-urlencoded** and pass the following attributes: | Attributes | Value | | --- | --- | | client\_id | Obtain the value from [Register a Client Application](<#register-a-client-application>). | | grant\_type | authorization\_code | | code | Obtain the value from step 3 above. | | redirect\_uri | Obtain the value from [Register a Client Application](<#register-a-client-application>). | | response\_type | token | | scope | Obtain the value from [Register a Client Application](<#register-a-client-application>). | 5. Save the Access and Refresh Token.