# Integrating SailPoint with SAP Portal

> [!NOTE]
>
> **Integration**
>
> This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

Connecting SailPoint to your SAP Portal allows to integrate information and applications across the enterprise to provide an integrated single point of access to information, enterprise applications, and services both inside and outside an organization. SailPoint's SAP Portal module uses the UME service to perform user management. The User Management Engine (UME) provides a centralized user management for all Java applications and can be configured to work with user management data from multiple data sources.

The UME can be configured to read and write user-related data from and to multiple data sources, such as Lightweight Directory Access Protocol (LDAP) directories, the system database of the AS Java, and user management of an AS ABAP.

The SAP Portal - User Management Web Service manages the following entities of SAP User Management Engine (UME):

- User
- Groups
- Role (UME and Portal)

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The SAP Portal source supports the following features:

- Load and \*provision SAP Portal Accounts
- \*Password management
- \*Access Certifications (certification of entitlements connected to accounts)
- Delete Account

> [!NOTE]
>
> Before you can use any item above marked with an asterisk (\*), SailPoint must activate the feature for your site.

For the SAP Portal source, the **Roles** group object is supported for Read operation. The following entitlements are also supported for ADD/ REMOVE operation:

- Roles
- Groups

For more information on features, refer to [Source Features](<https://community.sailpoint.com/knowledge/Identity-Security-Cloud-Source-Features>).

> [!NOTE]
>
> If SAP Portal is integrated with an external LDAP data source, and you need to aggregate more than 1000 users and associated information from the source, it is recommended to enable pagination using the extended search size attribute. For more information, refer to [Enable Pagination in SAP Portal](<#enable-pagination-in-sap-portal>).

### Enable Pagination in SAP Portal

1. Open the User Management console (UME) of SAP Portal.
2. Select the **Configuration** tab.
3. Select **Modify Configuration** to download the LDAP Data Source xml and add the following line under `<privateSection>`

   ```text
   <ume.ldap.access.extended_search_size>2000</ume.ldap.access.extended_search_size>
   ```

   > **Note**
   >
   > The desired extended size should be the optimum value greater than 1000.
4. Browse and upload the modified LDAP Data Source XML file.
5. Save the changes, and then sign in to the SAP server and restart the SAP Portal instance.

### Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

| Privilege Level | Description |
| --- | --- |
| High | Administrative level access to accounts |
| Medium | Administrative level access for a specific role or function |
| Low | Only basic access of data |

> [!NOTE]
>
> To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.

For more information, refer to [Managing Privilege Classification](<https://documentation.sailpoint.com/saas/help/loading_entitlements/privilege_classification.html>).

> [!NOTE]
>
> **Example**
>
> [![Privilege High](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/img/privilege_high.png>)](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/img/privilege_high.png>)
>
> [![Privilege Medium](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/img/privilege_medium.png>)](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/img/privilege_medium.png>)
>
> [![Privilege Low](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/img/privilege_low.png>)](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/img/privilege_low.png>)

## Prerequisites

- Configure at least one virtual appliance [cluster](<https://documentation.sailpoint.com/saas/help/va/deploy_va.html>) and successfully test the connection.
- The `sailpoint_ume.sda` file must be deployed on the SAP Enterprise Portal server which must be provisioned. For more information on deploying the `sailpoint_ume.sda` file, see [Installation of SDA](<#installation-of-sda>).
- (*For OAuth 2.0 Authentication Type only*) All the roles to be managed by SailPoint must have the scope assigned that was created under [Register a Client Application](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/configuring_for_integration.html#register-a-client-application>).

### Installation of SDA

Perform the following steps to deploy the `sailpoint_ume.sda` file:

1. Download the latest .sda file from the [SailPoint SAP Portal Integration: SDA File](<https://community.sailpoint.com/knowledge/SailPoint-SAP-Portal-Integration-SDA-File>) page.
2. Copy the `SDA` file to a temporary directory on the SAP server.
3. Open the telnet connection to the server (for example, telnet `<hostname>:<telnet port>`) and login with a J2EE administrator user credential. For telnet to work, you must log into the operating system.
4. Execute the `lsc` command to list the available server nodes.
5. Go to the server node, default is 0. Use the `jump 0` command.
6. Run the following command to deploy the `SDA` file:

   ```text
   <path to sailpoint_ume.sda > on_deploy_error=stop
   ```

   For example, `deploy C:\<user name>\sailpoint_ume.sda on_deploy_error=stop`
7. Verify by going to the **System Information** tab.

### Uninstallation of SDA

To uninstall the deployed SDA file, enter the following command:

```text
>UNDEPLOY name=SailpointSapEPArchive vendor=sailpoint.com
```

## Supported Managed Systems

The following versions of SAP NetWeaver are supported by the SAP ERP - SAP Portal - User Management Web Service:

- SAP NetWeaver 7.5 (up to SP28)

> [!NOTE]
>
> The SAP ERP - SAP Portal - User Management Web Service manages SAP User Management Engine users.

## Required Permissions

The service account must have the following permissions for performing test connection, aggregation and provision operations:

- `pcd:portal_content/administrator/user_admin/user_admin_role`
- `pcd:portal_content/administrator/system_admin/system_admin_role`
- `pcd:portal_content/administrator/super_admin/super_admin_role`
- `SAP_J2EE_ADMIN`

For OAuth 2.0 authentication, the scope created in [Register a Client Application](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/configuring_for_integration.html#register-a-client-application>) must be provided which must be assigned to any one of these Roles.

For example,

> [!NOTE]
>
> **Screenshot**
>
> [![Roles example for SAP Portal](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/img/roles_example_for_sap_portal.png>)](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/img/roles_example_for_sap_portal.png>)