# SailPoint SAP Portal Connector Documentation

> SAP Portal Connector Documentation

# Documentation

# Configuring SAP Portal - User Management Web Service for Integration

This section describes the configurations to be performed on SAP Server to support the following authentication types:

- Basic Authentication
- OAuth 2.0 Authentication

## Configurations on SAP Server for Basic Authentication

Perform the following configurations:

- [Installation of SDA](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/index.html#installation-of-sda>)
- Authentication Mechanism in SDA

### Authentication Mechanism in SDA

1. On the **SAP NetWeaver Application Server Java** page, go to **SAP NetWeaver Administrator**.
2. Go to **Configuration \> Security \> Authentication and Single Sign-On**.
3. On the **Portal Authschemas Migration Status** page, search for **SailPoint** under **Policy Configuration Name**.
4. Select the SailPoint prefixed policy configuration name and select **Edit**.
5. On the details of policy configuration page, provide the following values:

   - **Login Modules**:

     - (*For Basic Authentication*) BasicPasswordLoginModule
     - (*For OAuth 2.0 Authentication*) OAuth2Login Module
   - **FLAG**:

     - SUFFICIENT

     Or

     - REQUIRED

   > **Note**
   >
   > Only one Login Module must be specified at a time.

## Configurations on SAP Server for OAuth 2.0 Authentication

Perform the following configurations:

- [Installation of SDA](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/index.html#installation-of-sda>)
- Authentication Mechanism in SDA
- Register a Client Application
- Generation of Authorization Code

### Authentication Mechanism in SDA

1. On the **SAP NetWeaver Application Server Java** page, go to **SAP NetWeaver Administrator**.
2. Go to **Configuration \> Security \> Authentication and Single Sign-On**.
3. On the **Portal Authschemas Migration Status** page, search for **SailPoint** under **Policy Configuration Name**.
4. Select the SailPoint prefixed policy configuration name and select **Edit**.
5. On the details of policy configuration page, provide the following values:

   - **Login Modules**:

     - (*For Basic Authentication*) BasicPasswordLoginModule
     - (*For OAuth 2.0 Authentication*) OAuth2Login Module
   - **FLAG**:

     - SUFFICIENT

     Or

     - REQUIRED

   > **Note**
   >
   > Only one Login Module must be specified at a time.

### Register a Client Application

Following are the required authorizations for registering a client application:

- **OAuth Administrator Role**: To use administration tools, an OAuth administrator must have the SAP\_OAUTH\_ADMIN role assigned.
- **OAuth User Role**: To use end user tools and to grant access of user resources to a client, a user must have the SAP\_OAUTH\_USER role.

Perform the following to register a client application:

1. Access the administration UI at `http://<host>:<port>/oauth/admin`.
2. Open the **CLIENTS** view to manage or register your client.

   1. Go to the **Data** tab and select the **Register New Client** button.

      To edit an existing client, select the table row and select the edit icon.
   2. Enter the following data as required.

      | Parameter | Description |
      | --- | --- |
      | Name\* | The default name of the client. If no translation for any language is provided, or no translation for the desired locale is found, the default client's name would be used. |
      | Description | The default description of the client. If no translation for any language is provided, or no translation for the desired locale is found, the default client's description would be used. |
      | ID\* | The Client's ID is automatically generated upon client registration.<br>**Note**: The Client ID can contain only alphanumeric characters, underscores, and hyphens, and is up to 255 characters long. |
      | Authorization Grant\* | Only **authorization code** is supported as an authorization grant type. |
      | Secret | The client secret can only be entered for confidential clients. If a client is marked as confidential, the **Secret** field is required. |
      | URL | The client's web site URL. |
      | Redirect URI\* | The redirection endpoint to which the authorization server redirects the user agent after completing its interaction with the resource owner.<br>Enter the value as follows:<br>`https://<host>:<port>/SailpointSapEPArchive/`<br>Or<br>`http://<host>:<port>/SailpointSapEPArchive/` |
      | Token Lifetime | The lifetime of the access tokens issued for this client. The default value is infinite lifetime. |
      | Refresh Token Lifetime | The lifetime of the refresh tokens issued for this client. The default value is infinite lifetime. If the value is changed, it must be greater than the value of **Token Lifetime**. |
      | Authorization Code Lifetime | The lifetime of the authorization codes issued for this client. The default value is 30 minutes. |

      > **Note**
      >
      > Only positive numbers are allowed for **Token Lifetime**, **Refresh Token Lifetime** and **Authorization Code Lifetime**.
   3. Save the configuration.

### Generation of Authorization Code

1. Go to `https://<host>:<port>/oauth/authorize?response_type=code&client_id=<client_id>&scope=<scope>&redirect_uri=https://<host>:<port>/SailpointSapEPArchive/`.
2. Login with Service Account having required permission and Scope and select **Authorize**.
3. Copy the code which is obtained from the above step as follows and save it:

   `https://<host>:<port>/SailpointSapEPArchive?code=54aa06c8c43c11eb84a20000006b0896`
4. Go to postman and perform a post request using the following:

   Request URL: `https://<host>:<port>/oauth/token`

   1. In the **Authorization** tab for a request, select **OAuth 2.0** from the **Type** dropdown list. Specify if you want to pass the auth details in the request URL or headers.

      > **Note**
      >
      > By default Postman will append the access token to Bearer in the Authorization header for your request, but if your server implementation requires a different prefix, you can specify it in the Header Prefix field.
   2. To request an access token, fill out the fields in the **Configure New Token** section, and select **Get New Access Token**. You can save both the token and the details to generate a token with your request or collection.

      > **Note**
      >
      > Once you have a token value generated and added, it will appear in the request Headers.
   3. Enter the details for your client application, and any auth details from the service provider. This allows you to replicate your application auth flow inside Postman in order to test authenticated requests.
   4. Postman will prompt you to supply specific details depending on the OAuth 2.0 **grant** type. Enter the details, and press **Save**.
   5. Press **Send** to send the request. The response should show `authenticated:true`
   6. Select the Console icon. The Request Header should say Authorization.

      > **Note**
      >
      > Authorization passes the client's ID and client's Secret.

   Use the Body type as **x-www-form-urlencoded** and pass the following attributes:

   | Attributes | Value |
   | --- | --- |
   | client\_id | Obtain the value from [Register a Client Application](<#register-a-client-application>). |
   | grant\_type | authorization\_code |
   | code | Obtain the value from step 3 above. |
   | redirect\_uri | Obtain the value from [Register a Client Application](<#register-a-client-application>). |
   | response\_type | token |
   | scope | Obtain the value from [Register a Client Application](<#register-a-client-application>). |
5. Save the Access and Refresh Token.

# Connecting SailPoint and SAP Portal

To connect SailPoint with SAP Portal, perform the following tasks:

## Adding the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

> [!IMPORTANT]
>
> By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration.

**To configure a new source:**

1. Sign in to SailPoint.
2. Go to **Admin \> Connections \> Sources**.
3. Select **Create New**.
4. Search for the connector by entering the name in the search box, and then select **Actions**.
5. In the **Actions** dropdown list, select the setup method:

   - [**Express Setup**](<#configuring-a-source-using-express-setup>) - Quickly create a read-only connection to your target system by providing minimal configurations and authentication. On completion, aggregation is automatically started.

     > **Note**
     >
     > Express Setup supports Credential Providers. For information on supported credential providers and configuration, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>). For more information, contact your SailPoint Customer Service Manager.
   - [**Standard Setup**](<#configuring-a-source-using-standard-setup>) - Provide detailed basic configuration to create the source. Once the source is created, continue with source setup.

### Configuring a Source Using Express Setup

Express Setup minimizes the initial configuration process so you can quickly connect the application and immediately begin aggregating user account and entitlement data.

1. Review the directions and select **Start Express Setup**.
2. Review the pre-populated **Source Name**, **Source Owner**, and **Description**. To update, select **Edit**.

   > **Note**
   >
   > The source name must be unique. You can change these settings later in the source configuration.
3. Select **Virtual Appliance**. A virtual appliance is a Linux-based virtual machine that connects to your sources and apps using SailPoint APIs, connectors, and integrations. For more information about configuring and deploying virtual appliances, refer to [SailPoint Virtual Appliances](<https://documentation.sailpoint.com/saas/help/va/index.html>).
4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
5. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** section.
6. Select **Finish**.

   After a successful test connection, the system creates your source and prompts you to run an aggregation.

   - If you want to aggregate now, select **Aggregate**.

     - To see the latest account aggregation history, go to **Account Management \> Account Aggregation**.
     - To see the list of aggregated source accounts, go to **Account Management \> Accounts**.
   - If you want to aggregate later, select **Exit**. This returns you to the **Sources** page. Your new source is listed, but contains no accounts or aggregation history yet.

### Configuring a Source Using Standard Setup

Use Standard Setup to configure the connector for full feature support.

1. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
2. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
3. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](<https://documentation.sailpoint.com/saas/help/sources/index.html#assigning-a-source-owner>).
4. Under **Connection Type**, select **Direct Connection** or **Flat File**.

   - **Direct Connection** - A direct connection fetches data from the **Virtual Appliance Cluster** you choose as the application connector for the source. A direct connection configuration allows for real-time updates. For more information about configuring and deploying virtual appliances, refer to the [Virtual Appliance Reference Guide](<https://documentation.sailpoint.com/saas/help/va/index.html>).
   - **Flat File** - Select the flat file if no connector is available, or if another system restricts the connection. This option allows only reading and aggregating data as a generic/delimited application. Provisioning activity is unsupported, and additional configuration pages like connection settings and aggregation settings are unavailable.
5. If you selected **Direct Connection**, in **Virtual Appliance Cluster**, select the virtual appliance cluster that will be used as the application connector for the source.
6. (Optional) Select a governance group to grant its members [source](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#source-sub-admin-user-level>) or [role](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#role-sub-admin-user-level>) sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html>).
7. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](<https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html>).
8. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there.

## Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a unique name and description for the source.
2. In the **Source Owner** dropdown list, select the identity that owns this source.

   - To find a source owner, begin entering their name.
3. In the **Virtual Appliance Cluster** dropdown list, select the virtual appliance to use when communicating with your organization's systems. For more information, refer to [SailPoint Virtual Appliances](<https://documentation.sailpoint.com/saas/help/va/index.html>).
4. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
5. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information.
6. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html#associating-a-governance-group-with-a-source>).
7. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default.

   - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system.
   - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source.
8. Select **Save**.

> [!NOTE]
>
> Ensure that the name and description of each source is unique.

## Connection Settings

The following information is required for SailPoint to connect and interact with SAP Portal UMWebService managed system. After you select **Connection Settings** the following UI page is displayed.

> [!NOTE]
>
> **Screenshot**
>
> [![Connection Settings](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/img/sap_portal_conn_basic.png>)](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/img/sap_portal_conn_basic.png>)

1. In the **UMWebService URL** field, enter the url for the UMWebService. For example, `http://HOST:PORT`

   In the above url, *HOST* refers to the instance where SAP Portal-User Management WebService is installed and *PORT* is the listening port of the server.

   > **Note**
   >
   > - This url can use either http or https.
   > - When using https, the portal server's keystore and the application server's keystore must be configured.
2. Select the one of the following **Authentication Type** supported by the managed system:

   - Basic
   - OAuth 2.0
3. If the **Authentication Type** is selected as **Basic** (default), enter the **Username** and **Password** of the SAP Portal user account which is used when connecting to the Web Service.
4. Select **Save**.

### OAuth 2.0 Authentication Type

If you select the **Authentication Type** as **OAuth 2.0**, *in addition* to the fields mentioned before, provide the following details:

> [!NOTE]
>
> **Screenshot**
>
> [![Connection Settings OAuth 2.0 - 1](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/img/sap_portal_conn_oa1.png>)](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/img/sap_portal_conn_oa1.png>)
>
> [![Connection Settings OAuth 2.0 - 2](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/img/sap_portal_conn_oa2.png>)](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/img/sap_portal_conn_oa2.png>)

1. In the **Grant Type** field, select the authorization grant type supported by the managed system:

   - Refresh Token / Auth Code
2. In the **Client ID** field, enter the Client ID for OAuth 2.0 authentication.
3. In the **Client Secret** field, enter the Client Secret for OAuth 2.0 authentication.
4. In the **Access Token** field, enter the access token required to access the managed system API.
5. In the **Refresh Token** field, enter the token required to regenerate the expired access token.
6. Select **Save**.

## Additional Settings

This section contains the information that the source uses to limit the scope of records to be retrieved when aggregating user accounts and entitlements. After you select **Additional Settings** the following UI page is displayed.

> [!NOTE]
>
> **Screenshot**
>
> [![Additional Settings](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/img/sap_portal_add.png>)](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/img/sap_portal_add.png>)

1. In the **Account Filter** field, enter the string representation of an object filter. Any account object matching the filter is filtered out of the dataset. The following is an example of a filterString that filters out all objects where the uniqueId starts with USER.R3\_DATASOURCE:

   ```text
   uniqueId.startsWith("USER.R3_DATASOURCE.")
   ```

   If this property is non-empty, filtering happens on the SailPoint server side and does not filter on the SAP Portal side.
2. In the **Group Filter** field, enter the string representation of an object filter. Any roles object matching the filter is filtered out of the dataset. The following is an example of a filterString that filters out all objects from the that have a displayName starting with com.sap.pct:

   ```text
   displayName.startsWith("com.sap.pct")
   ```

   When this property is non-empty filtering happens on the SailPoint server side and does not filter on the SAP Portal side.
3. Select **Save**.

## Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to **Review and Test**.
2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.
3. Select **Test Connection**.

## SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface.

For more information, refer to [Application Onboarding](<https://documentation.sailpoint.com/saas/help/ai/app_onboarding/index.html>) in the SailPoint SaaS documentation.

# Integrating SailPoint with SAP Portal

> [!NOTE]
>
> **Integration**
>
> This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

Connecting SailPoint to your SAP Portal allows to integrate information and applications across the enterprise to provide an integrated single point of access to information, enterprise applications, and services both inside and outside an organization. SailPoint's SAP Portal module uses the UME service to perform user management. The User Management Engine (UME) provides a centralized user management for all Java applications and can be configured to work with user management data from multiple data sources.

The UME can be configured to read and write user-related data from and to multiple data sources, such as Lightweight Directory Access Protocol (LDAP) directories, the system database of the AS Java, and user management of an AS ABAP.

The SAP Portal - User Management Web Service manages the following entities of SAP User Management Engine (UME):

- User
- Groups
- Role (UME and Portal)

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

The SAP Portal source supports the following features:

- Load and \*provision SAP Portal Accounts
- \*Password management
- \*Access Certifications (certification of entitlements connected to accounts)
- Delete Account

> [!NOTE]
>
> Before you can use any item above marked with an asterisk (\*), SailPoint must activate the feature for your site.

For the SAP Portal source, the **Roles** group object is supported for Read operation. The following entitlements are also supported for ADD/ REMOVE operation:

- Roles
- Groups

For more information on features, refer to [Source Features](<https://community.sailpoint.com/knowledge/Identity-Security-Cloud-Source-Features>).

> [!NOTE]
>
> If SAP Portal is integrated with an external LDAP data source, and you need to aggregate more than 1000 users and associated information from the source, it is recommended to enable pagination using the extended search size attribute. For more information, refer to [Enable Pagination in SAP Portal](<#enable-pagination-in-sap-portal>).

### Enable Pagination in SAP Portal

1. Open the User Management console (UME) of SAP Portal.
2. Select the **Configuration** tab.
3. Select **Modify Configuration** to download the LDAP Data Source xml and add the following line under `<privateSection>`

   ```text
   <ume.ldap.access.extended_search_size>2000</ume.ldap.access.extended_search_size>
   ```

   > **Note**
   >
   > The desired extended size should be the optimum value greater than 1000.
4. Browse and upload the modified LDAP Data Source XML file.
5. Save the changes, and then sign in to the SAP server and restart the SAP Portal instance.

### Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

| Privilege Level | Description |
| --- | --- |
| High | Administrative level access to accounts |
| Medium | Administrative level access for a specific role or function |
| Low | Only basic access of data |

> [!NOTE]
>
> To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.

For more information, refer to [Managing Privilege Classification](<https://documentation.sailpoint.com/saas/help/loading_entitlements/privilege_classification.html>).

> [!NOTE]
>
> **Example**
>
> [![Privilege High](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/img/privilege_high.png>)](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/img/privilege_high.png>)
>
> [![Privilege Medium](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/img/privilege_medium.png>)](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/img/privilege_medium.png>)
>
> [![Privilege Low](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/img/privilege_low.png>)](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/img/privilege_low.png>)

## Prerequisites

- Configure at least one virtual appliance [cluster](<https://documentation.sailpoint.com/saas/help/va/deploy_va.html>) and successfully test the connection.
- The `sailpoint_ume.sda` file must be deployed on the SAP Enterprise Portal server which must be provisioned. For more information on deploying the `sailpoint_ume.sda` file, see [Installation of SDA](<#installation-of-sda>).
- (*For OAuth 2.0 Authentication Type only*) All the roles to be managed by SailPoint must have the scope assigned that was created under [Register a Client Application](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/configuring_for_integration.html#register-a-client-application>).

### Installation of SDA

Perform the following steps to deploy the `sailpoint_ume.sda` file:

1. Download the latest .sda file from the [SailPoint SAP Portal Integration: SDA File](<https://community.sailpoint.com/knowledge/SailPoint-SAP-Portal-Integration-SDA-File>) page.
2. Copy the `SDA` file to a temporary directory on the SAP server.
3. Open the telnet connection to the server (for example, telnet `<hostname>:<telnet port>`) and login with a J2EE administrator user credential. For telnet to work, you must log into the operating system.
4. Execute the `lsc` command to list the available server nodes.
5. Go to the server node, default is 0. Use the `jump 0` command.
6. Run the following command to deploy the `SDA` file:

   ```text
   <path to sailpoint_ume.sda > on_deploy_error=stop
   ```

   For example, `deploy C:\<user name>\sailpoint_ume.sda on_deploy_error=stop`
7. Verify by going to the **System Information** tab.

### Uninstallation of SDA

To uninstall the deployed SDA file, enter the following command:

```text
>UNDEPLOY name=SailpointSapEPArchive vendor=sailpoint.com
```

## Supported Managed Systems

The following versions of SAP NetWeaver are supported by the SAP ERP - SAP Portal - User Management Web Service:

- SAP NetWeaver 7.5 (up to SP28)

> [!NOTE]
>
> The SAP ERP - SAP Portal - User Management Web Service manages SAP User Management Engine users.

## Required Permissions

The service account must have the following permissions for performing test connection, aggregation and provision operations:

- `pcd:portal_content/administrator/user_admin/user_admin_role`
- `pcd:portal_content/administrator/system_admin/system_admin_role`
- `pcd:portal_content/administrator/super_admin/super_admin_role`
- `SAP_J2EE_ADMIN`

For OAuth 2.0 authentication, the scope created in [Register a Client Application](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/configuring_for_integration.html#register-a-client-application>) must be provided which must be assigned to any one of these Roles.

For example,

> [!NOTE]
>
> **Screenshot**
>
> [![Roles example for SAP Portal](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/img/roles_example_for_sap_portal.png>)](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/img/roles_example_for_sap_portal.png>)

# Machine Account Attributes

Machine account creation uses the same source attributes as standard account creation. For the complete list of supported attributes and their descriptions, refer to [Create Profile Account Attributes](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/schema.html#create-profile-account-attributes>).

## Classification

The Classification attribute is used to identify and categorize the account as a Machine Account.

- Attribute name: SecurityPolicy
- Value: Communication, Reference, Service, System.

For more information, refer to [Machine Identity Security Overview](<https://documentation.sailpoint.com/saas/help/machine/index.html#implementing-without-application-data>).

# Schema Attributes

This section describes the different schema attributes.

> [!NOTE]
>
> The attributes with \* are required attributes.

### Default Account ID

SailPoint requires certain attributes remain in your configuration. These attributes are referred to as Account IDs, and they must not be updated. If you update these attributes from their default values, the connector may fail. To resolve any issues caused by changing Account IDs, re-configure them to their default values. The following table lists the Account IDs for this connector:

| Account ID | Schema Object Type |
| --- | --- |
| uniqueName | Account |
| uniqueName | Group |

## Create Profile Account Attributes

When SailPoint provisions new accounts to a SAP Portal direct connect source, it uses the attributes on the Create Profile page as instructions or a template for what to include in the account. This page is also referred to as the provisioning policy.

> [!IMPORTANT]
>
> This section describes the configuration of the default Create Profile. However, SailPoint recommends that you work with Services to define a Create Profile specific to your company's needs.

The following generators create required information for a new SAP Portal account. You might need to edit the contents.

| Attribute | Description |
| --- | --- |
| uniqueId | Users unique identification |
| firstName | Users first name |
| lastName | Users last name |
| displayName | Users display name |
| company | Users company name |
| title | Users title |
| uniqueName | Users unique name<br>This is an Account ID which must not be changed. |
| city | Users city |
| email | Users email address |
| street | Users street |
| state | Users state |
| country | Users country |
| zip | Users postal zip code |
| fax | Users fax |
| telePhone | Users telephone number |
| cellPhone | Users cell phone number |
| department | Users department assigned |
| salutation | Users salutation |
| jobTitle | Users job title |
| timeZone | Timezone of the user |
| language | Language of the user |
| securityType | Users's security type |
| lockStatus | User is locked or open |
| roles | Role assigned to the user |
| groups | Groups assigned to the user |

## Group Attributes

Following are the list of group attributes:

| Attribute | Description |
| --- | --- |
| displayName | Display name of the role |
| uniqueName | Unique name of the role |
| uniqueId | Unique ID of the role |
| description | Description of the role |
| userMembers | Users associated to the role |
| groupMembers | Groups associated to the role |

# Enable Connector Logging

This topic provides the steps needed to enable logging on SailPoint using REST APIs.

> [!NOTE]
>
> This topic only applies to VA-based integrations.

> [!NOTE]
>
> The examples provided might not match your configuration. Use the logging levels and logging classes reference at the bottom of the topic to configure your API responses to match your connector.

This process is broken up into four steps:

1. Identify the Virtual Appliance (VA) cluster on which you want to enable logging.
2. Get the logging configuration for the existing VA cluster.
3. Update the VA cluster to enable logging levels.
4. Observe logging changes to the logging levels.

### Identify the Virtual Appliance Cluster

Select the VA on which you need to enable logging using REST API. If you already know the VA application's `id`, proceed to [Get the Logging Configuration](<#get-the-logging-configuration>).

1. Make the following call to the REST API to return a list of available VA clusters:

   GET /v3/managed-clusters

   The REST API returns a response that looks similar to the following:

   ```json
   [
       {
           "id": "2c9180866166b5b0016167c32ef31a66",
           "name": "Development Cluster",
           "description": "Development Cluster",
           "clientType": "CCG",
           "ccgVersion": "373_535_70.2.0",
           "pinnedConfig": true,
           "logConfiguration": null
       },
       {
           "id": "2c9180846a93ce60016ab29f039944de",
           "name": "Cloud Cluster",
           "description": "Cloud Cluster",
           "clientType": "CCG",
           "ccgVersion": "373_535_70.2.0",
           "pinnedConfig": true,
           "logConfiguration": {
               "clientId": null,
               "durationMinutes": 60,
               "expiration": "2020-12-15T19:13:36.079Z",
               "rootLevel": "DEBUG",
               "logLevels": {
                   "sailpoint.connector.ADLDAPConnector": "DEBUG"
               }
           }
       }
   ]
   ```

   > **Note**
   >
   > The previous example code shows two VA clusters. One VA cluster has a log configuration and the other does not (refer to the `logConfiguration` value in each returned VA cluster). This is because one of the clusters already has logging enabled. This is just an example configuration, and your environment may not have logging enabled on a cluster.
2. Identify the VA cluster that you want to enable logging on by its name or description and record its `id` attribute.

### Get the Logging Configuration

Get your selected VA's cluster logging configuration and identify the values you need to update.

1. Make the following call to the REST API to return the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier.

   GET /v3/managed-clusters/{id}/log-config

   - If the VA doesn't have a logging configuration currently set, it returns `204 No Content` as a response.
   - If the VA has an existing logging configuration, it returns something similar to the following:

     ```json
     {
         "clientId": null,
         "durationMinutes": 60,
         "expiration": "2020-12-15T19:13:36.079Z",
         "rootLevel": "DEBUG",
         "logLevels": {
             "sailpoint.connector.ADLDAPConnector": "DEBUG"
         }
     }
     ```

     You'll need to configure the following information in the response:

     - `durationMinutes` is the number of minutes logging should remain enabled.
     - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>).
     - `logLevels` is a map object with logging classes as keys and logging levels as values.

       - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes.
       - For a list of available values, refer to [Logging Levels](<#logging-levels>).

### Update Logging Configuration

Update the VA cluster configuration returned by the REST API to update the logging settings as needed.

1. Make the following call to the REST API to update the VA cluster's logging configuration. Replace `{id}` with the VA cluster's `id` attribute value recorded earlier.

   PUT /v3/managed-clusters/{id}/log-config
2. Submit your configuration changes to the REST API in a JSON body.

   - If the VA cluster did not already have a logging configuration and you received a `204 No Content` response, you can create a new one.
   - If the VA returned a configuration, you can edit it to include the changes.

   The JSON body should be as follows:

   ```json
   {
       "durationMinutes": 60,
       "rootLevel": "DEBUG",
       "logLevels": {
           "sailpoint.connector.ADLDAPConnector": "DEBUG"
       }
   }
   ```

   Consider the following as you edit the JSON:

   - `durationMinutes` is the number of minutes logging should remain enabled.
   - `rootLevel` is the default level for all logs. For more information, refer to [Logging Levels](<#logging-levels>).
   - `logLevels` is a map object with logging classes as keys and logging levels as values.

     - For keys, refer to [Logging Classes](<#logging-classes>) for commonly used logging classes.
     - For a list of available values, refer to [Logging Levels](<#logging-levels>).

   If the update was successful, the REST API should return a response similar to the following:

   ```json
   {
       "clientId": null,
       "durationMinutes": 60,
       "expiration": "2020-12-15T19:13:36.079Z",
       "rootLevel": "DEBUG",
       "logLevels": {
           "sailpoint.connector.ADLDAPConnector": "DEBUG"
       }
   }
   ```

### Observe Logging Changes

Approximately five minutes after you update the configuration, the VA cluster starts generating log files you can review. You can view the log files in **ccg.log**.

### References

The tables in this reference section list information that can be helpful when creating the JSON body you'll use to configure the VA cluster's configuration file.

#### Logging Levels

| Logging Level | Description |
| --- | --- |
| ERROR | Designates error events that might still allow the connector to continue. |
| WARN | Designates potentially harmful situations. |
| INFO | Designates information messages that highlight process at a coarse-grain level. |
| DEBUG | Very verbose. Fine grain logging levels used for development and debugging. |
| TRACE | Most verbose. Finer grain logging levels than debugging. |

#### Logging Classes

| Connector | Logging Class |
| --- | --- |
| Active Directory | sailpoint.connector.ADLDAPConnector sailpoint.connector.LDAPConnector |
| AIX | openconnector.connector.unix.AIXConnector openconnector.connector.unix.UnixConnector |
| Amazon Web Services | logger.aws.name=openconnector.connector.aws logger.aws.level=trace logger.aws.additivity = false logger.aws.appenderRef.rolling.ref = STDOUT |
| Atlassian Suite Cloud | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianConnector |
| Atlassian Data Center | sailpoint.connector.OpenConnectorAdapter openconnector.connector.atlassian.AtlassianDataCenterConnector |
| Microsoft Entra ID | sailpoint.connector.AzureADConnector |
| Box | openconnector.connector.BoxNetConnector sailpoint.connector.OpenConnectorAdapter |
| Cerner | openconnector.connector.CernerConnector sailpoint.connector.OpenConnectorAdapter |
| Delimited File | logger.DelimitedFileConnector.name = sailpoint.connector.DelimitedFileConnector logger.DelimitedFileConnector.level = debug logger.DelimitedFileConnector.additivity = false logger.DelimitedFileConnector.appenderRef.rolling.ref = STDOUT |
| Dropbox | openconnector.connector.DropBoxConnector sailpoint.connector.OpenConnectorAdapter |
| Epic | openconnector.connector.EPICConnector sailpoint.connector.OpenConnectorAdapter |
| GE Centricity | openconnector.connector.GECentricity sailpoint.connector.OpenConnectorAdapter |
| Google Apps / G Suite | openconnector.connector.GoogleAppsDirect sailpoint.connector.OpenConnectorAdapter |
| IBM i | openconnector.connector.IBMiConnector |
| Lotus Domino | sailpoint.connector.LotusDomino |
| JDBC | sailpoint.connector.JDBCConnector |
| Sun One LDAP | sailpoint.connector.LDAPConnector |
| Linux | openconnector.connector.unix.LinuxConnector sailpoint.connector.OpenConnectorAdapter sailpoint.connector.UnixConnector |
| Microsoft Office365 | sailpoint.connector.Office365Connector |
| Microsoft SQL Server | sailpoint.connector.mssql.serviceimpl.MSSQLServerConnectorV2 |
| Okta | logger.openconnector.name = openconnector.connector.okta.OktaConnector logger.openconnector.level = debug logger.openconnector.additivity = false logger.openconnector.appenderRef.rolling.ref = STDOUT |
| Oracle Database | sailpoint.connector.OracleDBConnector sailpoint.connector.JDBCConnector |
| Oracle E-Business | sailpoint.connector.OracleEBSConnector sailpoint.connector.JDBCConnector |
| Oracle Fusion HCM | openconnector.connector.oraclefusionhcm.OracleFusionHCMConnector sailpoint.connector.OpenConnectorAdapter |
| Oracle HCM Cloud | sailpoint.connector.oraclehcmcloud.OracleHCMCloudConnector |
| Oracle HRMS | sailpoint.connector.OracleAppsHRMSConnector sailpoint.connector.JDBCConnector |
| Oracle Netsuite | openconnector.connector.netsuite.NetsuiteConnector |
| PeopleSoft ERP | openconnector.connector.PeopleSoftConnector sailpoint.connector.OpenConnectorAdapter |
| PeopleSoft HRMS | sailpoint.connector.PeopleSoftHRMSConnector |
| RemedyForce | sailpoint.connector.ForceConnector |
| RSA Authentication Manager | openconnector.connector.RSAConnector openconnector.connector.rsa.RSAHTTPClient sailpoint.connector.OpenConnectorAdapter |
| Salesforce | sailpoint.connector.ForceConnector |
| SAP Concur | openconnector.connector.sapconcur.SAPConcurConnector |
| SAP - Direct | sailpoint.connector.SAPConnector sailpoint.connector.SAPInternalConnector |
| SAP GRC | logger.SAPGRCConnector.name = sailpoint.connector.sapgrc logger.SAPGRCConnector.level = debug logger.SAPGRCConnector.additivity = false logger.SAPGRCConnector.appenderRef.rolling.ref = STDOUT |
| SAP HR/HCM | sailpoint.connector.SAPHRInternalConnector |
| SCIM 1.1 | openconnector.connector.SCIMConnector sailpoint.connector.OpenConnectorAdapter |
| SCIM 2.0 | openconnector.connector.scim2.SCIM2Connector sailpoint.connector.OpenConnectorAdapter |
| ServiceNow | openconnector.connector.servicenow.ServiceNowConnector openconnector.connector.servicenow.ServiceNowRestClient sailpoint.connector.OpenConnectorAdapter |
| ServiceNow Service Desk Integration | openconnector.connector.servicedesk.ServiceNowServiceDeskConnector sailpoint.connector.OpenConnectorAdapter |
| Siebel | openconnector.connector.SiebelConnector sailpoint.connector.OpenConnectorAdapter |
| Snowflake | openconnector.connector.snowflake.SnowflakeConnector sailpoint.connector.OpenConnectorAdapter |
| Solaris | openconnector.connector.unix.SolarisConnector openconnector.connector.unix.UnixConnector sailpoint.connector.OpenConnectorAdapter |
| SuccessFactors | sailpoint.connector.SuccessFactorsConnector |
| Sybase | sailpoint.connector.SybaseDirectConnector sailpoint.connector.JDBCConnector |
| Webex | openconnector.connector.Webex sailpoint.connector.OpenConnectorAdapter |
| Workday | openconnector.connector.WorkDay sailpoint.connector.OpenConnectorAdapter |
| Workday Accounts | openconnector.connector.workdayaccounts openconnector.connector.workdayaccounts.WorkdayAccountsConnector sailpoint.connector.OpenConnectorAdapter |
| Web Services | sailpoint.connector.WebServices |
| XML | openconnector.connector.XMLConnector sailpoint.connector.OpenConnectorAdapter |
| Yammer | openconnector.connector.YammerConnector sailpoint.connector.OpenConnectorAdapter |
| Zoom | openconnector.connector.zoom.ZoomConnector sailpoint.connector.OpenConnectorAdapter |

# Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

- [SailPoint Identity Services Documentation](<https://documentation.sailpoint.com/saas/help/index.html>)
- [SailPoint Support Knowledge Base](<https://support.sailpoint.com/csm?id=kb_view2&amp;kb_id=05ff44289f011200550bf7b6077fcfa3>)
- [SailPoint Developer Community](<https://developer.sailpoint.com/>)

## Role assignment fails with an error message

All the roles assigned to the users are not getting aggregated.

**Resolution**: Ensure that all the roles that need to be managed by the SAP Portal source must have the scope assigned that was created in the Register a Client Application phase. Refer to the [Prerequisites](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/index.html#prerequisites>) section.

## Aggregation Fails with an Error Message

- During aggregation when SAP Portal Server is connected to Active Directory/LDAP Server, the following error message appears:

  ```text
  Reason: java.lang.NullPointerException
  ```

  **Resolution**: Undeploy the existing `sailpoint_ume.sda` file and deploy the new `sailpoint_ume.sda` file. For more information, see [Prerequisites](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/index.html#prerequisites>).
- Aggregation fails with the following error message:

  ```text
  Connector failed, sailpoint.connector.ConnectorException: Error while testing connection. sailpoint.connector.ConnectorException: Invalid request
  ```

  This error message appears due to `.sda` file version mismatch.

  **Resolution**: Ensure that the versions of `.sda` file matches the versions according to IdentityIQ version. For more information, see [Prerequisites](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/index.html#prerequisites>).

## Test Connection Fails with an Error Message

Test Connection fails with the following error message:

```text
Failed to retrieve client for current request
```

**Resolution**: Ensure that the URL configured is in the `http://host:port` format.

## Roles Assigned to Users Are Not Aggregated (OAuth 2.0 Authentication Type Only)

**Resolution**: Ensure that the all the roles that must be managed by SailPoint should have the scope assigned that was created under [Register a Client Application](<https://documentation.sailpoint.com/connectors/sap/portal/va/help/configuring_for_integration.html#register-a-client-application>).

# Timeout Errors and Settings

Timeout errors might occur when SailPoint is waiting for a response from the Virtual Appliance (VA). These errors are applicable to all connectors and tend to occur during the setup of sources or when sources are down.

This document is designed to give specific information that can be used to resolve these errors.

Each timeout attribute has a default time value that is listed in seconds or minutes. Increasing the time value may resolve the error as it will allow for longer communication time between the two systems, thus avoiding the timeout error.

> [!IMPORTANT]
>
> Add the necessary attributes or values before performing the "replace" operation, as missing attributes will cause the operation to fail.

To increase the communication time, increase the value of the appropriate timeout attribute. Then submit the change to the VA using the SailPoint REST API.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

### aggregateTimeout

**Description:** This parameter is set for the aggregation timeout, measured in seconds.

**Resolution:** Increase the `aggregateTimeout` value gradually to optimize aggregation. Start with 180, then increase to 600, 900, and finally 1800. The maximum value is 3600 seconds.

For example:

If your current time value is 180 seconds, update the `aggregateTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/aggregateTimeout",
        "value": 600
    }
]
```

### healthCheckTimeout

**Description:** This parameter is set for the test connection and health check timeout.

**Resolution:** The default value is 30 seconds. If the timeout error continues, increase the value in 15 second increments and try again.

For example:

If your current time value is 30 seconds, update the `healthCheckTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/healthCheckTimeout",
        "value": 45
    }
]
```

### provisioningTimeout

**Description:** This parameter is set for provisioning timeout.

**Resolution:** Increase the `provisioningTimeout` value gradually to optimize provisioning. Start with 180, then increase to 360, and finally 600. The maximum value is 600 seconds.

For example:

If your current time value is 180 seconds, update the `provisioningTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/provisioningTimeout",
        "value": 360
    }
]
```

### timeout

**Description:** This parameter is set for pass-through authentication timeout.

**Resolution:** The default value is 15 seconds. If the timeout error continues, increase this value in 15 second increments and try again.

For example:

If your current time value is 15 seconds, update the `timeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/timeout",
        "value": 30
    }
]
```

### apiTimeout

**Description:** This parameter is set for API time tracking; customers can check it using an external tool.

**Resolution:** The default value is 60 seconds. If the error continues, increase the value by 15 second increments and try again.

For example:

If your current time value is 60 seconds, update the `apiTimeout` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/apiTimeout",
        "value": "75"
    }
]
```

### timeoutInSeconds

**Description:** This parameter helps prevent the VA from waiting indefinitely for an API response, ensuring efficient handling of API requests.

For example:

If your current time value is 30 seconds, update the `timeoutInSeconds` attribute as follows:

```json
[
    {
        "op": "replace",
        "path": "/connectorAttributes/timeoutInSeconds",
        "value": "15"
    }
]
```