Integrating SailPoint with SAP S/4HANA Cloud SaaS

SAP S/4HANA is an Enterprise Resource Planning (ERP) Business Suite based on the SAP HANA in-memory database with which transactions and business data analysis can be performed in real time.

This guide is designed to give specific information about the requirements and field definitions needed for SAP S/4HANA Cloud SaaS.

Supported Features

SAP S/4HANA Cloud SaaS supports the following features:

• Aggregation of SAP S/4HANA Business Users as Accounts
• Add/Remove Entitlements (supported entitlements are Business Roles)
• Enable/Disable SAP S/4HANA Cloud accounts
• Aggregation of Business Role as Account-Group

• Create Business User Account on S/4HANA Cloud

  Note

  Create Business User is supported for user type "Employee" (BUP003).

• Update User Attributes (User Date Valid From and User Date Valid To)

Refer to Source Features for more information on features.

Contact your CSM or SailPoint Services for feature settings.

Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

For more information, refer to Managing Privilege Classification.

Prerequisites

• Create the Communication User, Communication System, and Communication Arrangement on the SAP system, and export Role Data for SAP S/4HANA Cloud.
• The role details must be exported in a .csv file.

File Upload Utility

The file upload utility provides a way for you to upload files to the cloud automatically. For more information about downloading and using the file upload utility with the SAP S/4HANA Cloud source, refer to File Upload Utility.

Create Communication User

A Communication User is a user defined in the SAP S/4HANA Cloud system for inbound communication and processing messages in the system.

1. Sign in as an administrator to the SAP S/4HANA Cloud system. In the Communication Management panel, select Maintain Communication Users. A list of existing communication users page is displayed.
2. To create a new communication user, select New.

3. Enter the following details and select Create:

   • User Name*
   • Description*
   • Password

4. Note the details of the User Name and Password used above.

Create Communication System

A Communication system is defined in the SAP S/4HANA Cloud system as a target system. Communication systems must be created for inbound and outbound communication.

1. Sign in as an administrator to the SAP S/4HANA Cloud system. In the Communication Management panel, select Communication Systems. A list of existing communication systems page is displayed.
2. To create a new communication system, select New.

3. Enter the following details, and select Create:

   • System ID*
   • System Name*

4. For inbound communication, perform the following:

   1. Enter the details for the Host Name*.
   2. In the User for Inbound Communication panel, select Add (+) to add a new user.
   3. Select an Authentication Method from the dropdown list, specify a relevant User Name, and select OK.

5. For outbound communication, perform the following:

   1. In the User for Outbound Communication panel, select an Authentication Method from the dropdown list and specify the User Name and Password.
   2. Select Create.

6. Select Save to complete the creation of the communication system.

Create Communication Arrangement

Communication Arrangement is defined in the SAP S/4HANA Cloud system to enable key users to create and edit communication arrangements that are set up with a communication partner.

1. Sign in as an administrator to the SAP S/4HANA Cloud system. In the Communication Management panel, select Communication Arrangements. A list of existing communication arrangements page is displayed.
2. To create a new communication arrangement, select New.

3. Enter the following details and then select Create:

   • Scenario*

     • The Scenario ID is SAP_COM_0093 and SAP_COM_0465

   • Arrangement Name

4. Select the ID of the Communication System* and enter other details.

5. Select Save to complete the creation of a communication arrangement.

Obtaining the URL Details

The existing list of Communication Arrangements page is updated to include the newly created communication arrangement for the SAP_COM_0093 and SAP_COM_0465 scenario as explained above.

To obtain the URL details, perform the following:

1. Select the newly created communication arrangement with Scenario ID SAP_COM_0093 and SAP_COM_0465. The details of the SAP_COM_0093 and SAP_COM_0465 communication arrangement are displayed.
2. Under the Inbound Services section, copy the URL mentioned in Service URL/Service Instance.

Create Business User Account

The S/4HANA Cloud system supports the creation of Business User accounts. A key requirement for creating a Business User is the presence of a Worker ID. The Worker ID must be passed when creating the user.

Additionally, you can use the custom-exposed Worker ID API to fetch worker details from the S/4HANA Cloud system.

Approaches for Creating a Business User in S/4HANA Cloud System

1. Create Business User using Worker ID API

   • Ensure that the Email ID and Username in the provisioning plan are unique values.
   • Ensure that the First Name, Last Name, and Email ID in the provisioning plan must be valid to fetch the Worker ID.

   If both options are provided, Approach B (Passing Worker ID) takes precedence over Approach A (Using Worker ID API).

2. Create Business User using Worker ID

   This is the standard method for creating a Business User in the S/4HANA Cloud system.

   • Ensure that the Worker ID, First Name, Last Name, and Email ID in the provisioning plan are appropriate for creating the Business User.

Obtain Worker ID API in S/4HANA Cloud

This is the optional setup process to retrieve the Worker ID from the S/4HANA Cloud System using an API. The Worker ID can be fetched by passing Email, First Name, and Last Name as filters.

To configure the Worker ID API:

1. Create an External API CDS View:

   • Open the Fiori App for creating custom CDS views (Custom CDS View).
   • Search for the standard CDS view I_WorkforcePerson.
   • Select the following fields: FirstName, LastName, DefaultEmailAddress, PersonFullName, and PersonExternalID.

   • Select Publish to make the view available for use.

     

2. Create a Communication Scenario:

   • In the Fiori App, create a new Communication Scenario.
   • Go to Inbound Services and add the service generated from the custom CDS view.
   • Publish the service to make it accessible.

3. Set Up the Communication Arrangement:

   • Go to Communication Arrangements. Select the Communication Scenario you created earlier.
   • Enter the required fields such as System and User Name.

   • Retrieve the generated URL for the communication arrangement.

     

4. Configure the Worker ID API in the Connector Settings:

   • Add the Entity Name (from the API metadata) to the API URL.
   • Enter the complete URL in the Worker ID API field on the configuration settings page of the connector.

Required Permissions

The following table lists the required permissions for the specific operations mentioned later in this section:

The administrative user must have access to the following Inbound Services to perform the operations:

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.