# SailPoint SAP S/4HANA Cloud SaaS Connector Documentation

> SAP S/4HANA Cloud SaaS Connector Documentation

# Documentation

# Connecting SailPoint and SAP S/4HANA Cloud SaaS

To connect SailPoint with SAP S/4HANA Cloud, perform the following tasks:

## Adding the Source in SailPoint

To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs.

> [!IMPORTANT]
>
> By default, the provisioning feature is **disabled**, and the connector only supports read-only operations. To support provisioning operations, you must manually enable the feature in the source configuration.

**To configure a new source:**

1. Sign in to SailPoint.
2. Go to **Admin \> Connections \> Sources**.
3. Select **Create New**.
4. Search for the connector by entering the name in the search box, and then select **Actions**.
5. In the **Actions** dropdown list, select the setup method:

   - [**Express Setup**](<#configuring-a-source-using-express-setup>) - Quickly create a read-only connection to your target system by providing minimal configurations and authentication. On completion, aggregation is automatically started.

     > **Note**
     >
     > Express Setup supports Credential Providers. For information on supported credential providers and configuration, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>). For more information, contact your SailPoint Customer Service Manager.
   - [**Standard Setup**](<#configuring-a-source-using-standard-setup>) - Provide detailed basic configuration to create the source. Once the source is created, continue with source setup.

### Configuring a Source Using Express Setup

Express Setup minimizes the initial configuration process so you can quickly connect the application and immediately begin aggregating user account and entitlement data.

1. Review the directions and select **Start Express Setup**.
2. Review the pre-populated **Source Name**, **Source Owner**, and **Description**. To update, select **Edit**.

   > **Note**
   >
   > The source name must be unique. You can change these settings later in the source configuration.
3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
4. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** section.
5. Select **Finish**.

   After a successful test connection, the system creates your source and prompts you to run an aggregation.

   - If you want to aggregate now, select **Aggregate**.

     - To see the latest account aggregation history, go to **Account Management \> Account Aggregation**.
     - To see the list of aggregated source accounts, go to **Account Management \> Accounts**.
   - If you want to aggregate later, select **Exit**. This returns you to the **Sources** page. Your new source is listed, but contains no accounts or aggregation history yet.

### Configuring a Source Using Standard Setup

Use Standard Setup to configure the connector for full feature support.

1. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters.
2. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters.
3. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](<https://documentation.sailpoint.com/saas/help/sources/index.html#assigning-a-source-owner>).
4. (Optional) Select a governance group to grant its members [source](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#source-sub-admin-user-level>) or [role](<https://documentation.sailpoint.com/saas/help/common/users/user_levels.html#role-sub-admin-user-level>) sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html>).
5. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](<https://documentation.sailpoint.com/saas/help/setup/identity_profiles.html>).
6. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there.

## Base Configuration

Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary.

1. Enter a unique name and description for the source.
2. In the **Source Owner** dropdown list, select the identity that owns this source.

   - To find a source owner, begin entering their name.
3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider.

   > **Note**
   >
   > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](<https://documentation.sailpoint.com/connectors/help/credential_providers.html>).
4. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information.
5. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](<https://documentation.sailpoint.com/saas/help/common/users/governance_groups.html#associating-a-governance-group-with-a-source>).
6. (Optional) Choose whether to enable or disable provisioning for the source. Provisioning is disabled by default.

   - **Enable Provisioning** - Set the toggle to **Enabled** to allow the source to create, update, and deactivate accounts in the connected source system.
   - **Disable Provisioning** - Set the toggle to **Disabled** to disable provisioning for the source. Disabling provisioning will prevent the creation, updating, or deactivating of accounts on this source.
7. Select **Save**.

## Connection Settings

> [!NOTE]
>
> **Screenshot**
>
> [![Connection Settings](<https://documentation.sailpoint.com/connectors/sap/s4_hana/saas/help/img/sap_4hana_cloud_conn.png>)](<https://documentation.sailpoint.com/connectors/sap/s4_hana/saas/help/img/sap_4hana_cloud_conn.png>)

1. Select **Connection Settings** from the menu.
2. Enter the **API URL**. This is the Service URL of the endpoint to be used. For example, `https://<Service URL/Service Instance>.com`
3. Enter the **User name**. This is the name of the Communication User with required permission connecting to the SAP S/4HANA Cloud system.
4. Enter the associated **Password**.
5. Select **Save**.

## Aggregation Settings

For more information about aggregation, refer to [Loading Account Data](<https://documentation.sailpoint.com/saas/help/accounts/loading_data.html>).

> [!NOTE]
>
> **Screenshot**
>
> [![Aggregation Settings](<https://documentation.sailpoint.com/connectors/sap/s4_hana/saas/help/img/account_aggregation_settings.png>)](<https://documentation.sailpoint.com/connectors/sap/s4_hana/saas/help/img/account_aggregation_settings.png>)

1. Select **Aggregation Settings** from the menu.
2. In **Page Size**, enter the number of records to fetch. The default value is 50.
3. Select **Save**.

## Provisioning Settings

Configure settings for provisioning operations between the connector and the source.

> [!NOTE]
>
> **Screenshot**
>
> [![Provisioning Settings](<https://documentation.sailpoint.com/connectors/sap/s4_hana/saas/help/img/provision_settings.png>)](<https://documentation.sailpoint.com/connectors/sap/s4_hana/saas/help/img/provision_settings.png>)

1. Select **Create Business User Account** toggle button to enable the creation of business user account on S/4HANA public cloud.
2. Enter the API URL in **Worker ID API** for detecting the Worker based on the FirstName, LastName and Email. When not provided, Worker ID needs to be passed in provisioning plan to create the Business User on S4 HANA public cloud.
3. Select **Save**.

## Review and Test

Perform a test to confirm the connection to SailPoint.

1. Go to **Review and Test**.
2. Confirm that the entries in each field are correct.

   If you note any mistakes, return to the section and make corrections.
3. Select **Test Connection**.

## SailPoint Application Onboarding

SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface.

For more information, refer to [Application Onboarding](<https://documentation.sailpoint.com/saas/help/ai/app_onboarding/index.html>) in the SailPoint SaaS documentation.

# Integrating SailPoint with SAP S/4HANA Cloud SaaS

> [!NOTE]
>
> **Integration**
>
> This is an integration and requires additional licensing or subscriptions to utilize it. For more information, contact your customer success manager.

SAP S/4HANA is an Enterprise Resource Planning (ERP) Business Suite based on the SAP HANA in-memory database with which transactions and business data analysis can be performed in real time.

This guide is designed to give specific information about the requirements and field definitions needed for SAP S/4HANA Cloud SaaS.

> [!NOTE]
>
> To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes](<https://community.sailpoint.com/release-notes/saas>) page.

## Supported Features

SAP S/4HANA Cloud SaaS supports the following features:

- Aggregation of SAP S/4HANA Business Users as Accounts
- Add/Remove Entitlements (supported entitlements are Business Roles)
- Enable/Disable SAP S/4HANA Cloud accounts
- Aggregation of Business Role as Account-Group
- Create Business User Account on S/4HANA Cloud

  > **Note**
  >
  > Create Business User is supported for user type "Employee" (BUP003).
- Update User Attributes (User Date Valid From and User Date Valid To)

Refer to [Source Features](<https://community.sailpoint.com/knowledge/Identity-Security-Cloud-Source-Features>) for more information on features.

Contact your CSM or SailPoint [Services](<https://community.sailpoint.com/knowledge/collection/working-with-services>) for feature settings.

### Privilege Classification

SailPoint Privilege Classification helps organizations systematically categorize and manage the privilege levels of entitlements within their sources. By classifying entitlements as high, medium, or low, administrators can better understand the potential risk and impact associated with specific access rights. This allows automatic assignment of privilege levels based on system recommendations, custom-defined criteria, or a same level across all entitlements.

| Privilege Level | Description |
| --- | --- |
| High | Administrative level access to accounts |
| Medium | Administrative level access for a specific role or function |
| Low | Only basic access of data |

> [!NOTE]
>
> To manage Privilege Classification, users must have administrative roles such as Org Admin, Source Admin or Source Sub-Admin.

For more information, refer to [Managing Privilege Classification](<https://documentation.sailpoint.com/saas/help/loading_entitlements/privilege_classification.html>).

> [!NOTE]
>
> **Example**
>
> [![Privilege Level - High](<https://documentation.sailpoint.com/connectors/sap/s4_hana/saas/help/img/privilege_high.png>)](<https://documentation.sailpoint.com/connectors/sap/s4_hana/saas/help/img/privilege_high.png>)
>
> [![Privilege Level - Medium](<https://documentation.sailpoint.com/connectors/sap/s4_hana/saas/help/img/privilege_medium.png>)](<https://documentation.sailpoint.com/connectors/sap/s4_hana/saas/help/img/privilege_medium.png>)

## Prerequisites

- Create the Communication User, Communication System, and Communication Arrangement on the SAP system, and export Role Data for SAP S/4HANA Cloud.
- The role details must be exported in a .csv file.

### File Upload Utility

The file upload utility provides a way for you to upload files to the cloud automatically. For more information about downloading and using the file upload utility with the SAP S/4HANA Cloud source, refer to [File Upload Utility](<https://community.sailpoint.com/knowledge/SailPoint-File-Upload-Utility>).

### Create Communication User

A Communication User is a user defined in the SAP S/4HANA Cloud system for inbound communication and processing messages in the system.

1. Sign in as an administrator to the SAP S/4HANA Cloud system. In the **Communication Management** panel, select **Maintain Communication Users**. A list of existing communication users page is displayed.
2. To create a new communication user, select **New**.
3. Enter the following details and select **Create**:

   - User Name\*
   - Description\*
   - Password
4. Note the details of the User Name and Password used above.

### Create Communication System

A Communication system is defined in the SAP S/4HANA Cloud system as a target system. Communication systems must be created for inbound and outbound communication.

1. Sign in as an administrator to the SAP S/4HANA Cloud system. In the **Communication Management** panel, select **Communication Systems**. A list of existing communication systems page is displayed.
2. To create a new communication system, select **New**.
3. Enter the following details, and select **Create**:

   - System ID\*
   - System Name\*
4. For inbound communication, perform the following:

   1. Enter the details for the **Host Name\***.
   2. In the **User for Inbound Communication** panel, select **Add (+)** to add a new user.
   3. Select an **Authentication Method** from the dropdown list, specify a relevant **User Name**, and select **OK**.
5. For outbound communication, perform the following:

   1. In the **User for Outbound Communication** panel, select an **Authentication Method** from the dropdown list and specify the **User Name** and **Password**.
   2. Select **Create**.
6. Select **Save** to complete the creation of the communication system.

### Create Communication Arrangement

Communication Arrangement is defined in the SAP S/4HANA Cloud system to enable key users to create and edit communication arrangements that are set up with a communication partner.

1. Sign in as an administrator to the SAP S/4HANA Cloud system. In the **Communication Management** panel, select **Communication Arrangements**. A list of existing communication arrangements page is displayed.
2. To create a new communication arrangement, select **New**.
3. Enter the following details and then select **Create**:

   - Scenario\*

     - The Scenario ID is **SAP\_COM\_0093** and **SAP\_COM\_0465**
   - Arrangement Name
4. Select the ID of the **Communication System\*** and enter other details.
5. Select **Save** to complete the creation of a communication arrangement.

#### Obtaining the URL Details

The existing list of Communication Arrangements page is updated to include the newly created communication arrangement for the **SAP\_COM\_0093** and **SAP\_COM\_0465** scenario as explained above.

To obtain the URL details, perform the following:

1. Select the newly created communication arrangement with Scenario ID **SAP\_COM\_0093** and **SAP\_COM\_0465**. The details of the **SAP\_COM\_0093** and **SAP\_COM\_0465** communication arrangement are displayed.
2. Under the **Inbound Services** section, copy the URL mentioned in **Service URL/Service Instance**.

### Create Business User Account

The S/4HANA Cloud system supports the creation of Business User accounts. A key requirement for creating a Business User is the presence of a Worker ID. The Worker ID must be passed when creating the user.

Additionally, you can use the custom-exposed Worker ID API to fetch worker details from the S/4HANA Cloud system.

> [!NOTE]
>
> The Worker ID API is an optional parameter. If the Worker ID is not known, the Worker ID API can be used to retrieve it. For instructions on obtaining the Worker ID API for your system, refer to [Obtain Worker ID API in S/4HANA Cloud](<#obtain-worker-id-api-in-s4hana-cloud>).

> [!NOTE]
>
> In the S/4HANA Public Cloud, you can only create a Business User Account with a reference to a valid Worker ID.

#### Approaches for Creating a Business User in S/4HANA Cloud System

1. Create Business User using Worker ID API

   - Ensure that the Email ID and Username in the provisioning plan are unique values.
   - Ensure that the First Name, Last Name, and Email ID in the provisioning plan must be valid to fetch the Worker ID.

   If both options are provided, Approach B (Passing Worker ID) takes precedence over Approach A (Using Worker ID API).
2. Create Business User using Worker ID

   This is the standard method for creating a Business User in the S/4HANA Cloud system.

   - Ensure that the Worker ID, First Name, Last Name, and Email ID in the provisioning plan are appropriate for creating the Business User.

#### Obtain Worker ID API in S/4HANA Cloud

This is the optional setup process to retrieve the Worker ID from the S/4HANA Cloud System using an API. The Worker ID can be fetched by passing Email, First Name, and Last Name as filters.

> [!NOTE]
>
> This is an optional custom-exposed API that must be explicitly configured in the S/4HANA Cloud system before use.

**To configure the Worker ID API:**

1. Create an External API CDS View:

   - Open the Fiori App for creating custom CDS views (Custom CDS View).
   - Search for the standard CDS view I\_WorkforcePerson.
   - Select the following fields: FirstName, LastName, DefaultEmailAddress, PersonFullName, and PersonExternalID.
   - Select **Publish** to make the view available for use.

     [![Create Business User](<https://documentation.sailpoint.com/connectors/sap/s4_hana/saas/help/img/create_businessuser.png>)](<https://documentation.sailpoint.com/connectors/sap/s4_hana/saas/help/img/create_businessuser.png>)
2. Create a Communication Scenario:

   - In the Fiori App, create a new Communication Scenario.
   - Go to **Inbound Services** and add the service generated from the custom CDS view.
   - Publish the service to make it accessible.
3. Set Up the Communication Arrangement:

   - Go to Communication Arrangements. Select the Communication Scenario you created earlier.
   - Enter the required fields such as System and User Name.
   - Retrieve the generated URL for the communication arrangement.

     [![Communication Arrangement URL](<https://documentation.sailpoint.com/connectors/sap/s4_hana/saas/help/img/create_businessuser1.png>)](<https://documentation.sailpoint.com/connectors/sap/s4_hana/saas/help/img/create_businessuser1.png>)
4. Configure the Worker ID API in the Connector Settings:

   - Add the Entity Name (from the API metadata) to the API URL.
   - Enter the complete URL in the Worker ID API field on the configuration settings page of the connector.

## Required Permissions

The following table lists the required permissions for the specific operations mentioned later in this section:

| Operation | Required Permissions |
| --- | --- |
| Test Connection | Test Connection |
| Aggregation | Test Connection and Aggregation |
| Provisioning | Test Connection, Aggregation and Provisioning |

The administrative user must have access to the following Inbound Services to perform the operations:

| Operation | Inbound SOAP Services | Service Interface |
| --- | --- | --- |
| Test Connection /Account Aggregation | Business User - Read | `https://<hostname>/sap/bc/srt/scs_ext/sap/querybusinessuserin` |
| Group Aggregation | Business User - Read | `https://<hostname>/sap/bc/http/sap/aps_iam_api_scim/Groups` |
| Provisioning | Business User - Update | `https://<hostname>/sap/bc/srt/scs_ext/sap/managebusinessuserin` |
| Provisioning | Business User - Update | `https://<hostname>/sap/bc/http/sap/aps_iam_api_scim/Users` |

> [!NOTE]
>
> After you create the Communication Arrangement SAP\_COM\_0093 on the SAP managed system and the Communication User is assigned, the service account for the SAP S/4HANA Cloud source will have all the permissions. Refer to [SAP S/4HANA Prerequisites](<https://community.sailpoint.com/knowledge/SAP-S-4HANA-Cloud-Prerequisites>) for more information.

# Machine Account Attributes

Machine account attributes are used in provisioning configurations for machine accounts.

After you have [created the required machine account subtypes](<https://documentation.sailpoint.com/saas/help/machine/account_configuration.html#creating-machine-account-subtypes>), you can use the machine account attributes to provision machine accounts in your SailPoint tenant.

Refer to [Machine Identity Security Overview](<https://documentation.sailpoint.com/saas/help/machine/index.html>) for more information.

## Machine Account Provisioning Attributes

| Account Attribute | Description |
| --- | --- |
| First Name | First Name of Business User. |
| Last Name | Last Name of Business User. |
| Username | Defaults to the identity's user name. |
| Email | Email ID of the user. |
| Worker ID | Worker ID of the worker of S4HANA system. |

> [!NOTE]
>
> The Worker ID is mandatory if the Worker ID API is not set in the configuration settings.

For additional attribute descriptions and provisioning behavior, refer to [Default Create Account Attributes](<https://documentation.sailpoint.com/connectors/sap/s4_hana/saas/help/provisioning.html#default-create-account-attributes>).

# Provisioning

The SAP S/4HANA Cloud SaaS connector supports provisioning, allowing you to create and manage accounts and entitlements in SAP S/4HANA Cloud directly from SailPoint.

**Prerequisite:** Your system is configured for provisioning.

When SailPoint provisions new accounts to the source, it uses the attributes on the **Create Account** page as instructions or a template for what to include in the account. This page is also referred to as the *provisioning policy*.

When new access is granted on a source where a user does not already have an account, SailPoint automatically includes account creation in the provisioning. This applies whether provisioning is started from an access request or from an automated role or lifecycle state assignment.

For direct-connect sources, SailPoint automatically creates the account from this configuration. If the source is not configured as a direct-connect source, SailPoint creates and assigns a provisioning task to the source owner and includes the values for the source owner to use in manually creating the account.

> [!IMPORTANT]
>
> This section describes the default **Create Account** configuration. SailPoint recommends that you work with Services to define a provisioning configuration specific to your company's needs. Be sure to verify large changes to the provisioning policy before implementation. Failure to do so might cause provisioning to fail.

## Default Create Account Attributes

> [!NOTE]
>
> Enable the **Create Business User** checkbox in the configuration settings for Create Operation.

| Account Attribute | Description |
| --- | --- |
| First Name | First Name of Business User. |
| Last Name | Last Name of Business User. |
| Username | Defaults to the identity's user name. |
| Email | Email ID of the user. |
| Worker ID | Worker ID of the worker of S4HANA system. |

> [!NOTE]
>
> The `Worker ID` attribute is mandatory if the `Worker ID API` is not set in the configuration settings.

## Modify Support for Attributes

| Attribute Name | Type | Modify Supported | Description |
| --- | --- | --- | --- |
| User Name | String | Yes | Updated through SCIM PATCH. |
| User UUID | String | Yes (conditional) | Updated through SCIM PATCH only when `User UUID` exists in the account schema. |

> [!NOTE]
>
> Modify attribute only work when `User Name` and `User UUID` are part of the account schema.

# Schema Reference

The application schema is used to configure the objects returned from a connector.

> [!NOTE]
>
> - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.
> - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified.

The SAP S/4HANA Cloud SaaS connector uses the following default correlation and object configurations.

## Default Correlation Configuration

Before you aggregate accounts from this source, you can map account attributes with their corresponding identity attributes based on your requirements.

You can customize the correlation configuration. Refer to [Assigning Source Accounts to Identities](<https://documentation.sailpoint.com/saas/help/accounts/correlation.html>) for more information.

When you first create the SAP S/4HANA Cloud SaaS source, the default correlation mapping is:

| Account Attribute | Operation | Identity Attribute |
| --- | --- | --- |
| Email | Equals | Work Email |

## Default Account Schema

Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location.

The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas](<https://documentation.sailpoint.com/saas/help/accounts/schema.html>) for more information.

### Default Account ID

SailPoint requires that certain attributes remain in your configuration. These attributes are referred to as *account IDs*.

> [!CAUTION]
>
> Changing the attribute marked as the account ID after aggregating accounts can result in duplicate accounts being created. To avoid this, either reset the accounts on this source before editing the account ID attribute or edit the account ID attribute before aggregating accounts.
>
> To resolve issues caused by changing account IDs, reconfigure them to their default values.

The following table lists the default account IDs for this connector:

| Account ID | Schema Object Type |
| --- | --- |
| Person ID | Account |
| Business Role ID | Group |

### Default Account Attributes

The SAP S/4HANA Cloud SaaS connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified.

| Attribute Name | Description |
| --- | --- |
| First Name | First Name of Business User. |
| Last Name | Last Name of Business User. |
| Person External ID | Person External ID of Business User. |
| Business Partner Role | Business Partner Role of Business User. |
| Person ID | Person ID of Business User. This is an Identity Attribute which must not be changed. |
| Email | Email Address of Business User. |
| User Name | User Name of Business User. |
| User ID | User ID of Business User. |
| Employee Date Valid From | Employment start date of the Business User. |
| Employee Date Valid To | Employment end date of the Business User. |
| Is Locked | Is Business User Locked. |
| Business Roles | Business Roles assigned to Business User. |
| User Date Valid From | Valid From Date of the Business User. |
| User Date Valid To | Valid To Date of the Business User. |

### Additional Account Attributes

The SAP S/4HANA Cloud connector supports aggregation of additional account attributes from the SCIM User API. These attributes are aggregated only when they are defined in the account schema.

| Attribute Name | Type | Description |
| --- | --- | --- |
| Created | String | Account creation date of the Business User. Stored in `yyyy-MM-dd` format. |
| Login Time | String | Last logon timestamp of the Business User. Stored in `yyyy-MM-dd+timestamp` format. |
| User UUID | String | Global User ID of the Business User. |

## Default Entitlement Attributes

Entitlement attributes define the entitlements, such as groups or roles, that can be assigned to the managed system's user accounts. Refer to [Managing Entitlements](<https://documentation.sailpoint.com/saas/help/access/entitlements.html>) for more information.

> [!CAUTION]
>
> Changing the attribute marked as the Entitlement ID after aggregating accounts or entitlements can result in duplicate entitlements being created, or access profiles and roles breaking. To avoid this, edit the entitlement schema before performing any aggregations.

### Default Group Attributes

The SAP S/4HANA Cloud SaaS connector also supports groups. The following attributes must be configured on the managed system and in the SailPoint source schema to manage groups.

| Attribute Name | Description |
| --- | --- |
| Business Role ID | Business Role Identifier. This is an Identity Attribute which must not be changed. |
| Business Role Name | Business Role Name. |

# Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

- [SailPoint Identity Services Documentation](<https://documentation.sailpoint.com/saas/help/index.html>)
- [SailPoint Support Knowledge Base](<https://support.sailpoint.com/csm?id=kb_view2&amp;kb_id=05ff44289f011200550bf7b6077fcfa3>)
- [SailPoint Developer Community](<https://developer.sailpoint.com/>)

## Debug Logs

For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](<https://documentation.sailpoint.com/saas/help/sources/managing_additional_settings.html>).

## Invalid File Extension

If an incorrect **Role Details File Name** is provided without the extension of the file, the following error message appears during aggregation:

```text
"Exception during aggregation of Object Type account on Application SAP HANA. Reason: Unable to create iterator sailpoint.connector.InvalidConfigurationException: [InvalidConfigurationException] [Possible suggestions] Ensure that Role Details File Path is correct and accessible. [Error details] Invalid Role Details file path."
```

**Resolution**: Ensure that the .csv file extension is provided.

## Incorrect Connection Credentials

The following error message appears when incorrect inputs are provided for the **API URL**, **User name** or **Password**:

```text
For Invalid URL 403 Not Authorized.
```

```text
For Invalid UserName / Password 401 Not Authorized.
```

**Resolution**: Ensure that the inputs provided for the **API URL**, **User name** and **Password** are correct and valid.

## Test Connection Fails with an Error Message

```text
[ConnectorException] [Possible suggestions] Provide correct configurations, ensure user is active with correct set of permissions and credentials. [Error details] Error extracting response from XML
```

**Resolution**: Ensure the value of the **URL** is entered correctly. Refer to [SAP S/4HANA Cloud Prerequisites](<https://community.sailpoint.com/knowledge/SAP-S-4HANA-Cloud-Prerequisites>) for more information.

## Create User Account Is Failing with an Error When the Worker ID API Is Used

```text
sailpoint.connector.ConnectorException: java.lang.Exception: Worker Id Api execution failed with error : java.lang.Exception: Could not find worker ID
```

**Resolution**: Ensure that the worker has valid work agreements assigned in the S/4HANA Cloud system.

## Account Aggregation Fails Due to SCIM Groups API Timeout

Account aggregation fails due to SCIM Groups API timeout issues.

**Resolution**:

1. Add `groupPageSize` in the connector configuration and set the value to 500.
2. If the issue persists, increase `connTimeout` to 5 minutes.