PingOne Advanced Identity Cloud

SAP User Management

The SAP User Management connector lets you synchronize users from Advanced Identity Cloud to SAP user accounts. This application can only be a target application.

Register the application

  1. In the Advanced Identity Cloud admin console, go to Applications, and click grid_view Browse App Catalog.

  2. In the Browse App Catalog modal, select an application, and click Next.

    Select the latest application version.

  3. Review the Application Integration information, and click Next.

  4. In the Application Details window, specify the name, description, application owners, and logo for the application.

  5. To make the application an Authoritative source of identity data, select the Authoritative check box. This option is not available for every application.

  6. Click Create Application.

Configure provisioning

  1. Set up a remote connector server (RCS).

  2. In the Advanced Identity Cloud admin console, on the Provisioning tab:

    • If setting up provisioning for the first time, click Set up Provisioning.

    • When editing existing settings in the Connection area, click Settings.

  3. Configure the following fields:

    Field/Option Description

    SAP Application Server FQDN

    The FQDN of your SAP Application Server. For example, sap.example.com.

    SAP Gateway Host

    The SAP gateway host name.

    SAP Gateway Server

    The SAP gateway server.

    SAP User

    The SAP Logon user.

    Password

    The SAP Logon password.

    SAP Client

    The SAP client.

    SAP System Number

    The SAP system number.

    SAP System Language

    The language of the remote SAP system.

    SAP Router

    The IP address, port, and optional password of the SAP router, if applicable. The syntax is /H/host/S/port/W/optionalPassword. For example:

    /H/203.0.113.0/S/3299/W/48npb_hg815.77rr62.hdj

    CUA

    Whether to enable SAP Central User Administration (CUA).

  4. Optionally, click Show advanced settings to set any of the following options:

    Field/Option Description

    Destination

    SAP JCo destination name.

    Direct Connection

    If selected, use a direct connection to an SAP ABAP Application server or SAP router. If cleared, use a connection to a group of SAP instances through a SAP message server.

    Target Directory

    The directory to write classes.

    Warning Level

    The compiler warning level.

    Disabled Global AST Transformations

    A list of global AST transformations which should not be loaded even if they are defined in META-INF/org.codehaus.groovy.transform.ASTTransformation files. By default, none are disabled.

    SourceEncoding

    The encoding for source files.

    X509 Certificate

    The X509 certificate to supply for authentication.

    Trace

    Whether to enable RFC trace.

    CPIC Trace

    Whether to enable CPIC trace. Possible values are 0-3.

    SAP Message Server Host

    The message server host.

    Group

    The group name of the application servers. Used when you log in to a logon group that uses load balancing.

    Message Server Service

    The message server service name.

    R3 Name

    The name of the SAP system used when you log in to a logon group that uses load balancing.

    SNC Mode

    Flag used to activate SNC (Secure Network Connection). Possible values are 0 (OFF) and 1 (ON).

    SNC QoP

    The connection security level to use. Possible values are:

    1

    Authentication only
    2

    Integrity protection
    3

    Privacy protection
    8

    Use the application server value snc/data_protection/use
    9

    Use the application server value snc/data_protection/max

    SNC Library

    The external library path for the Secure Network Connection service. The default is the system-defined library as defined in the environment variable SNC_LIB.

    SNC Partner Name

    The application server ABAP SNC name. For example, "p:CN=ABC, O=MyCompany, C=US". You can find the name in the profile parameter snc/identity/as on the AS ABAP.

    SNC Name

    The connector SNC name. For example, "p:CN=OpenIDM, O=MyCompany, C=US". This parameter is optional, but set it to make sure that the correct SNC name is used for the connection.

    SNC SSO

    Whether the connection should be configured for single sign-on (SSO). Possible values are 0 (OFF) and 1 (ON).

    Pool Capacity

    The maximum number of idle connections kept open by the destination. If there is no connection pooling, set this to 0. The default value is 1.

    For optimum performance, set this value to an integer between 5 and 10.

    Expiration time

    After this time (in milliseconds) has elapsed, the system closes the free connection. The default value is 60000.

    Max Get time

    If the pool has allocated the maximum allowed number of connections, the maximum time (in milliseconds) to wait for a connection.

    Peak Limit

    The maximum number of active connections that can be created for a destination simultaneously. The value 0 is unlimited.

    Expiration Period

    After this time (in milliseconds) has elapsed, the destination checks released connections for expiration.

    Exclude Unmodified

    Select this option to synchronize only the modified properties on a target resource.

  5. Click Connect.

  6. Verify the information in the Details tab.

Provision side tabs

The object type determines the side tabs that display on the Provisioning tab. Use the object type list to select an object type, such as Group. Afterward, you can configure properties in the different sub-tabs under the Provisioning tab.

Sub-tabs under the Provisioning tab
Provisioning tab Description Related sections

Details

View and manage an application, including name, ID, and native type.

Select the specific application from Provision settings for an application.

Properties

View and manage properties for the selected object type.

Manage application attributes

Data

View data about the selected object type.

View user access data

Mapping

View and manage mappings from the Advanced Identity Cloud admin console properties to external system properties and from external system properties to the Advanced Identity Cloud admin console properties.

Manage mappings

Reconciliation

Preview mappings on target applications between external systems and the Advanced Identity Cloud admin console, and reconcile the data between the two systems.

View and manage rules for the users and groups that use your application.

View and manage schedules for Full and Incremental reconciliation.

Reconcile and synchronize end-user accounts

Privacy & Consent

Manage end-user data sharing and synchronization.

Configure end-user data sharing

Rules

View and manage provisioning rules for mappings between Advanced Identity Cloud and a target application.

Manage provisioning rules

Advanced Sync

Create and manage mappings between an identity profile and an application or between applications.

Manage advanced sync

Next steps