I’ve tried using a Build Map Rule in the SAP GRC connector, starting with a very simple piece of code like the following:
import sailpoint.object.Attributes;
import sailpoint.connector.SAPInternalConnector;
import sailpoint.object.Application;
import sailpoint.object.Schema;
import com.sap.conn.jco.JCoDestination;
import java.util.Map;
import java.util.HashMap;
import org.apache.commons.lang3.StringUtils;
import com.sap.conn.jco.JCoException;
import com.sap.conn.jco.JCoFunction;
import com.sap.conn.jco.JCoFunctionTemplate;
import com.sap.conn.jco.JCoParameterList;
import com.sap.conn.jco.JCoRecordField;
import com.sap.conn.jco.JCoRecordFieldIterator;
import com.sap.conn.jco.JCoStructure;
import com.sap.conn.jco.JCoTable;
import com.sap.conn.jco.JCoRecordMetaData;
import com.sap.conn.jco.JCo;
import com.sap.conn.jco.JCoContext;
import com.sap.conn.jco.AbapException;
import com.google.gson.JsonArray;
import com.google.gson.JsonElement;
import com.google.gson.JsonObject;
import com.google.gson.JsonParser;
import java.time.Duration;
import java.time.Instant;
import java.time.LocalDate;
import sailpoint.services.rule.App;
import org.apache.commons.lang3.ArrayUtils;
import java.text.SimpleDateFormat;
String initials = "Test";
object.put("initials", initials);
However, this had no effect. Accounts coming from SAP GRC were not updated with the “Initials” attribute, nor with any other attributes I attempted to add in a similar way. This suggests that the rule is either not being detected or not executed by the SAP GRC connector.
This raises the following question:
Is it possible that the SAP GRC connector does not support BuildMap rules? Or is there an additional configuration required for these rules to be applied properly?
Note: The rule was added to the connector following this guide:
The need for this rule comes from the requirement to map the IIQDisabled attribute based on the Valid To date, creating a direct relationship between the account’s IIQDisabled status and its expiration. If the date doesn’t meet the necessary logic, the account should be considered disabled in ISC.
My initial approach is to achieve this through the BuildMap rule to enforce the logic I need, as I haven’t found another native way to implement it for this connector.
It’s worth noting that I understand the connector maps the account’s status in ISC directly from the Status field of the corresponding SAP system. However, the client does not interpret this Status field as an indicator of an expired or inactive date, which leads to inconsistencies in how the account status is represented in ISC compared to what is actually reflected in GRC.