Coupa Provisioning error : attribute is not sync across Coupa Source

[osmanmohammed]

Coupa Provisioning error : attribute is not synch across coupa

even though it is a default schema attribute not a custom attribute
values are not provisioned on coupa application.

when ever their is job level (attribute) change it is reflected in sailpoint with transform but it is not provisioning in Coupa application but expectation is it should reflect as it is a generic attribute from sailpoint coupa connector.

and the transform we used is

{
    "id": "abcd1234",
    "name": "Coupa test expense approval limit",
    "type": "lookup",
    "attributes": {
        "input": {
            "type": "firstValid",
            "attributes": {
                "values": [
                    {
                        "attributes": {
                            "sourceName": "UltiPro",
                            "attributeName": "level"
                        },
                        "type": "accountAttribute"
                    },
                    "noLevelSet"
                ]
            }
        },
        "table": {
            "10": "20000",
            "11": "50000",
            "12": "100000",
            "13": "200000",
            "14": "200000",
            "15": "2500000",
            "default": "0"
        },
        "requiresPeriodicRefresh": "true"
    },
    "internal": false
}

in create account we did configured requisition approval limit and also it is set to synch but is it a wrong configuration under identity attribute ? not sure why this is not getting provisioned to coupa application ?

no issues at all from transform but why do we see provisioning issue ?

When there is a job level (attr) change, the requisition approval (attr) threshold is not updating.
I attempted the attribute sync for - Bryan Cameron and noticed below error in the back end logs

Provisioning Verification for ‘Set’ Operation FAILED for source ‘Coupa Production [source]’ Tracking id: null
attributeName ‘requisition-approval-limit.amount’
expected value(s) ‘20000’ to be set as the new value found ‘null’

Not sure if we can sync such custom attributes or not ?
we have a go live

[kjakubiak (Kamil Jakubiak)]

One thing I’ve noticed
"requiresPeriodicRefresh”: “true”
Should be
"requiresPeriodicRefresh”: true

[osmanmohammed]

thank you, let me test it again

[osmanmohammed]

Still after performing attribute sync on a user, am getting this error on sailpoint

[“Update operation failed with exception Failed to process the request for operation :: UPDATE_USER :: Aggregated Errors after total retries of :: 1 Current attempt to execute request failed for operation :UPDATE_USER:: HTTP Failure status code :: 400 :: HTTP failure message :: {"errors":{"user":["Next Approver will result in a cyclic approval chain","Next Approver will result in a cyclic approval chain"],"warnings":null}}”]

[MVKR7T (Krishna Mummadi)]

If you can provision an attribute then of course you can do the sync as well.

Check with your app team, if you cannot override null with some value at application side.

Also, I could see that attribute value as 15, but as per your transform it supposed to be 2500000.

You don’t need to worry about requiresPeriodicRefresh at all.

Thanks
Krish

[osmanmohammed]

Hi @MVKR7T
2 questions :
i can see the values in Sailpoint as expected but it is not passing the value to Coupa application and
how to capture the payload ?

thanks
osman

[osmanmohammed]

@MVKR7T how to capture payload ?

[MVKR7T (Krishna Mummadi)]

For Coupa, we have both VA based and SaaS connectors. Not sure which one you are using.

Since it is a direct connector, you need to write Before Provisioning Rule which is a cloud Rule, to see the logs you need to depend on SailPoint ES.

You can look at the Account Activity by searching the user in Search page, it will give the attribute requests that are submitted to the application.

Ask your application team to look at the activity at their end, as SailPoint is submitting the request with those values but application is not accepting, why is it so ?

• Not supported to update the attribute ?
• No permission to update that specific attribute for the service account you are using to connect to Coupa.
• Please note that, some attributes are supported in creation but not in attribute sync which I have experienced in Atlassian connector.
• Create a Support case, so that SailPoint can look into this issue.

Thanks
Krish

[osmanmohammed]

HI @MVKR7T
We are using VA based Connector

-we a have a used case where for a user (Muruli) i ran Attribute sync and to validate changes went into search - account activity and though it is saying modify operation is set/ passed but the value i can see is shown in below image.

user level attribute is upgraded to 10 and it should modify requistion approval limit amount to 20,000 and we still see 0.0 but we do see his details updated because of the transform as expected value but not sendig/passing/updating in coupa production as shown in 1st image here and from Admin> identity management > identities

also an image shared from Coupa application

thanks
osman

[osmanmohammed]

@MVKR7T any inputs/suggestions on details shared.

[MVKR7T (Krishna Mummadi)]

In your Provisioning Activity, it is showing 0.

What is the mapping for that approval limit in your create account provisioning policy form.

Are you using an Identity attribute or a Transform ?

Thanks
Krish

[osmanmohammed]

their are 2 attributes which attribute you were asking for
in Account creation/provisioning → attributes are
requisition approval limit

approval limit

it is a transform → type: accountAttribute

{
    "id": "abcd1234",
    "name": "Coupa expense approval limit",
    "type": "lookup",
    "attributes": {
        "input": {
            "type": "firstValid",
            "attributes": {
                "values": [
                    {
                        "attributes": {
                            "sourceName": "UltiPro",
                            "attributeName": "level"
                        },
                        "type": "accountAttribute"
                    },
                    "noLevelSet"
                ]
            }
        },
        "table": {
            "10": "20000",
            "11": "50000",
            "12": "100000",
            "13": "200000",
            "14": "200000",
            "15": "2500000",
            "default": "0"
        },
        "requiresPeriodicRefresh": true
    },
    "internal": false
}

also in attr sync we have

is the “Approval limit / requisition approval limit amount” configuration is set wrong in account provisioning ? Or because in provisioning policy we selected identity attribute as type and in transform we created with “accountAttribute” type transform ?

[osmanmohammed]

it seems that connector doesnt support update command on requisition approval limit amount field because of period (.) in requisition-approval-limit.amount attribute.

[osmanmohammed]

after the update in ISC - under provisioning policies mapping are only listing identity attribute and account attribute transforms getting populated, how can we implement account attribute in provisioning policies ?