SAP HR ModifyProvisioningRule - write back more subtypes under 0105

Identity Security Cloud (ISC) ISC Discussion and Questions
,
1

In SAP Connector, we are using attribute sync for writing back SamAccount, Email address and SSO as per the SAPHRProvisioning Rule - https://community.sailpoint.com/t5/IdentityNow-Connectors/SAP-HR-Provisioning-Modify-Rule/ta-p/73639
We are using the same BAPI_EMPLCOMM_CHANGE for SSO field update as well under infotype 0105 and have enhanced the code to include SSO subtype in addition to 0010 for email and 0001 for system user.

Issue is, we are able to update and aggregate back everything but the sso is not working.
during the attribute sync request, the value of sso is being passed successfully and we can see under synced attributes but when we aggregate back, it is blank and never reached SAP.

Did anyone came across similar need to write back attributes apart from default ones supported?

3

have you the permissions for write this attribute on SAP?

1 Like
4

Yes, we do. These 3 attributes(email, userid, sso) are in same infotype 0105 and also we have all access in SAP.
SSO config is also under subtype SSO and in infortype 0105, I am attaching SAP snip for SSO here.
One thing to note is instead of normal field of SAP, the sso field is under SAP additional fields( By default SAP is storing values in uppercase and sso ids are randomly generated values).
infotype : 0105
subtype : SSO
name : ZSSO_ID

image
image928×347 81.2 KB

5

@enistri_devo Emanuele, do you have any insight on what all changes will be required to support write back of SSO to additional field under subtype of 0105 infortype?

7

No, sorry. I think what you are doing is correct. I can only suggest to talk with the sap PM of your customer. SAP has a lot of configurations and is possibile you need a permission on SAP side.

8

Thankyou Emanuele , for your responses. I was able to make it work after further troubleshooting.

9

Hi @NehaSingh6,

Just to help others that may encounter this issue, here are the troubleshooting steps I believe you took -

  1. Checked Authorizations in SAP.
  2. Ran the Function_Module through SE37 (directly in SAP) to confirm that it was working as expected.
  3. Added loggers in the saphrModifyProvisioningRule.
  4. Investigate the SAP Logs for any indication of errors.

It turned out 1 was the root cause of the issue.

10

Hi @kyle1, Thank you!
yes, the last issue was authorization issue and it worked after fixing that.
Also, to add more - for supporting additional write back if anyone is looking, Custom BAPI or Update BAPI will be required and the SailPoint configurations need to be updated as well accordingly.

1 Like
11

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.