## 4.5.4  Configure Identity Provisioning Service
Configure the Identity Provisioning service to provision identities and their authorizations to SAP Build Work Zone, standard edition.
## Procedure
1. In your SAP S/4HANA Cloud Private Edition system, open transaction SU01 and add the role SAP\_BC\_JSF\_COMMUNICATION\_RO to the technical service user used for reading the content.
2. Go to your BTP Account and navigate to Instances and Subscriptions and subscribe to Cloud Identity Services with plan connectivity .
3. Navigate to Connectivity Destinations , and create a new destination for the Identity Provisioning integration.
For more information, see SAP Application Server ABAP.
The following tables contain as an example the values used for a connection with load balancing:
| Field              | Value                                                                       |
|--------------------|-----------------------------------------------------------------------------|
| Name               | Nameof the destination                                                      |
| Type               | RFC                                                                         |
| Description        | Enter a description                                                         |
| ProxyType          | OnPremise                                                                   |
| User               | <Username of your SAP S/4HANA Cloud Private Edition technical service user> |
| Password           | <Password of your SAP S/4HANA Cloud Private Edition technical service user> |
| Authorization Type | CONFIGURED_USER                                                             |
| Location ID        | <ID of the SAP Cloud Connector, if configured, example DLM_MAIL>            |
Add the following additional properties with their values (case sensitive):
| Property          | Value                                                                                                                                          |
|-------------------|------------------------------------------------------------------------------------------------------------------------------------------------|
| jco.client.client | <Client of your SAP S/4HANA Cloud Private Edition system, example 950>                                                                         |
| jco.client.mshost | <Virtual host of your SAP Cloud Connector configuration for Identity Provisioning service integration, until the colon, example uctclnt950rfc> |
| jco.client.r3name | <System ID of your SAP S/4HANA Cloud Private Edition system, example UCT>                                                                      |
4. Open your Identity Authentication service administrator console at: &lt;IAS domain&gt;/admin
5. Navigate to the Identity Provisioning section and open the Source Systems section.
6. Click + Add to add a new Source System:
1. Select SAP Application Server ABAP as the type.
2. Give the source system a meaningful name.
3. In the Transformations tab, click Edit , use the {..} button to switch to JSON mode, and paste the following standard transformation:
```
 Source Code { "user": { "mappings": [ { "sourcePath": "$.USERNAME", "targetVariable": "entityIdSourceSystem" }, { "sourcePath": "$.USERNAME", "targetPath": "$.userName", "correlationAttribute": true },
```
```
{ "sourcePath": "$.ALIAS.USERALIAS", "targetPath": "$.externalId", "optional": true, "correlationAttribute": true }, { "sourcePath": "$.SAPUSER_UUID.SAP_UID", "targetPath": "$ ['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']", "optional": true }, { "targetPath": "$.schemas[0]", "constant": "urn:ietf:params:scim:schemas:core:2.0:User" }, { "sourcePath": "$.ADDRESS.E_MAIL", "targetPath": "$.emails[0].value", "optional": true, "correlationAttribute": true }, { "targetPath": "$.emails[0].primary", "condition": "$.ADDRESS.E_MAIL EMPTY false", "constant": true }, { "targetPath": "$.emails[0].type", "condition": "$.ADDRESS.E_MAIL EMPTY false", "constant": "work" }, { "sourcePath": "$.ADDRESS.FIRSTNAME", "targetPath": "$.name.givenName", "optional": true }, { "sourcePath": "$.ADDRESS.LASTNAME", "targetPath": "$.name.familyName" }, { "sourcePath": "$.ADDRESS.MIDDLENAME", "targetPath": "$.name.middleName", "optional": true }, { "sourcePath": "$.ADDRESS.NICKNAME", "targetPath": "$.nickName", "optional": true }, { "sourcePath": "$.ADDRESS.TITLE_P", "targetPath": "$.name.honorificPrefix", "optional": true }, { "sourcePath": "$.ADDRESS.COUNTRY", "targetPath": "$.addresses[0].country", "optional": true }, { "targetPath": "$.addresses[0].primary", "condition": "$.ADDRESS.COUNTRY EMPTY false", "constant": true }, { "targetPath": "$.addresses[0].type",
```
```
"condition": "$.ADDRESS.COUNTRY EMPTY false", "constant": "work" }, { "sourcePath": "$.ADDRESS.TEL1_NUMBR", "targetPath": "$.phoneNumbers[0].value", "optional": true }, { "targetPath": "$.phoneNumbers[0].primary", "condition": "$.ADDRESS.TEL1_NUMBR EMPTY false", "constant": true }, { "targetPath": "$.phoneNumbers[0].type", "condition": "$.ADDRESS.TEL1_NUMBR EMPTY false", "constant": "work" }, { "sourcePaths": ["$.DEFAULTS.LANGU"], "targetPath": "$.locale", "valueMappings": [ { "key": ["W"], "mappedValue": "bg" } ], "optional": true, "type": "valueMapping", "defaultValue": "en" }, { "sourcePaths": ["$.ADDRESS.LANGUP_ISO"], "targetPath": "$.preferredLanguage", "valueMappings": [ { "key": ["W"], "mappedValue": "bg" } ], "optional": true, "type": "valueMapping", "defaultValue": "en", "functions": [ { "function": "toLowerCaseString" } ] }, { "sourcePaths": ["$.LOGONDATA.TZONE"], "targetPath": "$.timezone", "valueMappings": [ { "key": ["EET"], "mappedValue": "Europe/Sofia" } ], "optional": true, "type": "valueMapping", "defaultValue": "Europe/Berlin" }, { "targetPath": "$.active", "constant": false }, { "targetPath": "$.active",
```
```
"condition": "($.ISLOCKED.LOCAL_LOCK != 'L') && ($.ISLOCKED.GLOB_LOCK != 'L') && ($.ISLOCKED.WRNG_LOGON != 'L')", "constant": true }, { "sourcePath": "$.ACTIVITYGROUPS[*].AGR_NAME", "targetPath": "$.groups[?(@.value)]", "optional": true, "preserveArrayWithSingleElement": true } ] }, "group": { "mappings": [ { "sourcePath": "$.ROLE_NAME", "targetVariable": "entityIdSourceSystem" }, { "sourcePath": "$.ROLE_NAME", "targetPath": "$.displayName", "functions": [ { "function": "concatString", "condition": "'%abap.role.prefix%' !== 'null'", "prefix": "%abap.role.prefix%" } ] }, { "targetPath": "$.schemas[0]", "constant": "urn:ietf:params:scim:schemas:core:2.0:Group" }, { "sourcePath": "$.USERLIST[*].USERNAME", "targetPath": "$.members[?(@.value)]", "optional": true, "preserveArrayWithSingleElement": true } ] } }
```
7. Navigate to the Identity Provisioning section and open the Target Systems section.
8. Click + Add to add a new Target System:
1. Select SAP Build Work Zone, standard edition as the type.
2. Give the target system a meaningful name.
3. Select the source system you created.
4. In the Transformations tab, click Edit , use the {..} button to switch to JSON mode, and paste the following standard transformation:
```
 Source Code { "user": { "condition": "($.emails EMPTY false) && ($ ['urn:ietf:params:scim:schemas:extension:sap:2.0:User'].userUuid EMPTY false)", "skipOperations": ["update"], "mappings": [ { "targetPath": "$.id",
```
```
"sourceVariable": "entityIdTargetSystem" }, { "targetPath": "$.schemas[0]", "constant": "urn:ietf:params:scim:schemas:core:2.0:User" }, { "targetPath": "$ ['urn:ietf:params:scim:schemas:extension:2.0:mapping']['providerId']", "constant": "%cflp.providerId%" }, { "sourcePath": "$.emails[0].value", "targetPath": "$.emails[0].value", "condition": "$.emails[?(@.primary == true)].value == []", "optional": true }, { "sourcePath": "$.emails[?(@.primary == true)].value", "targetPath": "$.emails[0].value", "condition": "$.emails[?(@.primary == true)].value != []", "optional": true, "preserveArrayWithSingleElement": true, "functions": [ { "function": "elementAt", "index": 0 } ] }, { "targetPath": "$.emails[0].primary", "condition": "$.emails[0].length() > 0", "constant": true }, { "sourcePath": "$ ['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']", "targetPath": "$.externalId", "optional": true }, { "sourcePath": "$.groups[*].value", "targetPath": "$.groups[?(@.value)]", "optional": true, "preserveArrayWithSingleElement": true, "functions": [ { "function": "resolveEntityIds", "entityType": "group" } ] } ] }, "group": { "mappings": [ { "targetPath": "$.id", "sourceVariable": "entityIdTargetSystem" }, { "targetPath": "$ ['urn:ietf:params:scim:schemas:extension:2.0:mapping']['providerId']", "constant": "%cflp.providerId%" },
```
```
{ "targetPath": "$.schemas[0]", "constant": "urn:ietf:params:scim:schemas:core:2.0:Group" }, { "targetPath": "$.schemas[1]", "constant": "urn:ietf:params:scim:schemas:core:2.0:mapping", "optional": true }, { "sourcePath": "$.displayName", "targetPath": "$.externalId" }, { "sourcePath": "$.externalId", "targetPath": "$.externalId", "optional": true, "functions": [ { "function": "replaceAllString", "regex": "(?i)(^pcd:)", "replacement": "" }, { "function": "replaceString", "target": "/", "replacement": ":" }, { "function": "replaceString", "target": "(", "replacement": "@" }, { "function": "replaceString", "target": ")", "replacement": "+" } ] }, { "sourcePath": "$.members[*].value", "targetPath": "$.members[?(@.value)]", "optional": true, "preserveArrayWithSingleElement": true, "functions": [ { "function": "resolveEntityIds" } ] } ] } }
```
5. Open the Properties tab and add the following properties and their values:
| Field                       | Value                                                                             |
|-----------------------------|-----------------------------------------------------------------------------------|
| Authentication              | BasicAuthentication                                                               |
| cflp.group.unique.attribute | externalId, ['urn:ietf:params:scim:schemas:extension:2.0:mapping ']['providerId'] |
| Field                                      | Value                                                                                                                |
|--------------------------------------------|----------------------------------------------------------------------------------------------------------------------|
| cflp.patch.group.mem- bers.above.threshold | 5000                                                                                                                 |
| cflp.providerId                            | <ID of the content provider you created in your SAP Build Work Zone, standard edition tenant, e.g. S4_PC_UCT950>     |
| cflp.user.unique.attribute                 | emails[0].value, ['urn:ietf:params:scim:schemas:extension:2.0:mapping ']['providerId'],externalId                    |
| ips.trace.failed.entity.content            | false                                                                                                                |
| OAuth2TokenServiceURL                      | <Value of the UAA URL property of the SAP Build Work Zone, standard edition service key you created + /oauth/ token> |
| Password                                   | <Value of the clientsecret property of the SAP Build Work Zone, standard edition service key>                        |
| ProxyType                                  | Internet                                                                                                             |
| Type                                       | HTTP                                                                                                                 |
| URL                                        | <Value of the portal-service property of the SAP Build Work Zone, standard edition service key>                      |
| User                                       | <Value of the clientid property of the SAP Build Work Zone, standard edition service key service key>                |
9. Navigate to the Identity Provisioning section and open the Source Systems section.
10. Select the source system you created for your SAP S/4HANA Cloud Private Edition tenant.
11. Open the Jobs tab.
12. Click Run Now for the Read Job to start the synchronization of your SAP S/4HANA Cloud Private Edition users and roles with your SAP Build Work Zone, standard edition tenant.
13. Navigate to the Identity Provisioning section and open the Provisioning Logs section to see the logs and status of your synchronization jobs.
You have now completed the setup of the Identity Provisioning service.
Users who have configured cards as visible in the Insights section of My Home in SAP S/4HANA Cloud, should now be able to see their cards in the Insights section of SAP Build Work Zone, standard edition.
## Related Information
Configure the Identity Provisioning Service