## 4.4.2  Configure Identity Provisioning Service
Steps to configure Identity Provisioning service.
Navigation service of SAP Build Work Zone, standard edition service uses Identity Provisioning service (IPS) that is used to provision identities and their authorizations between source and target systems.
This section describes the steps to configure the source system (SAP SuccessFactors) and target systems (Identity Authentication and SAP Build Work Zone, standard edition) in the Identity Provisioning of your IAS application user interface. For some customers, SAP SuccessFactors and the Identity Authentication systems are already configured as the source and target system by the Upgrade Center.
The following configurations are required to provision:
1. User details like user email, Global User ID and group memberships from SAP SuccessFactors to SAP Build Work Zone, standard edition.
2. User roles as groups from SAP SuccessFactors (source system) to SAP Build Work Zone, standard edition with role ID as external ID and group memberships.
##  Note
You must have the administrative access to your Identity Provisioning tenant and you need to enable the Manage Identity Provisioning role for your user. For more information, see Manage Authorizations in SAP Cloud Identity Infrastructure.
3. Login to your Identity Authentication tenant.
4. Navigate to Identity Provisioning Source System .
5. Select the source system configured for SAP SuccessFactors from the left panel and go to the Transformations tab. Y ou can switch to the JSON editor by choosing the code-bracket icon.
##  Note
Existing Identity Authentication customers must switch from the ODATA API to the SCIM API for use with Identity Provisioning. For more information, see Upgrade from ODATA IPS Connector to SCIM IPS Connector with SAP SuccessFactors HXM Suite.
6. Ensure that the group entity has following configuration:
7. Under the Properties tab, ensure that the field sf.user.filter is configured to fetch all the required and valid users.

| Property   | Value                                                                 | Description                                                                |
|------------|-----------------------------------------------------------------------|----------------------------------------------------------------------------|
| Ignore     | false                                                                 | Ensures groups SCIM entity is consid- ered during the provisioning jobs    |
| Mappings   |  Sample Code { "sourcePath": "$.id", "targetPath": "$.externalId" }, | Ensures the source ID field of the SCIM entity groups is set to externalId |
8. Follow these steps if you don't want the groups to be provisioned in IAS, else skip this step and go to step 7.
1. Navigate to Identity Provisioning Target System .
2. Select the target system configured for Identity Authentication from the left panel and go to the Transformations tab. Y ou can switch to the JSON editor by choosing the code-bracket icon.
3. Ensure that the group entity has following configuration:
9. Create a new target system with following information:
10. Select the target system that you created from the left panel and go to the Transformations tab. Y ou can switch to the JSON editor by choosing the code-bracket icon.
11. Choose Edit . Add the following attribute mapping for the group entity.
12. Switch to Properties tab and add or confirm if the following properties are available using service key generated earlier for the SAP Build Work Zone, standard edition (foundation or standard plan):
| Property   | Value   | Description                                                          |
|------------|---------|----------------------------------------------------------------------|
| Ignore     | true    | Ensures groups SCIM entity is ig- nored during the provisioning jobs |
| Field         | Value                                  |
|---------------|----------------------------------------|
| Type          | SAP Build Work Zone, standard edition  |
| Name          | Any meaningful name (Work Zone-Target) |
| Description   | Any meaningful description             |
| Source System | Select SuccessFactors source system    |

| Property   | Value                                                                          | Description                                                                 |
|------------|--------------------------------------------------------------------------------|-----------------------------------------------------------------------------|
| Mapping    |  Sample Code { "sourcePath": "$.externalId", "targetPath": "$.externalId", }, | Ensures the externalId field of the SCIM entity groups is set to externalId |
| Field          | Value                                                                |
|----------------|----------------------------------------------------------------------|
| URL            | portal-service field value under endpoints node from the service key |
| Authentication | BasicAuthentication                                                  |
| Field                           | Value                                                                                              |
|---------------------------------|----------------------------------------------------------------------------------------------------|
| User                            | clientid field value under uaa node from the service key                                           |
| Password                        | clientsecret field value under uaa node from the service key                                       |
| ProxyType                       | Internet                                                                                           |
| Type                            | HTTP                                                                                               |
| OAuth2TokenServiceURL           | https://<uaa url>/oauth/token                                                                      |
| ips.trace.failed.entity.content | false                                                                                              |
| cflp.user.unique.attribute      | emails[0].value, ['urn:ietf:params:scim:schemas:extensio n:2.0:mapping'] ['providerId'],externalId |
| cflp.support.bulk.operation     | false                                                                                              |
| cflp.providerId                 | ID field value for content channel configured for SAP Suc- cessFactors in SAP Build Work Zone      |
| cflp.group.unique.attribute     | externalId, ['urn:ietf:params:scim:schemas:extensio n:2.0:mapping']['providerId']                  |
| cflp.bulk.operations.max.count  | 100                                                                                                |
##  Note
Add the properties cflp.support.bulk.operation (value as true ) and cflp.bulk.operations.max.count if your source system has too many entries, else you can omit them. For more information, see List of Properties.
13. Navigate to Identity Provisioning Source System .
14. Select the source system configured for SAP SuccessFactors and switch to Jobs tab.
15. Run a Read or a Resync job as per your requirements to provision SAP SuccessFactors users and roles to SAP Build Work Zone ( Navigation Service ).
##  Note
1. We recommended to run Identity provisioning service (IPS) provisioning job on scheduled basis with interval less than or equal to twenty four hours for permissions to take effect on time and overlap with Refresh Synthetic Group Data job in SAP SuccessFactors.
2. Depending on the job schedules and configuration, it may take twenty four to forty eight hours for the roles to reflect in the navigation service from SAP SuccessFactors.
3. You may need to run Refresh Synthetic Group Data and IPS job in SAP SuccessFactors and IPS job to sync the roles on adhoc basis or as needed.