## 4.11.4  Configure Identity Provisioning Service from IAS to SAP Build Work Zone
Configure the Identity Provisioning service to provision identities and their authorizations to SAP Build Work Zone, standard edition.
Navigation service of SAP Build Work Zone, standard edition service uses Identity Provisioning service (IPS) that is used to provision identities and their authorizations between source and target systems.
This section describes the steps to configure the source system (Identity Authentication) and target systems (SAP Build Work Zone, standard edition) in the Identity Provisioning of your IAS application user interface. For some customers, the Identity Authentication and SAP Build Work Zone systems are already configured as the source and target system by the Upgrade Center.
The following configurations are required to provision:
1. Configure the Identity Provisioning service to provision identities and their authorizations to SAP Build Work Zone, standard edition.
2. User details like user email, Global User ID and group memberships from IAS to SAP Build Work Zone, standard edition.
##  Note
You must have the administrative access to your Identity Provisioning tenant and you need to enable the Manage Identity Provisioning role for your user. For more information, see Manage Authorizations in SAP Cloud Identity Infrastructure.
## Configure the Source System
1. Login to your Identity Authentication tenant.
2. Navigate to Identity Provisioning Source System .
3. Add IAS as a source system. For more information, see Add New Systems.
4. Select the source system configured for IAS from the left panel and go to the Transformations tab. Y ou can switch to the JSON editor by choosing the code-bracket icon.
##  Note
Existing Identity Authentication customers must switch from the ODATA API to the SCIM API for use with Identity Provisioning. For more information, see Upgrade from ODATA IPS Connector to SCIM IPS Connector with SAP SuccessFactors HXM Suite.
5. Ensure that the group entity has following configuration:
| Property   | Value                                                                                | Description                                                                                 |
|------------|--------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------|
| Ignore     | false                                                                                | Ensures that the SCIM entity of the groups is considered during the provi- sioning of jobs. |
| Mappings   |  Sample Code { "sourcePath": "$.id", "targetVariable": "$.entityIdSourceSys tem" }, | Ensures that the source ID field of the SCIM entity groups is set to entityIDSourceSystem   |
6. Switch to Properties tab and add or verify that the following properties are available using service key generated earlier for the SAP Build Work Zone, standard edition (foundation or standard plan):
| Field                                      | Value                                                                |
|--------------------------------------------|----------------------------------------------------------------------|
| URL                                        | portal-service field value under endpoints node from the service key |
| Authentication                             | BasicAuthentication                                                  |
| User                                       | clientid field value under uaa node from the service key             |
| Password                                   | clientsecret field value under uaa node from the service key         |
| ProxyType                                  | Internet                                                             |
| Type                                       | HTTP                                                                 |
| ias.api.version                            | 2                                                                    |
| ips.failed.request.retry.attempts          | 2                                                                    |
| ips.failed.request.retry.attempts.interval | 60                                                                   |
| ips.trace.created.entity                   | true                                                                 |
| ips.trace.failed.entity                    | true                                                                 |
| ips.trace.failed.entity.content            | false                                                                |
| ips.trace.skipped.entity                   | true                                                                 |
| ips.trace.skipped.entity.content           | false                                                                |
| Field                    | Value   |
|--------------------------|---------|
| ips.trace.updated.entity | true    |
## Configure Target Systems
1. Create a new target system with following information:
2. Select the target system that you created from the left panel and go to the Transformations tab. Y ou can switch to the JSON editor by choosing the code-bracket icon.
3. Choose Edit . Add the following attribute mapping for the group entity.
| Field         | Value                                            |
|---------------|--------------------------------------------------|
| Type          | SAP Build Work Zone, standard edition            |
| Name          | Any meaningful name (Work Zone-Target)           |
| Description   | Any meaningful description                       |
| Source System | Select the IAS source system created previously. |
| Property   | Value                                                                                                                                                                                  | Description                                                                   |
|------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------|
| Mapping    |  Sample Code { "sourcePath": "$.displayName", "optional": true, "targetPath": "$.externalId", "functions": [ { "function": "replaceAllString", "regex": " ", "replacement": "_" } ] } | Ensures the externalId field of the SCIM entity groups is set to externalId . |
4. Switch to Properties tab and add or confirm if the following properties are available using service key generated earlier for the SAP Build Work Zone, standard edition (foundation or standard plan):
| Field                                    | Value                                                                                              |
|------------------------------------------|----------------------------------------------------------------------------------------------------|
| URL                                      | portal-service field value under endpoints node from the service key                               |
| Authentication                           | BasicAuthentication                                                                                |
| User                                     | clientid field value under uaa node from the service key                                           |
| Password                                 | clientsecret field value under uaa node from the service key                                       |
| ProxyType                                | Internet                                                                                           |
| Type                                     | HTTP                                                                                               |
| OAuth2TokenServiceURL                    | https://<uaa url>/oauth/token                                                                      |
| cflp.group.unique.attribute              | externalId, ['urn:ietf:params:scim:schemas:extensio n:2.0:mapping']['providerId']                  |
| cflp.patch.group.members.above.threshold | 5000                                                                                               |
| cflp.providerId                          | ariba_buyer                                                                                        |
| cflp.user.unique.attribute               | emails[0].value, ['urn:ietf:params:scim:schemas:extensio n:2.0:mapping'] ['providerId'],externalId |
| ips.trace.failed.entity.content          | true                                                                                               |
5. Create another target system for sourcing applications and ensure that the cflp.providerId field value is set to ariba\_sourcing .
You can export the previously created target system, import the file, and make necessary changes.
## Run Replication in IPS
1. Navigate to Identity Provisioning Source System .
2. Select the source system configured for IAS and switch to the Jobs tab.
3. Run a Read or a Resync job as per your requirements to provision IAS users and roles to SAP Build Work Zone ( Navigation Service ).
##  Note
1. We recommended to run Identity provisioning service (IPS) provisioning job on scheduled basis with interval less than or equal to twenty four hours for permissions to take effect on time and overlap with Refresh Synthetic Group Data job in SAP Ariba.
2. Depending on the job schedules and configuration, it may take twenty four to forty eight hours for the roles to reflect in the navigation service from IAS.
3. You may need to run Refresh Synthetic Group Data and IPS job in SAP Ariba and IPS job to sync the roles on adhoc basis or as needed.