## 4.6.3  Configure Identity Provisioning Service
Navigation service of SAP Build Work Zone, standard edition service uses Identity Provisioning service (IPS) that is used to provision identities and their authorizations between source and target systems.
This section describes the steps to configure the source system (SAP S/4HANA Cloud Public Edition) and target systems (Identity Authentication and SAP Build Work Zone, standard edition) in the Identity Provisioning of your IAS application user interface.
The following configurations are required to provision:
1. User details like user email, Global User ID and group memberships from SAP S/4HANA Cloud Public Edition to SAP Build Work Zone, standard edition.
2. User roles as groups from SAP S/4HANA Cloud Public Edition (source system) to SAP Build Work Zone, standard edition with role ID as external ID and group memberships.
##  Note
You must have the administrative access to your Identity Provisioning tenant and you need to enable the Manage Identity Provisioning role for your user. For more information, see Manage Authorizations in SAP Cloud Identity Infrastructure.
You must have created the communication scenario and communication users for the communication arrangement SAP\_COM\_0193 . For more information, see SAP S/4HANA Cloud.
## Configure Source System
1. Login to your Identity Authentication tenant.
2. Navigate to Identity Provisioning Source System .
3. Add SAP S/4HANA Cloud Public Edition as a source system. For more information, see Add New Systems.
4. Under the Properties tab, configure the connection settings for your system and add or confirm if the following properties are available.

| Property Name                    | Value                                                                                                                                                                                                                                                                                      |
|----------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Type                             | HTTP                                                                                                                                                                                                                                                                                       |
| URL                              | Enter the SAP S/4HANA Cloud Public Edition API URL. You can find the correct URL in the API-URL field of the communication arrangement set up for communication scenario SAP_COM_0193 . For example: https://my123456- api.s4hana.ondemand.com or https:// my123456-api.s4hana.cloud.sap . |
| ProxyType                        | Internet                                                                                                                                                                                                                                                                                   |
| Authentication                   | Enter your authentication method: BasicAuthentication                                                                                                                                                                                                                                      |
| User                             | Enter the user name from the communication arrange- ment SAP_COM_0193                                                                                                                                                                                                                      |
|                                  |  Caution Do not use special symbol ',' (comma) as it is not supported.                                                                                                                                                                                                                    |
| Password                         | Enter the password for the user name from the communi- cation arrangement SAP_COM_0193                                                                                                                                                                                                     |
|                                  |  Caution Do not use special symbol ',' (comma) as it is not supported.                                                                                                                                                                                                                    |
| s4hana.cloud.skip.read.archived  | In the event of archived (disabled) entities in the source system SAP S/4HANA Cloud Public Edition, choose whether the provisioning jobs to continue reading such entities or to skip them. This property is enabled by default. If you want to always                                     |
| ips.date.variable.format         | yyyy-MM-dd                                                                                                                                                                                                                                                                                 |
| s4hana.cloud.api.version         | 1 This means your SAP S/4HANA Cloud Public Edition sys- tem uses SAP_COM_0193 communication arrangement.                                                                                                                                                                                   |
| ips.trace.skipped.entity.content | true                                                                                                                                                                                                                                                                                       |
| ips.trace.failed.entity.content  | true                                                                                                                                                                                                                                                                                       |
5. Configure the transformations. Transformations are used to map the user attributes from the data model of the source system to the data model of the target system, and the other way around. The Identity Provisioning offers a default transformation for the SAP S/4HANA Cloud Public Edition source system, whose settings are displayed under the Transformations tab after saving its initial configuration. You can change the default transformation mapping rules depending on your setup of entities in your SAP S/4HANA Cloud Public Edition system.
```
{ "user": { "condition": "($.user.validityPeriod.startDate <= '${currentDate}') && ($.user.validityPeriod.endDate > '${currentDate}')", "mappings": [ { "sourcePath": "$.personID", "targetVariable": "entityIdSourceSystem" }, { "sourcePath": "$.personalInformation.firstName", "targetPath": "$.name.givenName", "optional": true }, { "sourcePath": "$.personalInformation.lastName", "targetPath": "$.name.familyName", "optional": true }, { "sourcePath": "$.personalInformation.middleName", "targetPath": "$.name.middleName", "optional": true }, { "sourcePath": "$.personalInformation.personFullName", "targetPath": "$.name.formatted", "optional": true }, { "sourcePath": "$.user.userName", "targetPath": "$.userName", "optional": true, "correlationAttribute": true }, { "constant": true, "targetPath": "$.active" }, { "condition": "$.user.lockedIndicator == 'true'", "constant": false, "targetPath": "$.active", "optional": true }, { "sourcePath": "$.workplaceInformation.emailAddress", "targetPath": "$.emails[0].value", "optional": true, "correlationAttribute": true }, { "sourcePath": "$.user.logonLanguageCode", "optional": true, "targetPath": "$.locale" }, { "sourcePath": "$.PersonExternalID", "optional": true,
```
```
"correlationAttribute": true }, { "sourcePath": "$.user.globalUserID", "optional": true, "targetPath": "$ ['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']" }, { "sourcePath": "$.user.role", "targetPath": "$.groups", "preserveArrayWithSingleElement": true, "functions": [ { "condition": "'%s4hana.cloud.roles.prefix%' !== 'null'", "function": "concatString", "applyOnElements": true, "prefix": "%s4hana.cloud.roles.prefix%", "applyOnAttribute": "roleName", "assignToAttribute": "display" }, { "condition": "'%s4hana.cloud.roles.prefix%' === 'null'", "function": "concatString", "applyOnElements": true, "prefix": "", "applyOnAttribute": "roleName", "assignToAttribute": "display" }, { "function": "concatString", "applyOnElements": true, "prefix": "", "applyOnAttribute": "roleName", "assignToAttribute": "value" } ] }, { "type": "remove", "targetPath": "$.groups[*].roleName" }, { "type": "valueMapping", "sourcePaths": [ "$.user.timeZoneCode" ], "targetPath": "$.timezone", "defaultValue": "Europe/Berlin", "valueMappings": [ { "key": [ "WDFT" ], "mappedValue": "Europe/Berlin" }, { "key": [ "ISRAEL" ], "mappedValue": "Asia/Jerusalem" }, { "key": [ "RUS03" ],
```
```
"mappedValue": "Europe/Moscow" }, { "key": [ "AUSNSW" ], "mappedValue": "Australia/Sydney" }, { "key": [ "UTC+4" ], "mappedValue": "Asia/Dubai" }, { "key": [ "BRAZIL" ], "mappedValue": "America/Sao_Paulo" }, { "key": [ "BRZLEA" ], "mappedValue": "America/Sao_Paulo" }, { "key": [ "MSTNO" ], "mappedValue": "America/Phoenix" }, { "key": [ "EST" ], "mappedValue": "America/New_York" }, { "key": [ "UTC" ], "mappedValue": "Etc/UTC" }, { "key": [ "UTC+3" ], "mappedValue": "Asia/Riyadh" }, { "key": [ "EST_" ], "mappedValue": "America/Toronto" }, { "key": [ "UTC+8" ], "mappedValue": "Asia/Shanghai" }, { "key": [ "JAPAN" ], "mappedValue": "Asia/Tokyo" }
```
```
] }, { "type": "valueMapping", "sourcePaths": [ "$.businessPartnerRoleCode" ], "targetPath": "$.userType", "defaultValue": "Employee", "valueMappings": [ { "key": [ "BUP003" ], "mappedValue": "Employee" }, { "key": [ "BBP005" ], "mappedValue": "Contingent Worker" } ] } ] }, "group": { "mappings": [ { "sourcePath": "$.ID", "targetPath": "$.displayName", "targetVariable": "entityIdSourceSystem", "functions": [ { "condition": "'%s4hana.cloud.roles.prefix%' !== 'null'", "function": "concatString", "prefix": "%s4hana.cloud.roles.prefix%" } ] }, { "constant": "urn:ietf:params:scim:schemas:core:2.0:Group", "targetPath": "$.schemas[0]" }, { "sourcePath": "$.to_BusinessUserAssignment.results", "optional": true, "preserveArrayWithSingleElement": true, "targetPath": "$.members" }, { "type": "remove", "targetPath": "$.members[*].__metadata" }, { "type": "remove", "targetPath": "$.members[*].UserName" }, { "type": "rename", "constant": "value", "targetPath": "$.members[*].PersonID" }, { "constant": "User", "targetPath": "$.members[*].type" }
```
]
}
## Configure Target System
1. Navigate to Identity Provisioning Target System .
2. Add SAP Build Work Zone, standard edition as a target system. For more information, see Add New Systems.
3. Select SAP S/4HANA Cloud Public Edition as the Source system (that you configured in the previous step), whose identities you want to read and provision to the target one.
4. Choose the Properties tab to configure the connection settings for your system:
| Property Name                     | Value                                                                                                                                                                                                                                                           |
|-----------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Type                              | HTTP                                                                                                                                                                                                                                                            |
| URL                               | Enter the API URL of SAP Build Work Zone, standard edition from the service key of your SAP Build Work Zone, standard edition instance under endpoints [por- tal-service]. It follows the pattern: https://portal- service.cfapps.sap.hana.ondemand.com         |
| ProxyType                         | Internet                                                                                                                                                                                                                                                        |
| Authentication                    | BasicAuthentication                                                                                                                                                                                                                                             |
| User                              | Enter the OAuth Client Id, from the service key of your SAP Build Work Zone, standard edition instance under uaa.clientid .                                                                                                                                     |
| Password                          | (Credential) Enter the OAuth Client Secret, from the serv- ice key of your SAP Build Work Zone, standard edition instance under uaa.clientsecret .                                                                                                              |
| OAuth2TokenServiceURL             | Enter the OAuth 2.0 Token Service URL from the serv- ice key of your SAP Build Work Zone, standard edition instance. It follows the pattern: <uaa.url>/oauth/ token . For example: https://ips-cflp- woaealle.authentication.sap.hana.ondema nd.com/oauth/token |
| cflp.providerId                   | Enter a valid provider ID value. The provider ID is specified in the Channel Manager of the SAP Build Work Zone, standard edition when defining a new content provider.                                                                                         |
| ips.failed.request.retry.attempts | 2                                                                                                                                                                                                                                                               |
| Property Name                              | Value                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
|--------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| ips.failed.request.retry.attempts.interval | 50                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| ips.trace.failed.entity.content            | true                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| xsuaa.user.unique.attribute                | userName,origin                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
| xsuaa.origin                               | sap.custom                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| cflp.user.unique.attribute                 | If Identity Provisioning tries to provision a user that al- ready exists in the target system (a conflicting user), this property defines the unique attributes by which the exist- ing user will be searched and resolved. SAP Build Work Zone, standard edition supports the fol- lowing unique attributes which are automatically filled in when the target system is added in the service UI: emails[0].value, ['urn:ietf:params:scim:schemas:extensio n:2.0:mapping'] ['providerId'],externalId • If the user has an externalId , the conflict is re- solved by externalId and providerId . • If the user doesn't have an externalId , the con- flict is resolved by email and providerId . For the conflict to be resolved, an existing user matching both unique attributes should be found. If an existing doesn't match both unique attributes or matches only of them, the user creation fails. |
|                                            | user one                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
|                                            |  Tip Werecommend that you do not modify the value of the cflp.user.unique.attribute property. Otherwise, user creation fails.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            |
| Property Name               | Value                                                                                                                                                                                                                                                                                                                                                                                       |
|-----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| cflp.group.unique.attribute | If Identity Provisioning tries to provision a group that al- ready exists in the target system (a conflicting group), this property defines the unique attributes by which the existing group will be searched and resolved. SAP Build Work Zone, standard edition supports a pair of unique attributes which is automatically filled in when the target system is added in the service UI: |
|                             | externalId, n:2.0:mapping']['providerId'] For the conflict to be resolved, an existing group match-                                                                                                                                                                                                                                                                                         |
|                             | ['urn:ietf:params:scim:schemas:extensio                                                                                                                                                                                                                                                                                                                                                     |
|                             | ing both unique attributes should be found. In this case, Identity Provisioning updates the group. This means, the conflicting group overwrites the existing one. If the group matches only one of the unique attributes, the conflict is                                                                                                                                                   |
|                             | not resolved, and the group creation fails.                                                                                                                                                                                                                                                                                                                                                 |
|                             |  Tip Werecommend that you do not modify the value of the cflp.user.unique.attribute property. Otherwise, user creation fails.                                                                                                                                                                                                                                                              |
## Property Name
## Value
| cflp.support.bulk.operation            | This property enables bulk operations for users and groups. When the property is enabled (set to true ), the following operations can be executed by Identity Provisioning serv- ice in a single request: • Create or delete multiple users • Create, update, or delete multiple groups When the property is disabled (set to false ), the following operations can be executed by Identity Provisioning serv- ice for a single entity at a time: • Create or delete a user • Create, update, or delete a group  Note Update operation is skipped for users in the default write transformation. Possible values: • true •   |
|----------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| cflp.bulk.operations.max.count         | If you have enabled the bulk operations, you can use this property to set the number of operations to be provi- sioned per request. Possible values: Default value: 20 Maximum value: 100 If you enter a number larger than 100, the service will                                                                                                                                                                                                                                                                                                                                                                             |
| (Optional) ips.delete.threshold.groups | Use this property to control the number of groups to be deleted in a target system by defining a threshold. This will prevent you from accidentally deleting a huge number of groups, for example by adding a filter or condition.                                                                                                                                                                                                                                                                                                                                                                                            |
| (Optional) ips.delete.threshold.users  | Use this property to control the number of users to be deleted in a target system by defining a threshold. This will prevent you from accidentally deleting a huge number of users, for example by adding a filter or condition. For more information, see List of Properties                                                                                                                                                                                                                                                                                                                                                 |
5. From the left panel and go to the Transformations tab. Y ou can switch to the JSON editor by choosing the code-bracket icon. Transformations are used to map user and group attributes from the data model of the source system to the data model of the target system, and the other way around. The Identity Provisioning offers a default transformation for the SAP Build Work Zone, standard edition target system, whose settings are displayed under the Transformations tab after saving its initial configuration.
##  Sample Code
```
{ "user": { "skipOperations": [ "update" ], "mappings": [ { "sourceVariable": "entityIdTargetSystem", "targetPath": "$.id" }, { "constant": "urn:ietf:params:scim:schemas:core:2.0:User", "targetPath": "$.schemas[0]" }, { "constant": "%cflp.providerId%", "targetPath": "$ ['urn:ietf:params:scim:schemas:extension:2.0:mapping']['providerId']" }, { "condition": "$.emails[?(@.primary == true)].value == []", "sourcePath": "$.emails[0].value", "optional": true, "targetPath": "$.emails[0].value" }, { "condition": "$.emails[?(@.primary == true)].value != []", "sourcePath": "$.emails[?(@.primary == true)].value", "preserveArrayWithSingleElement": true, "optional": true, "targetPath": "$.emails[0].value", "functions": [ { "function": "elementAt", "index": 0 } ] }, { "condition": "$.emails[0].length() > 0", "constant": true, "targetPath": "$.emails[0].primary" }, { "sourcePath": "$ ['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']", "optional": true, "targetPath": "$.externalId" }, { "sourcePath": "$.groups[*].value", "preserveArrayWithSingleElement": true, "optional": true, "targetPath": "$.groups[?(@.value)]", "functions": [ { "entityType": "group",
```
```
"function": "resolveEntityIds" } ] } ] }, "group": { "mappings": [ { "sourceVariable": "entityIdTargetSystem", "targetPath": "$.id" }, { "constant": "%cflp.providerId%", "targetPath": "$ ['urn:ietf:params:scim:schemas:extension:2.0:mapping']['providerId']" }, { "constant": "urn:ietf:params:scim:schemas:core:2.0:Group", "targetPath": "$.schemas[0]" }, { "constant": "urn:ietf:params:scim:schemas:core:2.0:mapping", "optional": true, "targetPath": "$.schemas[1]" }, { "sourcePath": "$.displayName", "optional": true, "targetPath": "$.externalId" }, { "sourcePath": "$.externalId", "optional": true, "targetPath": "$.externalId", "functions": [ { "function":"replaceAllString", "regex":"(?i)(^pcd:)", "replacement":"" }, { "function": "replaceString", "target": "/", "replacement": ":" }, { "function": "replaceString", "target": "(", "replacement": "@" }, { "function": "replaceString", "target": ")", "replacement": "+" } ] }, { "sourcePath": "$.members[*].value", "preserveArrayWithSingleElement": true, "optional": true, "targetPath": "$.members[?(@.value)]", "functions": [ { "function": "resolveEntityIds" } ]
```
```
} ] } }
```
## Run Replication in IPS
In order to replicate content from SAP S/4HANA Cloud Public Edition system to the content provider in SAP Build Work Zone standard edition, you must run the provisioning job from the Identity Provisioning user interface (UI).
1. Under Source Systems , select your source system for SAP S/4HANA Cloud Public Edition. Choose Jobs Read Job Run Now .
2. Choose Resync and choose Run Now .
##  Note
It is recommended to schedule the Read Job once every twenty four hours.