SAP Advanced Financial Closing

Follow this procedure to set up SAP Advanced Financial Closing as a target system.

Prerequisites

You have created an instance and generated a service key for the standard service plan of SAP Advanced Financial Closing. For more information, see: How to Manage User Access Using the SCIM API Provided.

The service key contains the API URL and the OAuth credentials (clientid and clientsecret) under the uaa property.

Context

SAP Advanced Financial Closing allows you to define, automate, process, and monitor the financial closing tasks for the entities of your organization. It is an SAP BTP application that runs in an SAP BTP subaccount.

You can use Identity Provisioning to configure SAP Advanced Financial Closing as a target system for provisioning users and user groups from various source systems.

Procedure

Access the Identity Provisioning UI.
- Access Identity Provisioning UI of Bundle Tenants ↗️
- Access Identity Provisioning UI of Standalone Tenants ↗️
Sign in to the administration console of SAP Cloud Identity Services and navigate to Identity Provisioning > Target Systems.
Add SAP Advanced Financial Closing as a target system. For more information, see Add New Systems.

Choose the Properties tab to configure the connection settings for your system.

Note:

If your tenant is running on SAP BTP, Neo environment, you can create a connectivity destination in your subaccount in the SAP BTP cockpit, and then select it from the Destination Name combo box in your Identity Provisioning User Interface.

If one and the same property exists both in the cockpit and in the Properties tab, the value set in the Properties tab is considered with higher priority.

We recommend that you use the Properties tab. Use a connectivity destination only if you need to reuse one and the same configuration for multiple provisioning systems.

Mandatory Properties

Property Name	Value
`Type`	Enter: HTTP
`URL`	Enter the URL provided by the service key under endpoints > scim2 without adding the path information. For example: `https://afc-production-afc-api.cfapps.eu10.hana.ondemand.com`
`ProxyType`	Enter: Internet
`Authentication`	Enter: BasicAuthentication
`User`	Enter the user ID provided by the service key under uaa > clientid.
`Password`	(Credential) Enter the password provided by the service key under uaa > clientsecret.
`OAuth2TokenServiceURL`	Enter the OAuth 2.0 Token Service URL provided by the service key of your SAP Advanced Financial Closing instance. It follows the pattern: `<uaa.url>/oauth/token`, where: <uaa.url> is the URL provided by the service key under uaa > url. `/oauth/token` is the suffix you need to add.
`s4hana.afc.user.unique.attribute`	If Identity Provisioning tries to provision a user that already exists in the target system (a conflicting user), this property defines the unique attributes by which the existing user will be searched and resolved. Possible values: userName emails[0].value userName,emails[0].value
`s4hana.afc.group.unique.attribute`	If Identity Provisioning tries to provision a group that already exists in the target system (a conflicting group), this property defines the unique attributes by which the existing group will be searched and resolved. The default value is displayName.
(Optional) `ips.delete.threshold.groups`	Use this property to control the number of groups to be deleted in a target system by defining a threshold. This will prevent you from accidentally deleting a huge number of groups, for example by adding a filter or condition. For more information, see: List of Properties
(Optional) `ips.delete.threshold.users`	Use this property to control the number of users to be deleted in a target system by defining a threshold. This will prevent you from accidentally deleting a huge number of users, for example by adding a filter or condition. For more information, see: List of Properties

To learn what additional properties are relevant to this system, see List of Properties. You can use the main search, or filter properties by the Name or System Type columns.

Configure the transformations.

Transformations are used to map user and group attributes from the data model of the source system to the data model of the target system, and the other way around. The Identity Provisioning offers a default transformation for the SAP Advanced Financial Closing target system, whose settings are displayed under the Transformations tab after saving its initial configuration.

You can change the default transformation mapping rules to reflect your current setup of entities in your SAP Advanced Financial Closing system. For more information, see: Manage Transformations.

How to Manage User Access Using the SCIM API Provided

SAP Business Accelerator Hub: SAP Advanced Financial Closing

To make group assignments via the user resource, you need to change the default transformation of the target system as described in Enabling Group Assignment.

Mapping logic – The behavior of the default transformation logic is to map all attributes from the internal SCIM representation to the target SAP Advanced Financial Closing entity.

Default transformation:

Code Syntax:

{
  "user": {
    "mappings": [
      {
        "constant": [
          "urn:ietf:params:scim:schemas:core:2.0:User",
          "urn:ietf:params:scim:schemas:extension:enterprise:2.0:User",
          "urn:ietf:params:scim:schemas:extension:sap:2.0:User"
        ],
        "targetPath": "$.schemas"
      },
      {
        "sourcePath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']",
        "optional": true,
        "targetPath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']"
      },
      {
        "sourceVariable": "entityIdTargetSystem",
        "targetPath": "$.id"
      },
      {
        "sourcePath": "$.userName",
        "targetPath": "$.userName"
      },
      {
        "sourcePath": "$.name.formatted",
        "targetPath": "$.name.formatted",
        "optional": true
      },
      {
        "sourcePath": "$.name.familyName",
        "targetPath": "$.name.familyName",
        "optional": true
      },
      {
        "sourcePath": "$.name.givenName",
        "targetPath": "$.name.givenName",
        "optional": true
      },
      {
        "sourcePath": "$.displayName",
        "targetPath": "$.displayName",
        "optional": true
      },
      {
        "sourcePath": "$.locale",
        "targetPath": "$.locale",
        "optional": true
      },
      {
        "sourcePath": "$.active",
        "targetPath": "$.active",
        "optional": true
      },
      {
        "condition": "$.emails[0].length() > 0",
        "targetPath": "$.emails[0].primary",
        "constant": true
      },
      {
        "sourcePath": "$.emails",
        "preserveArrayWithSingleElement": true,
        "optional": true,
        "targetPath": "$.emails",
        "functions": [
          {
            "function": "putIfAbsent",
            "key": "type",
            "defaultValue": "work"
          }
        ]
      },
      {
        "sourcePath": "$.phoneNumbers",
        "targetPath": "$.phoneNumbers",
        "preserveArrayWithSingleElement": true,
        "optional": true
      },
      {
        "sourcePath": "$.groups",
        "targetPath": "$.groups",
        "preserveArrayWithSingleElement": true,
        "optional": true
      }
    ]
  },
  "group": {
    "condition": "('%s4hana.afc.group.prefix%' === 'null') || (($.displayName =~ /%s4hana.afc.group.prefix%.*/) && (($['urn:sap:cloud:scim:schemas:extension:custom:2.0:Group']['name'] EMPTY true) || ($['urn:sap:cloud:scim:schemas:extension:custom:2.0:Group']['name'] =~ /%s4hana.afc.group.prefix%.*/)))",
    "mappings": [
      {
        "sourceVariable": "entityIdTargetSystem",
        "targetPath": "$.id"
      },
      {
        "constant": ["urn:ietf:params:scim:schemas:core:2.0:Group","urn:sap:cloud:scim:schemas:extension:custom:2.0:Group"],
        "targetPath": "$.schemas"
      },
      {
        "sourcePath": "$.displayName",
        "targetPath": "$.displayName",
        "functions": [
          {
            "condition": "('%s4hana.afc.group.prefix%' !== 'null') && (@ =~ /%s4hana.afc.group.prefix%.*/)",
            "function": "replaceFirstString",
            "regex": "%s4hana.afc.group.prefix%",
            "replacement": ""
          }
        ]
      },
      {
        "sourcePath": "$.displayName",
        "targetPath": "$['urn:sap:cloud:scim:schemas:extension:custom:2.0:Group']['name']",
        "functions": [
          {
            "condition": "('%s4hana.afc.group.prefix%' !== 'null') && (@ =~ /%s4hana.afc.group.prefix%.*/)",
            "function": "replaceFirstString",
            "regex": "%s4hana.afc.group.prefix%",
            "replacement": ""
          }
        ]
      },
      {
        "sourcePath": "$['urn:sap:cloud:scim:schemas:extension:custom:2.0:Group']['name']",
        "optional": true,
        "targetPath": "$['urn:sap:cloud:scim:schemas:extension:custom:2.0:Group']['name']",
        "functions": [
          {
            "condition": "('%s4hana.afc.group.prefix%' !== 'null') && (@ =~ /%s4hana.afc.group.prefix%.*/)",
            "function": "replaceFirstString",
            "regex": "%s4hana.afc.group.prefix%",
            "replacement": ""
          }
        ]
      },
      {
        "sourcePath": "$.members",
        "targetPath": "$.members",
        "preserveArrayWithSingleElement": true,
        "optional": true
      },
      {
        "sourcePath": "$.members[*].value",
        "preserveArrayWithSingleElement": true,
        "optional": true,
        "targetPath": "$.members[?(@.value)]",
        "functions": [
          {
            "function": "resolveEntityIds"
          }
        ]
      }
    ]
  }
}

Add a source system from which to read users and groups. Choose from: Source Systems

Next Steps

Before starting a provisioning job, you can first subscribe for e-mail notifications from the source system you use in your scenario. This way, you will be notified by e-mail about eventual failed entities during the jobs. For more information, see Manage Job Notifications.
Now, start an identity provisioning job. For more information, see Monitor Provisioning Job Logs.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

sap-advanced-financial-closing-beeeebf.md

sap-advanced-financial-closing-beeeebf.md

SAP Advanced Financial Closing

Prerequisites

Context

Procedure

Note:

Code Syntax:

Next Steps

Files

sap-advanced-financial-closing-beeeebf.md

Latest commit

History

sap-advanced-financial-closing-beeeebf.md

File metadata and controls

SAP Advanced Financial Closing

Prerequisites

Context

Procedure

Note:

Code Syntax:

Next Steps