SAP Ariba Category Management

Follow this procedure to set up SAP Ariba Category Management as a target system.

Prerequisites

Note:

Currently, SAP Ariba Category Management connector is only available for selected customers who are approached by SAP.

Restriction:

This system is available for bundle tenants running on SAP Cloud Identity infrastructure and standalone tenants running on SAP Cloud Identity infrastructure and SAP BTP, Neo environment. Bundle tenants running on Neo environment can use it only through SAP Identity Access Governance bundle option.

You have created an instance and generated a service key for the scim service plan of SAP Ariba Category Management. For more information, see Creating a SAP Ariba Category Management SCIM Service Instance in Your Subaccount.

Context

SAP Ariba Category Management is a cloud-based solution that enables organizations to define and manage purchasing categories and provides actionable market intelligence, category insights, and various tools and templates for developing and operationalizing category strategies that drive business value and performance. This business solution is built on SAP Business Technology Platform (BTP). You can use Identity Provisioning to configure SAP Ariba Category Management as a target system where you can provision users from source systems.

Note:

SAP Ariba Category Management does not support groups.

Procedure

Access the Identity Provisioning UI.
- Access Identity Provisioning UI of Bundle Tenants ↗️
- Access Identity Provisioning UI of Standalone Tenants ↗️
Sign in to the administration console of SAP Cloud Identity Services and navigate to Identity Provisioning > Target Systems.
Add SAP Ariba Category Management as a target system. For more information, see Add New Systems.

Choose the Properties tab to configure the connection settings for your system.

Note:

If your tenant is running on SAP BTP, Neo environment, you can create a connectivity destination in your subaccount in the SAP BTP cockpit, and then select it from the Destination Name combo box in your Identity Provisioning User Interface.

If one and the same property exists both in the cockpit and in the Properties tab, the value set in the Properties tab is considered with higher priority.

We recommend that you use the Properties tab. Use a connectivity destination only if you need to reuse one and the same configuration for multiple provisioning systems.

Mandatory Properties

Property Name	Value
`Type`	Enter: HTTP
`URL`	Enter the URL provided by the service key under the scim-v1 field without adding the path information.
`ProxyType`	Enter: Internet
`Authentication`	Enter: BasicAuthentication
`User`	Enter the value from the clientid field of the service key.
`Password`	(Credential) Enter the value from the clientsecret field of the service key.
`OAuth2TokenServiceURL`	Enter the OAuth 2.0 Token Service URL. This is the value from the url field of the service key plus `/oauth/token`
(Optional) `cm.user.unique.attribute`	If Identity Provisioning tries to provision a user that already exists in the target system (a conflicting user), this property defines the unique attributes by which the existing user will be searched and resolved. The property is not added automatically at system creation. Possible values: userName and emails[].value* For more information, see: User Update and Uniqueness section below and List of Properties.
(Optional) `ips.delete.threshold.users`	Use this property to control the number of users to be deleted in a target system by defining a threshold. This will prevent you from accidentally deleting a huge number of users, for example by adding a filter or condition. For more information, see: List of Properties

To learn what additional properties are relevant to this system, see List of Properties. You can use the main search, or filter properties by the Name or System Type columns.

Configure the transformations.

Transformations are used to map the user attributes from the data model of the source system to the data model of the target system, and the other way around. The Identity Provisioning offers a default transformation for the SAP Ariba Category Management target system, whose settings are displayed under the Transformations tab after saving its initial configuration.

You can change the default transformation mapping rules to reflect your current setup of entities in your SAP Ariba Category Management system. For more information, see:

Manage Transformations

SCIM APIs for SAP Ariba Category Management

Mapping logic – The behavior of the default transformation logic is to map all attributes from the internal SCIM representation to the target SAP Ariba Category Management entity.

User Update and Uniqueness

The write transformation of SAP Ariba Category Management supports two user unique attributes for managing conflict resolution: username and email. The username is a mandatory attribute, while the email is an optional, multivalue attribute, indicating that a user may have multiple unique emails.

The uniqueness of a user in the target system is determined not only by the individual attributes or the combination of both, but also by considering whether one or multiple existing users in the target system share the same values for these unique attributes. Have in mind the following specifics when updating an existing user in the target system, in accordance with the configuration of the cm.user.unique.attribute property:
- When cm.user.unique.attribute= userName
  
  If a user in the source system, with a specific username and an email, matches an existing user in the target system by the same email, but a different userName, the user provisioning will fail. In this case, Identity Provisioning will try to create a new user but will fail, since a user with the same email already exists.
- When cm.user.unique.attribute= emails[*].value
  
  If a user in the source system, with a specific username and an email, matches an existing user in the target system by the same username, but a different email, the user provisioning will fail. In this case, Identity Provisioning will try to create a new user but will fail, since a user with the same username already exists.
- When cm.user.unique.attribute= userName, emails[*].value
  - If a user in the source system, with a specific username and multiple emails, matches an existing user in the target system by the same username and at least one identical email, the user in the target system will be updated.
  - If a user in the source system, with a specific username and multiple emails, matches multiple existing users in the target system (each sharing one of the multiple emails but having different usernames), the user provisioning will fail. In this case, the user will neither be created nor updated.
Default transformation:
Code Syntax:
```
{
    "user": {
        "mappings": [
            {
                "targetPath": "$.id",
                "sourceVariable": "entityIdTargetSystem"
            },
            {
                "constant": "urn:ietf:params:scim:schemas:core:2.0:User",
                "targetPath": "$.schemas[0]",
                "preserveArrayWithSingleElement": true
            },
            {
                "sourcePath": "$.userName",
                "targetPath": "$.userName"
            },
            {
                "sourcePath":"$.externalId",
                "targetPath":"$.externalId",
                "optional":true
            },
            {
                "sourcePath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']",
                "targetPath": "$['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']",
                "optional": true
            },
            {
                "sourcePath": "$.name.givenName",
                "targetPath": "$.name.givenName",
                "optional": true
            },
            {
                "sourcePath": "$.name.familyName",
                "targetPath": "$.name.familyName",
                "optional": true
            },
            {
                "sourcePath": "$.displayName",
                "targetPath": "$.displayName",
                "optional": true
            },
            {
                "sourcePath": "$.active",
                "targetPath": "$.active",
                "optional": true,
                "defaultValue": true
            },
            {
                "sourcePath": "$.emails",
                "targetPath": "$.emails",
                "optional":true,
                "preserveArrayWithSingleElement": true
            }
        ]
    }
}
```
Add a source system from which to read users. Choose from: Source Systems

Next Steps

Before starting a provisioning job, you can first subscribe for e-mail notifications from the source system you use in your scenario. This way, you will be notified by e-mail about eventual failed entities during the jobs. For more information, see Manage Job Notifications.
Now, start an identity provisioning job. For more information, see Monitor Provisioning Job Logs.

Related Information

User Replication Setup

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

sap-ariba-category-management-e4c55e4.md

sap-ariba-category-management-e4c55e4.md

SAP Ariba Category Management

Prerequisites

Note:

Restriction:

Context

Note:

Procedure

Note:

Code Syntax:

Next Steps

Files

sap-ariba-category-management-e4c55e4.md

Latest commit

History

sap-ariba-category-management-e4c55e4.md

File metadata and controls

SAP Ariba Category Management

Prerequisites

Note:

Restriction:

Context

Note:

Procedure

Note:

Code Syntax:

Next Steps