Syncing Onboardees in SAP Identity Authentication Service (IAS) using SCIM API

[mfelizard0]

We are encountering an issue with reading/syncing Onboardee 2.0 user(s) in IAS using SCIM API..

We already upgraded our IAS to SCIM version. We have all the setup needed for this upgrade in IAS and we are using the default transformation logic for Source and Target systems for SCIM. Now we are simulating the IPS sync job for one test onboardee and for some reason it is not being read in IPS. We have tried the default sf.user.filter: active eq "true" and userName eq "our_test_onboardee" but IPS still could not read. We have tried several filters to try to query this test onboardee but none seems to be working. The test onboardee has been verified to be existing in Successfactors so we should be able to read and fetch but we cannot pinpoint right now what we are missing in IAS side since we are just using the default configurations already set up by SAP.

We have also tried querying the onboardee using API tester/Postman:

First we tried using ODATA API and we are successful in querying the onboardee. With SCIM API though, we are only able to fetch data with userType: EMPLOYEE. We thought it might have something to do with the permission for SCIM API so we did a check on that as well but still not able to query ONBOARDEES. Any advice on how we can fetch data with userType: ONBOARDEE using SCIM API?

This is the URI we used for ODATA: https://api**.sapsf.com/odata/v2/User?$filter=status in 'e'
Result: Test Onboardee was fetched

This is the URI we are using for SCIM: https://api**.sapsf.com/rest/iam/scim/v2/Users

Result: ONLY userType: EMPLOYEE is fetched

This issue is only happening with onboardees. In IPS, regular employees are successfully read and synced with our current configuration. What could we be missing and what else can we check ?

Thank you in advance!

Identity Provisioning SAP SuccessFactors Onboarding 

[faresabbes]

Hi @mfelizard0 great troubleshooting progress. My suspicion is that the issue may be due to the technical user permission role's association for the external ONB user type. such issue needs to get addressed in the backend by the ENG team. Have you had disabled ONB module and enable it again on this SF tenant before? Please raise a support case under component LOD-SF-PLT-IAS and share the INC number INC4890269 and this KBA  - 3307884 - Onboarding user is redirected to SSO login page after resetting password -  . This remains an hypothesis though, further investigation may be required.