Identity Provisioning Service for GRC AC integration with Successfactors using IAG bridge

[nidhi_kumari02]

Hello,

Do we need IPS for integrating GRC AC with Successfactors and Ariba using IAG bridge scenario? If yes, then why.

Can someone explain this in detail.

Regards,

Nidhi Kumari

[Trinetra_Bhusha]

nidhikumari : In terms of technical configuration by Customer we do not need to Configure IPS for Integration of GRC AC using IAG Bridge.There are some system like SAP Analytics who do requires IPS configuration by customer to achieve the User Provisioning in SAC system using IAG Bridge.

In those scenarios IPS act as a proxy system for IAG.I hope that answers you primary query.

[D_Olderdissen]

You will need to do some puzzeling.

1. What API`s does SAP AC provide? Ideally look for SCIM
2. What API`s does SuccessFactors and Ariba provide?

The challenge is now to match those various API`s and figure out how you get your data from A to B.

AFAIK SuccessFactors has a oData API and Ariba has some SCIM interface but it might not be GA yet. Some home work to be done there.

Then there is IPS. There are two flavors - the bundle IPS and the IPS that comes with IAG. Bundled IPS come with certain BTP Cloud Products, like BTP or SuccessFactors. Read the docs carefully what IPS connectors are included in what bundle. And wrap your head around the proxy function. So your mileage with them will vary on what you already have licensed.

IAG-IPS is intended to connect IAG to the various SAP Cloud Solutions and for that reason the classic IPS full tenant is included. If that included IPS tenant serves your needs again depends on your exact needs. Make sure you read the IPS documentation very carefully to not mix up the new bundle connectors with the classic IPS stuff. Particularly Ariba will need to be qualified as I heard that IAG might not even use IPS to connect to Ariba. Kind of closes the circle to figuring out what API`s Ariba provides for user management.

Food for thought: Maybe revisit this requirement to integrate with AC? Considering that those SaaS (Ariba & SuccessFactors) do have their very own user roles and rights concepts, changes are very high that the AC way of looking at things does not fit at all. Maybe it is easier and faster to work with Authentication only and handle the roles assignment on those particular SaaS systems locally. Particularly SuccessFactors seems to have some very nifty auto group assignement methods to handle the authorizations more easily.

You see, a very complex topic that should be taken step by step