> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/connector-configuration/sap-fiori.md).

# SAP Fiori connector

Configure the SAP Fiori connector to provision users to SAP over an RFC (JCo) connection.

The **SAP Fiori connector** (`sap-fiori-connector-rabbitmq`) provisions users to SAP systems serving the Fiori UX layer. Despite the name, it connects over **SAP RFC using the SAP Java Connector (JCo)** — not over HTTP/OData — so the managed system is configured with SAP logon parameters, exactly like a classic SAP system connection.

| Operation                   | Supported                                  |
| --------------------------- | ------------------------------------------ |
| Create / update user (Save) | ✅                                          |
| Delete user                 | ✅                                          |
| Suspend / resume user       | ✅                                          |
| Reset password              | ✅                                          |
| Search users                | ✅                                          |
| Search groups               | ✅                                          |
| Test connection             | ✅                                          |
| Login                       | ❌ Not implemented in the current connector |
| Group create/delete         | ❌ Not implemented in the current connector |

{% hint style="info" %}
**Which SAP connector do I need?** OpenIAM ships several: **SAP** (S/4HANA / ERP application server — see [SAP connector](/connector-configuration/sap.md)), **SAP UME** (the Java-stack User Management Engine — see [SAP UME connector](/connector-configuration/sapume.md)), and **SAP Fiori** (this page). Check which SAP stack actually owns the user accounts you need to manage.
{% endhint %}

## Use cases

* Full **user-lifecycle provisioning** to the SAP system behind your Fiori deployment.
* **Importing SAP users and groups** into OpenIAM via synchronization.
* When accounts live in the **ABAP application server** itself, compare with the main [SAP connector](/connector-configuration/sap.md) — the two overlap; choose by the target system that owns the accounts.

## Versions and compatibility

The end application is an **SAP system serving the Fiori UX layer**, reached the same way as any other ABAP-stack SAP system: over **JCo/RFC**, using BAPI calls, not over HTTP. The Fiori layer changes what users see, not how user administration is performed.

<table><thead><tr><th width="155">Property</th><th>Value</th></tr></thead><tbody><tr><td><strong>SAP systems</strong></td><td>ABAP stack, serving Fiori</td></tr><tr><td><strong>Interface</strong></td><td>JCo/RFC, using BAPI calls</td></tr><tr><td><strong>JCo library</strong></td><td>Bundled with the connector; the native <code>libsapjco3.so</code> is still required on the host</td></tr></tbody></table>

{% hint style="info" %}
This connector and the [SAP connector](/connector-configuration/sap.md) are the same integration pointed at different systems. If you are deciding between them, the prerequisites — the RFC service user, the authorization objects, the function modules — are documented in full on the [SAP connector](/connector-configuration/sap.md) page and apply here unchanged. The Java-stack User Management Engine is a third, separate thing: see the [SAP UME connector](/connector-configuration/sapume.md).
{% endhint %}

## Prerequisites

* An SAP service user with the RFC authorizations required for user management.
* The **SAP JCo native library** available to the connector process (the same prerequisite as the main [SAP connector](/connector-configuration/sap.md)).
* Network access from the connector host to the SAP application server or message server.

## Installing the connector

### Kubernetes

In Kubernetes deployments, the connector is deployed as part of OpenIAM — enable it in your deployment configuration; no separate installation is required.

### RPM

Run the connector JAR directly (with the JCo library on the path):

{% code overflow="wrap" %}

```bash
java -Dlogging.level.root=INFO -Dconfpath=/data/openiam/ -jar sap-fiori-connector-rabbitmq.jar > sap-fiori.out &
```

{% endcode %}

Or, when managed by systemd, use the connector service unit (`openiam-connector@sap-fiori-connector-rabbitmq`). To deploy on a separate host, see [Connectors via RPM](/installation/rpm/rpm-single-node/add-a-connector.md).

## Starting, stopping, and restarting

<table><thead><tr><th width="167">Deployment</th><th>Commands</th></tr></thead><tbody><tr><td>RPM (systemd)</td><td><code>systemctl start|stop|restart openiam-connector@sap-fiori-connector-rabbitmq</code></td></tr><tr><td>RPM (manual)</td><td>Start with the <code>java -jar</code> command above; stop by killing the process.</td></tr><tr><td>Kubernetes</td><td><code>kubectl rollout restart</code> the connector deployment.</td></tr></tbody></table>

## Command-line parameters and properties

The connector is a Spring Boot application. Its defaults ship inside the jar, and you override them in either of two places:

* **An external property file**, read at `${confpath}/conf/properties/sap-fiori-connector-rabbitmq.properties`. The file is optional, and `confpath` is itself a system property, set with `-Dconfpath=/data/openiam/`.
* **Directly on the command line**, as `-D` arguments, which win over the file.

{% code overflow="wrap" %}

```bash
java -Dconfpath=/data/openiam/ -Dlogging.level.root=INFO -Dorg.openiam.connector.queue=SAP_Fiori_Connector_1_Request -jar sap-fiori-connector-rabbitmq.jar
```

{% endcode %}

| Property                                  | Default                         | Notes                                                                                                        |
| ----------------------------------------- | ------------------------------- | ------------------------------------------------------------------------------------------------------------ |
| `org.openiam.connector.queue`             | `SAP_Fiori_Connector_1_Request` | Mixed-case queue name — the connector record must match exactly.                                             |
| `sap.property.date.format`                | `yyyy-MM-dd`                    | Date format used with the SAP API.                                                                           |
| `sap.general.checkIfUserHasPwdAlreadySet` | `false`                         | When `true`, skips setting the password if the SAP user already has one.                                     |
| `CIPHER_sap.general.dummyPassword`        | (encrypted)                     | The encrypted dummy password used during user creation (`CIPHER_`-prefixed properties are stored encrypted). |

| Property                                  | Default                      | Purpose                                                        |
| ----------------------------------------- | ---------------------------- | -------------------------------------------------------------- |
| `sap.property.date.format`                | `yyyy-MM-dd`                 | Date format used for SAP validity dates                        |
| `sap.general.checkIfUserHasPwdAlreadySet` | `false`                      | Whether to check for an existing password before setting one   |
| `CIPHER_sap.general.dummyPassword`        | *a value shipped in the jar* | The placeholder password used when creating a user without one |

{% hint style="warning" %}
**Set your own `CIPHER_sap.general.dummyPassword`.** The connector ships with a default, and the same default is shipped by the SAP S/4HANA connector — so it is neither unique to your deployment nor private to it. Any account created without an explicit password carries that value until it is changed.
{% endhint %}

The connection details themselves are **not** set here — they are managed system parameters, covered under [Configuring the managed system](#configuring-the-managed-system).

## Verifying the connector is running

{% stepper %}
{% step %}
In the Webconsole, open the managed system — the **Running connector status** indicator must be green.
{% endstep %}

{% step %}
Click **Test Connection** — it must return success.
{% endstep %}

{% step %}
In the RabbitMQ management console, confirm the `SAP_Fiori_Connector_1_Request` queue exists and has a consumer.
{% endstep %}

{% step %}
Check the connector log for startup errors (JCo library problems appear here).
{% endstep %}
{% endstepper %}

## Troubleshooting

| Symptom                                                    | Likely cause                                                      | Resolution                                                                                                                      |
| ---------------------------------------------------------- | ----------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| Connector never receives messages                          | Queue-name mismatch — including case                              | The connector record's queue must equal `SAP_Fiori_Connector_1_Request` exactly.                                                |
| Connector fails at startup with a JCo error                | The SAP JCo native library is missing or the wrong platform build | Install the correct JCo native library for the connector host's OS/architecture.                                                |
| Connection fails in `LOGIN_GROUP` mode                     | One of the group-logon attributes is missing                      | All of `JCO_SYSNR`, `JCO_CLIENT`, `JCO_LANG`, and `JCO_MSG_GROUP` must be set (case-sensitive names), plus Port (`JCO_MSSERV`). |
| User creation fails on password                            | Password handling conflicts with the target's state               | Review `sap.general.checkIfUserHasPwdAlreadySet` and the encrypted dummy-password property.                                     |
| Group create or delete reports success but nothing changes | Group-object operations are stubs                                 | Both return `SUCCESS` without calling SAP. Manage groups in SAP; the connector reads them.                                      |

See also: [general connector troubleshooting](/connector-configuration/4-troubleshootingconnector.md) and the [connector error-code reference](/connector-configuration/4-troubleshootingconnector.md#connector-error-codes).

## Registering the connector in OpenIAM

Register the connector under **Provisioning → Connectors** and attach it to the managed system — see [Registering the connector](/administration-guide/lifecycle/connectors-and-managed-systems.md).

## Configuring the managed system

The connector supports two SAP logon types, selected by the **`LOGON_TYPE`** managed-system attribute:

**Direct application-server logon** (default):

| Field / attribute        | JCo parameter             | Value                              |
| ------------------------ | ------------------------- | ---------------------------------- |
| **URL**                  | `JCO_ASHOST`              | The SAP application server host.   |
| **Login** / **Password** | `JCO_USER` / `JCO_PASSWD` | The SAP service user credentials.  |
| `JCO_SYSNR` (attribute)  | `JCO_SYSNR`               | The SAP system number.             |
| `JCO_CLIENT` (attribute) | `JCO_CLIENT`              | The SAP client.                    |
| `JCO_LANG` (attribute)   | `JCO_LANG`                | Logon language (for example `EN`). |

**Logon-group (message server) logon** — set `LOGON_TYPE` = `LOGIN_GROUP`:

| Field / attribute                                               | JCo parameter | Value                            |
| --------------------------------------------------------------- | ------------- | -------------------------------- |
| **URL**                                                         | `JCO_MSHOST`  | The SAP message server host.     |
| **Port**                                                        | `JCO_MSSERV`  | The message server service/port. |
| `JCO_MSG_GROUP` (attribute)                                     | `JCO_GROUP`   | The logon group name.            |
| **Login** / **Password**, `JCO_SYSNR`, `JCO_CLIENT`, `JCO_LANG` | as above      |                                  |

Attribute names are case-sensitive and must be added to the managed system exactly as shown.

## Attribute mapping and policy map

Map OpenIAM user attributes to the SAP user fields in the managed system's [policy map](/administration-guide/lifecycle/policy-map.md).

## Reconciliation and synchronization

The user and group searches supply SAP records as source data. Configure a sync against the managed system as described in [Configuring synchronization](/administration-guide/lifecycle/synchronize-and-import-data.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/connector-configuration/sap-fiori.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.