> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/connector-configuration/sapume.md).

# SAP UME connector

This page describes how to set up connection to SAP UME connector

The user management engine (UME) provides a centralized user management for all Java applications and can be configured to work with user management data from multiple data sources. It is seamlessly integrated in the SAP NetWeaver Application Server (AS) Java as its default user store and can be administrated using the administration tools of the AS Java.

The UME adds business value by enabling you to leverage your existing system infrastructure by accessing user-related data on an existing LDAP directory, an AS ABAP system, a database of the AS Java, or any combination of these. In addition, it reduces administrative overhead by allowing you to perform centralized user administration.

The SAP UME connector uses the SAP UME **SPML** interface to communicate with the SAP UME system.

{% hint style="danger" %}
**This connector reads; it does not write.** Search, group search and Test Connection are implemented. Create, update, delete, suspend, resume, password reset and group create/delete are **not** — and they do not fail. Each one returns `SUCCESS` without calling SAP at all, so OpenIAM records the provisioning as having worked while nothing changes in the target. Treat SAP UME as a read-only source until these are implemented.
{% endhint %}

| Operation                 | Supported                                                                                    |
| ------------------------- | -------------------------------------------------------------------------------------------- |
| Search / reconcile users  | ✅                                                                                            |
| Search / reconcile groups | ✅                                                                                            |
| Test connection           | ✅                                                                                            |
| Create / update users     | ❌ **reports success and does nothing**                                                       |
| Delete users              | ❌ **reports success and does nothing**                                                       |
| Suspend / resume users    | ❌ **reports success and does nothing**                                                       |
| Reset password            | ❌ **reports success and does nothing**                                                       |
| Group create / delete     | ❌ **reports success and does nothing**                                                       |
| Role management           | ❌ no role operation exists; `assignedroles` and `assignedgroups` are read during search only |

Incremental reconciliation applies to users only; groups and roles need a full run.

{% hint style="info" %}
**Which SAP connector do I need?** This page covers the Java-stack **User Management Engine (UME)**. For the **SAP S/4HANA / ERP (ABAP)** system, see the [SAP connector](/connector-configuration/sap.md); for SAP systems serving the **Fiori** UX layer, see the [SAP Fiori connector](/connector-configuration/sap-fiori.md).
{% endhint %}

## Use cases

* Managing **SAP NetWeaver AS Java users** — accounts, attributes, and passwords — from OpenIAM.
* Driving **UME role and group assignments** from OpenIAM entitlements.
* **Reconciling users, groups, and roles** from UME into OpenIAM.

In a common case, you can add any attribute in the Policy Map linked to a Groovy script and the attribute value will be provisioned to the target system.

## Versions and compatibility

The end application is the **SAP User Management Engine**, the user store of an SAP **Java stack** (NetWeaver AS Java) system. It is reached over **SPML** — Service Provisioning Markup Language, carried in SOAP — not over JCo/RFC and not over a REST API.

<table><thead><tr><th width="130">Property</th><th>Value</th></tr></thead><tbody><tr><td><strong>Platform</strong></td><td>SAP NetWeaver AS Java, User Management Engine</td></tr><tr><td><strong>Interface</strong></td><td>SPML over SOAP</td></tr><tr><td><strong>Endpoint</strong></td><td>The SPML web service, typically <code>http://&#x3C;host>:5&#x3C;NN>00/spml/provisioning</code></td></tr><tr><td><strong>Filters</strong></td><td>DSML filters, which is why the search syntax below is <code>substrings(...)</code> and <code>equalityMatch(...)</code> rather than SQL or LDAP</td></tr></tbody></table>

{% hint style="info" %}
**Three SAP connectors, three different integrations.** This one is for the **Java stack** and speaks SPML. The [SAP connector](/connector-configuration/sap.md) is for the **ABAP stack** — S/4HANA and R/3 — and speaks JCo/RFC with BAPI calls. The [SAP Fiori connector](/connector-configuration/sap-fiori.md) is that same JCo integration pointed at a system serving Fiori. They are not interchangeable, and the prerequisites differ completely.
{% endhint %}

## Prerequisites

On the SAP UME server side:

* Add two roles in SAP UME.
  * SPML\_FULL\_ACCESS\_ROLE (SPML full access Role) with the following actions:
    * SPML\_Read\_Action;
    * SPML\_Write\_Action.
  * SPML\_READ\_ACCESS\_ROLE (SPML read only access Role) with the following actions: - SPML\_Read\_Action
* Add two users in SAP UME.
  * spmluser (SPML full access User):
    * Role: SPML\_FULL\_ACCESS\_ROLE.
  * spmluser\_readonly (SPML read only access User)
    * Role: SPML\_READ\_ACCESS\_ROLE.

You will also need the **SPML Web Service EndPoint** URL of your SAP UME system (for example: `http://10.1.11.58:50000/spml/provisioning`).

## Installing the connector

The connector runs as a standalone service (JAR). Download and deploy the JAR using this link: <http://download.openiam.com/customers/sia/sap-ume-connector-rabbitmq.jar>.

In an RPM environment, run it with the connector service unit (`openiam-connector@sap-ume-connector-rabbitmq`) — see [Connectors via RPM](/installation/rpm/rpm-single-node/add-a-connector.md).

## Starting, stopping, and restarting

<table><thead><tr><th width="175">Deployment</th><th>Commands</th></tr></thead><tbody><tr><td>RPM (systemd)</td><td><code>systemctl start|stop|restart openiam-connector@sap-ume-connector-rabbitmq</code></td></tr><tr><td>Standalone JAR</td><td>Run the JAR with <code>java -jar sap-ume-connector-rabbitmq.jar</code>; stop the process to stop the connector.</td></tr></tbody></table>

## Command-line parameters and properties

The connector is a Spring Boot application. Its defaults ship inside the jar, and you override them in either of two places:

* **An external property file**, read at `${confpath}/conf/properties/sap-ume-connector-rabbitmq.properties`. The file is optional, and `confpath` is itself a system property, set with `-Dconfpath=/data/openiam/`.
* **Directly on the command line**, as `-D` arguments, which win over the file.

{% code overflow="wrap" %}

```bash
java -Dconfpath=/data/openiam/ -Dlogging.level.root=INFO -Dorg.openiam.connector.queue=SAP_Connector_ 411_Request -jar sap-ume-connector-rabbitmq.jar
```

{% endcode %}

| Property                                  | Default                       | Purpose                                                                                                                                                                                                                                                                                                                      |
| ----------------------------------------- | ----------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `org.openiam.connector.queue`             | `SAP_Connector_ 411_Request`  | ⚠️ The shipped default contains a **literal space** (`SAP_Connector_ 411_Request`). The connector record in OpenIAM must match the queue name **character-for-character, including the space** — or change both sides to a clean name. A silent mismatch here is the most common reason this connector receives no messages. |
| `org.openiam.connector.queueResponseName` | `SAP_Connector_ 411_Response` | Same caveat as above.                                                                                                                                                                                                                                                                                                        |

{% hint style="danger" %}
**The shipped queue name contains a literal space** — `SAP_Connector_ 411_Request`, between `SAP_Connector_` and `411`. RabbitMQ accepts it, so a mismatch produces no error at all: the connector simply never receives anything. Either reproduce the name character for character on the connector record in OpenIAM, or change both sides to a clean name such as `SAP_UME_Connector_1_Request`. Setting it on the command line, as above, makes the value explicit and visible.
{% endhint %}

The connection details themselves are **not** set here — they are managed system parameters, covered under [Configuring the managed system](#configuring-the-managed-system).

## Verifying the connector is running

{% stepper %}
{% step %}
In the Webconsole, open the managed system — the **Running connector status** indicator must be green.
{% endstep %}

{% step %}
Click **Test Connection** — it must return success.
{% endstep %}

{% step %}
In the RabbitMQ management console, confirm the request queue (default `SAP_Connector_ 411_Request`) exists and has a consumer.
{% endstep %}
{% endstepper %}

## Troubleshooting

| Symptom                                                     | Likely cause                                                        | Resolution                                                                                                                                           |
| ----------------------------------------------------------- | ------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------- |
| Connector never receives messages                           | Queue-name mismatch — the default name contains a **literal space** | The connector record's queue in OpenIAM must match `SAP_Connector_ 411_Request` character-for-character (including the space), or rename both sides. |
| SPML write operations fail                                  | Service account lacks write access                                  | The managed-system login must be the user holding SPML\_FULL\_ACCESS\_ROLE (both SPML\_Read\_Action and SPML\_Write\_Action).                        |
| Reconciliation filter errors                                | More than one logical operand in the filter                         | A filter may combine clauses with only one operand type (`AND` **or** `OR`), not both.                                                               |
| Incremental reconciliation returns nothing for groups/roles | Not implemented                                                     | Incremental mode works for users only; run full reconciliation for groups and roles.                                                                 |

See also: [general connector troubleshooting](/connector-configuration/4-troubleshootingconnector.md) and the [connector error-code reference](/connector-configuration/4-troubleshootingconnector.md#connector-error-codes).

## Registering the connector in OpenIAM

Register the connector under **Provisioning → Connectors** and attach it to the managed system — see [Registering the connector](/administration-guide/lifecycle/connectors-and-managed-systems.md).

## Configuring the managed system

Configure the connection to SAP UME through the Managed System.

To configure the properties of the Managed System, log in to webconsole and select **Provisioning → Managed System**, then **Create Managed System** in case you are creating a new system or find an applicable out-of-the-box managed system and click **Edit** icon. For more information on Managed system creating and updating, refer to [Managed system configuration](/administration-guide/lifecycle/configure-managed-system.md) page. Here, provide login and password for the SAP UME user created above.

{% hint style="info" %}
Note that creating a new Managed system is an extremely rare case and the existing out-of-the-box managed system configurations will serve the overwhelming majority of business uses.
{% endhint %}

{% hint style="info" %}
A **Host URL** in Managed system configuration is the **SPML Web Service EndPoint** from SAP UME.

For example: <http://10.1.11.58:50000/spml/provisioning>.
{% endhint %}

## Attribute mapping and policy map

Determine what attributes you need to pass to the SAP connector. Combined with the use of the Groovy scripting language, you can dynamically derive any attribute that is needed in SAP from the data maintained within OpenIAM. The screenshot below provides a sample mapping between rules in the Identity Manager, called attribute policies, and the SAP attributes. More details on the attribute policies and mappings can be found at the [Policy map](/administration-guide/lifecycle/policy-map.md) document.

A sample mapping. Every row is an entry in the policy map: an OpenIAM attribute on the left, the SAP UME attribute it is written to on the right, and the rule that produces the value.

| Object type | SAP UME attribute                                  | Type   | Typical source                      |
| ----------- | -------------------------------------------------- | ------ | ----------------------------------- |
| USER        | `logonname`                                        | Policy | The user's principal                |
| USER        | `firstname`                                        | Policy | `firstName`                         |
| USER        | `lastname`                                         | Policy | `lastName`                          |
| USER        | `email`                                            | Policy | `mail`                              |
| USER        | `password`                                         | Policy | `userPassword`                      |
| USER        | `displayname`, `title`, `department`, `jobtitle`   | Policy | Default value, or derived in Groovy |
| USER        | `city`, `state`, `country`, `zip`, `streetaddress` | Policy | Default value, or derived in Groovy |
| USER        | `telephone`, `fax`, `mobile`                       | Policy | Default value, or derived in Groovy |
| USER        | `timezone`, `locale`, `salutation`                 | Policy | Default value                       |
| USER        | `validfrom`, `validto`                             | Policy | The account's validity dates        |
| USER        | `islocked`                                         | Policy | The account's lock state            |
| USER        | `assignedgroups`, `assignedroles`                  | Policy | `memberOf`                          |
| GROUP       | `uniquename`, `description`                        | Policy | The group's name and description    |

{% hint style="info" %}
Treat the rows above as a shape, not a specification. The attribute names are SAP UME's, but which of them you populate and what feeds each one is yours to decide — and deployments commonly add custom attributes of their own that will not appear in any sample.
{% endhint %}

Attributes allowed

| TAB             | General Information | Note                       |
| --------------- | ------------------- | -------------------------- |
| Logon ID        | logonname           |                            |
| Last Name       | lastname            |                            |
| First Name      | firstname           |                            |
| E-Mail Address  | email               |                            |
| Form of Address | salutation          |                            |
| Language        | locale              |                            |
| Security Policy | securitypolicy      | ('Default' or 'technical') |
| Unique ID       | id                  |                            |
| Display Name    | displayname         |                            |
| Title           | title               |                            |
| Password        | password            |                            |

| TAB                            | Account Information |
| ------------------------------ | ------------------- |
| Start Date of Account Validity | validfrom\*         |
| End Date of Account Validity   | validto\*           |
| User Account Locked            | islocked            |

{% hint style="info" %}
\*Format Output in OpenIAM is "yyyy-MM-dd". The connector transforms it into the format SAP UME accepts, "yyyyMMddHHmmss'Z'".
{% endhint %}

| TAB             | Contact Information |
| --------------- | ------------------- |
| Telephone       | telephone           |
| Fax             | fax                 |
| Mobile          | mobile              |
| Street          | streetaddress       |
| City            | city                |
| State/Province  | state               |
| Zip/Postal Code | zip                 |
| Country         | country             |
| Time Zone       | timezone            |

| TAB        | Additional Information |
| ---------- | ---------------------- |
| Position   | jobtitle               |
| Department | department             |

| TAB            | Assigned roles | TAB             | Assigned groups |
| -------------- | -------------- | --------------- | --------------- |
| Assigned Roles | assignedroles  | Assigned Groups | assignedgroups  |

## Reconciliation and synchronization

More details on what is and how to configure reconciliation in OpenIAM can be found in [Reconciliation](/administration-guide/lifecycle/configure-reconciliation.md) section of documents.

A managed system usually carries three reconciliation configurations — one for users and one for each kind of group object:

<table><thead><tr><th width="194">Reconciliation type</th><th>Search filter</th></tr></thead><tbody><tr><td>USER</td><td><code>substrings('logonname',"*")</code></td></tr><tr><td>GROUP</td><td><code>GROUP_TYPE=GROUP | FILTER=substrings('uniquename',"*")</code></td></tr><tr><td>GROUP</td><td><code>GROUP_TYPE=ROLE | FILTER=substrings('uniquename',"*")</code></td></tr></tbody></table>

The filter syntax those use is described below.

### Users

* Filter Operations: `equalityMatch`, `substrings`.
* Filter Logical operands: `AND`, `OR`.
* Complex filters: Filter can be formed with one or more clauses, but with only one logical operand (`AND` or `OR`).
* Correct filters samples:
  * substrings(`logonname`, `SAPUME`).
  * equalityMatch(`logonname`, `SAPUMEUSU01`)
  * equalityMatch(`logonname`, `SAPUMEUSU01`) or equalityMatch(`logonname`, `SAPUMEUSU02`).
  * substrings(`logonname`, `a`) or substrings(`logonname`, `z`) or equalityMatch(`logonname`, `sapusu01`).
* Incorrect filter samples:
  * equalityMatch(`logonname`, `SAPUMEUSU01`) or equalityMatch(`logonname`, `SAPUMEUSU02`) and substrings(`logonname`, `z`).

Reconciliation can be **full** or **Incremental**. You can use `UpdateSince MangedSysParam` to indicate incremental mode and the date to filter last updates.

We also have a `SAPSearchQuery.groovy` developed, which checks if `UpdateSince` is informed and add `"#TIMESTAMP#=yyyyMMddHHmmss"` to the search filter. Here, the connector checks this string to make a full/incremental search. Sample Incremental Filter received by the connector if you indicate UpdateSince looks as follows.

```
substrings('logonname', 'SAPUME')#TIMESTAMP#=20150709131143Z
```

Connector detects `#TIMESTAMP#` and generates SPML filters as follows.

```
    <dsml:filter>
        <dsml:and>
          <dsml:substrings name='logonname'>
            <dsml:any>SAPUME</dsml:any>
          </dsml:substrings>
          <dsml:greaterOrEqual name='lastmodifydate'>
            <dsml:value>20131008015052Z</dsml:value>
          </dsml:greaterOrEqual>
        </dsml:and>
    </dsml:filter>
```

### Groups and roles

Pattern for Groups and Roles filter looks as follows.

```
GROUP_TYPE=<groupType> | FILTER=<filter>
        - GROUP_TYPE --> "GROUP" or  "ROLE"
        - FILTER --> Filter expression like user filter expression.
```

Sample filters are

* GROUP\_TYPE=GROUP | FILTER= equalityMatch(`uniquename`, `Authenticated Users`).
* GROUP\_TYPE=ROLE | FILTER= substrings(`uniquename`, `*`).

Incremental reconciliation is **not** implemented for groups and roles.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/connector-configuration/sapume.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.