This is a governance integration. Oleria discovers users, groups, and group membership. It doesn’t inventory documents, purchasing units, or other Ariba content as resources.
What Oleria discovers
Prerequisites
- An SAP Ariba realm, and access to the SAP Ariba Developer Portal for that realm.
- An application on the Developer Portal with the SCIM API for User and Group Master Data API product approved for your realm.
- Optional: the Audit Search API API product, on the same application or on a separate one, if you want Oleria to collect activity. SAP documents it for the US and EU data centers.
SAP Ariba has no read-only version of the SCIM API. The application you create can also make changes, and Oleria uses it for the remediation actions below.
Set up the integration
1
Create an application
Sign in to the SAP Ariba Developer Portal and create an application for Oleria.
2
Request the API products
Request the SCIM API for User and Group Master Data API product for your realm. SAP must approve the request. Activating SCIM can also require an SAP support case.To collect activity, also request the Audit Search API product, either for the same application or for a separate application.
3
Collect the connection details
From the Developer Portal, copy these values for each application:
- Application key
- OAuth client ID
- OAuth client secret
mycompany-T), your Ariba Network ID (AN-ID) (for example, AN01234567890), and the data center that hosts your realm.Connect SAP Ariba to Oleria
1
Open the integration
Sign in to your Oleria workspace and navigate to Integrations -> SAP Ariba -> Connect.
2
Complete the connection form
3
Complete the connection
Select Authenticate. Oleria checks the credentials and confirms that the SCIM API product is approved for your realm, then begins the first sync. If the Audit Search API isn’t approved, the connection still succeeds, but Oleria doesn’t collect activity.
Connect each parent or child realm as a separate integration.
Verify the integration
Confirm SAP Ariba appears on the Connected tab of your Oleria Integrations page. After the first sync completes, you can review Ariba users, groups, and activity in your Oleria workspace.Remediation actions
Oleria checks that the SCIM API product is approved for the application before it runs each action. Every action is reversible, and reverting undoes only the change Oleria made.
Oleria refuses an action, and explains why, in these cases:
- Nested membership. The user belongs to the group only through a nested group. Oleria never changes a nested or parent group. Remove the user from the nested group instead.
- System users. Oleria won’t act on the
aribasystemuser, or on the technical user that the connection authenticates as.
Known limitations
- Group permissions: Oleria shows which groups a user belongs to, but not the roles and permissions each group grants. SAP Ariba’s APIs don’t expose them.
- Sign-in details: SAP Ariba’s APIs don’t report MFA, SSO, or last sign-in, so Oleria shows these as unavailable.
- Activity history: Oleria collects up to the last 89 days of audit events.
- Activity by data center: SAP has documented the Audit Search API for the US and EU data centers. If your realm is hosted elsewhere and SAP can’t approve the Audit Search API for it, Oleria still connects but doesn’t collect activity.
- China data center: Realms hosted in the China (CN) data center aren’t supported yet.
- No account creation or deletion: Oleria deactivates users and changes group membership. It doesn’t create or delete users or groups.