Skip to main content
Connect SAP S/4HANA to Oleria to see who can sign in to your ERP system and what they can do there. Oleria reads business users, their business roles and user groups, and the communication users that other systems use to call SAP S/4HANA. On Cloud Public Edition, Oleria uses SAP’s released OData and SCIM APIs with a dedicated communication user. On Cloud Private Edition and on-premise systems, Oleria reads business users through SAP’s released QueryBusinessUserIn SOAP service.

​
What Oleria discovers

Once connected, Oleria continuously discovers and maps the following from SAP S/4HANA Cloud Public Edition:
  • Accounts - every business user, with status, validity period, last sign-in, email address, and license type. A user is shown as disabled when locked or outside the validity period. Users who hold a business catalog for managing users, business roles, communication settings, or the Security Audit Log are marked as administrators, unless the role grants no write access.
  • User groups - each business user group and its members. A business user belongs to at most one group. Groups without members appear when SAP_COM_0465 is set up.
  • Roles - business roles and the users assigned to each one, with the business catalogs and access categories each role grants.
  • Non-human identities - communication users, which other systems use to call SAP S/4HANA, with the communication scenarios they can use. Their passwords and certificates, and the outbound users of communication systems, appear as secrets and certificates. SAP-managed communication users are labelled as such.
  • Ownership - the owner contact of each communication system, when the contact’s email matches exactly one business user.
  • Activity - sign-ins, failed sign-ins, user and authorization changes, and password and certificate changes from the Security Audit Log, plus changes to business users and business roles from their change documents, and each access request by SAP support with its incident, access level, and validity.
On Cloud Private Edition and on-premise systems, Oleria discovers business users only. See Known limitations. Oleria refreshes this data on its regular sync schedule.
Oleria doesn’t read business data, such as orders, invoices, or financial records.

​
Prerequisites

  • An SAP S/4HANA Cloud Public Edition tenant, or a Cloud Private Edition or on-premise system.
  • For Cloud Public Edition: a user with the Administrator business role (SAP_BR_ADMINISTRATOR), which grants access to the Communication Management apps.
  • For Cloud Private Edition or on-premise: a Basis administrator who can create users and roles, configure SOAMANAGER, and publish a service through the SAP Web Dispatcher.
  • Admin access to the Oleria workspace.
Use a dedicated communication user or technical user for Oleria, not a person’s user. SAP locks a user after three failed sign-ins, and the sync stops if the user is locked or its password expires.

​
Set up Cloud Public Edition

1

Create a communication user

In the SAP Fiori launchpad, go to Communication Management -> Maintain Communication Users, select New, enter a user name and a description, and generate a password. Keep the password for the last step.
2

Create a communication system

Go to Communication Management -> Communication Systems, select New, and enter a system ID and name. Select Inbound Only. Under Users for Inbound Communication, add the communication user with the User ID and Password authentication method. Set the person who owns the integration as the owner contact, then save.
3

Create the communication arrangements

Go to Communication Management -> Communication Arrangements. For each scenario below, select New, choose the scenario, select the communication system you created, and save.Read access (required for discovery):Remediation (optional):Create every read scenario. Oleria checks each one when you connect and names any that’s missing. If a scenario is removed later, the sync reports an error that names the missing arrangement until you create it again.
4

Find the API host

Your tenant’s API host is your Fiori launchpad host with -api after the tenant ID. For example, if you sign in at my123456.s4hana.cloud.sap, the API host is my123456-api.s4hana.cloud.sap.
If the communication system restricts inbound IP addresses, allow Oleria’s egress IP addresses. Contact support@oleria.com for the addresses for your region.

​
Set up Cloud Private Edition or on-premise

1

Expose the business user service

In SAP GUI, run transaction SOAMANAGER, go to Service Administration -> Web Service Configuration, open the QueryBusinessUserIn service, and create a binding for it. Note the binding path, if it differs from the default /sap/bc/srt/scs_ext/sap/querybusinessuserin.
2

Publish the service

Publish the binding through the SAP Web Dispatcher on a public host name, on port 443, over HTTPS. If the host’s certificate isn’t publicly trusted, you’ll paste it into the connection form. Contact support@oleria.com to allow that host name, and ask for Oleria’s egress IP addresses to allow on your firewall.
3

Create a technical user

Run transaction SU01, create a user, and on the Logon Data tab set the user type to System and set a password.
4

Grant read access

In transaction PFCG, create a role with these authorizations, and assign it to the technical user:

​
Connect SAP S/4HANA to Oleria

1

Open the integration

Go to your Oleria workspace, select Integrations -> select SAP S/4HANA.
2

Complete the connection form

Select Continue and provide the following:
3

Confirm the connection

Select Authenticate. Oleria signs in once to read a business user, then, on Cloud Public Edition, reads one record through each read communication arrangement. If a check fails, Oleria names the likely cause, such as the missing communication arrangement or a wrong host. A rejected password isn’t retried, so a wrong password doesn’t lock the user.

​
Verify the integration

Confirm the tenant appears on the Connected tab of your Oleria Integrations page with a status of Healthy. After the first sync completes, you can review the discovered accounts, groups, roles, non-human identities, and activity in your Oleria workspace.
If the password changes, edit the integration and enter the new one. Leave the password empty to keep the stored value. You can also edit the username and, on Cloud Private Edition or on-premise, the client, service path, and trusted certificate. To change the edition or the API host, add a new integration.

​
Remediation actions

On Cloud Public Edition, Oleria can take these actions with the integration’s communication user: Oleria refuses these actions and sends no change to SAP S/4HANA:
  • Create user with groups selected. SAP S/4HANA doesn’t set business roles or a user group at creation, so create the user first, then use Add user to role and Add user to group.
  • Acting on its own communication user, on SAP-managed communication users, or on SAP’s own users, such as those whose names start with SAP_.
  • Removing a user-administration business role from a user if no other user who holds one is unlocked and inside their validity period.
  • Adding a user to a user group while they belong to another one. A business user can belong to only one user group, so remove them from their current group first.
  • Disabling a communication user’s password, certificate, or outbound secret. SAP has no API for this, so rotate or delete them in Communication Management.
Keep these points in mind:
  • Oleria reads the target before it changes anything. If the target is already in the requested state, the action succeeds without making a change, and there’s nothing to revert.
  • After each change, Oleria reads the target again. If SAP S/4HANA returns an error but the change shows up, the action succeeds and you can revert it. If the change doesn’t show up, the action fails. If Oleria can’t read the result, the action fails and names what to check in SAP S/4HANA.
  • If Create user creates the user but can’t set the lock state you requested, Oleria locks the new user and the action fails.
  • When SAP S/4HANA integrates with an HR system, SAP doesn’t allow creating business users through the API. Create them in the HR system instead.
  • Reverting checks the target first. If it changed after the action ran, or no longer exists, Oleria leaves it as is.
Actions aren’t available on Cloud Private Edition or on-premise systems.

​
Known limitations

  • On Cloud Private Edition and on-premise systems, Oleria reads business users only, without their lock status or last sign-in. Technical users, PFCG roles, authorizations, and the Security Audit Log are available only through RFC function modules, not a released HTTPS API.
  • Oleria doesn’t read individual field values of business role restrictions yet. Restrictions are shown at the catalog level.
  • A derived business role is shown with the catalogs it holds, and its leading role is named in its description. Oleria doesn’t link the two roles, because a derived role can carry different organizational values.
  • SAP has no API that returns business roles assigned to a user group, so groups carry no role access in Oleria.
  • SAP’s Read Access Log isn’t collected because it records no user.
  • Oleria doesn’t import business data objects as resources.
  • SAP’s own technical users, such as SAP_SYSTEM, have no API. Activity by those users is attributed to one SAP system actor.
  • SAP pseudonymizes its support users, so they aren’t listed as accounts. Their access requests and activity are attributed to the support user’s ID, shown as a user that isn’t in the directory.
  • Joule agents run in SAP BTP and are catalogued in SAP AI Agent Hub, not in the SAP S/4HANA tenant. Oleria doesn’t discover them from SAP S/4HANA.
  • Multi-factor authentication is enforced by SAP Cloud Identity Services or your identity provider, so Oleria doesn’t report it from SAP S/4HANA.
  • Activity is collected for up to the last 90 days on the first sync. SAP keeps Security Audit Log events for 45 days by default, so older sign-ins are available only if your retention period is longer.
  • This integration was built from SAP’s API documentation and hasn’t yet been validated against a live tenant. If a sync or an action fails, contact support@oleria.com.

​
Contact us

For questions about this integration, contact us at support@oleria.com.