> ## Documentation Index > Fetch the complete documentation index at: https://docs.oleria.com/llms.txt > Use this file to discover all available pages before exploring further. # SAP S/4HANA > Connect SAP S/4HANA Cloud Public Edition, Cloud Private Edition, or an on-premise system to Oleria to bring business users, user groups, business roles, and communication users into your identity and access graph. Connect SAP S/4HANA to Oleria to see who can sign in to your ERP system and what they can do there. Oleria reads business users, their business roles and user groups, and the communication users that other systems use to call SAP S/4HANA. On Cloud Public Edition, Oleria uses SAP's released OData and SCIM APIs with a dedicated communication user. On Cloud Private Edition and on-premise systems, Oleria reads business users through SAP's released `QueryBusinessUserIn` SOAP service. ## What Oleria discovers Once connected, Oleria continuously discovers and maps the following from SAP S/4HANA Cloud Public Edition: * **Accounts** - every business user, with status, validity period, last sign-in, email address, and license type. A user is shown as disabled when locked or outside the validity period. Users who hold a business catalog for managing users, business roles, communication settings, or the Security Audit Log are marked as administrators, unless the role grants no write access. * **User groups** - each business user group and its members. A business user belongs to at most one group. Groups without members appear when `SAP_COM_0465` is set up. * **Roles** - business roles and the users assigned to each one, with the business catalogs and access categories each role grants. * **Non-human identities** - communication users, which other systems use to call SAP S/4HANA, with the communication scenarios they can use. Their passwords and certificates, and the outbound users of communication systems, appear as secrets and certificates. SAP-managed communication users are labelled as such. * **Ownership** - the owner contact of each communication system, when the contact's email matches exactly one business user. * **Activity** - sign-ins, failed sign-ins, user and authorization changes, and password and certificate changes from the Security Audit Log, plus changes to business users and business roles from their change documents, and each access request by SAP support with its incident, access level, and validity. On Cloud Private Edition and on-premise systems, Oleria discovers business users only. See [Known limitations](#known-limitations). Oleria refreshes this data on its [regular sync schedule](https://docs.oleria.com/integrations/overview.md#sync-model). > [!NOTE] > > Oleria doesn't read business data, such as orders, invoices, or financial records. ## Prerequisites * An SAP S/4HANA Cloud Public Edition tenant, or a Cloud Private Edition or on-premise system. * For Cloud Public Edition: a user with the Administrator business role (`SAP_BR_ADMINISTRATOR`), which grants access to the Communication Management apps. * For Cloud Private Edition or on-premise: a Basis administrator who can create users and roles, configure SOAMANAGER, and publish a service through the SAP Web Dispatcher. * Admin access to the Oleria workspace. > [!WARNING] > > Use a dedicated communication user or technical user for Oleria, not a person's user. SAP locks a user after three failed sign-ins, and the sync stops if the user is locked or its password expires. ## Set up Cloud Public Edition **1. Create a communication user** In the SAP Fiori launchpad, go to **Communication Management** -> **Maintain Communication Users**, select **New**, enter a user name and a description, and generate a password. Keep the password for the last step. **2. Create a communication system** Go to **Communication Management** -> **Communication Systems**, select **New**, and enter a system ID and name. Select **Inbound Only**. Under **Users for Inbound Communication**, add the communication user with the **User ID and Password** authentication method. Set the person who owns the integration as the owner contact, then save. **3. Create the communication arrangements** Go to **Communication Management** -> **Communication Arrangements**. For each scenario below, select **New**, choose the scenario, select the communication system you created, and save. **Read access (required for discovery):** | Scenario | Used for | | :- | :- | | `SAP_COM_0889` | Business users and user groups | | `SAP_COM_0A04` | Business roles, their users, catalogs, and restrictions | | `SAP_COM_0A05` | Communication users | | `SAP_COM_0A06` | Communication systems and their owner contacts | | `SAP_COM_0A07` | Communication arrangements and their scenarios | | `SAP_COM_0A13` | Certificates of communication users | | `SAP_COM_0750` | Security Audit Log | | `SAP_COM_0327` | Business user change documents | | `SAP_COM_0366` | Business role change documents | | `SAP_COM_0347` | SAP support user requests | **Remediation (optional):** | Scenario | Used for | | :- | :- | | `SAP_COM_0465` | Creating, locking, and unlocking business users, changing their business roles and user group, and creating user groups. Also adds each user's creation date, user group names, and groups without members. | | `SAP_COM_0A48` | Locking communication users | Create every read scenario. Oleria checks each one when you connect and names any that's missing. If a scenario is removed later, the sync reports an error that names the missing arrangement until you create it again. **4. Find the API host** Your tenant's API host is your Fiori launchpad host with `-api` after the tenant ID. For example, if you sign in at `my123456.s4hana.cloud.sap`, the API host is `my123456-api.s4hana.cloud.sap`. If the communication system restricts inbound IP addresses, allow Oleria's egress IP addresses. Contact [support@oleria.com](mailto:support@oleria.com) for the addresses for your region. ## Set up Cloud Private Edition or on-premise **1. Expose the business user service** In SAP GUI, run transaction **SOAMANAGER**, go to **Service Administration** -> **Web Service Configuration**, open the `QueryBusinessUserIn` service, and create a binding for it. Note the binding path, if it differs from the default `/sap/bc/srt/scs_ext/sap/querybusinessuserin`. **2. Publish the service** Publish the binding through the SAP Web Dispatcher on a public host name, on port 443, over HTTPS. If the host's certificate isn't publicly trusted, you'll paste it into the connection form. Contact [support@oleria.com](mailto:support@oleria.com) to allow that host name, and ask for Oleria's egress IP addresses to allow on your firewall. **3. Create a technical user** Run transaction **SU01**, create a user, and on the **Logon Data** tab set the user type to **System** and set a password. **4. Grant read access** In transaction **PFCG**, create a role with these authorizations, and assign it to the technical user: | Authorization object | Values | | :- | :- | | `S_SERVICE` | The `QueryBusinessUserIn` service | | `B_BUPA_RLT` | Display (`ACTVT` 03) | | `S_USER_GRP` | Display (`ACTVT` 03) | ## Connect SAP S/4HANA to Oleria **1. Open the integration** Go to your Oleria workspace, select **Integrations** -> select **SAP S/4HANA**. **2. Complete the connection form** Select **Continue** and provide the following: | Field | Notes | | :- | :- | | Edition | Required. **Cloud Public Edition**, or **Cloud Private Edition / on-premise**. | | API host | Required. On Cloud Public Edition, the host with `-api`, such as `my123456-api.s4hana.cloud.sap`. On Cloud Private Edition or on-premise, the SAP Web Dispatcher host. Enter the host only, without a path. The connection always uses HTTPS on port 443. | | Username | Required. The communication user (Cloud Public Edition) or the technical user (Cloud Private Edition or on-premise). | | Password | Required. The user's password. | | Client | Cloud Private Edition or on-premise only. Required. The three-digit client, such as `100`. | | Service path (optional) | Cloud Private Edition or on-premise only. The SOAMANAGER binding path. Defaults to `/sap/bc/srt/scs_ext/sap/querybusinessuserin`. | | Trusted certificate (optional) | Cloud Private Edition or on-premise only. The PEM certificate of the host, or of the certificate authority that issued it, when the certificate isn't publicly trusted. | **3. Confirm the connection** Select **Authenticate**. Oleria signs in once to read a business user, then, on Cloud Public Edition, reads one record through each read communication arrangement. If a check fails, Oleria names the likely cause, such as the missing communication arrangement or a wrong host. A rejected password isn't retried, so a wrong password doesn't lock the user. ## Verify the integration Confirm the tenant appears on the **Connected** tab of your Oleria **Integrations** page with a status of **Healthy**. After the first sync completes, you can review the discovered accounts, groups, roles, non-human identities, and activity in your Oleria workspace. > [!NOTE] > > If the password changes, edit the integration and enter the new one. Leave the password empty to keep the stored value. You can also edit the username and, on Cloud Private Edition or on-premise, the client, service path, and trusted certificate. To change the edition or the API host, add a new integration. ## Remediation actions On Cloud Public Edition, Oleria can take these actions with the integration's communication user: | Action | What it does | Revert | | :- | :- | :- | | Disable user accounts | Locks the business user. | Supported - unlocks the user. | | Enable user accounts | Unlocks the business user. If the user's validity period has ended, the result notes that the user still can't sign in until an administrator extends it. | Supported - locks the user again. | | Add user to role | Assigns a business role to the business user. | Supported - removes the role. | | Remove user from role | Removes a business role from the business user. | Supported - assigns the role again. | | Add user to group | Adds the business user to a user group. | Supported - removes the user from the group. | | Remove user from group | Removes the business user from a user group. | Supported - adds the user back. | | Create user | Creates a business user with the username, first and last name, display name, and email addresses you provide. The user is locked unless you choose to activate it. Business users sign in through SAP Cloud Identity Services, so Oleria sets no password, and the result notes when you provided one. If a user with that username already exists, nothing changes. | Supported - locks the user. SAP doesn't document deleting a business user through its APIs. | | Create group | Creates a user group. Oleria derives the group ID from the name you enter: upper case, with other characters replaced by `_`. The ID must be 12 characters or fewer. If a group with that ID already exists, nothing changes. | Supported - deletes the group, but only while it has no members. | | Disable NHI accounts | Locks a communication user from the non-human identity inventory. | Supported - unlocks the communication user. | Oleria refuses these actions and sends no change to SAP S/4HANA: * **Create user** with groups selected. SAP S/4HANA doesn't set business roles or a user group at creation, so create the user first, then use **Add user to role** and **Add user to group**. * Acting on its own communication user, on SAP-managed communication users, or on SAP's own users, such as those whose names start with `SAP_`. * Removing a user-administration business role from a user if no other user who holds one is unlocked and inside their validity period. * Adding a user to a user group while they belong to another one. A business user can belong to only one user group, so remove them from their current group first. * Disabling a communication user's password, certificate, or outbound secret. SAP has no API for this, so rotate or delete them in **Communication Management**. Keep these points in mind: * Oleria reads the target before it changes anything. If the target is already in the requested state, the action succeeds without making a change, and there's nothing to revert. * After each change, Oleria reads the target again. If SAP S/4HANA returns an error but the change shows up, the action succeeds and you can revert it. If the change doesn't show up, the action fails. If Oleria can't read the result, the action fails and names what to check in SAP S/4HANA. * If **Create user** creates the user but can't set the lock state you requested, Oleria locks the new user and the action fails. * When SAP S/4HANA integrates with an HR system, SAP doesn't allow creating business users through the API. Create them in the HR system instead. * Reverting checks the target first. If it changed after the action ran, or no longer exists, Oleria leaves it as is. Actions aren't available on Cloud Private Edition or on-premise systems. ## Known limitations * On Cloud Private Edition and on-premise systems, Oleria reads business users only, without their lock status or last sign-in. Technical users, PFCG roles, authorizations, and the Security Audit Log are available only through RFC function modules, not a released HTTPS API. * Oleria doesn't read individual field values of business role restrictions yet. Restrictions are shown at the catalog level. * A derived business role is shown with the catalogs it holds, and its leading role is named in its description. Oleria doesn't link the two roles, because a derived role can carry different organizational values. * SAP has no API that returns business roles assigned to a user group, so groups carry no role access in Oleria. * SAP's Read Access Log isn't collected because it records no user. * Oleria doesn't import business data objects as resources. * SAP's own technical users, such as `SAP_SYSTEM`, have no API. Activity by those users is attributed to one **SAP system** actor. * SAP pseudonymizes its support users, so they aren't listed as accounts. Their access requests and activity are attributed to the support user's ID, shown as a user that isn't in the directory. * Joule agents run in SAP BTP and are catalogued in SAP AI Agent Hub, not in the SAP S/4HANA tenant. Oleria doesn't discover them from SAP S/4HANA. * Multi-factor authentication is enforced by SAP Cloud Identity Services or your identity provider, so Oleria doesn't report it from SAP S/4HANA. * Activity is collected for up to the last 90 days on the first sync. SAP keeps Security Audit Log events for 45 days by default, so older sign-ins are available only if your retention period is longer. * This integration was built from SAP's API documentation and hasn't yet been validated against a live tenant. If a sync or an action fails, contact [support@oleria.com](mailto:support@oleria.com). ## Contact us For questions about this integration, contact us at [support@oleria.com](mailto:support@oleria.com). This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.