ROI iAM

Appearance

ROI iAM HUB ​

The ROI iAM HUB is the central repository responsible for the connection and provisioning from SAP IdM to ROI iAM.

Prerequisites

  • The configuration steps of the ROIABLE IdM accelerator must be completed.
  • The SAP IdM repository must be configured on ROI iAM side (source, target, and system details).
  • All master data for the identities must be loaded within ROI iAM.

Connector and provisioning constants ​

Several configuration constants are available in the repository type. The information they store is used for the connection to ROI iAM, related SAP IdM GUIDs, and proxy details. All systems that will use ROI iAM — whether new or already existing in SAP IdM — relate to the HUB, and the respective attribute values will be reused.

  • ROIAM_APIMGMT_HOST – Host for the ROI iAM Application Management.
  • ROIAM_APIMGMT_CLIENT_ID – Client ID for ROI iAM Application Management.
  • ROIAM_APIMGMT_CLIENT_SECRET – Client secret for ROI iAM Application Management.
  • ROIAM_ENDPOINT_EVENT_PROV – ROI iAM Event Provisioning endpoint.
  • ROIAM_ENDPOINT_SCIM – ROI iAM SCIM endpoint.
  • ROIAM_ENDPOINT_OAUTH – ROI iAM OAuth endpoint.
  • ROIAM_PROXY_AUTH_TYPE – Authorization type for the ROI iAM IdM Proxy application.
  • ROIAM_PROXY_HTTP_USER – Connection user for the ROI iAM IdM Proxy application.
  • ROIAM_PROXY_HTTP_PASSWORD – Connection password for the ROI iAM IdM Proxy application.
  • ROIAM_PROXY_SERVICE_URL – Service URL for the ROI iAM IdM Proxy application.
  • ROIAM_EVENT_<eventName> – ROI iAM event type ID representing the SAP IdM CreateUser plugin.
  • ROIAM_SCHEMA_<eventName> – ROI iAM schema identifier used for <eventName> event data.
  • ROIAM_FORM_<eventName> – GUID of the form used as the attribute source for <eventName>.

    HINT

    If ROIAM_FORM_MODIFY is left empty on both connector and HUB repositories, the modify plugin will be skipped.

  • ROIAM_UID_MAPPING_ATTR_IDM – The SAP IdM attribute used to map an SAP IdM user to a ROI iAM identity (e.g., MX_MAIL_PRIMARY, MSKEYVALUE).
  • ROIAM_UID_MAPPING_ATTR_ROI – The ROI iAM column/attribute used for the same mapping. Currently supported values are email and userName.

INFO

ROI iAM configuration details will be provided by the responsible team. It is recommended to use the already configured ROIAM_TECH user for the proxy connection.

INFO

When using the ROI iAM Connector for a brand new system which uses ROI iAM for provisioning, events, schemas, and forms can be populated on connector repository level.

Full load - identities ​

The job loads all identities from ROI iAM. Users who can be matched to IdM identities based on the configured ROIAM_UID_MAPPING_ATTR_IDM and ROIAM_UID_MAPPING_ATTR_ROI constants will receive the ROI iAM identifier attribute.

INFO

This step can be used for initial confirmation that the connection from SAP IdM to ROI iAM is working properly. Users should already be loaded in ROI iAM beforehand.

  • In the Admin UI of the SAP IdM, there is a job for the configured ROIAM_HUB_<landscape> repository called "Full load - ROI iAM Identities"
  • Validation that all ROI iAM users are loaded can be done in the temporary table roiam_%$rep.$NAME%_users.
  • All mapped SAP IdM identities should have the ROIAM_IDENTIFIER_<hubName> attribute populated after successful execution of the job.

IMPORTANT

ROI iAM load jobs enhance the MX_PERSON entries with the values required for the provisioning to the target systems. MX_PERSON entries are not being created from the ROI iAM jobs.

Delta load - identities ​

Once the full load is executed successfully, the "Delta load - ROI iAM Identities" job can be used for synchronization of the newly added or updated users.

HINT

To make sure that all identities are up to date, we recommend that the delta load is executed after the master data is updated in SAP IdM from the source HR system.