Transformation Expressions

Use this JSON expression when the value referenced by the sourcePath is a multivalue structure (a list or an array), and you want to apply a function to its elements instead of to the whole structure.

You can use the applyOnElements expression in any function, for any provisioning system.

Possible values:

• true

• false

Data type: Boolean

This expression is deprecated. You can use the new one – applyOnAttribute.

Data type: String

Use this JSON expression when the structure referenced by the sourcePath is a complex one (a map), and you want to apply a function to a single member of this map.

In the example below, all occurrences of "SAP" in the values of attribute COMPOSITE_PRIVILEGE are replaced with "test" in the transformation result.

Data type: String

Use this JSON expression when the structure referenced by targetPath is a complex one (a map), and you want to assign the result of this mapping to a specific map entry.

In the example below, all occurrences of "SAP" in the values of attribute COMPOSITE_PRIVILEGE are replaced with "test", and the result is assigned to the value of attribute "ASSIGNMENT".

Data type: String

Data type: String

Set a constant if the target system requires attributes that are not defined in the source system.

You can also use schemas to organize and combine multiple constants.

Correlation attributes are used in the "user" mappings of the Read Transformations (in source and proxy systems). They mark attributes that are unique for a user in multiple source systems where this user is read from.

The purpose of correlationAttribute is to properly count managed identities (users) during the reading process. This is essential because the calculated value is compared to the customer's licensing quota.

• Use Case 1 – Same attribute in different systems

  Result: If the Identity Provisioning reads a user whose username is one and the same in all the three systems (as listed above), the service will consider and count these "3 users" as one managed identity.

• Use Case 2 – Different attributes from several systems

  Result: If the Identity Provisioning reads a user with a certain username from one system, then it reads a user with a particular e-mail from another system, and then finds a user with the same username and e-mail in a third system (as listed above), the service will consider and count these "3 users" as one managed identity.

Possible values:

• true

• false

Data type: Boolean

This JSON expression returns the default value of an attribute when it is set as optional and there is no specific value provided in the sourcePath. The defaultValue expression comes in handy in the following cases:

• When an attribute of a previously provisioned entity is later deleted from the source system. After a new provisioning job, the target system will try to get some value for this missing attribute, and thus it will write its default one.

• When the system transformation contains a valueMapping operation. If the value of the mapped attribute is not found as a key in the "valueMappings" definitions, or some of the source paths does not return a value, the JSON transformation will use the default one.

The default value of an attribute can be a string, integer, Boolean, array, or empty (null).

You can add "defaultValue" for any attribute, in the transformation of any provisioning system. For example, you can find it in the default transformation of the Identity Authentication target system:

Use the ignore expression if you would like to exclude certain parts of the transformation from being considered during the provisioning. Similar to condition, you can set ignore on various levels, including on entire entity types such as users or roles, or specific mapping entities. This is applicable for both source and target systems.

Possible values:

• true

• false

Data type: Boolean

This JSON expression converts an array into a single element. That means, when the Identity Provisioning service reads an array that contains only one element, then in the target system:

• If "preserveArrayWithSingleElement" is set to true, this expression will keep the array with the single element as is.

• If "preserveArrayWithSingleElement" is set to false, this expression will convert the array into the relevant single element.

Possible values:

• true

• false

Data type: Boolean

You can set a scope for an entity attribute, based on its lifecycle. A scope can have the following values:

• createEntity – An entity attribute is processed only during creation. Transformation mappings without scope are always processed during the creation.
• patchEntity – When using the ipsproxy application and a system that supports SCIM PATCH operation, you may need to perform certain transformations over the PATCH request. To do this, use the patchEntity scope in the system transformation. Only mappings with this scope will be processed.

• deleteEntity – If an entity has been deleted from the source system or has been set a condition for it not to be read anymore, this entity can "stay" in the target system for the following reasons:

  • The target system does not support deletion of entities.

  • You do not want to delete it but only temporary disable/deactivate it.

  • You want to neither delete it, nor deactivate it but only remove its permissions, or exclude it from some corporate groups.

  If you have to fulfill some of these scenarios for an entity, use the deleteEntity scope. It prevents from deleting the entity from the target or proxy system as only updating its status instead. Also, bear in mind the following:

  • For the affected entity, all transformation mappings that do not contain this scope will be ignored.

  • If a condition exists on entity type level, it will be ignored as well.

  • If the deleteEntity scope is included in a proxy write transformation, it is taken into account only when used in the transformation mapping for the entityIdTargetSystem variable.

  Use this scope for the following systems:

  • Cloud Foundry UAA server

  • Identity Authentication

  • Local Identity Directory

  • Microsoft Entra ID

  • Sales Cloud – Analytics & AI

  • SAP Advanced Financial Closing

  • SAP Analytics Cloud

  • SAP Ariba Applications

  • SAP BTP Account Members (Neo)

  • SAP BTP XS Advanced UAA (Cloud Foundry)

  • SAP Business Network

  • SAP Build Work Zone, advanced edition

  • SAP Build Work Zone, standard edition

  • SAP Central Business Configuration

  • SAP Commerce Cloud

  • SAP SuccessFactors Incentive Management

  • SAP Concur version 2

  • SAP CPQ

  • SAP Data Custodian

  • SAP Enterprise Portal

  • SAP Fieldglass

  • SAP Field Service Management

  • SAP Intelligent Agriculture

  • SAP Jam Collaboration

  • SAP Sales Cloud and SAP Service Cloud

  • SAP SuccessFactors Learning

  • SAP SuccessFactors version 2

  • SAP S/4HANA for procurement planning

  • SCIM System

Data type: String

If you want the provisioning job to not execute operations of a certain type on groups and users , use the skipOperations expression. You can apply it when you need to avoid creating, deleting, or updating entities.

You can use skipOperations only in target system transformations.

• In the following example, the transformation does not allow updating groups in the target system. This approach is valuable when you have done group changes in the target system, and after a new Read or Resync job, you want these changes to be kept instead of being overwritten by the groups in the source system.

• In the following example, the transformation does not allow creating and deleting users in the target system:

  You can set the transformation to skip the "create" operation if you're sure that all entities from the source system already exist in the target – independently from the Identity Provisioning service. That means, they have been created in the target system manually or via a script. Thus, by skipping the "create" operation, the identity provisioning job will only provision the changes instead of creating the users all over again in the target.

  The Identity Provisioning service will skip creating the existing entities and will try to update them. There are two options for resolving the existing users by the service.

  Option 1: If the update operation is performed using a PATCH request, or a PUT request when the system is SCIM-based, the Identity Provisioning service will search and resolve existing users based on the system’s default or predefined unique attributes.

  For more information about the SCIM-based systems, see System Types.

  For more information about the unique attributes of your system, see List of Properties.

  Option 2: In all other cases that differ from the above mentioned (the target system is LDAP-based, RFC-based, SOAP or OData-based), the existing users are resolved by retrieving their IDs. In order for the skip create operation to be executed without an error, you need to make a few adjustments in your source and target transformations. This way, the service will search and retrieve the IDs of the entities correctly. An example how to modify your source and target transformations is included below.

  In the following detailed example, SAP SuccessFactors is a source system and SAP S/4HANA Cloud Public Edition, which is SOAP-based system, is a target. You want all users that exist on both systems to be skipped during creation and to only be updated on the target. If there are users existing only in the source system, they will not be created in the target. To do that:

  1. Open your SAP SuccessFactors admin console. For every user that you want to be provisioned and updated in SAP S/4HANA Cloud Public Edition, you need to set up one of its predefined custom attributes (custom01 – custom15), entering the SAP S/4HANA Cloud Public Edition unique identifier for that user (which is the value of the personID attribute). For example, you can do that in the custom10 attribute.

  2. Then go to the Identity Provisioning admin console, and in the Properties tab update the sf.user.attributes property, adding custom10 to the list of attributes.

  3. In the SAP SuccessFactors source system, add the following extra user mapping. It maps custom10 to a custom attribute in SAP S/4HANA Cloud Public Edition, for example custom_user_ID:

  4. In the SAP S/4 HANA Cloud target system, replace the following user mapping:

     with:

  5. (Optional) If there are users that exist only in the source system and you want them to be reported as skipped directly, without being processed further by the Identity Provisioning, adjust the SAP S/4 HANA Cloud target transformation by adding the following condition:

  6. Run the first Read provisioning job.

  7. Check in the Identity Provisioning admin console if the relevant "marked" users are updated, and that the rest are not. Also, check that users that exist only in SAP SuccessFactors (if any) are not created in SAP S/4 HANA Cloud.

  Such transformations adjustmants are not needed if your target system is SAP Application Server ABAP. In that case the Identity Provisioning service will search and resolve the existing users in the target system by userName.

Data type: String

The sourcePath expression denotes the path to an attribute in the input JSON message (could be the source system JSON data or the intermediate one).

Data type: String

Data type: String

The type of action to be performed in the mapping. It could be set, remove, rename and valueMapping.

• The set type maps an attribute from the source system to an attribute in the target JSON data. If no type is defined, "type": "set" is used by default.

• The remove type deletes an attribute during transformation. This attribute is not present in the target JSON data.

• The rename type renames the last element of a complex targetPath.

  In the example below, the last element .lastName of the targethPath $.name.lastName will be renamed with the provided constant value familyName. This will result in the following targetPath: "$.name.familyName",.

• The valueMapping type allows multiple entity attributes (read from the source system) to be mapped to a single target attribute.

  For example, you can set a mapping condition for a user attribute user.timeZoneCode. After the provisioning job, its value will be mapped to a new attribute – timezone. The example below provides a number of world locations and their relevant timezone.

Possible values:

• set

• remove

• rename

• valueMapping

Data type: String

Provides a list with mapped values. It can only be used when type is set to valueMapping. The list contains the keys, which are read from the source system and mapped to values in a single target attribute.

The example below provides the list of world locations and their relevant timezone.

Data type: JSONObjectArray

Specifies paths to attributes in the input JSON message from the source system. The sourcePaths can only be used with the valueMappings expression, which requires the type to be set to valueMapping. The number of values in the key arrays must correspond to the number of sourcePaths.

In the following example, the value pairs US and New York, US and Dallas, Germany and Berlin in the key arrays correspond to the two sourcePaths: country and city. The mappedValue is the value to be written to the targetPath attribute, such as timezone, provided that each key value matches the corresponding attribute value (e.g., US for country and New York for city).

Data type: StringArray

Specifies whether attribute's availability is mandatory or optional for a given system.

• If set to true, this means that the attribute is optional and even if it is missing, provisioning won't fail.

• If set to false or not set at all, this means that the attribute is mandatory and if it is missing, provisioning will fail.

For example, the default read transformation of SAP SuccessFactors shows that if the first name of a user is missing in the source system, this user will be read and provisioned to a target system. However, if the last name of a user is missing, provisioning will fail as this is a mandatory attribute.

Possible values:

• true

• false

Data type: Boolean

The sourceVariable expression denotes a variable that is valid only within a given provisioning system. It shows where the variable will be read from.

For more information, see Transformation Variables

Data type: String

The targetVariable expression denotes a variable that is valid only within a given provisioning system. It shows where the variable will be written to.

For more information, see Transformation Variables

Data type: String