Hello Everyone,
This blog post we'll discuss the overall troubleshooting methodology to follow when enabling SAP Task Center. If you've already read this far, you should be familiar with SAP Task Center and the enablement process. However if not, please review the below resources:
What is SAP Task Center
Getting Started with SAP Task Center
Step 1: Checking the Connectivity
If you are encountering issues with enabling SAP Task Center. The first step is to check for the connectivity for the LoB app you're trying to set up (Success Factors, S/4 Hana, Fieldglass, etc).
This can be done by testing out the Task Center API in Postman. Please review the below article to check out the steps.
Accessing SAP Task Center API with Postman
If you're not able to connect, or it says there's an issue with connecting with a specific application, then check out the enablement processes for Task Center for related application you're having issues with:
Enabling Destinations for SAP Task Center
You can also follow the various enablement missions on the SAP Discovery Center -
SAP Discovery Center - Enabling SAP Task Center
After going through those steps, you've found that you've connected and configured your applications successfully. However, when you log into SAP Task Center, you find that your approval tasks are not appearing. What steps should you take next?
Step 2: Checking the IAS/IPS Configuration
The tools that make SAP Task Center run are the Identity Authentication and Identity Provisioning Services. These are critical because they control the user access to multiple applications, and can provision the approval tasks from the applications into SAP Task Center. If you're not familiar with these tools, please check out the below community page:
Cloud Identity Services Community
Depending on your IAS/IPS configuration, you'll be using a Global User ID to designate your users or a UUID (Universal User ID). The Global User ID is used for customers who already have an identity provisioning tool, and will use a pre-existing Global User ID in IAS to identify the user's who will receive their approval tasks. The UUID is for customers who are using IAS and IPS as bundled app to send out their approval tasks, and their users will be designated by a specific UUID in the IAS tool.
Ideally, if the IAS/IPS was done correctly the approval tasks would be mapped to the user's Global User ID/UUID, and appear in SAP Task Center. To check if this setup needs to be corrected, you can export the SAP Task Center data.
How to Export SAP Task Center Data
This can be done with an application such as Postman or another API testing tool. You can then review the exported information and check for the approval documents and see what UUID/Global User ID is assigned to them. If the you're seeing incorrect user information from the approval task in the UI of the source application, and what's appearing in the exported data, then you'll need to check your user data in IAS/IPS/3rd party provisioning tool.
Once that is resolved, if you wish to repopulate the tasks, simply change the name of the URL/Name of the Destination for configured source application. This is a way to make troubleshooting easier, but be mindful it will repopulate all of the tasks for all users.
Troubleshooting Resources if You're Using IAS as a Proxy
Some customers will be interested in just using IAS as a proxy for their already established corporate IdP. If you're in this scenario, please follow these resources:
Configure IAS as SAML proxy to Corporate IdP
If you are following this configuration method for IAS. Please keep in mind that you will need to propagate certain assertion attributes, like the Global User ID, through provisioning process once this is enabled.
Please remember, that even if you're using IAS as a proxy, the user persistency is
required in IAS for Task Center enablement.
The reason being is that user profile data for a user in Task Center, is different than the logged in user - no SAML or token available at that point from the corporate IdP.
SAML assertion is issued for the logged in user and fields are reflected in the XSUAA token.
However, tasks have multiple relations to users, not just the logged in processor.
We need a central place where this data is stored and accessible by the admin. We also require that the same user has the same user identifier across the whole landscape, which is again provided by IAS whether it be the Global User ID, or the UUID.
If you need to troubleshoot and debug after checking the connectivity, and are using IAS as a proxy, please review these helpful links:
Configure the User Attributes Sent to the Application
Configure the Default Attributes Sent to the Application
Enrich Assertion Attributes Coming from Corporate IdP
Conclusion
As SAP Task Center is branched out and supported by various applications through the year, it will be helpful to keep a look at the release cadences of when it goes live for an application you're specifically interested in connecting. As more official documentation and Discovery Center missions are published, I will keep updating this blog to have the most relevant information to assist with troubleshooting.
