IPS Error with SCIM 2

[tskwin]

Hello Experts,

I am provisioning users from Azure to IAS, which works well so far. After that, I provision the users to SAC, but I encounter the following error:

user:34asa-34df-4434f-435f-5fgfgsdfgsfdgsdg,

system=Target - SAC

error=HTTP operation failed invoking https://sac-tenant.com/api/v1/scim2/Users with statusCode: 400, Response: {"schemas":["urn:ietf:params:scim:api:messages:2.0:Error"],"status":"400","scimType":"mutability","detail":"Request is unparsable, syntactically incorrect, or violates schema."},

 content={"active":true,"displayName":"sacfirst, saclast","emails":[{"primary":true,"value":"sacfirst.saclast@domain.com"}],"groups":[{"value":"438b6f2a-5ec4-4d93-b9f6-13cb4ee9502d"}],"name":{"familyName":"saclast","givenName":"sacfirst"},"schemas":["urn:sap:params:scim:schemas:extension:sac:2.0:user-custom-parameters","urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"],"urn:sap:params:scim:schemas:extension:sac:2.0:user-custom-parameters":{"idpUserId":"sacfirst.saclast@domain.com"},"userName":"sacfirst.saclast@domain.com"}

When I provision the users to IAS, the login name is set as the email address in IAS.

After that, the users are provisioned from IAS to SAC, and the error mentioned above occurs. We found that the error occurs because the login name from IAS (the email address) is transferred to the "USER ID" field in SAC. However, SAC does not allow the "USER ID" to be an email address.

This error happens with  SAP Analytics Cloud SCIM API version 2:

IAS Properties - sac.api.version=2, csrf.token.path=/api/v1/scim2/Users?count=1.

I copied the transformation code from the SAP help page for the target system - SAC.

How can this issue be resolved?

Thank you for your time and assistance.

Best Regards

[tskwin]

Hello,

Could someone please advise where I can begin or if there are any known solutions to this issue?

Any suggestions would be greatly appreciated!

Thank you very much.

Best Regards

[MatthiasL]

Took me a long time to figure this one out as it's not documented but after a lot of back and forth and tickets.

Loginname is only meant to be used for on-premise, and basically should just be 12 characters.

That said, for Cloud products I usually rssort to just using the P number, it doesn't really matter what the user ID as on any front-end you will see the full name displayed anyway.