IAS/IPS: UPN in Azure and UserName in Cloud Apps

[tskwin]

Dear SAP Community,

The following problem:

As far as I know, the UPN is typically set as an email address.

In my scenario, users are provisioned from Azure -> IAS -> cloud applications.

However, when provisioning users from IAS  (for example) to Enable Now, the usernames are created as email addresses.

How can I avoid this?

For example, in Entra ID Source System, the User Name is defined in the Default Code as follows:

{
"sourcePath": "$.userPrincipalName",
"targetPath": "$.userName",
"correlationAttribute": true
},

So, this means that the UPN (Azure) becomes the Login Name ( in IAS).

For example, if I map the employee ID to the username in the IPS transformation, the user is created in Enable Now with the employee ID (which would be ideal for us) as the username, but the users cannot authenticate in Azure with the employee ID.

Is there a way to change the UPN?

Or is there another solution to ensure that the usernames in cloud applications are not created as email addresses, while users can still authenticate in Azure?

Thank you very much !!!

Best regards

[yogananda]

{ "sourcePath": "$.userPrincipalName", "targetPath": "$.loginName", "correlationAttribute": true },

To Build Transformation between Source & Target Systems

JSON Path will save your time and make you better to build.. Paste your JSON payload from source system and identify the path to update in your Transformation to Target Systems fields. Kindly refer the below blog which will speed your build.

• https://community.sap.com/t5/technology-blogs-by-sap/understanding-of-sap-ips-transformation-logic-t...
• https://jsonpath.com
  
  https://github.com/yogananda-muthaiah/SAP-Sucessfactors-Incentive-Management/tree/main/Integrations/...

[tskwin]

Hello @yogananda, 

Thank you very much for your support!!! I will study the links.

My question is, for example, if I map the user like this (Default Code):

 { "sourcePath": "$.userPrincipalName", 
"targetPath": "$.loginName", 
"correlationAttribute": true }

Then, the userPrincipalName (email address) in Azure will be mapped to loginName (which is also created as an email address, as it’s provisioned from Azure) in IAS.

When I provision the user to SAC, the username in SAC is created as an email address, which SAC doesn't allow ->an error occurs.

How can I ensure that the userPrincipalName is not passed as an email address to the cloud application?

Thank you very much.

Best Regards

[yogananda]

@tskwin you will have to bring user from Entra to IAS and IAS to other SAP applications. once you bring users to IAS with populated details to respective fields.. you can map it properly to target systems according. you can refer my blog how you can map from source to target with fields