Identity Provisioning not creating users after a read/sync no errors

[eleonak]

So I'm trying to replicate SAP ECC Business Suite users to SAP Workzone Standard on BTP and have walked through a number of blogs and SAP Help documents to get everything setup.  When I run the job on the SAP Cloud Identity Services provisioning ECC source I see the users coming over and getting processed.  The results are mostly updated/created/read with a few errors which are expected, given the source is a development system with missing emails and other data for some users.

Now, the issue is that NO USERS/GROUPS are created in my custom identity provider as expected and there are no errors or logs that would help explain why they weren’t.  Without any specific errors I have no thread to pull on to try and get down to the root cause.

I’ve included some configuration screenshots for reference, which was gathered from the SAP Help documentation.  Transformations were left untouched which I believe is an important point.

Finally, for simplicity I have added a filter to bring in a single user from the source so that tests can be more quickly iterated; the results are below.

Source Configuration:

[ThomasRauen]

Hm, I'm somewhat confused, your provisioning scenario is showing that you're writing users to your WorkZone Standard (BTP) environment but you expect them to show up in a Custom Identity Provider... maybe I'm just confused but as far as I understand the situation all you're doing is using IPS to get Identities from your backendsystem to your btp.... no Custom Identity Provider included...

[eleonak]

@ThomasRauen: It is my understanding that by sending users/roles/groups to Work Zone they would inherently be created in the custom identity provider that we use to support the work zone. Is this not right?

[Dominik-Neumann]

@eleonakthat indeed would be incorrect: Work Zone standard edition is used as a target system in IPS for provisioning role mappings into its own user store (which doesn't have an UI, by the way). If you want to transfer users and groups to your custom identity provider, you must configure this one as a target system in the IPS specifically (e.g. with the Local Identity Directory type).

[eleonak]

Not sure why but I can't mark this as answered, @Dominik-Neumann ominik-Neumann

You are indeed correct, mapping to a work zone only maps roles/apps/etc. where as adding a new target to "Identity Authentication/Provider" creates my users as expected.  An interesting sidenote you can have more than one destination per source which is great.  It's working now, thanks for the assistance!

[Dominik-Neumann]

Glad to hear that you got it working! Yes, you can use one source system to provision users and groups to several target systems. The capabilities of the IPS can be used nicely for diverse scenarios, especially in hybrid SAP architectures, using cloud and on-premises products.