Skip to main content

​
After this article

You will be able to connect SAP S/4HANA to Lumos to sync users, business roles, and PFCG roles, and to grant and remove PFCG roles for a user from Lumos.

​
Capabilities

Notes:
  • Account creation, deactivation, and deletion are not available. Provisioning is limited to granting and removing PFCG roles for an existing user.
  • Business roles are read-only. They sync for visibility but cannot be requested or granted through Lumos.

​
Required plan and roles

  • SAP access: administrator privileges on your SAP S/4HANA on-premise system (using SAP NetWeaver) to create a development package, a custom role, a user, and two SOAP service endpoints.
  • Credentials: the username and password of a dedicated SAP S/4HANA user that can access the SOAP services.
  • Two SOAP endpoints: this integration needs both the QUERYBUSINESSUSERIN endpoint and a USER (BAPI) endpoint. Both are required connection fields. The USER endpoint is used for PFCG role data, so the integration will not sync PFCG roles without it.
  • Web service authorizations on the role: QUERYBUSINESSUSERIN/QUERY_BUSINESS_USER_IN and Z_USER/BAPI_USER_GET_DETAIL are used for syncing. Z_USER/BAPI_USER_ACTGROUPS_ASSIGN is used only when Lumos grants or removes a PFCG role.
  • Connectivity: network access from Lumos to your on-premise instance. S/4HANA 1809 or later is recommended, and users must have associated business partner records to sync.

​
Read-only access vs provisioning

Is read-only possible? Yes. The custom role you build lists each web service operation the integration user is allowed to call, so you can grant the two operations used for syncing and leave out the one used for writes. What read-only requires. A dedicated SAP S/4HANA user whose custom PFCG role includes only the QUERYBUSINESSUSERIN/QUERY_BUSINESS_USER_IN and Z_USER/BAPI_USER_GET_DETAIL web service authorization defaults. You still need to create both SOAP services and supply both endpoint fields, because PFCG role data is read through the USER service. Follow the steps below and skip the Z_USER/BAPI_USER_ACTGROUPS_ASSIGN entry in the Menu step.

​
Instructions

Phase 1: Create a development package in SAP
  1. Log in to your SAP S/4HANA system with administrator privileges.
  2. Open transaction code SE80 (Object Navigator).
  3. In the Repository Browser, select Package, enter a package name such as Z_LUMOS, and press Enter.
  4. When prompted to create a new object, click Yes.
  5. Set the package properties. Enter the package name and any description, set Software Component to HOME, select Package Type: Development Package, leave Transport Layer empty, and clear Package encapsulated.
  6. Click Create.
Phase 2: Create the USER (BAPI) web service
  1. Open transaction code BAPI.
  2. Select Alphabetical and open USER.
  3. Go to Tools, click Create Web Service, and click Start Wizard.
  4. Under Service, enter Z_USER as the Service Definition and any description.
  5. Under Endpoint BAPI, select Map Names.
  6. Under BAPI, select GetDetail. Also select ActgroupsAssign if you want Lumos to grant and remove PFCG roles.
  7. Under Configure Service, set Profile to Authentication with User and Password and Transport Guarantee.
  8. Under Transport, enter the package you created in Phase 1 (for example Z_LUMOS).
  9. Click Complete, then click Activate and complete the request.
Phase 3: Create a custom PFCG role in SAP
  1. Open transaction code PFCG (Role Maintenance).
  2. Create a new single role. Enter a role name such as LUMOS_INTEGRATION and click Single Role.
  3. Fill out the Menu section. Open the dropdown next to Transaction, choose Authorization Default, and set Authorization Default to WebService.
  4. In the empty fields, enter QUERYBUSINESSUSERIN/QUERY_BUSINESS_USER_IN and Z_USER/BAPI_USER_GET_DETAIL. Add Z_USER/BAPI_USER_ACTGROUPS_ASSIGN as well if you want Lumos to grant and remove PFCG roles. Click Copy.
  5. Fill out the Authorization section. Click Change Authorization Data. You should see object class AAAB and object class BC_A with an orange triangle. Open each nested field with an orange triangle and double-click it until the triangle turns into a green square.
  6. Click Generate, then Execute, then Save.
Phase 4: Create a dedicated user in SAP
  1. Open transaction code SU01 (User Management).
  2. Create a new user account. Enter a username such as LUMOS and click Technical User.
  3. On Logon Data, set User Type to System and set a secure password.
  4. On the Roles tab, assign the role you created in Phase 3 (for example LUMOS_INTEGRATION).
  5. Click Save.
Use this account only for the Lumos integration and restrict its permissions to what the integration needs. Phase 5: Create the two SOAP service bindings Repeat these steps twice, once for QUERYBUSINESSUSERIN and once for Z_USER.
  1. Open transaction code SOAMANAGER (SOA Management).
  2. Go to Service Administration → Web Service Configuration.
  3. Create a service filter. Select Object Type and is, then enter the service name (QUERYBUSINESSUSERIN or Z_USER) and select it from the results.
  4. Click Create Service. Enter the service name, set New Binding Name to binding, set Transport Level Security to SSL (https), set Message Level Security to None, and set Transport Channel Authentication to User ID/Password.
  5. Under SOAP Protocol, set Make Local Call to No Call in Local System, enter 0 for State Management Timeout, and click Finish.
  6. Click Display binding (the glasses icon). In Transport Settings, locate the Calculated Access URL. It has the format /sap/bc/srt/.... Copy it.
Phase 6: Connect in Lumos
  1. Find the SAP S/4HANA card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Fill in the connection fields:
    • Username: the SAP S/4HANA user that can access the SOAP services.
    • Password: the password for that user.
    • Account ID: any custom identifier that helps you recognize this integration instance.
    • Host: the hostname or IP address of your NetWeaver server that hosts the SOAP services (for example sap-server.example.com or 192.168.1.100).
    • Port: the port of your NetWeaver server (for example 50000 or 44300).
    • QUERYBUSINESSUSERIN Endpoint: the path from that service’s Calculated Access URL, meaning everything after host:port (for example /sap/bc/srt/wsdl/...).
    • USER Endpoint: the path from the Z_USER service’s Calculated Access URL, in the same format.
  3. Complete the connection.

​
API Endpoints Used

​
Troubleshooting

Can’t connect the integration. Confirm the Host and Port match your NetWeaver server, and that each endpoint field holds only the path after host:port taken from that service’s Calculated Access URL. Both the QUERYBUSINESSUSERIN Endpoint and the USER Endpoint are required. Verify the integration user has the custom PFCG role and that both services are active. Users sync but PFCG roles don’t. PFCG role data comes from the USER service, not the QUERYBUSINESSUSERIN service. Check that the Z_USER service is active, that the USER Endpoint field points at its Calculated Access URL path, and that the integration user’s role includes the Z_USER/BAPI_USER_GET_DETAIL authorization default. Granting or removing a PFCG role fails. The integration user’s role needs the Z_USER/BAPI_USER_ACTGROUPS_ASSIGN authorization default, and the Z_USER web service must have been generated with the ActgroupsAssign BAPI selected. Add both and regenerate the role profile. A user is missing from Lumos. Users must have an associated business partner record to sync. Users without one are not returned. Custom attributes are not syncing. The connector may not sync custom user attributes without additional configuration.