> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumos.com/llms.txt
> Use this file to discover all available pages before exploring further.

# SAP S/4HANA

## After this article

You will be able to connect SAP S/4HANA to Lumos to sync users, business roles, and PFCG roles, and to grant and remove PFCG roles for a user from Lumos.

## Capabilities

| Functionality | Type | Sync | Provision | Description |
| - | - | - | - | - |
| Users | Account | Yes | No | User account records |
| Business Roles | Permission | Yes | No | Business partner roles in SAP |
| PFCG Roles | Permission | Yes | Yes | PFCG roles in SAP, granted and removed by replacing the user's assigned role list |

Notes:

* Account creation, deactivation, and deletion are not available. Provisioning is limited to granting and removing PFCG roles for an existing user.
* Business roles are read-only. They sync for visibility but cannot be requested or granted through Lumos.

## Required plan and roles

* **SAP access:** administrator privileges on your SAP S/4HANA on-premise system (using SAP NetWeaver) to create a development package, a custom role, a user, and two SOAP service endpoints.
* **Credentials:** the **username** and **password** of a dedicated SAP S/4HANA user that can access the SOAP services.
* **Two SOAP endpoints:** this integration needs both the `QUERYBUSINESSUSERIN` endpoint and a `USER` (BAPI) endpoint. Both are required connection fields. The `USER` endpoint is used for PFCG role data, so the integration will not sync PFCG roles without it.
* **Web service authorizations on the role:** `QUERYBUSINESSUSERIN/QUERY_BUSINESS_USER_IN` and `Z_USER/BAPI_USER_GET_DETAIL` are used for syncing. `Z_USER/BAPI_USER_ACTGROUPS_ASSIGN` is used only when Lumos grants or removes a PFCG role.
* **Connectivity:** network access from Lumos to your on-premise instance. S/4HANA 1809 or later is recommended, and users must have associated business partner records to sync.

## Read-only access vs provisioning

**Is read-only possible?** Yes. The custom role you build lists each web service operation the integration user is allowed to call, so you can grant the two operations used for syncing and leave out the one used for writes.

**What read-only requires.** A dedicated SAP S/4HANA user whose custom PFCG role includes only the `QUERYBUSINESSUSERIN/QUERY_BUSINESS_USER_IN` and `Z_USER/BAPI_USER_GET_DETAIL` web service authorization defaults. You still need to create both SOAP services and supply both endpoint fields, because PFCG role data is read through the `USER` service. Follow the steps below and skip the `Z_USER/BAPI_USER_ACTGROUPS_ASSIGN` entry in the Menu step.

## Instructions

**Phase 1: Create a development package in SAP**

1. Log in to your SAP S/4HANA system with administrator privileges.
2. Open transaction code **SE80** (Object Navigator).
3. In the **Repository Browser**, select **Package**, enter a package name such as `Z_LUMOS`, and press Enter.
4. When prompted to create a new object, click **Yes**.
5. Set the package properties. Enter the package name and any description, set **Software Component** to `HOME`, select **Package Type: Development Package**, leave **Transport Layer** empty, and clear **Package encapsulated**.
6. Click **Create**.

**Phase 2: Create the USER (BAPI) web service**

1. Open transaction code **BAPI**.
2. Select **Alphabetical** and open **USER**.
3. Go to **Tools**, click **Create Web Service**, and click **Start Wizard**.
4. Under **Service**, enter `Z_USER` as the **Service Definition** and any description.
5. Under **Endpoint BAPI**, select **Map Names**.
6. Under **BAPI**, select **GetDetail**. Also select **ActgroupsAssign** if you want Lumos to grant and remove PFCG roles.
7. Under **Configure Service**, set **Profile** to **Authentication with User and Password and Transport Guarantee**.
8. Under **Transport**, enter the package you created in Phase 1 (for example `Z_LUMOS`).
9. Click **Complete**, then click **Activate** and complete the request.

**Phase 3: Create a custom PFCG role in SAP**

1. Open transaction code **PFCG** (Role Maintenance).
2. Create a new single role. Enter a role name such as `LUMOS_INTEGRATION` and click **Single Role**.
3. Fill out the **Menu** section. Open the dropdown next to **Transaction**, choose **Authorization Default**, and set **Authorization Default** to **WebService**.
4. In the empty fields, enter `QUERYBUSINESSUSERIN/QUERY_BUSINESS_USER_IN` and `Z_USER/BAPI_USER_GET_DETAIL`. Add `Z_USER/BAPI_USER_ACTGROUPS_ASSIGN` as well if you want Lumos to grant and remove PFCG roles. Click **Copy**.
5. Fill out the **Authorization** section. Click **Change Authorization Data**. You should see object class AAAB and object class BC\_A with an orange triangle. Open each nested field with an orange triangle and double-click it until the triangle turns into a green square.
6. Click **Generate**, then **Execute**, then **Save**.

**Phase 4: Create a dedicated user in SAP**

1. Open transaction code **SU01** (User Management).
2. Create a new user account. Enter a username such as `LUMOS` and click **Technical User**.
3. On **Logon Data**, set **User Type** to **System** and set a secure password.
4. On the **Roles** tab, assign the role you created in Phase 3 (for example `LUMOS_INTEGRATION`).
5. Click **Save**.

Use this account only for the Lumos integration and restrict its permissions to what the integration needs.

**Phase 5: Create the two SOAP service bindings**

Repeat these steps twice, once for `QUERYBUSINESSUSERIN` and once for `Z_USER`.

1. Open transaction code **SOAMANAGER** (SOA Management).
2. Go to **Service Administration → Web Service Configuration**.
3. Create a service filter. Select **Object Type** and **is**, then enter the service name (`QUERYBUSINESSUSERIN` or `Z_USER`) and select it from the results.
4. Click **Create Service**. Enter the service name, set **New Binding Name** to `binding`, set **Transport Level Security** to **SSL (https)**, set **Message Level Security** to **None**, and set **Transport Channel Authentication** to **User ID/Password**.
5. Under **SOAP Protocol**, set **Make Local Call** to **No Call in Local System**, enter `0` for **State Management Timeout**, and click **Finish**.
6. Click **Display binding** (the glasses icon). In **Transport Settings**, locate the **Calculated Access URL**. It has the format `/sap/bc/srt/...`. Copy it.

**Phase 6: Connect in Lumos**

1. Find the SAP S/4HANA card in your Lumos integrations ([reconnect](https://app.lumosidentity.com/integrations?tab=connected) an existing card or [add a new one](https://app.lumosidentity.com/integrations?tab=can_integrate)).
2. Fill in the connection fields:
   * **Username**: the SAP S/4HANA user that can access the SOAP services.
   * **Password**: the password for that user.
   * **Account ID**: any custom identifier that helps you recognize this integration instance.
   * **Host**: the hostname or IP address of your NetWeaver server that hosts the SOAP services (for example `sap-server.example.com` or `192.168.1.100`).
   * **Port**: the port of your NetWeaver server (for example `50000` or `44300`).
   * **QUERYBUSINESSUSERIN Endpoint**: the path from that service's Calculated Access URL, meaning everything after `host:port` (for example `/sap/bc/srt/wsdl/...`).
   * **USER Endpoint**: the path from the `Z_USER` service's Calculated Access URL, in the same format.
3. Complete the connection.

## API Endpoints Used

<Note>
  The API endpoints this integration uses are available to logged-in Lumos customers. [Log in](/login) to view them.
</Note>

## Troubleshooting

**Can't connect the integration.** Confirm the Host and Port match your NetWeaver server, and that each endpoint field holds only the path after `host:port` taken from that service's Calculated Access URL. Both the QUERYBUSINESSUSERIN Endpoint and the USER Endpoint are required. Verify the integration user has the custom PFCG role and that both services are active.

**Users sync but PFCG roles don't.** PFCG role data comes from the `USER` service, not the `QUERYBUSINESSUSERIN` service. Check that the `Z_USER` service is active, that the USER Endpoint field points at its Calculated Access URL path, and that the integration user's role includes the `Z_USER/BAPI_USER_GET_DETAIL` authorization default.

**Granting or removing a PFCG role fails.** The integration user's role needs the `Z_USER/BAPI_USER_ACTGROUPS_ASSIGN` authorization default, and the `Z_USER` web service must have been generated with the `ActgroupsAssign` BAPI selected. Add both and regenerate the role profile.

**A user is missing from Lumos.** Users must have an associated business partner record to sync. Users without one are not returned.

**Custom attributes are not syncing.** The connector may not sync custom user attributes without additional configuration.