Onboardees are not replicated into IAS through the scheduled Job

1. Check the Provioning Log if “statusCode: 400, Response: Value of attribute [applicationId] is invalid”.

If this error is presented, it’s because your IAS was implemented a long time ago and some Properties in target system may be missed. You need to update this value sin the target system properties.

• The steps on how such IDs can be collected directly from IAS admin console are below:
  1. ias.application.id.attribute is the application id taken from IAS admin console. Select your SF application and check the URL in browser where the value can be found. Example of URL: https://<tenant_id>.ondemand.com/admin/#/applications/<application_id>/
  2. ias.source.system.attribute is 100 for SF, 101 for LMS, 102 for Fieldglass.

2. Are IAS source system filters ok ?

The “real time Sync” will provide onboardees immediately to the IAS. But what about the scheduled “IAS identity Provisioning” job? Is that job at the “Source system” provisioning the onboardees?

If you have already migrated to the SCIM connector, then the only posible filter is sf.user.filter=active eq “true”. Then the onboardees are synched though the SCIM API and not through the SCHEDULED JOB. If you have continued with API 1 version (ODATA connector) then the provisioning of onboardees will be through the scheduled job. Mora info of this scenario at this KBA Section 2.2

The provisioning of onboardees through scheduled jobs is is configured through the filters in the source system. To set the filters in the system firstly, you should check which API version are you using. Consider that filters will be different depending of the API version (1 or 2).

To check the API version, go to your IAS panel > Source system > Properties, and check the “sf.api.version”

Once you checked the API version, let’s go to the source filter topic!

To ensure the IPS job is pulling onboardees, “IPS source system filters” should set as: ‘active’,’active_external_suite’.

👉 Do this:

1. At the IAS panel, go to “Identity Provisioning” then to “Source System” > then to “Properties”.
2. Filters are configured as “filter sf.user.filter” field at the source system. Then insert this values:

If you are using the sf.api.version=2, then you should set as filter sf.user.filter=active eq “true”. (this true inclues onboardees and employees) SAPHELP

If you are using sf.api.version=1, then you should set as filer “sf.user.filter=status in ‘active’,’active_external_suite’ and (personKeyNav/userAccountNav/userType in ’employee’, ‘onboardee’)”

Is the Syntaxy the correct for API2 in target system?

After the change from API1 to API2, you may have forgotten to update the transformation syntax. You need to copy the one provided at the SAP HELP and paste in the source and target destination.