SAP HANA / RFC Collector for NetIQ Identity Governance

A custom DaaS connector for NetIQ / OpenText Identity Governance (IG) that collects accounts, permissions, and assignments from SAP ABAP systems (ECC, S/4HANA, BW/4HANA) via JCo/RFC.

Deployed as a drop-in JAR alongside the stock daas-sapum-native connector and registered with IG through paired JSON application templates.

Why this exists

The stock daas-sapum-native collector does not reliably collect permission data from S/4HANA systems. On the HANA-based deployments we tested, RFC_READ_TABLE calls against UST04 and related pool tables either returned empty result sets or failed with TABLE_WITHOUT_DATA, causing profile assignments and several permission relationships to be silently dropped during collection.

This collector was written to work around those issues:

• Pool-table reads avoid the DDIC FIELDS restriction path that breaks on HANA DDIC (see UST04 note below)
• Automatic fallback to /SAPDS/RFC_READ_TABLE variants when the default module is blocked
• Permission-side JSON output is kept wire-compatible with the stock collector so the stock permission template can still be used

What it collects

Search class	Source	Notes
US_ACCOUNT / US_IDENTITY	BAPI_USER_GETLIST + BAPI_USER_GET_DETAIL	Dialog-only toggle for identities
ACTIVITYGROUP (Roles)	AGR_DEFINE, AGR_TEXTS, AGR_AGRS	Single vs composite role typing
ACTIVITYGROUP_ASSIGNMENT	AGR_USERS	Start/end dates in ms-since-epoch
ACTIVITYGROUP_HIERARCHY	AGR_AGRS	Composite → single role mapping
PROFILE	USR10, UST10C	Single vs composite profile typing
PROFILE_ASSIGNMENT	UST04 + BAPI_USER_GET_DETAIL	Full row read, pool-table safe
PROFILE_HIERARCHY	UST10C	Composite → sub-profile mapping
TCODE + TCODE_HIERARCHY	AGR_TCODES	Role → transaction code
GROUP + GROUP_ASSIGNMENT	USGRP, USGRPT, USR02	User groups

Differences from the stock daas-sapum-native collector

Same wire format for permissions

Our permission, assignment, hierarchy, TCode, and user-group JSON output matches the stock collector's keys and value format 1:1 (ROLE:, TCODE:, GROUP: prefixes; holderLink; epoch-ms dates; composite/single type strings). The stock permission template can drive this collector unchanged.

See ANALYSIS-stock-vs-custom-collector.md for the full field-by-field comparison.

Different account JSON keys

The stock collector emits structure-prefixed keys derived from the template's app-name values (e.g., USERNAME:BAPIBNAME, ADDRESS:FULLNAME, ISLOCKED). We emit flat keys (USERNAME, FULLNAME, LOCKED) plus extra fields (FIRSTNAME, LASTNAME, E_MAIL, DEPARTMENT, GLTGV, GLTGB, USTYP, userTypeName, LANGU, MODDATE, MODTIME).

Consequence: the paired account template in APPLICATION_templates/SAP-User-Management-Account.json is required — the stock account template will not work.

RFC_READ_TABLE fallbacks

When the standard RFC_READ_TABLE is unavailable or unauthorized, the collector falls back to /SAPDS/RFC_READ_TABLE and /SAPDS/RFC_READ_TABLE2 (SAP DataServices variants without the 512-byte buffer limit). The resolved module is cached per JVM.

Pool-table-safe UST04 read

The stock collector reads UST04 with no FIELDS restriction and resolves profiles via BAPI_USER_GET_DETAIL — we match this behavior. (Restricting FIELDS on UST04 triggers DDIC field-lookup failures that surface as TABLE_WITHOUT_DATA on some systems.)

Other differences

• Credential redaction in all log output
• Consistent permission-ID prefixing (ROLE:, TCODE:, GROUP:)
• SAP date → epoch-ms conversion for assignment validity
• Message-server connections with logon groups (in addition to direct app-server)
• Optional SNC (encrypted RFC) support

Configuration parameters

Set in the IG connection definition (service-params):

Param	Required	Notes
connection_type	yes	AppServer or MSGServer
app-server + instance	conditional	Required for AppServer
msg-server + system-id + logon-group	conditional	Required for MSGServer
client	yes	SAP client (e.g., 400)
language-code	yes	e.g., EN
page-size-limit	no	Default 500
assignment-mode	no	0 = direct, other modes reserved
use_snc + snc-*	no	Enables encrypted RFC

Build

# Requires Java 11+ and the SAP JCo library (sapjco3.jar vendored at project root)
mvn package

The IntelliJ artifact build also produces out/artifacts/sap_hana_collector_jar/sap-hana-collector.jar with bundled dependencies.

Install

Copy the built JAR to the IG DaaS webapp:

out/artifacts/sap_hana_collector_jar/sap-hana-collector.jar
→ /opt/netiq/idm/apps/tomcat/webapps/daas/WEB-INF/lib/sap-hana-collector.jar

Restart Tomcat. Import the application templates from APPLICATION_templates/ into the IG catalog.

SAP JCo runtime dependency

This collector links against sapjco3.jar (SAP Java Connector). You do not need to provide it separately in normal deployments — the stock daas-sapum-native connector ships sapjco3.jar in the same WEB-INF/lib/ directory, and this JAR will pick it up from there.

If you are deploying this collector to an environment where the stock SAP UM connector is not installed, copy sapjco3.jar (and the platform-specific native library, e.g. libsapjco3.so / sapjco3.dll) from SAP into WEB-INF/lib/ as well. SAP's JCo license prohibits redistribution, so it is not bundled here.

Releases

See GitHub releases for prebuilt JARs.

License

MIT — see LICENSE.