Integrate with SAP S/4HANA
Follow this guide to let SlashID monitor the users, roles and technical accounts of an SAP S/4HANA system. The integration inventories who can sign in, what they are allowed to do, and which technical users and RFC destinations other systems use to reach it. It then reports findings such as users who never signed in, weak password hashes, stale RFC destination passwords, and users who hold two duties that one person must not hold together.
One connection covers one SAP system:
- S/4HANA Cloud Public Edition: one tenant. SlashID pulls the data through SAP's released APIs.
- ABAP systems (S/4HANA Cloud Private Edition, RISE and on-premise): one system and client. A read-only SlashID extractor inside the system produces a package, which is either pushed by a collector or uploaded by you.
SlashID never issues a write call to SAP. It never collects password hashes (BCODE, PASSCODE, PWDSALTEDHASH) or the stored password of an RFC destination. It records only whether a password is stored, and which hash version protects a user's password.
Choose your edition
| Public Edition | ABAP system | |
|---|---|---|
| How data reaches SlashID | SlashID pulls it over HTTPS | The extractor's package, pushed by a collector or uploaded by you |
| Users, business roles, lock state | ✅ | ✅ (users, single, composite and derived roles, profiles) |
| Communication users and scenarios | ✅ | ✅ (communication and system users) |
| Authorization values, so privilege and toxic combinations | Partial: from SAP's administrator role templates plus roles you list | ✅ against SlashID's built-in catalogue |
| Department (for department segregation of duties) | ❌ | ✅ |
| Last login | ❌ unless you expose it through a custom API | ✅ |
| Password hash strength | ❌ | ✅ |
| RFC destinations | ❌ | ✅ |
Where an edition cannot supply a signal, SlashID does not report silence as a clean result. The connection's Configuration tab lists every detection area that is only partly covered, or not covered at all, for that system.
Contact SlashID to enable ABAP systems for your organization and to receive the extractor transport. Until then, creating an ABAP connection is refused.
Public Edition
Before starting
You need:
- An administrator who can maintain communication users, systems and arrangements in the tenant.
- The tenant's host, for example
my123456.s4hana.cloud.sap, and its tenant ID.
If your endpoint or tenant restricts traffic by source IP, allow connections from SlashID's egress IPs published at https://cdn.slashid.com/egress.json. The list is global and stable; the syncToken field changes whenever the IPs change, so you can use it to detect drift.
The file follows the JAFAR draft format (A JSON-Based Format for Publishing IP Ranges of Automated HTTP Clients), the same convention major cloud providers use to publish their IP ranges.
Step 1: Create a dedicated communication user
Every standard SAP scenario that exposes users also grants write access; SAP offers no read-only scenario. A leaked credential could therefore change users and roles in your tenant. To contain that risk:
- Create a communication user used by nothing but SlashID.
- Prefer OAuth 2.0 client credentials over a password. The inbound OAuth client of a communication arrangement is the communication user itself.
- Rotate the credential at least every 90 days, and monitor the user's changes through SAP's business user change documents.
SlashID checks this rule before every sync: if the communication user is assigned to any scenario other than the three below, or if the arrangements cannot be read, the sync is blocked and the health check says why.
Step 2: Create the communication arrangement
Create a communication system for SlashID with the communication user from Step 1 as its inbound user, and one communication arrangement for it with exactly these scenarios:
| Scenario | What SlashID reads |
|---|---|
SAP_COM_0465 | Business users and their business roles (SCIM 2.0) |
SAP_COM_0093 | Business users' lock state |
SAP_COM_0A48 | Communication users, systems and arrangements. Required: SlashID uses it to verify the dedicated-user rule above |
Step 3: Create the connection
Open the SlashID Console integrations page and create a new SAP S/4HANA connection.
| SlashID Console field | Description | Example |
|---|---|---|
| Name of the connection | Arbitrary name for this connection | S/4HANA Cloud Production |
| Authoritative status | Whether SAP identities are the primary source of truth when reconciling identities across providers | Secondary |
| Edition | S/4HANA Cloud Public Edition | — |
| Tenant host | The tenant's host name, not a URL | my123456.s4hana.cloud.sap |
| Tenant ID | The tenant's ID. It identifies the system and cannot be changed later | t-123456 |
| OAuth client ID, client secret, token URL | The communication user's OAuth 2.0 client credentials | — |
| Communication user, password | Instead of OAuth: the communication user's name and password | — |
| Additional privileged business role IDs | Business roles you consider privileged beyond SAP's administrator templates | Z_BR_FINANCE_ADMIN |
| Write-capable acknowledgement | Required. Confirms you understand the credential can write | — |
Public Edition exposes no authorization values, so SlashID cannot compute business capabilities there. Privilege is judged from SAP's administrator role templates plus the business roles you list.
ABAP systems
An ABAP connection identifies the system by its installation number, system ID (SID) and client, for example 0020123456/PRD/100. All three are checked against every package, so a package from another system is refused even if it shares the SID. Connect each client you want monitored as its own connection. A system copy that keeps its source's installation number, typically a QAS refresh, looks like the same system: connect it under its own client, or not at all.
- Import the SlashID extractor transport. It is a read-only report that runs under its own technical user; its install guide lists the exact authorizations.
- Create the connection in the SlashID Console with the edition ABAP system, collector or ABAP system, file upload, and the installation number, SID and client.
- Copy the connection's push token from its detail page.
- Collector: configure the SlashID collector inside your network with the token. It runs the extractor on a schedule and pushes each package.
- File upload: schedule the extractor as a background job and upload the package it writes, using the token.
You can switch between collector and upload later by editing the connection; its identities and push token are kept.
Replay protection and re-baselining
Every package is a complete snapshot of the system at its extraction time, and SlashID refuses a package older than the last one it applied, so a replayed or delayed package can never roll the graph back.
If the SAP system's clock moves backwards, new packages look older than the last applied one and are refused. Use Re-baseline on the connection's Configuration tab and enter the minimum extraction time to accept, in UTC as the SAP system reports it. The next package that was never uploaded before and was extracted at or after that time is accepted and becomes the new baseline.
Verification
Once connected, SlashID runs a preflight check. After the first sync you will see:
- SAP users, roles and, on ABAP systems, profiles in the Identities view, with each user's roles and profiles as relationships.
- Communication and system users marked as non-human identities. They are never merged into a person's account.
- On ABAP systems, RFC destinations as credentials, showing whether a password is stored and its target.
- The connection's detection coverage on its Configuration tab.
Last login times from an ABAP system are recorded in the system's local time. When the system's time zone cannot be established, SlashID shows the time with a ±26 hour uncertainty rather than implying precision.
Troubleshooting
The sync is blocked: the communication user is not dedicated
: The communication user is assigned to a scenario other than SAP_COM_0465, SAP_COM_0093 and SAP_COM_0A48. Create a separate communication user for SlashID.
The sync is blocked: the communication arrangements cannot be read
: Add SAP_COM_0A48 to the SlashID communication arrangement. The dedicated-user check cannot pass without it.
Cannot identify the connection's communication user : With OAuth, the client ID must be the communication user's name. With a password, the user name must be the communication user's name.
The health check reports read_lock_status failed
: SAP_COM_0093 is missing from the arrangement. Lock state is required: without it, SlashID could not tell a locked user from an active one.
The health check reports verify_tenant failed
: The tenant the credential reaches is not the tenant ID recorded on the connection. The tenant ID cannot be changed; create a new connection for another tenant.
Some users show the lock state as unknown : SAP returned a lock state SlashID does not recognise. Those users are reported neither as locked nor as active, and detections that depend on the lock state skip them.
An uploaded package is refused as older than the last one : Either the package was already uploaded, or the SAP system's clock moved backwards. For the latter, re-baseline the connection.