Integration Guide | PUBLIC

2025-01-07

Integrating Joule with SAP Solutions

© 2025 SAP SE or an SAP affiliate company. All rights reserved.

THE BEST RUN

Content

1 Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

2 Initial Setup. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

3 Joule Onboarding Guide. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

3.1 Prerequisites. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
3.2 Configure Trust to the Identity Authentication Tenant. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
3.3 Configure User Attributes for Joule from the Identity Directory. . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3.4 Run the Joule Booster. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
3.5 Configure Trusted Domains in Identity Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .15
3.6 Configure Trusted Domain in SAP BTP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.7 Constraints for Joule. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
3.8 Unsubscribe from Joule. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
3.9 Troubleshooting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

4 Integrating Your SAP Solution. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

5 Integrating Content with SAP Build Work Zone standard edition - foundation plan. . . . . . . . . 20
5.1 Create SAP Build Work Zone Application and Instance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

6 Integration with SAP Build Work Zone, standard edition. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .23

7 Integration with SAP Start. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24

8 Integration with SAP SuccessFactors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

8.1 Consume Content from SAP SuccessFactors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
8.2 Configure Identity Provisioning Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
8.3 Enabling Joule in SAP SuccessFactors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

9 Integration with SAP S/4HANA Cloud Private Edition. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

9.1 Set Up SAP S/4HANA Cloud Private Edition as a Content Provider. . . . . . . . . . . . . . . . . . . . . . . . . 35
9.2 Expose SAP Fiori Launchpad Content to SAP BTP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37
9.3 Configure Destinations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38
9.4 Configure Identity Provisioning Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
9.5 Configure and Activate Joule Plug-In in a Target Mapping. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50
Procedure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
9.6 Constraints for Joule in SAP S/4HANA Cloud Private Edition. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .52

10 Integration with SAP S/4HANA Cloud Public Edition. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

10.1 Set Up the Connection Between SAP S/4HANA Cloud Public Edition and the Large Language
Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54

Integrating Joule with SAP Solutions

2 PUBLIC Content
10.2 Expose the SAP Fiori Launchpad Content to SAP BTP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
10.3 Register the SAP S/4HANA Cloud Public Edition System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
10.4 Configure Identity Provisioning Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56
10.5 Maintain Custom Content Security Policy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
10.6 Constraints for Joule in SAP S/4HANA Cloud Public Edition. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69

11 Integration with SAP Product Lifecycle Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71

12 Integration with SAP Integrated Business Planning for Supply Chain. . . . . . . . . . . . . . . . . . . . 72

13 Set Up Document Grounding. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

13.1 Configure User Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
13.2 Prepare SharePoint Integration. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
13.3 Configure Access from SAP BTP. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .77
13.4 Set Up Content Ingestion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .78
13.5 Metering and Pricing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79

Integrating Joule with SAP Solutions

Content PUBLIC 3
1 Introduction

This guide provides detailed information to system administrators or technical consultants on how to set up
Joule and the integration between Joule and other SAP products.

• Check the setup requirements for your SAP Solution [page 6]

Integrating Joule with SAP Solutions

4 PUBLIC Introduction
• Follow the Joule onboarding process to get Joule ready for integrating your SAP Solution [page 7]
• Integrate your SAP Solution with Joule to use the Joule capabilities your solution offers [page 19]
• Set up document grounding to upload documents to the Joule service [page 73]

Integrating Joule with SAP Solutions

Introduction PUBLIC 5
2 Initial Setup

Learn about the options for setting up Joule for productive purposes.

Before you perform the setup instructions, it's important to know which path you should take. Here are the
different ways that Joule is available.

Joule is already available. I don't have to do anything.

You can tell that this applies to you when you see the Joule icon  inside your product. For example, in the SAP
BTP cockpit, just click the Joule icon and start working with Joule.

I already have a BTP platform set up. I just need to run the Joule booster.

In this situation, you already have a global account, subaccounts, and entitlements set up. You also have users
onboarded and trust set up to support your platform. Since the BTP platform is ready, you simply need to
initiate the booster to prepare Joule and then configure the trusted domains.

Instructions:

• Make sure you Configure Trust to the Identity Authentication Tenant [page 10] and Configure User
Attributes for Joule from the Identity Directory [page 11] before running the Joule booster.
• Run the Joule Booster [page 12]

I need to set up the BTP platform first and then I can onboard Joule.

If you haven't set up a BTP platform, then you'll need to set up BTP first. This involves administrative actions in
the SAP BTP cockpit. After you set up the platform, you can onboard Joule.

Instructions:

• Prerequisites [page 7]
• Joule Onboarding Guide [page 7]

Related Information

Joule Onboarding Guide [page 7]

Integration Guide [page 4]

Integrating Joule with SAP Solutions

6 PUBLIC Initial Setup
3 Joule Onboarding Guide

A step by step guide for setting up Joule and integrating it with SAP solutions.

Overview of the Onboarding Process

Joule includes multiple components that must be integrated for a seamless working solution. The onboarding
process consists of the following steps:

Prerequisites [page 7]
Prerequisites for Joule Onboarding.

Configure Trust to the Identity Authentication Tenant [page 10]

Use your SAP Cloud Identity Services - Identity Authentication tenant as an Identity Provider or a proxy
to your own Identity Provider hosting your business users.

Configure User Attributes for Joule from the Identity Directory [page 11]
A step by step guide to configure user attributes from the identity directory.

Run the Joule Booster [page 12]

Instructions for running the booster to set up Joule.

Configure Trusted Domains in Identity Authentication [page 15]

You need to add the domain of the integration product as trusted domain in the Identity Authentication.

Configure Trusted Domain in SAP BTP [page 16]

You can add, configure and save newly created trusted domain.

Constraints for Joule [page 16]

All constraints applicable to Joule are listed in this section. These constrains will provide you better
understandability of Joule.

Unsubscribe from Joule [page 17]

This section provides instructions on how to unsubscribe and delete a Joule subscription and service
instance. Use it to efficiently manage your subscriptions and free up resources when no longer needed.

Troubleshooting [page 18]

This section contains information that helps you troubleshoot problems in Joule.

3.1 Prerequisites

Prerequisites for Joule Onboarding.

Before completing the Joule onboarding tasks, you'll need to ensure you've met the required prerequisites for
both your product and for Joule.

Integrating Joule with SAP Solutions

Joule Onboarding Guide PUBLIC 7
SAP Product Prerequisites

• You have a license for an SAP product that supports Joule integration (such as SAP SuccessFactors,
SAP S/4HANA Cloud Private Edition. etc) in one of the supported data centers, as Joule is an embedded
application that is integrated with SAP products. For more information, see Data Centers Supported by
Joule.

 Note

• Joule is available with SAP Start under Early Adopter Care program only.
• If you want to integrate Joule with SAP Start, you must have a license of at least one SAP product
that supports Joule integration.

• You have integrated the SAP product with Identity Authentication as Joule leverages the IAS setup of the
SAP product for user login.
• You have an enterprise global account on SAP BTP as Joule is an SAP BTP based application and relies on
SAP BTP services. For more information, see Enterprise Accounts.

 Note

If you already have a global account in SAP BTP, Joule entitlements can be added in the same global
account.

Joule Specific Prerequisites

• You have the entitlements for Cloud Identity Services- Identity Authentication and Identity Provisioning.
Joule uses the Identity Authentication for user login and Identity Provisioning service to handle
provisioning of identities and their authorizations to various business applications (SAP SuccessFactors,
Identity Authentication Service Tenant, SAP Build Work Zone, standard edition). For more information, see
Tenant Models and licensing information for Identity Authentication and Identity Provisioning.

 Note

Please contact your account executive if any of the entitlements are not available in your global
account.

• Verify that your global account is configured with the following entitlements. For more information, see
Managing Entitlements and Quotas Using the Cockpit.

Application Technical Name Plan Required Quota Remaining Quota

Joule das-application foundation 1 limited

SAP Build Work Zone, SAPLaunchpad foundation or stand- 1 limited

standard edition ard

Integrating Joule with SAP Solutions

8 PUBLIC Joule Onboarding Guide
Service Technical Name Plan Required Quota Remaining Quota

SAP Build Work Zone, build-workzone- foundation or stand- 1 limited

standard edition standard ard

 Note

All SAP BTP Global accounts already include entitlements for foundation plan of SAP Build Work Zone,
standard edition. If you already have a license for standard plan of SAP Build Work Zone, standard
edition, you can continue to use the same for Joule. Make sure that you choose the same plan for SAP
Build Work Zone, standard edition application and service.

Joule uses navigation service component of SAP Build Work Zone, standard edition to resolve intent based
navigation targets and configure additional content providers.

• You have created a subaccount in your global account using the SAP BTP cockpit for provisioning Joule.
A single Joule subscription can be integrated into multiple SAP products like SAP SuccessFactors, SAP
S/4HANA Cloud Private Edition, however, one subscription of the Joule application can only be integrated
with one tenant of an SAP product. This means you cannot include multiple systems of the same product
in one Joule formation.
You must ensure that there is one IAS tenant per single independent entity and operate every single
independent entity from its own dedicated BTP sub-account.

 Tip

For more information, see Create a Subaccount in the Cloud Foundry Environment.

Related Information

SAP BTP Onboarding

SAP Cloud Identity Services
SAP Build Work Zone, standard edition
Joule Onboarding Guide [page 7]

Integrating Joule with SAP Solutions

Joule Onboarding Guide PUBLIC 9
3.2 Configure Trust to the Identity Authentication Tenant

Use your SAP Cloud Identity Services - Identity Authentication tenant as an Identity Provider or a proxy to your
own Identity Provider hosting your business users.

Prerequisites

• You have subaccount administrator permissions. For more information, see Managing Subaccounts Using
the Cockpit.
• You have a tenant of SAP Cloud Identity Services.
For more information, see Tenant Model and Licensing in the documentation for Identity Authentication.
• The Identity Authentication tenant is associated with the customer IDs of the relevant global account of
SAP BTP.
For more information, see Reuse SAP Cloud Identity Services Tenants for Different Customer IDs in the
documentation for Identity Authentication.
• You must use the same Identity Authentication tenant for all SAP applications that are included in the Joule
formation.

Procedure

1. In the SAP BTP cockpit, go to your subaccount and choose Security Trust Configuration .
2. Choose Establish Trust.
The Configure Tenant wizard opens.
3. Choose the Identity Authentication tenant. The Identity Providers listed are the Identity Authentication
tenants associated with your customer ID. Click Next.
4. Choose the domain configured with the Identity Authentication tenant and continue with Next.

 Note

For single-sign on to work, the domain of the Identity Authentication tenant must be same as the
corresponding SAP system trust setup.

5. You can change the name and the description of the tenant, display and change the origin key, and provide
a link text for user logon (see Using Multiple Identity Providers from the Same Subaccount). Click Next.
6. Review your configuration and confirm using Finish.

Related Information

Establish Trust and Federation Between SAP Authorization and Trust Management Service and Identity
Authentication

Integrating Joule with SAP Solutions

10 PUBLIC Joule Onboarding Guide
3.3 Configure User Attributes for Joule from the Identity
Directory

A step by step guide to configure user attributes from the identity directory.

1. Sign in to the administration console for SAP Cloud Identity Services.

2. Under Applications and Resources, choose the Applications tile.
3. Select the application which was automatically created in the previous step.
4. If you don’t have a created application in your list, you can create one. For more information, see Create a
New Application.
5. Choose the Trust tab.
6. Under SINGLE SIGN-ON, choose Attributes.
7. Under the Self-defined Attributes section, choose Expand All to view all the information about the user
attributes. Ensure that the following SAML Assertion Attributes are present:

User Attribute User Attribute Name

email Email

Email_verified Email Verified

family_name Last Name

given_name First Name

groups Groups

user_uuid Global User Id

8. If any attribute is missing, choose the Add button.

9. Provide a name for the attribute.
10. Choose Identity Directory source.
11. Choose a value from the drop-down list.
12. Optional: Choose the plus button next to the attribute to set a new value for the attribute.
13. Save your configuration.

Related Information

SAP Cloud Identity Services - Configuring User Attributes from the Identity Directory
Global User ID in Integration Scenarios

Integrating Joule with SAP Solutions

Joule Onboarding Guide PUBLIC 11
3.4 Run the Joule Booster

Instructions for running the booster to set up Joule.

Prerequisites

Before you run the booster, make sure:

• You have fulfilled all the necessary prerequisites for Joule. For more information, see Prerequisites [page
7].
• You must Configure Trust to the Identity Authentication Tenant [page 10] and Configure User Attributes for
Joule from the Identity Directory [page 11].
• You have fulfilled the prerequisites for setting up integration with a selected product. Refer to the product
specific integration section with which you want to integrate Joule.

Procedure

1. Log in to the SAP BTP account as global account administrator.

2. In the left navigation pane of the global account, click Boosters.
3. In the Boosters screen, search for Setting up Joule and click Start.
4. The following steps are involved in completing the provisioning process:

Steps Action

Check Prerequisites The following validations run in the backend:

• Global account administrator role for running the
booster
• Service entitlements in the global account
• Identity Authentication tenant to login to the inte-
grated product

Set up Subaccount Select the subaccount that should be used for Joule provi-
sioning and configurations.

Integrating Joule with SAP Solutions

12 PUBLIC Joule Onboarding Guide
Steps Action

Select Integrations 1. Select the SAP solutions where the Joule icon should
be enabled.
2. Choose if this integration is used for testing or pro-
ductive purposes.

 Note
Providing the integration use case improves us-
age data analysis that is used to improve the
Joule user experience.

3. Click Next.

Select Capabilities 1. Select the SAP solutions whose capability packages

should be provisioned in Joule.
2. Choose if Joule should log the conversation data for
your tenant. For more information, see Data Protec-
tion and Privacy.
3. Click Next.

Set Up Integrations 1. Provide a unique name for the Joule formation.

2. Select the systems for the SAP solutions that you had
chosen in screens 3 and 4.

 Note
• If you have selected SAP SuccessFactors,
SAP S/4HANA Cloud Public Edition or SAP
S/4HANA Cloud Private Edition in the Select
Capabilities screen, then you must select
SAP Build Work Zone system to support the
intent based navigation. For more informa-
tion, see Create SAP Build Work Zone Appli-
cation and Instance.
• You must enable the Identity Authentication
for the Build Work Zone, Standard Edition.
For more information, see Switching to SAP
Cloud Identity Services - Identity Authenti-
cation.

3. Select the SAP Cloud Identity Services System that is

configured in your SAP BTP Joule sub-account.
4. Click Next.

Validation Some product specific validation run in the background. If

the validation fails, you can either:
• Go back to screen 4 and select a different system or,
• Go back to screen 3 and select a different subaccount
in which the Joule subscription should be created

Integrating Joule with SAP Solutions

Joule Onboarding Guide PUBLIC 13
Steps Action

Review Review the information that you have entered on the last
page of the booster and click Finish to trigger Joule provi-
sioning.

5. After a successful provisioning, a confirmation message is displayed. A Joule formation is created in the
System Landscape that includes the Joule system and the selected integration systems.

 Note

Customers who have already set up the integration with Joule, need not run the booster again. The existing
integration will continue to work seamlessly. However, if you want to make changes to the existing set up
(include or exclude a system), you must run the Joule booster again. This step is valid only if the formation
for your existing set up does not exist in the System Landscape. If you have done the set up using the latest
booster and a formation already exists, then you must raise a ticket to update the formation. For more
information, see Include or Exclude a System in the Joule Formation [page 14].

Include or Exclude a System in the Joule Formation

 Note

Adding or removing a system in the Joule formation through the System Landscape is currently not
supported.

If you want to include or exclude a system in the existing Joule formation, please raise a ticket to CA-JOULE
with the following details. Please ensure that the system is registered in the System Landscape (except SAP
S4/HANA Cloud private edition) before you raise the ticket.

• Joule tenant ID
• Joule data center
• Global account ID
• Formation name or ID
• System type
• URL of the system/s to be added (for example, URL of SAP S4/HANA Cloud public edition system).
• Should Joule plugin be enabled in the system - Yes/No.
• Should the capability content for this system be included in the Joule capability package - Yes/No.
• Should any other capability content be included in the Joule capability package? Please specify.

Delete the Joule Formation

 Note

The Joule subscription is not deleted upon the deletion of the formation. To delete the Joule subscription,
refer to Unsubscribe from Joule [page 17]. You must delete the Joule formation before deleting the Joule
subscription to avoid any errors in the existing integration set up.

Integrating Joule with SAP Solutions

14 PUBLIC Joule Onboarding Guide
If you want to remove the Joule integration from the SAP solution(s), go to System Landscape in the SAP BTP
Cockpit and find the formation that you had created. Click Delete Formation. Once the formation is successfully
deleted, the configurations that were created for each product as part of the provisioning process are deleted
and the Joule icon is removed from the product UI.

 Note

The Joule subscription is not deleted upon the deletion of the formation.

Constraints

The following constraint is applied when running the Joule booster:

• The following product combination is not currently supported:

• SAP S/4HANA Cloud Public Edition and SAP S/4HANA Cloud Private Edition

Related Information

Integration with SAP SuccessFactors [page 26]

Integration with SAP S/4HANA Cloud Private Edition [page 34]
Integration with SAP Product Lifecycle Management [page 71]

3.5 Configure Trusted Domains in Identity Authentication

You need to add the domain of the integration product as trusted domain in the Identity Authentication.

Prerequisites

You are assigned the Manage Tenant Configuration role. For more information about how to assign
administrator roles, see Edit Administrator Authorizations.

Procedure

1. Sign in to the administration console for SAP Cloud Identity Services.

2. Under Applications and Resources, choose the Tenant Settings tile.
At the top of the page, you can view the administrative and license relevant information of the tenant.

Integrating Joule with SAP Solutions

Joule Onboarding Guide PUBLIC 15
3. Under Customization, choose the Trusted Domains list item
4. Press the + Add button.
5. Type the URL of the trusted host in the field.
You can type either the full name of the host or you can use the wild card * function.

 Caution

Be careful when using the wild card * function. Make sure that you trust the domain when you use it.

See the examples:

mycompany.ondemand.com
*.example.com
6. Save your changes.
If the operation is successful the system displays the message Trusted Domains updated.

For more information, see Configure Trusted Domains.

3.6 Configure Trusted Domain in SAP BTP

You can add, configure and save newly created trusted domain.

1. Go to your subaccount and choose Security Settings .

2. Choose + (Add).
3. Enter the host name for the trusted domain.
4. For example: https://store.example.com
5. All the trusted domains together, including their space separators, can't exceed 2048 characters.
6. Save your entries.

3.7 Constraints for Joule

All constraints applicable to Joule are listed in this section. These constrains will provide you better
understandability of Joule.

The following constraints apply for Joule:

• Joule currently supports conversations in English only.

• A Single Joule subscription can be integrated into multiple SAP products like SAP SuccessFactors, SAP
S/4HANA Cloud Private Edition, however, one subscription of the Joule application can be integrated with
only one tenant of an SAP product. This means you cannot include multiple systems of same product in
one Joule formation. Data isolation happens at tenant level.
• A subscription of Joule must be created in the same subaccount where the subscription and service
instance of SAP Build Work Zone exist.
• If you have created the NavigationService destination manually, then the subscription of Joule must be
created in the same subaccount where the subscription and service instance of SAP Build Work Zone

Integrating Joule with SAP Solutions

16 PUBLIC Joule Onboarding Guide
exists. However, this constraint does not apply if the destination is set up automatically via the booster. For
more information, see
Run the Joule Booster [page 12].
• Joule requires a trust configuration of type OpenID Connect with your Identity Authentication tenant.
SAML based trust is not supported.
• The domain of the Identity Authentication tenant used for setting up trust configuration in SAP BTP
subaccount should be same as the IAS domain for the SAP product.
• It is not possible to create trust to the same Identity Authentication tenant based on SAML and OIDC in
parallel. If you have to set up SAML trust to your application, you can create the Joule subscription in a
different subaccount and set up OIDC trust with the same IAS tenant that is linked with the application.

 Note

The domain of the Identity Authentication tenant used for setting up trust configuration in the SAP BTP
subaccount should be the same as the IAS domain used for integration with the parent SAP product.

• Joule uses SAP Build Work Zone, standard edition with foundation plan for navigational scenarios. This
implies that Identity Provisioning Service (IPS) must be enabled and configured for user assignment to the
navigation content.
• Users can send up to three thousand requests per minute to Joule. Once the rate limit is reached, any
subsequent requests will return an error code until enough time has passed for the call count to drop below
the limit.

3.8 Unsubscribe from Joule

This section provides instructions on how to unsubscribe and delete a Joule subscription and service instance.
Use it to efficiently manage your subscriptions and free up resources when no longer needed.

If you no longer need the Joule subscription or the service instance, you can delete them.

Upon unsubscribing from Joule, all new configurations will be deleted. All services that are part of Joule setup
will be unsubscribed, and their persisted data will be deleted. Consequently, you will not be able to access your
assistant and the chat data.

 Note

Once you delete the subscription, all your tenant data is deleted. Consequently, you will not be able to
access your assistant and the chat data.

Deleting the Joule Subscription

1. Open the Cockpit of your subaccount.

2. Open your Subaccount tile and click Instances and Subscriptions in the navigation pane on the left.
3. Find the application Joule under Subscriptions.
4. Click Delete under the actions menu ( ) on the right.

Integrating Joule with SAP Solutions

Joule Onboarding Guide PUBLIC 17
The subscription is deleted.

 Caution

After you have deleted the subscription of Joule, you may not be able to re-subscribe in the same
subaccount. Create a subscription in another subaccount in which you haven't yet subscribed to Joule
or raise a ticket to CA-DAS-TO.

3.9 Troubleshooting

This section contains information that helps you troubleshoot problems in Joule.

Joule screen is blank

Root Cause

You are using Corporate Identity Provider (like Azure AD or OKTA) for user login.

Solution

• Make sure you have set your Corporate Identity Provider as the Default Identity Provider for Joule
application in the Identity Authentication.
For more information, see Choose Default Identity Provider for an Application.

Joule Navigation button is missing after a successful Jobrun or Jobsync

Solution

• Check your NavigationService destination settings in your SAP BTP subaccount.

• Open SAP Build Work Zone application in your SAP BTP subaccount and select Content Channel that you
have created for your product integration.
• Ensure to select the Token Service URL Type as Dedicated.
• Manually refresh SAP Build Work Zone application to check if service provider details are updated.

Integrating Joule with SAP Solutions

18 PUBLIC Joule Onboarding Guide
4 Integrating Your SAP Solution

Use the following table to search for your SAP Solution, navigate the solution specific integration guide, and
integrate your solution with Joule.

Integrating your solution

SAP Solution Integration Guide

SAP Build Work Zone, standard edition - foundation plan Integrating Content with SAP Build Work Zone standard edi-
tion - foundation plan [page 20]

SAP Build Work Zone, standard edition Integration with SAP Build Work Zone, standard edition
[page 23]

SAP Start Integration with SAP Start [page 24]

SAP SuccessFactors Integration with SAP SuccessFactors [page 26]

SAP S/4HANA Private Cloud Integration with SAP S/4HANA Cloud Private Edition [page
34]

SAP S/4HANA Cloud Public Edition Integration with SAP S/4HANA Cloud Public Edition [page
53]

SAP Product Lifecycle Management Integration with SAP Product Lifecycle Management [page
71]

SAP Integrated Business Planning for Supply Chain Integration with SAP Integrated Business Planning for Sup-
ply Chain [page 72]

Integrating Joule with SAP Solutions

Integrating Your SAP Solution PUBLIC 19
5 Integrating Content with SAP Build Work
Zone standard edition - foundation plan

An overview of the process for integrating content to the SAP Build Work Zone Foundation.

To support navigation to different apps from Joule and handle role based access scenarios, you need to
configure the navigation service of SAP Build Work Zone. This allows resolution of intent based navigation
targets that are defined in the backend. The content needs to be exposed by the SAP product (source system)
and consumed by SAP Build Work Zone (target system). This process is composed of a content exposure flow
and a content consumption flow.

 Note

For integrating content from cloud solutions, all systems must operate under the same domain.

Content Exposure

The content exposure involves setting up the communication between the content provider system and the
SAP Build Work Zone, and exposing the roles that you want to integrate. The steps required for content
exposure vary for each SAP product. Please refer to the product specific integration section.

Content Consumption

After completing the content exposure, you need to set up the content consumption, at the end of which it
will be possible to transfer content from SAP product to SAP Build Work Zone. You also need to configure a
design-time destination from which the SAP Build Work Zone will fetch the exposed content. The following
steps need to be performed for all integrations that support navigational scenarios.

• Create SAP Build Work Zone Application and Instance [page 21]

Related Information

Integration with SAP SuccessFactors [page 26]

Integration with SAP S/4HANA Cloud Private Edition [page 34]

Integrating Joule with SAP Solutions

20 PUBLIC Integrating Content with SAP Build Work Zone standard edition - foundation plan
5.1 Create SAP Build Work Zone Application and Instance

Steps to create a subscription and instance of SAP Build Work Zone, standard edition.

Make sure that you have the entitlement for SAP Build Work Zone, standard edition (foundation plan) for both
application and service added in your global account. For more information, see Prerequisites [page 7].

 Note

If your subaccount already has the set up for SAP Build Work Zone system, standard edition (standard
plan), you can skip these entitlements and continue to use the same and add the missing configurations.

Create a Subscription for SAP Build Work Zone, standard edition

1. In the SAP BTP Cockpit, open your subaccount.

2. Go to Services Service Marketplace in the left navigation pane.
3. Search for SAP Build Work Zone, standard edition, and click the tile.
4. In the top right corner, click Create.
5. In the window that opens, keep all the default settings and click Create.
6. Assign users to the Launchpad_Admin role collection. This role collection enables you to perform all the
administration tasks for a SAP Build Work Zone, standard edition site, and is available out-of-the-box.
1. Go to Security Role Collections in the left navigation pane.
2. Search for the role collection Launchpad_Admin.
3. Open the role collection for editing. Click the arrow at the far right, and in the role collection screen,
click Edit.
4. In the Users section of the screen, search for your email and add it to the list of users by clicking the +
button. Save your changes.

Create an Instance for SAP Build Work Zone, standard edition

1. Go to Services Service Marketplace in the left navigation pane.

2. Search for SAP Build Work Zone, standard edition, and click the tile.
3. In the top right corner, click Create and enter the details of the new service instance.

 Note

You must enable Cloud Foundry and create a space before you create a service instance. For more
information, see Creating Service Instances in Cloud Foundry.

4. In the window that opens, keep all the default settings and click Create.
5. To create a service key, still in the Instances and Subscriptions screen, click the  (Actions) next to the
service instance entry in the table, and create a service key. For more information, see Creating Service
Keys in Cloud Foundry.

Integrating Joule with SAP Solutions

Integrating Content with SAP Build Work Zone standard edition - foundation plan PUBLIC 21
Related Information

SAP Build Work Zone, standard edition

Integrating Joule with SAP Solutions

22 PUBLIC Integrating Content with SAP Build Work Zone standard edition - foundation plan
6 Integration with SAP Build Work Zone,
standard edition

Prerequisites

• You've switched to SAP Cloud Identity Services - Identity Authentication as Joule leverages Identity
Authentication for user login. If you're not yet using Identity Authentication, please switch over. For more
information, see Switching to SAP Cloud Identity Services - Identity Authentication.
• Before completing the Joule onboarding tasks, you'll need to ensure that you've met the required
prerequisites for both SAP Build Work Zone, standard edition and for Joule. For a list of these prerequisites,
please refer to: Prerequisites [page 7].

 Note

The trust is already created, so you can skip this particular step in the list of prerequisites.

• The Joule booster has been run. For more information, see Run the Joule Booster [page 12].

Setting Up the Joule Integration

1. Once the Joule booster has been run, and the integrations between SAP Build Work Zone, standard edition
and Joule is complete, a setting becomes available in the Site Settings screen of the site.
2. As an administrator, you can then go to the Site Settings screen and enable the Joule setting.
3. Once enabled, the Joule icon is displayed in the header of your runtime site.

Restrictions

To view a list of restrictions and constraints when using Joule, see Constraints for Joule [page 16].

Integrating Joule with SAP Solutions

Integration with SAP Build Work Zone, standard edition PUBLIC 23
7 Integration with SAP Start

Prerequisites

• You have already run the manual setup for SAP Start, to obtain a subscription to SAP Build Work Zone,
standard edition.
For more information, see Manual Setup.

 Note

If you run the automated set up for SAP Start, you can't select an existing subaccount. It is
recommended to run the manual set up for SAP Start and select an existing subaccount.

• SAP Build Work Zone, standard edition is configured to use SAP Cloud Identity Services - Identity
Authentication.
For more information, see Switching to SAP Cloud Identity Services - Identity Authentication.

 Note

If you plan to set up Joule in another subaccount than the SAP Build Work Zone, standard edition
subaccount, then you need to ensure that for both subaccounts trust is established to the same SAP
Cloud Identity Services - Identity Authentication tenant.

Procedure

1. Run the Joule booster.

For more information, see Run the Booster.

 Note

In steps 3 and 4 of the booster, you don't need to select anything from the Products and Capability
Packages drop-down lists, respectively.

2. Add the Joule system created by the booster to the SAP Start formation:
1. In your global account, select System Landscape from the left panel, and select the Formations tab.
2. Search for your formation of type Integration with SAP Start and click Include Systems (in the top right
corner of the formation).
3. Select the Joule system to include in the formation. This system has your subaccount in the Discovery
column and Joule in the System Type column.
4. Click Next Step.
5. Click Include.
As a result, the Joule system is added to the formation's list of systems.

Integrating Joule with SAP Solutions

24 PUBLIC Integration with SAP Start
You can now use Joule in SAP Start by clicking the Joule icon that was added to the header.

Restrictions

To view a list of restrictions and constraints when using Joule, see Constraints for Joule.

Integrating Joule with SAP Solutions

Integration with SAP Start PUBLIC 25
8 Integration with SAP SuccessFactors

Steps required to integrate Joule in SAP SuccessFactors.

Prerequisites

• You have fulfilled the necessary prerequisites as mentioned in Prerequisites [page 7].
• You have integrated SAP SuccessFactors with Identity Authentication as Joule leverages the IAS setup
of the integrated SAP product for user login. For more information, see Getting Started with Identity
Authentication and SAP SuccessFactors.
• You have created a service instance and generated a service key for SAP Build Work Zone, standard edition
(foundation plan). For more information, see Create SAP Build Work Zone Application and Instance [page
21].

Integration Steps

The integration process involves the following steps:

• Register an SAP SuccessFactors System in a Global Account in SAP BTP

• Run the Joule Booster [page 12] with SAP SuccessFactors as an option in the Select Integrations screen.
You can select other products in combination with SAP SuccessFactors if you have appropriate licenses
and entitlements.
• Create SAP Build Work Zone Application and Instance [page 21]
• Consume Content from SAP SuccessFactors [page 26]
• Configure Identity Provisioning Service [page 29]

8.1 Consume Content from SAP SuccessFactors

SAP SuccessFactors provides a REST API to push CDM content to SAP Start. You need to configure a design
time destination and a runtime destination in the SAP BTP subaccount, and a content channel in the SAP Build
Work Zone Content Manager to push the content to the SAP Start site.

Create a Design Time Destination

Create a design-time destination on SAP BTP to access the CDM content API from SAP SuccessFactors.

Integrating Joule with SAP Solutions

26 PUBLIC Integration with SAP SuccessFactors
 Note

Accessing SAP SuccessFactors APIs using Basic Authentication has been deprecated. You can create
certificate based destinations. For more information, see Deprecation of HTTP Basic Authentication for
APIs.

1. Log into your SAP BTP cockpit and go to your subaccount for Joule set up.
2. Choose Connectivity Destinations and create new destination with the following information:

Field Value

Name LPS_SFSF_dt

Type HTTP

URL https://<tenant
API URL>/rest/servicesfoundation/
sfcdmcontentservice/v1/SFCDMContent

Proxy Type Internet

Authentication Basic Authentication

User Enter your SAP SuccessFactors username with oData API

access and company in the format of username@COM-
PANY

Password Enter the password for your SAP SuccessFactors

3. In the Additional Properties section, enter the following information:

Field Value

Use default JDK trust store Enable this option

HTML5.Dynamic Destination true

4. Save your changes.

Update the Runtime Destination

LPS_SFSF_rt destination is automatically created when you run the Joule booster. It has the following
configurations:

Field Value

Name LPS_SFSF_rt

Integrating Joule with SAP Solutions

Integration with SAP SuccessFactors PUBLIC 27
Field Value

Proxy Type Internet

Authentication NoAuthentication

Type HTTP

URL Your SAP SuccessFactors tenant URL

Additional Properties
Field Value

sfsf.companyID SAP SuccessFactors company

However, you may need to update the destination in the following scenarios:

• If you are using SAP Build Work Zone foundation plan (not standard plan), add the following property in the
Additional Properties section by typing sap-start in the field. It is not available in the drop-down menu.

Field Value

sap-start true

• If your SAP SuccessFactors tenant is already migrated to cloud.sap (SAP super domain), update the URL
field in the destination to use new super domain, for example, https://sfsf.cloud.sap.

Add a Content Provider to Consume CDM Content

Add a new content provider to your SAP Start site to consume the CDM content from SAP SuccessFactors. For
information on accessing the Site Manager, see section Open and Manage SAP Build Work Zone Application in
this tutorial .

1. Go to Services Service Marketplace in the left navigation pane.

2. Click the SAP Build Work Zone, standard edition application subscription hyperlink to open the application.
3. Go to the Site Manager page and open the Channel Manager tab.
4. Choose + New Content Provider to add a new content provider.
5. Enter the following information:

Field Value

Title Enter a name for the content provider (recommended

sfsf)

Description Enter a description for the content provider

ID Any unique ID (recommended sfsf)

Design-Time Destination Select the design time destination LPS_SFSF_dt

Integrating Joule with SAP Solutions

28 PUBLIC Integration with SAP SuccessFactors
Field Value

Runtime Destination Select the runtime destination LPS_SFSF_rt

Runtime Destination for Dynamic Data Select Use default runtime destination

Automatically add all content items to subaccount True

Use the Identity Provisioning service to provision user au- True

thorizations

6. Save the entry.

8.2 Configure Identity Provisioning Service

Steps to configure Identity Provisioning service.

Navigation service of SAP Build Work Zone, standard edition service uses Identity Provisioning service (IPS)
that is used to provision identities and their authorizations between source and target systems.

This section describes the steps to configure the source system (SAP SuccessFactors) and target systems
(Identity Authentication and SAP Build Work Zone, standard edition) in the Identity Provisioning of your IAS
application user interface. For some customers, SAP SuccessFactors and the Identity Authentication systems
are already configured as the source and target system by the Upgrade Center.

The following configurations are required to provision:

1. User details like user email, Global User ID and group memberships from SAP SuccessFactors to SAP Build
Work Zone, standard edition.
2. User roles as groups from SAP SuccessFactors (source system) to SAP Build Work Zone, standard edition
with role ID as external ID and group memberships.

 Note

You must have the administrative access to your Identity Provisioning tenant and you need to enable
the Manage Identity Provisioning role for your user. For more information, see Manage Authorizations in
SAP Cloud Identity Infrastructure.

3. Login to your Identity Authentication tenant.

4. Navigate to Identity Provisioning Source System .
5. Select the source system configured for SAP SuccessFactors from the left panel and go to the
Transformations tab. You can switch to the JSON editor by choosing the code-bracket icon.

 Note

Existing Identity Authentication customers must switch from the ODATA API to the SCIM API for use
with Identity Provisioning. For more information, see Upgrade from ODATA IPS Connector to SCIM IPS
Connector with SAP SuccessFactors HXM Suite.

6. Ensure that the group entity has following configuration:

Integrating Joule with SAP Solutions

Integration with SAP SuccessFactors PUBLIC 29
Property Value Description

Ignore false Ensures groups SCIM entity is consid-

ered during the provisioning jobs

Mappings  Sample Code Ensures the source ID field of the

SCIM entity groups is set to externalId
{
"sourcePath":
"$.id",
"targetPath":
"$.externalId"
},

7. Under the Properties tab, ensure that the field sf.user.filter is configured to fetch all the required and
valid users.
8. Follow these steps if you don’t want the groups to be provisioned in IAS, else skip this step and go to step 7.
1. Navigate to Identity Provisioning Target System .
2. Select the target system configured for Identity Authentication from the left panel and go to the
Transformations tab. You can switch to the JSON editor by choosing the code-bracket icon.
3. Ensure that the group entity has following configuration:

Property Value Description

Ignore true Ensures groups SCIM entity is ig-

nored during the provisioning jobs

9. Create a new target system with following information:

Field Value

Type SAP Build Work Zone, standard edition

Name Any meaningful name (Work Zone-Target)

Description Any meaningful description

Source System Select SuccessFactors source system

10. Select the target system that you created from the left panel and go to the Transformations tab. You can
switch to the JSON editor by choosing the code-bracket icon.
11. Choose Edit. Add the following attribute mapping for the group entity.

Integrating Joule with SAP Solutions

30 PUBLIC Integration with SAP SuccessFactors
Property Value Description

Mapping  Sample Code Ensures the externalId field of the

SCIM entity groups is set to externalId
{
"sourcePath":
"$.externalId",
"targetPath":
"$.externalId",
},

12. Switch to Properties tab and add or confirm if the following properties are available using service key
generated earlier for the SAP Build Work Zone, standard edition (foundation or standard plan):

Field Value

URL portal-service field value under endpoints node

from the service key

Authentication BasicAuthentication

User clientid field value under uaa node from the service
key

Password clientsecret field value under uaa node from the

service key

ProxyType Internet

Type HTTP

OAuth2TokenServiceURL https://<uaa url>/oauth/token

ips.trace.failed.entity.content false

cflp.user.unique.attribute emails[0].value,
['urn:ietf:params:scim:schemas:extensio
n:2.0:mapping']
['providerId'],externalId

cflp.support.bulk.operation false

cflp.providerId ID field value for content channel configured for SAP Suc-
cessFactors in SAP Build Work Zone

cflp.group.unique.attribute externalId,
['urn:ietf:params:scim:schemas:extensio
n:2.0:mapping']['providerId']

cflp.bulk.operations.max.count 100

Integrating Joule with SAP Solutions

Integration with SAP SuccessFactors PUBLIC 31
 Note

Add the properties cflp.support.bulk.operation (value as true) and

cflp.bulk.operations.max.count if your source system has too many entries, else you can omit
them. For more information, see List of Properties.

13. Navigate to Identity Provisioning Source System .

14. Select the source system configured for SAP SuccessFactors and switch to Jobs tab.
15. Run a Read or a Resync job as per your requirements to provision SAP SuccessFactors users and roles to
SAP Build Work Zone (Navigation Service).

 Note

1. We recommended to run Identity provisioning service (IPS) provisioning job on scheduled basis with
interval less than or equal to twenty four hours for permissions to take effect on time and overlap with
Refresh Synthetic Group Data job in SAP SuccessFactors.
2. Depending on the job schedules and configuration, it may take twenty four to forty eight hours for the
roles to reflect in the navigation service from SAP SuccessFactors.
3. You may need to run Refresh Synthetic Group Data and IPS job in SAP SuccessFactors and IPS job to
sync the roles on adhoc basis or as needed.

8.3 Enabling Joule in SAP SuccessFactors

Administrators can enable Joule and grant the role-based permission to SAP SuccessFactors users who need
to access the copilot.

Procedure

1. Follow the initial set up procedure linked in Related Information to complete initial settings on SAP Business
Technology Platform.

After you complete the settings, Joule is enabled in your instance. Then, you need to grant the role-based
permission to SAP SuccessFactors users.

2. At SAP SuccessFactors Admin Center Manage Permission Groups , create a permission group for
the users who need to access Joule.
All users in this permission group can access Joule after you grant the required role-based permission to
the group.

3. At Admin Center Manage Permission Roles , create new permission roles for Joule users.

 Tip

You can also update existing permission roles. For more details about how to create a permission role,
refer to Permission Roles.

Integrating Joule with SAP Solutions

32 PUBLIC Integration with SAP SuccessFactors
a. Choose Create New.
b. On the Permission Role Detail page, choose Permission.
c. In the Permission settings dialogue box, grant the User Permissions General User Permission
Access to Joule permission and other permissions if needed to the permission role, and then choose
Done to save your changes.

 Note

To access use cases, make sure that users have the User Permissions General User Permission
User Search permission.

d. On the Permission Role Detail page, choose Grant this role to Add and grant this role to the
permission group that you've configured for Joule users in Step 2.
e. Choose Done.
4. Save all your changes.

If the changes don’t take effect within 10 minutes, you can manually refresh the permissions according to
Refreshing RBP after Changes in Provisioning Configuration.

 Note

For use cases with the navigation capability, users may not be able to see the navigation links
immediately after they are granted the required permissions. Please expect 1-2 days for such
permission changes to take effect.

5. As a prerequisite to use each case for Employee Central Quick Actions, you must enable this feature and
configure the corresponding templates.

 Tip

For more information about the configuration, refer to Employee Central Quick Actions.

Results

Joule is now ready to use.

Related Information

Initial Setup
What Are Role-Based Permissions?

Integrating Joule with SAP Solutions

Integration with SAP SuccessFactors PUBLIC 33
9 Integration with SAP S/4HANA Cloud
Private Edition

This section describes the steps to enable the Joule Communication Scenario on your SAP S/4HANA Private
Cloud instance and integrate Joule Web Client plugin in your SAP Fiori Launchpad, allowing your users to
interact with Joule.

Prerequisites

• You have carried out the steps described in Initial Setup [page 6].
• You have referred to the Security related information for Joule.
• You have fulfilled the necessary prerequisites as mentioned in Prerequisites [page 7].
• You have integrated the SAP S/4HANA Cloud Private Edition with Identity Authentication as Joule
leverages the IAS setup of the SAP product for user login.
• You have created a service instance and generated a service key for SAP Build Work Zone, standard edition
(foundation plan). For more information, see Create SAP Build Work Zone Application and Instance [page
21].
• You have added the entitlement for the connectivity plan of the Cloud Identity services in your subaccount.

Integration Steps

1. Configure Trust to the Identity Authentication Tenant [page 10]

2. Configure Trusted Domain in SAP BTP [page 16]
3. Configure User Attributes for Joule from the Identity Directory [page 11]
4. Configure Trusted Domains in Identity Authentication [page 15]
5. Expose SAP Fiori Launchpad Content to SAP BTP [page 37]
6. Set Up SAP S/4HANA Cloud Private Edition as a Content Provider [page 35]
7. Integrating Content with SAP Build Work Zone standard edition - foundation plan [page 20]
8. Run the Joule Booster [page 12]
9. Configure Destinations [page 38]
10. Configure Identity Provisioning Service [page 43]
11. Configure and Activate Joule Plug-In in a Target Mapping [page 50]

Integrating Joule with SAP Solutions

34 PUBLIC Integration with SAP S/4HANA Cloud Private Edition
9.1 Set Up SAP S/4HANA Cloud Private Edition as a
Content Provider

Set up SAP S/4HANA Cloud Private Edition as a content provider for SAP Build Work Zone, standard edition
using the SAP Cloud Connector.

 Caution

SAP Build Work Zone, standard edition automatically uses SAP Cloud Connector as a proxy to any system
connected to it. All paths that you configure in your cloud connector will be reachable via the public
internet. Please make sure that you only configure the necessary paths and that your SAP S/4HANA Cloud
Private Edition system is properly secured to prevent unauthorized access.

1. Establish trust between your subaccount and your SAP S/4HANA Cloud Private Edition system.
For more information, see Cloud Connector.
Take note of the following:
• The section about Configure Principal Propagation.
• Disable the System Certificate for Logon setting to enable principal propagation and basic
authentication via the SAP Cloud Connector.
For more information, see Expose Intranet Systems.
2. In your SAP Cloud Connector Administration UI, open the Cloud To On-Premise tab.
3. Create a new system mapping and expose the following paths for the HTTPS protocol:

Path to fetch... Value

Card manifests and i18n files /sap/bc/lrep/

The UI5 App Index /sap/bc/ui2/app_index/

CDM3 content /sap/bc/ui2/cdm3/

Data from OData services /sap/opu/odata/

Data from OData V4 services /sap/opu/odata4/

 Note

The paths in the table above are for a default configuration, that covers most use cases. However, from
a security perspective, we recommend to restrict the paths further, according to the services that are
used in your use case.

For more information, see Set Up Cloud Connector.

4. Create a new mapping for the integration with the Identity Provisioning Service using the following values:

Field Value

Back-end Type ABAP System

Protocol RFC or RFC SNC

Integrating Joule with SAP Solutions

Integration with SAP S/4HANA Cloud Private Edition PUBLIC 35
Field Value

Connection Type With load balancing (system ID and message server)

Message Server <Your SAP S/4HANA Cloud Private Edition message

server host, e.g. ldcsuct>

System ID <Your SAP S/4HANA Cloud Private Edition system ID,

e.g. UCT>

SAProuter Leave empty.

Virtual Message Server ldcsuct

Virtual System ID UCT

 Note

Using the values in the table above, the value of the internal host would be: ldcsuct:sapmsUCT

5. With the Naming Policy set to Exact Name in the Identity Provisioning service, allow access to the following
resources:
• BAPI_USER_GETLIST
• BAPI_USER_GET_DETAIL
• PRGN_ACTIVITY_GROUPS_LOAD_RFC
• PRGN_ROLE_GETLIST
For more information, see SAP Application Server ABAP.
6. Open your SAP S/4HANA Cloud Private Edition system to preview and expose your content.

 Note

• Exposure Version: Version 2

• To check that your content exposure was successful, you can use the SAP Gateway Client
(transaction /IWFND/GW_CLIENT) as follows: Send a GET request to /sap/bc/http/ui2/
flp_content_exposure and check that you receive as a response the status code 200.

For more information, see Manage Launchpad Content for Exposure.

7. To create a technical service user, open transaction SU01 and as the User Type select Service.
8. Make sure that the technical service user fulfills the prerequisites in Manage Launchpad Content for
Exposure.
9. In the My Home Settings, make sure that the business users are assigned the value: Insights Cards.

Related Information

Integrate SAP S/4HANA Cloud Private Edition

Integrating Joule with SAP Solutions

36 PUBLIC Integration with SAP S/4HANA Cloud Private Edition
9.2 Expose SAP Fiori Launchpad Content to SAP BTP

Administrators can expose SAP Fiori launchpad content to SAP BTP by choosing specific roles. The related
content, such as groups, catalogs, pages, or spaces can then be consumed on SAP BTP. For information, see
Manage Launchpad Content for Exposure.

Procedure

Expose your SAP Fiori launchpad content:

1. Launch transaction /UI2/CDM3_EXP_SCOPE.

2. Choose the exposure version you would like to use. See Content Exposure Versions Overview.

 Note

Each exposure version uses a dedicated repository, allowing you to run, schedule, and use both version
1 and version 2 simultaneously.

3. Choose which roles you want to provide to SAP BTP. You have the following options:
• All roles with launchpad content - By default, all roles are exposed.
• Selected roles in areas (all selected roles in all areas will be exposed) - Select specific roles or bundle
several roles in a specific area. See Select Roles for Content Exposure.

 Note

All roles contained in the role selections of all areas are used for the exposure. To add additional roles to
the exposed content, simply include these roles in the existing role selection and execute the exposure.
Conversely, to remove specific roles from the exposed content, simply exclude these roles from the
existing role selection and execute the exposure.

 Note

Derived roles are not supported directly. If you want to expose a derived role, choose the leading role
containing the launchpad content and add it to the role selection. The derived role will be exposed
indirectly as a related role assignment.

4. Optional: Click Preview Content or Preview Area Content to see a preview of the selected content. This
might help you to see if you have selected all your required content and if the content contains any errors
or warnings that you might need to fix before exposing.
5. Save your defined roles by clicking on Save Selected Roles. The role selection must be saved first before
exposing. Otherwise you will expose the last saved role selection.
6. Check whether your content contains any errors by either clicking View Log or Preview Content Display
Log . Note that only content without errors can be exposed.
7. Expose your launchpad content:
• Schedule a job to expose your content on a regular basis. The exposure process will use the saved
configuration. See Schedule Content Exposure.

Integrating Joule with SAP Solutions

Integration with SAP S/4HANA Cloud Private Edition PUBLIC 37
• Click Expose Content to manually trigger the exposure of the saved configuration.

Related Information

Manage Launchpad Content for Exposure

9.3 Configure Destinations

This document provides you with the information to configure a design-time destination, runtime destination,
and single sign-on (SSO).

To integrate the content you exposed on the SAP S/4HANA Private Cloud system into SAP Build Work Zone,
standard edition, you need to configure a design-time destination to define the location from which to fetch the
exposed content. In addition, you configure the runtime destinations to obtain the resources needed to run the
federated apps in runtime. For more information, see Configure Destinations.

Design-Time Destination

In the SAP BTP cockpit, in your subaccount, navigate to Connectivity Destinations .

Use the following properties to define the design-time destination:

Property Value

Name We recommend to add the suffix dt to the name.

 Note
The name must contain only lowercase letters.

Type HTTP

Description Enter a description

URL The URL of the Virtual Host of your Cloud Connector: https://
<host>:<port>/sap/bc/ui2/cdm3/entities

Proxy Type OnPremise

Integrating Joule with SAP Solutions

38 PUBLIC Integration with SAP S/4HANA Cloud Private Edition
Property Value

Authentication Method
 Note
The selected method must also be supported on the side of the content
provider.

The following methods is supported:Basic Authentication.

To connect to the backend, use a technical user with permission to read the
CDM.

 Note
Principal Propagation is not supported.

sap-client (additional The client number of the ABAP system. For example: 120

property)

Runtime Destination

The runtime destination defines the location from which to obtain the resources needed to run the federated
apps in runtime.

Property Value

Name We recommend to add the suffix rt to the name.

 Note
The name must contain only lowercase letters and must not contain the under-
score (_) character.

Type HTTP

Description Enter a description

Integrating Joule with SAP Solutions

Integration with SAP S/4HANA Cloud Private Edition PUBLIC 39
Property Value

URL The URL of the Virtual Host of the system that is set up in your Cloud Connector.

You find this value in the Cloud Connector Administration tool - select Cloud to
On-Premise and in Access Control, use the value in the Virtual Host column.

For example: http://qky:44300

For more information, see Set Up Cloud Connector.

 Note
For Web Dynpro ABAP applications, if they include SAP Business Client
(CompatibilityMode=TRUE), it is necessary to configure the value of
the Cloud Connector virtual host to be the same as the full path. For more
information, see the settings for WDA Apps Integration Mode in Maintaining
Launchpad App Descriptor Items.

Proxy Type OnPremise

Authentication Method Depends on the authentication method in use. To use single sign on (SSO), select
Principal Propagation.

Add the following additional properties:

Property Value

HTML5.DynamicDestination Add this property and set its value to true when you are creating a destination for
a dynamic tile.

 Note
To enable CSRF protection via the approuter, set the
CEP.EnableCsrfProtection destination property to true for all dynamic
destinations where their respective backend doesn’t handle CSRF protection.

If your backend is already protected, there’s no need to add this property.

sap-platform ABAP

sap-client The client number of the ABAP system. For example: 120

sap-sysid System ID of the SAP system (also referred to as SID). For example: QKY

launchpad.wa.productId, launch- To enable SAP Companion content (on-screen help) for the SAP S/4HANA apps
pad.wa.productVersion running on this system (destination), you need to configure the product and version
of the SAP Companion content that corresponds to the SAP S/4HANA apps. For
more information, see Activating SAP Companion Content.

Integrating Joule with SAP Solutions

40 PUBLIC Integration with SAP S/4HANA Cloud Private Edition
Property Value

sap-provider-label Add this property to provide a user-friendly display name for the system of a desti-
nation. This system label is used in various runtime features, such as:

• It can be displayed directly on each tile of an SAP S/4HANA app, if this setting
was enabled in the Site Settings.
• It is shown in the drop-down list of the search results (only when using the
Spaces and Page - New Experience view mode) and in the Search Results page.
• In the Source System field in the user Default Values option, located under the

User Actions menu - Settings Default Values .

• In the App Finder.

sap-service A concatenated string that contains 4 characters: the first 2 characters are “32”;
the last 2 characters are the instance number of the ABAP application server or the
SAP system number. For example: 3200

Runtime Destination for Dynamic Data

A dynamic tile displays data that is updated during runtime. To retrieve the dynamic data, it is necessary to
define an additional runtime destination for dynamic data. When defining a content provider in the Channel
Manager, the default value for the dynamic data destination is the same one as the default runtime destination.
However, you can select a different destination than the default one, if required.

Destination for Retrieving Nominations via the SAP Cloud Connector

Configure an additional destination (for example privatecloud) for retrieving nominations via the SAP Cloud
Connector, using the following values:

Field Value

Name privatecloud

Type HTTP

URL <Virtual host and port from SAP Cloud Connector>

ProxyType OnPremise

Authentication PrincipalPropagation

Location ID <ID of the SAP Cloud Connector, if configured>

Add the following additional properties with their values (case sensitive):

Property Value

HTML5.DynamicDestination true

nameIdFormat tc:SAML:1.1:nameid-format:emailAddress

Integrating Joule with SAP Solutions

Integration with SAP S/4HANA Cloud Private Edition PUBLIC 41
Property Value

sap-card-nominations-path /sap/opu/odata4/ui2/insights_srv/srvd/ui2/
insights_cards_read_srv/0001/CEP_Cards?
$expand=DescriptorResources

Create a Content Provider

In SAP Build Work Zone, standard edition, in theChannel Manager, define the SAP S/4HANA Private Cloud
system as content provider. For more information, see Manage Content Providers.

1. In the SAP BTP cockpit, log on to your subaccount as administrator.

2. In your subaccount, go to Instances and Subscriptions and launch SAP Build Work Zone, standard edition.
3. In SAP Build Work Zone, standard edition, go to Channel Manager.
4. Choose + New to add a new content provider.

Field Value

Title SAP S/4HANA Cloud Private Edition or any other meaningful

name

ID <A unique ID>

Design-Time Destination Select the design time destination

Runtime Destination Select the runtime destination

Runtime Destination for Dynamic Data The runtime destination for retrieving dynamic data to display on dynamic
tiles. By default, the default runtime destination is used.

Automatically add all content items to true

subaccount

Use the Identity Provisioning service to true

provision user authorizations

Include group and catalog assignments to Use this toggle switch depending on how the provider is modeled
roles
• Disable this feature to include all groups and catalogs in this site, with-
out considering their assignment to roles.
• Enable this feature to include only groups and catalogs in this site, that
have been directly assigned to roles.

For more information, see Defining Optional Relations Between Roles and
Groups/Catalogs.

A new row is added to the Content Channels table, with the status “Creating…”.

When the content provider is ready, the status changes to “Created”.

Click the Report link to see the number of roles, apps, groups, catalogs, spaces, pages, and URL templates that
are included in the content provider.

The content provider is now visible also in the Content Explorer.

Integrating Joule with SAP Solutions

42 PUBLIC Integration with SAP S/4HANA Cloud Private Edition
Single Sign-On Destination

• In the SAP BTP cockpit, log on to your subaccount for Joule as administrator.
• In the navigation area, choose Connectivity Destinations .

To create the destination, choose New Destination and enter the following information:

Property Description/Value

Name S4HANA_PCE_SSO

Type HTTP

Description Enter a description.

URL The URL of the Virtual Host of your Cloud Connector : https://
<host>:<port>

Proxy Type OnPremise

Authentication Principal Propagation is supported.

sap-client (additional property) The client number of the ABAP system.

9.4 Configure Identity Provisioning Service

Configure the Identity Provisioning service to provision identities and their authorizations to SAP Build Work
Zone, standard edition.

Procedure

1. In your SAP S/4HANA Cloud Private Edition system, open transaction SU01 and add the role
SAP_BC_JSF_COMMUNICATION_RO to the technical service user used for reading the content.

 Note

2. Go to your BTP Account and navigate to Instances and Subscriptions and subscribe to Cloud Identity
Services with plan connectivity.
3. Navigate to Connectivity Destinations , and create a new destination for the Identity Provisioning
integration.
For more information, see SAP Application Server ABAP.
The following tables contain as an example the values used for a connection with load balancing:

Field Value

Name Name of the destination

Integrating Joule with SAP Solutions

Integration with SAP S/4HANA Cloud Private Edition PUBLIC 43
Field Value

Type RFC

Description Enter a description

ProxyType OnPremise

User <Username of your SAP S/4HANA Cloud Private

Edition technical service user>

Password <Password of your SAP S/4HANA Cloud Private

Edition technical service user>

Authorization Type CONFIGURED_USER

Location ID <ID of the SAP Cloud Connector, if configured,

example DLM_MAIL>

Add the following additional properties with their values (case sensitive):

Property Value

jco.client.client <Client of your SAP S/4HANA Cloud Private

Edition system, example 950>

jco.client.mshost <Virtual host of your SAP Cloud Connector

configuration for Identity Provisioning service
integration, until the colon, example
uctclnt950rfc>

jco.client.r3name <System ID of your SAP S/4HANA Cloud Private

Edition system, example UCT>

4. Open your Identity Authentication service administrator console at: <IAS domain>/admin
5. Navigate to the Identity Provisioning section and open the Source Systems section.
6. Click + Add to add a new Source System:
1. Select SAP Application Server ABAP as the type.
2. Give the source system a meaningful name.
3. In the Transformations tab, click Edit, use the {..} button to switch to JSON mode, and paste the
following standard transformation:

 Source Code

{
"user": {
"mappings": [
{
"sourcePath": "$.USERNAME",
"targetVariable": "entityIdSourceSystem"
},
{
"sourcePath": "$.USERNAME",
"targetPath": "$.userName",
"correlationAttribute": true
},
{
"sourcePath": "$.ALIAS.USERALIAS",
"targetPath": "$.externalId",
"optional": true,

Integrating Joule with SAP Solutions

44 PUBLIC Integration with SAP S/4HANA Cloud Private Edition
"correlationAttribute": true
},
{
"sourcePath": "$.SAPUSER_UUID.SAP_UID",
"targetPath": "$
['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']",
"optional": true
},
{
"targetPath": "$.schemas[0]",
"constant": "urn:ietf:params:scim:schemas:core:2.0:User"
},
{
"sourcePath": "$.ADDRESS.E_MAIL",
"targetPath": "$.emails[0].value",
"optional": true,
"correlationAttribute": true
},
{
"targetPath": "$.emails[0].primary",
"condition": "$.ADDRESS.E_MAIL EMPTY false",
"constant": true
},
{
"targetPath": "$.emails[0].type",
"condition": "$.ADDRESS.E_MAIL EMPTY false",
"constant": "work"
},
{
"sourcePath": "$.ADDRESS.FIRSTNAME",
"targetPath": "$.name.givenName",
"optional": true
},
{
"sourcePath": "$.ADDRESS.LASTNAME",
"targetPath": "$.name.familyName"
},
{
"sourcePath": "$.ADDRESS.MIDDLENAME",
"targetPath": "$.name.middleName",
"optional": true
},
{
"sourcePath": "$.ADDRESS.NICKNAME",
"targetPath": "$.nickName",
"optional": true
},
{
"sourcePath": "$.ADDRESS.TITLE_P",
"targetPath": "$.name.honorificPrefix",
"optional": true
},
{
"sourcePath": "$.ADDRESS.COUNTRY",
"targetPath": "$.addresses[0].country",
"optional": true
},
{
"targetPath": "$.addresses[0].primary",
"condition": "$.ADDRESS.COUNTRY EMPTY false",
"constant": true
},
{
"targetPath": "$.addresses[0].type",
"condition": "$.ADDRESS.COUNTRY EMPTY false",
"constant": "work"
},
{

Integrating Joule with SAP Solutions

Integration with SAP S/4HANA Cloud Private Edition PUBLIC 45
"sourcePath": "$.ADDRESS.TEL1_NUMBR",
"targetPath": "$.phoneNumbers[0].value",
"optional": true
},
{
"targetPath": "$.phoneNumbers[0].primary",
"condition": "$.ADDRESS.TEL1_NUMBR EMPTY false",
"constant": true
},
{
"targetPath": "$.phoneNumbers[0].type",
"condition": "$.ADDRESS.TEL1_NUMBR EMPTY false",
"constant": "work"
},
{
"sourcePaths": ["$.DEFAULTS.LANGU"],
"targetPath": "$.locale",
"valueMappings": [
{
"key": ["W"],
"mappedValue": "bg"
}
],
"optional": true,
"type": "valueMapping",
"defaultValue": "en"
},
{
"sourcePaths": ["$.ADDRESS.LANGUP_ISO"],
"targetPath": "$.preferredLanguage",
"optional": true,
"type": "valueMapping",
"functions": [
{
"function": "toLowerCaseString"
}
]
},
{
"sourcePaths": ["$.LOGONDATA.TZONE"],
"targetPath": "$.timezone",
"valueMappings": [
{
"key": ["EET"],
"mappedValue": "Europe/Sofia"
}
],
"optional": true,
"type": "valueMapping",
"defaultValue": "Europe/Berlin"
},
{
"targetPath": "$.active",
"constant": false
},
{
"targetPath": "$.active",
"condition": "($.ISLOCKED.LOCAL_LOCK != 'L') &&
($.ISLOCKED.GLOB_LOCK != 'L') && ($.ISLOCKED.WRNG_LOGON != 'L')",
"constant": true
},
{
"sourcePath": "$.ACTIVITYGROUPS[*].AGR_NAME",
"targetPath": "$.groups[?(@.value)]",
"optional": true,
"preserveArrayWithSingleElement": true
}
]

Integrating Joule with SAP Solutions

46 PUBLIC Integration with SAP S/4HANA Cloud Private Edition
},
"group": {
"mappings": [
{
"sourcePath": "$.ROLE_NAME",
"targetVariable": "entityIdSourceSystem"
},
{
"sourcePath": "$.ROLE_NAME",
"targetPath": "$.displayName",
"functions": [
{
"function": "concatString",
"condition": "'%abap.role.prefix%' !== 'null'",
"prefix": "%abap.role.prefix%"
}
]
},
{
"targetPath": "$.schemas[0]",
"constant": "urn:ietf:params:scim:schemas:core:2.0:Group"
},
{
"sourcePath": "$.USERLIST[*].USERNAME",
"targetPath": "$.members[?(@.value)]",
"optional": true,
"preserveArrayWithSingleElement": true
}
]
}
}

7. Navigate to the Identity Provisioning section and open the Target Systems section.
8. Click + Add to add a new Target System:
1. Select SAP Build Work Zone, standard edition as the type.
2. Give the target system a meaningful name.
3. Select the source system you created.
4. In the Transformations tab, click Edit, use the {..} button to switch to JSON mode, and paste the
following standard transformation:

 Source Code

{
"user": {
"condition": "($.emails EMPTY false) && ($
['urn:ietf:params:scim:schemas:extension:sap:2.0:User'].userUuid EMPTY
false)",
"skipOperations": ["update"],
"mappings": [
{
"targetPath": "$.id",
"sourceVariable": "entityIdTargetSystem"
},
{
"targetPath": "$.schemas[0]",
"constant": "urn:ietf:params:scim:schemas:core:2.0:User"
},
{
"targetPath": "$
['urn:ietf:params:scim:schemas:extension:2.0:mapping']['providerId']",
"constant": "%cflp.providerId%"
},

Integrating Joule with SAP Solutions

Integration with SAP S/4HANA Cloud Private Edition PUBLIC 47
{
"sourcePath": "$.emails[0].value",
"targetPath": "$.emails[0].value",
"condition": "$.emails[?(@.primary == true)].value == []",
"optional": true
},
{
"sourcePath": "$.emails[?(@.primary == true)].value",
"targetPath": "$.emails[0].value",
"condition": "$.emails[?(@.primary == true)].value != []",
"optional": true,
"preserveArrayWithSingleElement": true,
"functions": [
{
"function": "elementAt",
"index": 0
}
]
},
{
"targetPath": "$.emails[0].primary",
"condition": "$.emails[0].length() > 0",
"constant": true
},
{
"sourcePath": "$
['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']",
"targetPath": "$.externalId",
"optional": true
},
{
"sourcePath": "$.groups[*].value",
"targetPath": "$.groups[?(@.value)]",
"optional": true,
"preserveArrayWithSingleElement": true,
"functions": [
{
"function": "resolveEntityIds",
"entityType": "group"
}
]
}
]
},
"group": {
"mappings": [
{
"targetPath": "$.id",
"sourceVariable": "entityIdTargetSystem"
},
{
"targetPath": "$
['urn:ietf:params:scim:schemas:extension:2.0:mapping']['providerId']",
"constant": "%cflp.providerId%"
},
{
"targetPath": "$.schemas[0]",
"constant": "urn:ietf:params:scim:schemas:core:2.0:Group"
},
{
"targetPath": "$.schemas[1]",
"constant": "urn:ietf:params:scim:schemas:core:2.0:mapping",
"optional": true
},
{
"sourcePath": "$.displayName",

Integrating Joule with SAP Solutions

48 PUBLIC Integration with SAP S/4HANA Cloud Private Edition
"targetPath": "$.externalId"
},
{
"sourcePath": "$.externalId",
"targetPath": "$.externalId",
"optional": true,
"functions": [
{
"function": "replaceAllString",
"regex": "(?i)(^pcd:)",
"replacement": ""
},
{
"function": "replaceString",
"target": "/",
"replacement": ":"
},
{
"function": "replaceString",
"target": "(",
"replacement": "@"
},
{
"function": "replaceString",
"target": ")",
"replacement": "+"
}
]
},
{
"sourcePath": "$.members[*].value",
"targetPath": "$.members[?(@.value)]",
"optional": true,
"preserveArrayWithSingleElement": true,
"functions": [
{
"function": "resolveEntityIds"
}
]
}
]
}
}

5. Open the Properties tab and add the following properties and their values:

Field Value

Authentication BasicAuthentication

cflp.group.unique.attribute externalId,
['urn:ietf:params:scim:schemas:extension:2.0:mapping
']['providerId']

cflp.patch.group.mem- 5000
bers.above.threshold

cflp.providerId <ID of the content provider you created in your SAP

Build Work Zone, standard edition tenant, e.g. S4_PC_UCT950>

cflp.user.unique.attribute emails[0].value,
['urn:ietf:params:scim:schemas:extension:2.0:mapping
']['providerId'],externalId

Integrating Joule with SAP Solutions

Integration with SAP S/4HANA Cloud Private Edition PUBLIC 49
Field Value

ips.trace.failed.entity.content false

OAuth2TokenServiceURL <Value of the UAA URL property of the SAP Build Work
Zone, standard edition service key you created + /oauth/
token>

Password <Value of the clientsecret property of the SAP Build

Work Zone, standard edition service key>

ProxyType Internet

Type HTTP

URL <Value of the portal-service property of the SAP Build

Work Zone, standard edition service key>

User <Value of the clientid property of the SAP Build Work

Zone, standard edition service key service key>

9. Navigate to the Identity Provisioning section and open the Source Systems section.
10. Select the source system you created for your SAP S/4HANA Cloud Private Edition tenant.
11. Open the Jobs tab.
12. Click Run Now for the Read Job to start the synchronization of your SAP S/4HANA Cloud Private Edition
users and roles with your SAP Build Work Zone, standard edition tenant.
13. Navigate to the Identity Provisioning section and open the Provisioning Logs section to see the logs and
status of your synchronization jobs.

You have now completed the setup of the Identity Provisioning service.

Users who have configured cards as visible in the Insights section of My Home in SAP S/4HANA Cloud, should
now be able to see their cards in the Insights section of SAP Build Work Zone, standard edition.

Related Information

Configure the Identity Provisioning Service

9.5 Configure and Activate Joule Plug-In in a Target

Mapping

Steps to configure and activate Joule plugin in SAP Fiori Launchpad.

You need to create a target mapping to activate the Joule plugin in the SAP Fiori Launchpad of your application.
As a prerequisite, you must create a business catalog. For more information, see Creating Catalogs.

Integrating Joule with SAP Solutions

50 PUBLIC Integration with SAP S/4HANA Cloud Private Edition
Procedure

Procedure

1. In the launchpad app manager (see e.g. Creating and Maintaining Launchpad App Descriptor Items),
create a target mapping with the intent Shell-plugin and the following configuration:

Field Value

Semantic Object Shell

Action plugin

Application Type SAP UI5 Fiori App

Title Joule

URL URL of the Joule application appended with /resources/public/

webclient/s4

ID sap.das.webclientplugin.s4

Information Optional: Enter a description of your plug-in.

Device Types Select the device or devices that are supported by your plug-in, e.g. desktop or
phone. The plug-in will only be shown on these selected devices.

Parameters Define parameters that you want to pass to the plug-in component by entering a
name and a default value for each parameter.

 Note

As target mappings with the intent Shell-plugin have a special meaning, they do
not appear in standard services such as the TargetMappings feed, resolveLink, or
getLinksForSemanticObjects.

2. In the launchpad content manager, assign the catalog to a role. See Adding and Removing Catalogs,
Groups and Spaces to/from Roles for detailed information.
3. If you have not already done this, assign the role to the respective users (see Assigning Users to Roles ).

Integrating Joule with SAP Solutions

Integration with SAP S/4HANA Cloud Private Edition PUBLIC 51
9.6 Constraints for Joule in SAP S/4HANA Cloud Private
Edition

In addition to the general Constraints for Joule [page 16], the following constraints apply for Joule in SAP
S/4HANA Cloud Private Edition:

• Joule is available for SAP S/4HANA Cloud Private Edition 2023 FPS01 or later.
• A Joule instance can be only connected to exactly one SAP S/4HANA system.
• Joule is available for SAP S/4HANA Cloud Private Edition only within Rise with SAP .
• You can enable Joule for SAP S/4HANA Cloud Private Edition only in an SAP managed data center setup.

Integrating Joule with SAP Solutions

52 PUBLIC Integration with SAP S/4HANA Cloud Private Edition
10 Integration with SAP S/4HANA Cloud
Public Edition

This section describes the steps on how to integrate Joule with the technical product SAP S/4HANA Cloud
Public Edition. These steps comprise the Joule-specific and product-specific prerequisites and depend on your
initial system setup. For example, you must first set up the technical environment, such as the SAP Business
Technology Platform (BTP) with the entitlements for Joule and SAP Build Work Zone, standard edition
(foundation/standard plan). You are guided through the integration steps with instructions, for example, you
run the Joule booster that - among other settings - enables the communication scenario SAP_COM_0882 (SAP
Digital Assistant Services) in the background.

 Note

SAP S/4HANA Cloud Public Edition refers to an offering that includes the technical product SAP S/4HANA
Cloud Public Edition as the main component and a large variety of surrounding services. The integration
described here is between Joule and the technical product SAP S/4HANA Cloud Public Edition.

 Note

To access Joule within SAP S/4HANA Cloud Public Edition, an additional entitlement and authorization
may be required. Please consult your account executive for more information.

Prerequisites

• You fulfill the general Prerequisites [page 7] for Joule.

• You have reviewed the Initial Setup [page 6] for Joule and have carried out the necessary steps.
• You checked the Joule-specific information regarding Security.
• You are aware of the Constraints for Joule in SAP S/4HANA Cloud Public Edition [page 69].

 Recommendation

If you have used SAP CoPilot Digital Assistant in the past, we recommend to request its deactivation
(CoPilot Operations (MOB-UIA-CP-OP)) before setting up Joule. However, you can continue using SAP
CoPilot Collaboration (human to human chat and collaboration capabilities of SAP CoPilot).

This recommendation is relevant for 2-system landscape only. For more information, see System
Landscapes in SAP S/4HANA Cloud.

Integration Steps

To integrate Joule with SAP S/4HANA Cloud Public Edition, you must carry out the following steps:

Integrating Joule with SAP Solutions

Integration with SAP S/4HANA Cloud Public Edition PUBLIC 53
1. Set Up the Connection Between SAP S/4HANA Cloud Public Edition and the Large Language Model [page
54] (specific for SAP S/4HANA Cloud Public Edition)
2. Expose the SAP Fiori Launchpad Content to SAP BTP [page 55] (specific for SAP S/4HANA Cloud Public
Edition)
3. Configure Trust to the Identity Authentication Tenant [page 10]
4. Configure User Attributes for Joule from the Identity Directory [page 11]
5. Register the SAP S/4HANA Cloud Public Edition System [page 56] (specific for SAP S/4HANA Cloud
Public Edition)
6. Create SAP Build Work Zone Application and Instance [page 21]
7. Run the Joule Booster [page 12]
8. Configure Identity Provisioning Service [page 56] (specific for SAP S/4HANA Cloud Public Edition)
9. Configure Trusted Domain in SAP BTP [page 16]
10. Configure Trusted Domains in Identity Authentication [page 15]
11. Maintain Custom Content Security Policy [page 69] (specific for SAP S/4HANA Cloud Public Edition)
12. Set Up Document Grounding [page 73]

Related Information

Integrating With SAP Build Work Zone, Standard Edition

10.1 Set Up the Connection Between SAP S/4HANA Cloud

Public Edition and the Large Language Model

Here's how to connect your SAP S/4HANA Cloud Public Edition system to the large language model. Because
SAP's Business AI scenarios rely on multiple large language models, you need to complete this configuration
process in any system or client in which you intend to use SAP Business AI features.

1. Open the Intelligent Scenario Mangement app. For this, you need a user with the same minimum
authorizations as the Analytics Specialist (SAP_BR_ANALYTICS_SPECIALIST) business role template.
2. Enter “GPT35T_COMPLETION" in the Intelligent Scenario field. In the results table, verify that
GPT35T_COMPLETION scenario show Published in the Status field.

 Note

If the Status column for the scenario shows any result other than published, this means that there's a
problem that needs to be corrected before you can proceed. Please create an incident for component
BC-SRV-APS-AI-UIS.

3. Open the scenario entry.

4. Choose the model that you want to complete and open it.
5. Choose Deployments.
If the Status column shows Deployed and the Active column shows Active for all, then the scenario is
completely configured, and you don't need to continue.

Integrating Joule with SAP Solutions

54 PUBLIC Integration with SAP S/4HANA Cloud Public Edition
6. Otherwise, choose Trainings and click the Deploy button.

 Note

If the training isn't completed, then there's a problem that needs to be corrected before you can
continue. Please create an incident for component BC-SRV-APS-AI-UIS.

7. In the Deployment Details section, enter a deployment description in that field. Then enter latest in the
modelVersion parameter field.

 Remember

The Deployment Description field is alphanumeric and allows for some special characters, but you
cannot include spaces, ampersands (&), pound sign/hashtags (#), or percentage signs (%) in this
field.

8. Click the Deploy button.

9. Select the Deployments tab. This shows you the status of your deployments.
10. When the deployment status changes to Deployed, select the deployment and then select Active for all
from the dropdown menu under the Activate button.

Result

The connection between SAP S/4HANA Cloud Public Edition and the large language model is finished.

10.2 Expose the SAP Fiori Launchpad Content to SAP BTP

To set up the content exposure flow, the Joule booster created a communication arrangement in
the Communication Arrangements app, and a communication system for the communication scenario
SAP_COM_0647 (Launchpad Content Exposure to SAP BTP Integration). In most cases, you set the Exposure
Role Selection to ALL (All Roles with SAP Fiori Launchpad Content). For more information, see Expose
Launchpad Content to SAP BTP.

However, if you would like to expose individual business roles to SAP BTP and have therefore set the Exposure
Role Selection to SELECTION (Selected Roles in “Maintain Business Roles” Application), you must expose your
roles as follows:

1. In the SAP S/4HANA Cloud Public Edition system, log on to the SAP Fiori Launchpad as administrator.
2. Open the Maintain Business Roles app.
3. Identify the business roles that your are using.
For more information about business roles in SAP S/4HANA Cloud Public Edition, see Business Roles,
Business Catalogs and Restrictions.
4. Open each role and select Exposed to SAP BTP. For more information about mass changes, see How to
Select Business Roles for Exposure.
5. Confirm the dialog box that displays.

Integrating Joule with SAP Solutions

Integration with SAP S/4HANA Cloud Public Edition PUBLIC 55
6. The Exposed to SAP BTP entry indicates that the role you selected is exposed.
7. The content is ready to be consumed by SAP Build Work Zone, standard edition. To look at the exposure
log, open the application log in the Display Launchpad Content Exposure Logs tile.

10.3 Register the SAP S/4HANA Cloud Public Edition

System

Procedure

1. In the SAP BTP cockpit, navigate to your global account, and then choose System Landscape
Systems .
2. On the Systems page, choose Add System. In the Add System wizard do the following:
a. Enter a name for the system you want to register.
b. In the Type dropdown list, select the system type.
c. Choose Add.
d. Select All Communication Scenarios in the Communication Scenario Groups dropdown menu.
e. Choose Get Token.

The system generates the registration token.

f. Copy the registration token. You need the token to complete the integration on the respective SAP
solution system side.
g. Close the wizard.

3. Go to your SAP S/4HANA Cloud Public Edition system. Open the Communication Management
Maintain BTP Extension app.
4. Choose New and add the token fetched from the SAP BTP cockpit as mentioned in the step 2.
5. The status of the system is set as Enabled once you add the token.
6. Go back to SAP BTP Cockpit and verify if the status of the system is set as Registered.

10.4 Configure Identity Provisioning Service

Navigation service of SAP Build Work Zone, standard edition service uses Identity Provisioning service (IPS)
that is used to provision identities and their authorizations between source and target systems.

This section describes the steps to configure the source system (SAP S/4HANA Cloud Public Edition) and
target systems (Identity Authentication and SAP Build Work Zone, standard edition) in the Identity Provisioning
of your IAS application user interface.

The following configurations are required to provision:

1. User details like user email, Global User ID and group memberships from SAP S/4HANA Cloud Public
Edition to SAP Build Work Zone, standard edition.

Integrating Joule with SAP Solutions

56 PUBLIC Integration with SAP S/4HANA Cloud Public Edition
2. User roles as groups from SAP S/4HANA Cloud Public Edition (source system) to SAP Build Work Zone,
standard edition with role ID as external ID and group memberships.

 Note

You must have the administrative access to your Identity Provisioning tenant and you need to enable the
Manage Identity Provisioning role for your user. For more information, see Manage Authorizations in SAP
Cloud Identity Infrastructure.

You must have created the communication scenario and communication users for the communication
arrangement SAP_COM_0193. For more information, see SAP Cloud Identity Services.

Configure Source System

1. Login to your Identity Authentication tenant.

2. Navigate to Identity Provisioning Source System .
3. Add SAP S/4HANA Cloud Public Edition as a source system. For more information, see Add New Systems.
4. Under the Properties tab, configure the connection settings for your system and add or confirm if the
following properties are available.

Property Name Value

Type HTTP

URL Enter the SAP S/4HANA Cloud Public Edition API URL.

You can find the correct URL in the API-URL field of the
communication arrangement set up for communication
scenario SAP_COM_0193.

For example: https://my123456-

api.s4hana.ondemand.com or https://
my123456-api.s4hana.cloud.sap.

ProxyType Internet

Authentication Enter your authentication method:

BasicAuthentication

User Enter the user name from the communication arrange-

ment SAP_COM_0193

 Caution
Do not use special symbol ',' (comma) as it is not
supported.

Integrating Joule with SAP Solutions

Integration with SAP S/4HANA Cloud Public Edition PUBLIC 57
Property Name Value

Password Enter the password for the user name from the communi-
cation arrangement SAP_COM_0193

 Caution
Do not use special symbol ',' (comma) as it is not
supported.

s4hana.cloud.skip.read.archived In the event of archived (disabled) entities in the source

system SAP S/4HANA Cloud Public Edition, choose
whether the provisioning jobs to continue reading such
entities or to skip them.

This property is enabled by default. If you want to always

read disabled entities, set the property to false, or de-
lete it.

ips.date.variable.format yyyy-MM-dd

s4hana.cloud.api.version 1

This means your SAP S/4HANA Cloud Public Edition sys-

tem uses SAP_COM_0193 communication arrangement.

ips.trace.skipped.entity.content true

ips.trace.failed.entity.content true

5. Configure the transformations. Transformations are used to map the user attributes from the data model
of the source system to the data model of the target system, and the other way around. The Identity
Provisioning offers a default transformation for the SAP S/4HANA Cloud Public Edition source system,
whose settings are displayed under the Transformations tab after saving its initial configuration.
You can change the default transformation mapping rules depending on your setup of entities in your SAP
S/4HANA Cloud Public Edition system.

 Sample Code

{
"user": {
"condition": "($.user.validityPeriod.startDate <= '${currentDate}')
&& ($.user.validityPeriod.endDate > '${currentDate}')",
"mappings": [
{
"sourcePath": "$.personID",
"targetVariable": "entityIdSourceSystem"
},
{
"sourcePath": "$.personalInformation.firstName",
"targetPath": "$.name.givenName",
"optional": true
},
{
"sourcePath": "$.personalInformation.lastName",
"targetPath": "$.name.familyName",
"optional": true

Integrating Joule with SAP Solutions

58 PUBLIC Integration with SAP S/4HANA Cloud Public Edition
},
{
"sourcePath": "$.personalInformation.middleName",
"targetPath": "$.name.middleName",
"optional": true
},
{
"sourcePath": "$.personalInformation.personFullName",
"targetPath": "$.name.formatted",
"optional": true
},
{
"sourcePath": "$.user.userName",
"targetPath": "$.userName",
"optional": true,
"correlationAttribute": true
},
{
"constant": true,
"targetPath": "$.active"
},
{
"condition": "$.user.lockedIndicator == 'true'",
"constant": false,
"targetPath": "$.active",
"optional": true
},
{
"sourcePath": "$.workplaceInformation.emailAddress",
"targetPath": "$.emails[0].value",
"optional": true,
"correlationAttribute": true
},
{
"sourcePath": "$.user.logonLanguageCode",
"optional": true,
"targetPath": "$.locale"
},
{
"sourcePath": "$.PersonExternalID",
"optional": true,
"correlationAttribute": true
},
{
"sourcePath": "$.user.globalUserID",
"optional": true,
"targetPath": "$
['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']"
},
{
"sourcePath": "$.user.role",
"targetPath": "$.groups",
"preserveArrayWithSingleElement": true,
"functions": [
{
"condition": "'%s4hana.cloud.roles.prefix%' !==
'null'",
"function": "concatString",
"applyOnElements": true,
"prefix": "%s4hana.cloud.roles.prefix%",
"applyOnAttribute": "roleName",
"assignToAttribute": "display"
},
{
"condition": "'%s4hana.cloud.roles.prefix%' ===
'null'",
"function": "concatString",
"applyOnElements": true,

Integrating Joule with SAP Solutions

Integration with SAP S/4HANA Cloud Public Edition PUBLIC 59
"prefix": "",
"applyOnAttribute": "roleName",
"assignToAttribute": "display"
},
{
"function": "concatString",
"applyOnElements": true,
"prefix": "",
"applyOnAttribute": "roleName",
"assignToAttribute": "value"
}
]
},
{
"type": "remove",
"targetPath": "$.groups[*].roleName"
},
{
"type": "valueMapping",
"sourcePaths": [
"$.user.timeZoneCode"
],
"targetPath": "$.timezone",
"defaultValue": "Europe/Berlin",
"valueMappings": [
{
"key": [
"WDFT"
],
"mappedValue": "Europe/Berlin"
},
{
"key": [
"ISRAEL"
],
"mappedValue": "Asia/Jerusalem"
},
{
"key": [
"RUS03"
],
"mappedValue": "Europe/Moscow"
},
{
"key": [
"AUSNSW"
],
"mappedValue": "Australia/Sydney"
},
{
"key": [
"UTC+4"
],
"mappedValue": "Asia/Dubai"
},
{
"key": [
"BRAZIL"
],
"mappedValue": "America/Sao_Paulo"
},
{
"key": [
"BRZLEA"
],
"mappedValue": "America/Sao_Paulo"
},
{

Integrating Joule with SAP Solutions

60 PUBLIC Integration with SAP S/4HANA Cloud Public Edition
"key": [
"MSTNO"
],
"mappedValue": "America/Phoenix"
},
{
"key": [
"EST"
],
"mappedValue": "America/New_York"
},
{
"key": [
"UTC"
],
"mappedValue": "Etc/UTC"
},
{
"key": [
"UTC+3"
],
"mappedValue": "Asia/Riyadh"
},
{
"key": [
"EST_"
],
"mappedValue": "America/Toronto"
},
{
"key": [
"UTC+8"
],
"mappedValue": "Asia/Shanghai"
},
{
"key": [
"JAPAN"
],
"mappedValue": "Asia/Tokyo"
}
]
},
{
"type": "valueMapping",
"sourcePaths": [
"$.businessPartnerRoleCode"
],
"targetPath": "$.userType",
"defaultValue": "Employee",
"valueMappings": [
{
"key": [
"BUP003"
],
"mappedValue": "Employee"
},
{
"key": [
"BBP005"
],
"mappedValue": "Contingent Worker"
}
]
}
]
},
"group": {

Integrating Joule with SAP Solutions

Integration with SAP S/4HANA Cloud Public Edition PUBLIC 61
"mappings": [
{
"sourcePath": "$.ID",
"targetPath": "$.displayName",
"targetVariable": "entityIdSourceSystem",
"functions": [
{
"condition": "'%s4hana.cloud.roles.prefix%' !==
'null'",
"function": "concatString",
"prefix": "%s4hana.cloud.roles.prefix%"
}
]
},
{
"constant": "urn:ietf:params:scim:schemas:core:2.0:Group",
"targetPath": "$.schemas[0]"
},
{
"sourcePath": "$.to_BusinessUserAssignment.results",
"optional": true,
"preserveArrayWithSingleElement": true,
"targetPath": "$.members"
},
{
"type": "remove",
"targetPath": "$.members[*].__metadata"
},
{
"type": "remove",
"targetPath": "$.members[*].UserName"
},
{
"type": "rename",
"constant": "value",
"targetPath": "$.members[*].PersonID"
},
{
"constant": "User",
"targetPath": "$.members[*].type"
}
]
}
}

Configure Target System

1. Navigate to Identity Provisioning Target System .

2. Add SAP Build Work Zone, standard edition as a target system. For more information, see Add New
Systems.
3. Select SAP S/4HANA Cloud Public Edition as the Source system (that you configured in the previous step),
whose identities you want to read and provision to the target one.
4. Choose the Properties tab to configure the connection settings for your system:

Property Name Value

Type HTTP

Integrating Joule with SAP Solutions

62 PUBLIC Integration with SAP S/4HANA Cloud Public Edition
Property Name Value

URL Enter the API URL of SAP Build Work Zone, standard
edition from the service key of your SAP Build Work
Zone, standard edition instance under endpoints [por-
tal-service]. It follows the pattern: https://portal-
service.cfapps.sap.hana.ondemand.com

ProxyType Internet

Authentication BasicAuthentication

User Enter the OAuth Client Id, from the service key of your
SAP Build Work Zone, standard edition instance under
uaa.clientid.

Password (Credential) Enter the OAuth Client Secret, from the serv-
ice key of your SAP Build Work Zone, standard edition
instance under uaa.clientsecret.

OAuth2TokenServiceURL Enter the OAuth 2.0 Token Service URL from the serv-
ice key of your SAP Build Work Zone, standard edition
instance. It follows the pattern: <uaa.url>/oauth/
token.

For example: https://ips-cflp-

woaealle.authentication.sap.hana.ondema
nd.com/oauth/token

cflp.providerId Enter a valid provider ID value.

The provider ID is specified in the Channel Manager of the

SAP Build Work Zone, standard edition when defining a
new content provider.

ips.failed.request.retry.attempts 2

ips.failed.request.retry.attempts.interval 50

ips.trace.failed.entity.content true

xsuaa.user.unique.attribute userName,origin

xsuaa.origin sap.custom

Integrating Joule with SAP Solutions

Integration with SAP S/4HANA Cloud Public Edition PUBLIC 63
Property Name Value

cflp.user.unique.attribute If Identity Provisioning tries to provision a user that al-

ready exists in the target system (a conflicting user), this
property defines the unique attributes by which the exist-
ing user will be searched and resolved.

SAP Build Work Zone, standard edition supports the fol-

lowing unique attributes which are automatically filled in
when the target system is added in the service UI:

emails[0].value,
['urn:ietf:params:scim:schemas:extensio
n:2.0:mapping']
['providerId'],externalId
• If the user has an externalId, the conflict is re-
solved by externalId and providerId.
• If the user doesn't have an externalId, the con-
flict is resolved by email and providerId.

For the conflict to be resolved, an existing user matching

both unique attributes should be found. If an existing user
doesn't match both unique attributes or matches only one
of them, the user creation fails.

 Tip
We recommend that you do not modify the value of
the cflp.user.unique.attribute property.
Otherwise, user creation fails.

Integrating Joule with SAP Solutions

64 PUBLIC Integration with SAP S/4HANA Cloud Public Edition
Property Name Value

cflp.group.unique.attribute If Identity Provisioning tries to provision a group that al-

ready exists in the target system (a conflicting group),
this property defines the unique attributes by which the
existing group will be searched and resolved.

SAP Build Work Zone, standard edition supports a pair of

unique attributes which is automatically filled in when the
target system is added in the service UI:

externalId,
['urn:ietf:params:scim:schemas:extensio
n:2.0:mapping']['providerId']
For the conflict to be resolved, an existing group match-
ing both unique attributes should be found. In this case,
Identity Provisioning updates the group. This means, the
conflicting group overwrites the existing one. If the group
matches only one of the unique attributes, the conflict is
not resolved, and the group creation fails.

 Tip
We recommend that you do not modify the value of
the cflp.user.unique.attribute property.
Otherwise, user creation fails.

Integrating Joule with SAP Solutions

Integration with SAP S/4HANA Cloud Public Edition PUBLIC 65
Property Name Value

cflp.support.bulk.operation This property enables bulk operations for users and

groups.

When the property is enabled (set to true), the following

operations can be executed by Identity Provisioning serv-
ice in a single request:

• Create or delete multiple users

• Create, update, or delete multiple groups

When the property is disabled (set to false), the following

operations can be executed by Identity Provisioning serv-
ice for a single entity at a time:

• Create or delete a user

• Create, update, or delete a group

 Note
Update operation is skipped for users in the default
write transformation.

Possible values:

• true
• false

Default value: false

cflp.bulk.operations.max.count If you have enabled the bulk operations, you can use
this property to set the number of operations to be provi-
sioned per request.

Possible values:

Default value: 20

Maximum value: 100

If you enter a number larger than 100, the service will

replace it with the default value (20).

(Optional) ips.delete.threshold.groups Use this property to control the number of groups to be

deleted in a target system by defining a threshold. This will
prevent you from accidentally deleting a huge number of
groups, for example by adding a filter or condition.

For more information, see List of Properties

(Optional) ips.delete.threshold.users Use this property to control the number of users to be

deleted in a target system by defining a threshold. This will
prevent you from accidentally deleting a huge number of
users, for example by adding a filter or condition.

For more information, see List of Properties

Integrating Joule with SAP Solutions

66 PUBLIC Integration with SAP S/4HANA Cloud Public Edition
5. From the left panel and go to the Transformations tab. You can switch to the JSON editor by choosing
the code-bracket icon. Transformations are used to map user and group attributes from the data model
of the source system to the data model of the target system, and the other way around. The Identity
Provisioning offers a default transformation for the SAP Build Work Zone, standard edition target system,
whose settings are displayed under the Transformations tab after saving its initial configuration.

 Sample Code

{
"user": {
"skipOperations": [
"update"
],
"mappings": [
{
"sourceVariable": "entityIdTargetSystem",
"targetPath": "$.id"
},
{
"constant": "urn:ietf:params:scim:schemas:core:2.0:User",
"targetPath": "$.schemas[0]"
},
{
"constant": "%cflp.providerId%",
"targetPath": "$
['urn:ietf:params:scim:schemas:extension:2.0:mapping']['providerId']"
},
{
"condition": "$.emails[?(@.primary == true)].value == []",
"sourcePath": "$.emails[0].value",
"optional": true,
"targetPath": "$.emails[0].value"
},
{
"condition": "$.emails[?(@.primary == true)].value != []",
"sourcePath": "$.emails[?(@.primary == true)].value",
"preserveArrayWithSingleElement": true,
"optional": true,
"targetPath": "$.emails[0].value",
"functions": [
{
"function": "elementAt",
"index": 0
}
]
},
{
"condition": "$.emails[0].length() > 0",
"constant": true,
"targetPath": "$.emails[0].primary"
},
{
"sourcePath": "$
['urn:ietf:params:scim:schemas:extension:sap:2.0:User']['userUuid']",
"optional": true,
"targetPath": "$.externalId"
},
{
"sourcePath": "$.groups[*].value",
"preserveArrayWithSingleElement": true,
"optional": true,
"targetPath": "$.groups[?(@.value)]",
"functions": [
{
"entityType": "group",

Integrating Joule with SAP Solutions

Integration with SAP S/4HANA Cloud Public Edition PUBLIC 67
"function": "resolveEntityIds"
}
]
}
]
},
"group": {
"mappings": [
{
"sourceVariable": "entityIdTargetSystem",
"targetPath": "$.id"
},
{
"constant": "%cflp.providerId%",
"targetPath": "$
['urn:ietf:params:scim:schemas:extension:2.0:mapping']['providerId']"
},
{
"constant": "urn:ietf:params:scim:schemas:core:2.0:Group",
"targetPath": "$.schemas[0]"
},
{
"constant": "urn:ietf:params:scim:schemas:core:2.0:mapping",
"optional": true,
"targetPath": "$.schemas[1]"
},
{
"sourcePath": "$.displayName",
"optional": true,
"targetPath": "$.externalId"
},
{
"sourcePath": "$.externalId",
"optional": true,
"targetPath": "$.externalId",
"functions": [
{
"function":"replaceAllString",
"regex":"(?i)(^pcd:)",
"replacement":""
},
{
"function": "replaceString",
"target": "/",
"replacement": ":"
},
{
"function": "replaceString",
"target": "(",
"replacement": "@"
},
{
"function": "replaceString",
"target": ")",
"replacement": "+"
}
]
},
{
"sourcePath": "$.members[*].value",
"preserveArrayWithSingleElement": true,
"optional": true,
"targetPath": "$.members[?(@.value)]",
"functions": [
{
"function": "resolveEntityIds"
}
]

Integrating Joule with SAP Solutions

68 PUBLIC Integration with SAP S/4HANA Cloud Public Edition
}
]
}
}

Run Replication in IPS

In order to replicate content from SAP S/4HANA Cloud Public Edition system to the content provider in
SAP Build Work Zone standard edition, you must run the provisioning job from the Identity Provisioning user
interface (UI).

1. Under Source Systems, select your source system for SAP S/4HANA Cloud Public Edition. Choose Jobs
Read Job Run Now .
2. Choose Resync and choose Run Now.

 Note

It is recommended to schedule the Read Job once every twenty four hours.

10.5 Maintain Custom Content Security Policy

Maintain a custom content security policy to enable loading the plugin script as cross-origin resource.

1. Open Manage Content Security Policy app, click Trusted Sites and navigate to details for Resources Scripts.
2. Click New in Managed by Customer section.
3. Enter the URL of your Joule tenant under Trusted Content and choose Save.

10.6 Constraints for Joule in SAP S/4HANA Cloud Public

Edition

In addition to the general Constraints for Joule [page 16], the following constraints apply for Joule in SAP
S/4HANA Cloud Public Edition:

• Joule does not cover the full set of globalization support as SAP S/4HANA Cloud Public Edition. For now,
you can converse with Joule in English (EN).
• Joule is not designed to process personal data or sensitive data. You must not add any personal sensitive
data in Joule. For more information, see Data Protection and Privacy.
• Joule is designed to work with one SAP S/4HANA Cloud Public Edition instance only.
• To use single log-out (SLO) for Joule with SAP S/4HANA Cloud Public Edition, you need to configured
(SLO). For more information, see Authentication of Requests.

Integrating Joule with SAP Solutions

Integration with SAP S/4HANA Cloud Public Edition PUBLIC 69
• In the Joule booster, when you enable Joule in the system, Joule is enabled for all users.

Since Joule Web Client is embedded via iFrame, it requires support for iFrame and 3rd-party cookies. This
implies the following technical constraints:

• Blocking of iFrame from Joule domains (*.cloud.sap) and IAS domains must be disabled in the browser
settings, either by default or by policy. See Supported Browsers for details.
• Single Sign-On (SSO) relies on an a shared session with IAS used by SAP S/4HANA Cloud Public Edition
instance and Joule instance. Thus, IAS must not be configured to force authentication with the Corporate
IdP for each authentication if IAS is configured as a proxy IdP.

Other technical constraints:

• Rate limits for BTP apply.

• Rate limit for Joule is 3000 requests per minute per tenant.
• Restrictions for SAP Build Work Zone, standard edition with SAP S/4HANA Cloud Public Edition apply. For
more information, see 3075638 .
• If SAP Build Work Zone, standard edition is not already used, Joule uses SAP Build Work Zone, standard
edition with foundation plan for navigational scenarios. This implies that Identity Provisioning Service (IPS)
is enabled and will be configured for user assignment to the navigation content.

Integrating Joule with SAP Solutions

70 PUBLIC Integration with SAP S/4HANA Cloud Public Edition
11 Integration with SAP Product Lifecycle
Management

SAP Product Lifecycle Management is a cloud solution that enables you to digitally orchestrate your product
development from design to operate, resulting in reduced time to market, higher R&D return on investment,
higher margins, and reliable product launches.

With Joule, business users have conversational access to the SAP Product Lifecycle Management product
documentation on the SAP Help Portal from within the SAP Fiori apps that are delivered for the different SaaS
applications. For more information about supported scope and setting up Joule for SAP Product Lifecycle
Management, see 3503056 .

Integrating Joule with SAP Solutions

Integration with SAP Product Lifecycle Management PUBLIC 71
12 Integration with SAP Integrated Business
Planning for Supply Chain

SAP Integrated Business Planning for Supply Chain (SAP IBP) combines supply chain monitoring, sales and
operations planning, demand management, inventory planning, and supply planning into a comprehensive
solution.

With Joule, business users have conversational access to the SAP IBP product documentation on SAP Help
Portal from within the SAP IBP apps. For more information about supported scope and setting up Joule for SAP
IBP, see SAP Note 3497247 .

Integrating Joule with SAP Solutions

72 PUBLIC Integration with SAP Integrated Business Planning for Supply Chain
13 Set Up Document Grounding

The document grounding capability uses information gathered from documents that you upload to the service
to add context to Joule answers. To make this optional capability available, first complete the integration steps
between Joule and the SAP solution that you want to use to consume Joule. Then, set up document grounding
as described here.

For now, the scope of the document grounding capability is as follows:

• Data repository: Microsoft SharePoint (You can upload a maximum of 2000 documents to the service.)
• Document (file) format:
• HTML (Static)
• JPEG
• JPG
• Microsoft Word
• PDF
• PNG
• TIFF
• Document content: Plain text and images (Tables aren’t currently supported.)
• Content refresh: SharePoint content updated once every day

Before triggering the configuration process, make sure that you’ve done the following for your global account
and subaccount:

• You’ve purchased the AI Unit SKU (8018592) and AI units. After you’ve done so, the entitlements for
document grounding are automatically added to your global account. For more information, contact your
account executive.
• You’ve added the entitlements for document grounding to the subaccount where you’ve subscribed to
Joule. For more information, see Managing Entitlements and Quotas Using the Cockpit.
• You’ve enabled Identity Authentication. For more information, see What Are Cloud Identity Services?.

 Caution

The document grounding capability has no mechanism for determining the type of data that it processes.
The capability therefore can’t determine whether this data includes personal data, which is subject to the
data protection laws applicable in specific countries/regions.

Any ingested documents are available to all Joule business users in the given Joule tenant. We therefore
recommend that you don’t expose confidential or other privileged documents.

 Note

For now, the response from Joule doesn't take context information into consideration, for example, user
location and user permission.

The configuration process involves the following steps:

• Configure User Authentication [page 74]

Integrating Joule with SAP Solutions

Set Up Document Grounding PUBLIC 73
• Prepare SharePoint Integration [page 77]
• Configure Access from SAP BTP [page 77]
• Set Up Content Ingestion [page 78]

See also the blog post Getting Started with Document Grounding for Your SAP SFSF .

Related Information

Metering and Pricing [page 79]

13.1 Configure User Authentication

Configure user authentication and access the document grounding capability.

To access the document grounding capability, complete the following configuration steps:

1. Open the SAP BTP cockpit and go to the subaccount where you’ve subscribed to Joule.
2. Navigate to Services Service Marketplace .
3. Search for document grounding and choose the tile.
4. Choose Create.
5. Choose Other as Runtime Environment. Enter an Instance Name, copy it, and paste it into a text editor.
You need the instance name in step 12.
Choose Create.
6. Choose View Instance.
7. Select the instance and create a service binding. Enter a Service Binding Name.
8. Choose Create. Once the service binding is created, choose its name to display the details. Copy the
service binding URL and paste it into a text editor.
You need this URL in step 21.
9. Again, navigate to Services Service Marketplace .
10. Search for Cloud Identity Services and choose the tile.
11. Choose Create.
Choose application as Plan and Other as Runtime Environment. Enter an Instance Name.
Choose Next.
12. In Parameters, enter the following parameter, using the Instance Name that you created for document
grounding in step 5 as the "service-instance-name" value:

{
"consumed-services":[
{
"service-instance-name":"<doc-grounding-instance-name>"
}
]
}

13. Choose Create.

Integrating Joule with SAP Solutions

74 PUBLIC Set Up Document Grounding
14. Choose View Instance.
15. Select the instance and create a service binding. Enter a Service Binding Name and the following
parameters:

{
"credential-type": "X509_GENERATED",
"validity": 365,
"validity-type": "DAYS"
}

 Remember

SAP Cloud Identity Services triggers an automatic e-mail when the certificate is nearing its expiration
date. To generate the new certificate, re-create the service binding.

16. Choose Create.

17. Once the service binding is created, choose its name to display the details.
18. Copy the values for "clientid" and "authorization_endpoint" from the service binding and paste them into a
text editor.

 Note

Edit the "authorization_endpoint" value by replacing the ending .../oauth2/authorize with .../oauth2/
token.

You need the values for "clientid" and "authorization_endpoint" in step 20.
19. Create two files (for example, doc-grounding.crt and doc-grounding.key) using the service binding
values for "certificate" and "key". The files can have any name.

 Note

The service binding values are generated with the characters "\n" representing new lines, instead of
actual line breaks. To use the doc-grounding.crt and doc-grounding.key files, convert the "\n"
characters into real line breaks. You can do so either manually, replacing each "\n" with a line break, or
using a bash function, as in the following examples:

For MacOS:

sed 's/\\n/\n/g' doc-grounding.crt > temp.crt && mv temp.crt doc-

grounding.crt

sed 's/\\n/\n/g' doc-grounding.key > temp.key && mv temp.key doc-

grounding.key

For Windows PowerShell:

(Get-Content -Path doc-grounding.crt -Raw) -replace '\\n', "`n" |

Set-Content -Path temp.crt; Move-Item -Path temp.crt -Destination doc-
grounding.crt -Force

(Get-Content -Path doc-grounding.key -Raw) -replace '\\n', "`n" |

Set-Content -Path temp.key; Move-Item -Path temp.key -Destination doc-
grounding.key -Force

Integrating Joule with SAP Solutions

Set Up Document Grounding PUBLIC 75
20.To get a token, submit the following request in the same folder you downloaded the doc-grounding.crt
and doc-grounding.key files:

curl \
--request POST \
--url <edited_authorization_endpoint> \
--header 'accept: application/json' \
--header 'content-type: application/x-www-form-urlencoded' \
--data 'client_id=<clientid>' \
--data 'grant_type=client_credentials' \
--cert <file_with_certificate> \
--key <file_with_key>

Placeholder Description

<edited_authorization_endpoint> The "authorization_endpoint" value that you obtained in

step 18, edited as described in step 18

<clientid> The "clientid" value that you obtained in step 18

<file_with_certificate> The doc-grounding.crt file, edited with line breaks

as described in step 19

<file_with_key> The doc-grounding.key file, edited with line breaks

as described in step 19

You should receive a response like the following:

{
"access_token":"eyJq........LI-L8KsOQV593dmtPU1g",
"token_type":"Bearer",
"expires_in":3600
}

 Note

You need the token to Set Up Content Ingestion [page 78].

21. Use the service binding URL, the token, and the doc-grounding.crt and doc-grounding.key files to
call the document grounding endpoints:

curl \
--request GET \
--url '<url>/pipeline/api/v1/pipeline' \
--header 'accept: application/json' \
--header 'Authorization: Bearer <access_token>' \
--cert <file_with_certificate> \
--key <file_with_key>

Placeholder Description

<url> The service binding URL value for document grounding

that you obtained in step 8

<file_with_certificate> The doc-grounding.crt file, edited with line breaks

as described in step 19

Integrating Joule with SAP Solutions

76 PUBLIC Set Up Document Grounding
Placeholder Description

<file_with_key> The doc-grounding.key file, edited with line breaks

as described in step 19

You should receive a response with an empty list [] since the pipeline hasn’t been created yet.

13.2 Prepare SharePoint Integration

Create user and register application in Microsoft Entra ID.

1. Create a technical user. For more information, see the Microsoft Entra documentation article Quickstart:
Create and assign a user account .
2. Register an application. For more information, see the Microsoft Entra documentation article Quickstart:
Register an application with the Microsoft identity platform .
3. Add a scope to the application that you've registered. For more information, see the Microsoft Entra
documentation article Quickstart: Configure an application to expose a web API .

13.3 Configure Access from SAP BTP

Create a destination configuration in the SAP BTP cockpit.

1. Open the SAP BTP cockpit.

2. Go to the subaccount where you've subscribed to Joule, choose Connectivity Destinations , and
create a new destination with the following information:

Field Value

Name <NAME_OF_DESTINATION>

Type HTTP

URL https://graph.microsoft.com

Proxy Type Internet

Authentication OAuth2Password

User The technical user that you've created in Microsoft Entra

ID

Password The password that you've created in Microsoft Entra ID

Client ID Microsoft Entra ID Application credentials

Integrating Joule with SAP Solutions

Set Up Document Grounding PUBLIC 77
Field Value

Client Secret Microsoft Entra ID Application credentials

Token Service URL https://login.microsoftonline.com/

<TENANT_ID>/oauth2/v2.0/token, where <TEN-
ANT_ID> is the token service URL of Microsoft Entra ID

3. In the Additional Properties section, enter the following information:

Field Value

scope https://graph.microsoft.com/.default

4. Save your entries.

5. Choose Check Connection to check whether the basic configuration is working.

Destination Configuration Sample

Name=<NAME_OF_DESTINATION>
Description=SharePoint Access (On-behalf of technical user)
Type=HTTP
ProxyType=Internet
Authentication=OAuth2Password
clientId=<CLIENT_ID>
clientSecret=<CLIENT_SECRET>
User=<USERNAME>
Password=<PASSWORD>
tokenServiceURL=https\://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/token
tokenServiceURLType=Dedicated
scope=https\://graph.microsoft.com/.default
URL=https\://graph.microsoft.com

13.4 Set Up Content Ingestion

Configure schedule for scanning SharePoint and ingesting documents.

To register a new data pipeline, submit a POST request to the endpoint <url>/pipeline/api/v1/pipeline
with the desired configuration parameters.

 Tip

The <url> value is the service key URL value for document grounding that you obtained in step 8 in
Configure User Authentication [page 74].

Request Example

curl \

Integrating Joule with SAP Solutions

78 PUBLIC Set Up Document Grounding
--request POST \
--url '<url>/pipeline/api/v1/pipeline' \
--header 'Authorization: Bearer <access_token>' \
--header 'content-type: application/json' \
--data '{"type": "MSSharePoint","configuration":
{"destination": "<NAME_OF_DESTINATION>","sharePoint":
{"site": {"name": "<NAME_OF_SHAREPOINT_SITE>","includePaths":["/
<NAME_OF_SHAREPOINT_FOLDER_1>","/<NAME_OF_SHAREPOINT_FOLDER_2>"]}}}}' \
--cert <file_with_certificate> \
--key <file_with_key>

 Note

In the request, the parameter includePaths is optional. Use it if you want to add specific SharePoint
folders from the SharePoint site to the data pipeline.

Nested folders are supported. Use "includePaths":["/<NAME_OF_SHAREPOINT_FOLDER_1>/

<NAME_OF_SHAREPOINT_FOLDER_2>"] if <NAME_OF_SHAREPOINT_FOLDER_2> is a subfolder of
<NAME_OF_SHAREPOINT_FOLDER_1>.

Response Example

The response is given as a JSON file that contains the ID of the created pipeline.

{
"pipelineId":"4cfd0478-29ea-45c2-bc40-d3817621744e"
}

The created pipeline starts ingesting the data in the provided SharePoint site and updates the content daily.

13.5 Metering and Pricing

Find out about metering and pricing for the document grounding capability.

 Tip

The metering and pricing details presented here are relevant only to users of the data-manager service
plan for enterprise accounts.

Usage Metric

The document grounding capability is metered monthly based on the predefined usage metric – records.

One record corresponds to one 50-MB block of data uploaded to the cloud service. For pricing purposes, one
record is equivalent to 0.005 AI units.

Integrating Joule with SAP Solutions

Set Up Document Grounding PUBLIC 79
The following table shows examples of how the size of an uploaded document determines the number of
records:

Document Size Number of Records

45 MB 1

80 MB 2

105 MB 3

Price Calculation

The total monthly price for the document grounding capability is calculated as follows:

• Number of records for the month * 0.005 * price per AI unit

 Note

The number of records for the month is the total number of records added to the cloud service during that
month plus any records carried forward from the preceding month. Records remaining in the cloud service
at the end of one month are automatically carried forward to the next.

If you delete uploaded documents, they’re removed from the cloud service. However, they’re not deducted
from the total number of chargeable records for the month in which you delete them. Deleted documents
aren’t carried forward to the following month.

Examples

Key Elements of the Monthly Price Calculation

The following table illustrates how the number, size, and deletion of documents affect the number of records
used in the monthly price calculation.

Number of Docu-
ments Uploaded in Number of Docu- Calculation of
Month Size Per Document ments Deleted Number of Records Monthly Price

1 50 MB 0 1 1 * 0.005 * price per AI

unit

1 52 MB 0 2 2 * 0.005 * price per AI

unit

10 5 MB 0 10 10 * 0.005 * price per

AI unit

Integrating Joule with SAP Solutions

80 PUBLIC Set Up Document Grounding
Number of Docu-
ments Uploaded in Number of Docu- Calculation of
Month Size Per Document ments Deleted Number of Records Monthly Price

25 50 MB 10 25 25 * 0.005 * price per

AI unit

25 51 MB 10 50 50 * 0.005 * price per

AI unit

Monthly Price Calculation Including Records from Earlier Months

Let’s say you start using the cloud service in June. At the outset, there are no documents in the service. Over
the course of the month, you upload documents equivalent to a total of 10 records. Before the end of June, you
delete documents equivalent to 5 records, leaving 5 records in the cloud service at the end of the month.

In this case, the monthly charge for June is calculated as follows:

• Total number of records added to cloud service in current month (10) * 0.005 * price per AI unit

 Remember

Deleting documents reduces the number of records in the cloud service. But it doesn’t change the total
number of records for the current month.

The 5 records in the cloud service at the end of June are carried forward to the following month. These records
now count toward the total number of records for July.

In July, you again upload documents equivalent to a total of 10 records and delete the equivalent of 5.

The monthly charge for July is calculated as follows:

• (Number of records carried over from previous month (5) + total number of records added to cloud service
in current month (10) = 15) * 0.005 * price per AI unit

The number of records remaining at the end of July is calculated as follows:

• (Number of records carried over from previous month (5) + total number of records added to cloud service
in current month (10) = 15) – number of records deleted during month (5) = 10

These 10 records are carried forward to August.

This process applies for all subsequent months.

 Tip

Use the SAP Discovery Center - AI Feature Estimator .

Related Information

SAP AI Services List

Integrating Joule with SAP Solutions

Set Up Document Grounding PUBLIC 81
Important Disclaimers and Legal Information

Hyperlinks
Some links are classified by an icon and/or a mouseover text. These links provide additional information.
About the icons:

• Links with the icon : You are entering a Web site that is not hosted by SAP. By using such links, you agree (unless expressly stated otherwise in your
agreements with SAP) to this:

• The content of the linked-to site is not SAP documentation. You may not infer any product claims against SAP based on this information.

• SAP does not agree or disagree with the content on the linked-to site, nor does SAP warrant the availability and correctness. SAP shall not be liable for any
damages caused by the use of such content unless damages have been caused by SAP's gross negligence or willful misconduct.

• Links with the icon : You are leaving the documentation for that particular SAP product or service and are entering an SAP-hosted Web site. By using
such links, you agree that (unless expressly stated otherwise in your agreements with SAP) you may not infer any product claims against SAP based on this
information.

Videos Hosted on External Platforms

Some videos may point to third-party video hosting platforms. SAP cannot guarantee the future availability of videos stored on these platforms. Furthermore, any
advertisements or other content hosted on these platforms (for example, suggested videos or by navigating to other videos hosted on the same site), are not within
the control or responsibility of SAP.

Beta and Other Experimental Features

Experimental features are not part of the officially delivered scope that SAP guarantees for future releases. This means that experimental features may be changed by
SAP at any time for any reason without notice. Experimental features are not for productive use. You may not demonstrate, test, examine, evaluate or otherwise use
the experimental features in a live operating environment or with data that has not been sufficiently backed up.
The purpose of experimental features is to get feedback early on, allowing customers and partners to influence the future product accordingly. By providing your
feedback (e.g. in the SAP Community), you accept that intellectual property rights of the contributions or derivative works shall remain the exclusive property of SAP.

Example Code
Any software coding and/or code snippets are examples. They are not for productive use. The example code is only intended to better explain and visualize the syntax
and phrasing rules. SAP does not warrant the correctness and completeness of the example code. SAP shall not be liable for errors or damages caused by the use of
example code unless damages have been caused by SAP's gross negligence or willful misconduct.

Bias-Free Language
SAP supports a culture of diversity and inclusion. Whenever possible, we use unbiased language in our documentation to refer to people of all cultures, ethnicities,
genders, and abilities.

Integrating Joule with SAP Solutions

82 PUBLIC Important Disclaimers and Legal Information
Integrating Joule with SAP Solutions
Important Disclaimers and Legal Information PUBLIC 83
www.sap.com/contactsap

© 2025 SAP SE or an SAP affiliate company. All rights reserved.

No part of this publication may be reproduced or transmitted in any form

or for any purpose without the express permission of SAP SE or an SAP
affiliate company. The information contained herein may be changed
without prior notice.

Some software products marketed by SAP SE and its distributors

contain proprietary software components of other software vendors.
National product specifications may vary.

These materials are provided by SAP SE or an SAP affiliate company for

informational purposes only, without representation or warranty of any
kind, and SAP or its affiliated companies shall not be liable for errors or
omissions with respect to the materials. The only warranties for SAP or
SAP affiliate company products and services are those that are set forth
in the express warranty statements accompanying such products and
services, if any. Nothing herein should be construed as constituting an
additional warranty.

SAP and other SAP products and services mentioned herein as well as
their respective logos are trademarks or registered trademarks of SAP
SE (or an SAP affiliate company) in Germany and other countries. All
other product and service names mentioned are the trademarks of their
respective companies.

Please see https://www.sap.com/about/legal/trademark.html for

additional trademark information and notices.

THE BEST RUN