User Provisioning from IAS/IPS to SAP Concur!

[yacoulibaly]

Dear Expert Team,

I have been struggling since few days when I decided to setup the User Provisioning between our IAS tenant and our Concur Partner Demo Entity.

Firstly, I wanted to configure Joule for our Concur Demo instance as I did with our Partner Demo for SAP Ariba, SuccessFactor and S4 HANA Public Cloud. However, my initial ticket didn't move because it seems there is a legal issue to activate Jouel for Partners...so I gave up on Joule.

Secondly, I decided to configure the user integration from SuccessFactor to SAP Concur, I was then told that this is not possible for Partner Demo, because for that Concur Technical Team needs to associate the entity ID to the Customer ID in SAP for Me...I don't know why this can't be done, because in the way we could use MDI Integration with SuccessFactor. 

Thirdly, I decided to integrate the Users data via the SAP CIS/IAS/IPS using the user provisioning from IAS/IPS,  and use the standard setup that Concur is providing (See below secreenshot), but I quickly, I ran into issues as the IAS system is not linked...which take me to the second point above.

I asked this question to Concur via my initial ticket that was opened for Joule activation almost a year ago and it turned out, to activate Joule or MDI Integrtaion or user provisioning via IAS/IPS, Concur needs to add the entity ID to SAP for Me, that give the possiblity to use the automationm Concur provides for end Customer but Concur confirmed that this can't be done for Partner Demo System...I still don't understand why it can't be done?
However Concur guided me toward the SAP Cloud Identify Service document where I could configure an Application to setup SSO with SAP Concur via IAS and create a provisioning Source and Target sytems mabually and provision my user to Concur froIAS.

I followed the document to enable SSO and user provisioning manually, as I did many times for other tool.
But none of them were working initailly so I opened a ticket to Concur to help me and also to add the company domain to the domain list in Concur. Thanks to the Support Team the SSO works fine but the user provisioning has always failed and I am always getting this error below in SAP IAS.

What is interesting this error is happening regarless if my application is Concur "OAuth 2.0 Application Management" is on Dev, Test or Production, and the error happen even when the Application is deactivated in Concur. But there is an issue with the ticket in Concur which seems stucks because of who to handle the ticket.
I opened a SAP ticket andd I had lot of call with CIS/IAS Support Team who said that it all seems OK from IAS and will forward the ticket to Concur...and I am still waiting...

My questions are:

• Does anyone faced such error and how to fix it?
• Why Concur can't link the Concur entity to SAP for me as it is for all the other Partner SAP Test Demo and Development  (TDD) systems like Ariba, SFSF, S4, BTP and more?

Thank you,
Yacouba 

[KevinD]

@yacoulibaly was the initial ticket you submitted done through our Partner Support Portal? 

If not, I would suggest submitting it there as we have a dedicated Partner Support team just for you. They might be able to give better guidance than what you would find here since your situation, as a Partner, is different than most.

[yacoulibaly]

Hi @KevinD,

Yes, indeed, I opened a ticket first with SAP Concur, which is still there as we fixed the issue with SSO via IAS, but the user provisioning part, which is set according to the document provided by SAP, isn't working and for some reason my ticket is transferred to TC Team, who refuse to acknowledge the issue and investigate pretexting some PSD issue.

I also opened a ticket with SAP IAS Team in parallel, they have done all their possible, we went into a call with them and conclusion is there is an issue on Concur side, so they transferred the ticket to Concur on SAP 4 Me, and of course Concur will not check that ticket as they pointed to me in my initial case, "We don't have access to SAP 4 Me ticket".

So, I am trapped, 

• I don't have access to the tools like elastic search to investigate
• Concur doesn't provide any API or anything else to monitor of troubleshoot integration issues
• The standard IAS provisioning automation that concur provides to normal test entities, for some reason, isn't available to partners
• Partners have to manually setup the provisioning from IAS and when they do and it doesn't work, it is partners problem.

It's like a scene from an old Western movie: I'm handcuffed, blindfolded, and gagged, lying on the railroad tracks with a steam train barreling toward me at full speed, and I somehow have to avoid getting run over :-).

Thanks,
Yacouba 

[KevinD]

@yacoulibaly I want to clarify, you opened a ticket with Concur Support or was your ticket opened with our Concur Support Partner portal? I need to know so I can try and escalate to the correct team. I looked up your email and it shows you work for a company that is a Certified Implementation Partner. I need to know if you are asking your question in the capacity of a Partner or not? 

[samasuraj]

Hi KevinD / yacoulibaly 

Please see below. Hope it helps.

The issue appears to be related to SAP Concur Partner Demo provisioning permissions or API configuration, not IAS authentication.

1. SSO works: This confirms IAS authentication is functioning, but not IPS provisioning.

2. Provisioning fails: Verify the Concur IPS target connector, Company UUID, OAuth credentials, API permissions, and provisioning job logs.

3. SAP for Me association: Partner Demo tenants may have different entitlement restrictions from customer tenants. SAP Concur must confirm whether the required association is supported.

4. Next action: Request a joint investigation by SAP Concur and SAP Cloud Identity Services Support to confirm API eligibility and examine the exact provisioning error.

Conclusion: Before changing the configuration further, confirm whether SCIM-based IPS provisioning is officially supported for your specific Concur Partner Demo entity. If supported, the exact HTTP error from the IPS job should identify the next troubleshooting step.

One critical question:

Could you please share the exact error text or HTTP status code from the failed IPS provisioning job?

The two screenshot links in your post do not provide that error text here.

With the exact message, I can narrow the problem to authentication, authorization, connector configuration,

or attribute mapping.

Thanks & Regards

--

Samantha Prathikantam

SF_EC & ECP / SAP Concur Consultant

[yacoulibaly]

Hello Samantha / KevinD,

Thank you very much for your support.
Please, find below the exact error on IPS logs

Caused by: All target systems are marked as invalid due to the following reasons:

• Oauth request failed with status: 403 and body:
  • error: invalid_request
  • concur-correlationid: 8dd381f791d01ca3c58f6232e5d0f131
  • error_description: Authtoken was not issued for you
  • code: 136
  • geolocation: https://us2.api.concursolutions.com

Please note that Concur has mentionned that they can't link the Partner Solution on SAP4Me.

Below is the target system config in IAS.

Also see the configuration of the SCIM 4 API at Concur side

And note that the App Stage which is "Test" was checnged to Dev and Prod, but it didn't have an impact on the Error.

[PoojaKumatkar]

Hi @yacoulibaly ,

Note - I have very limited knowledge on this issue but still I would like you to try below things and see if it resolves your issue.

Can you please update App Stage to "Development" and try updating below scopes. We are using this for one of our existing integration in our Concur Test instance to create and update user profiles.

Check the provisioning configuration. Verify the Concur target system's data center, company UUID, company domain, connector version, and authentication settings. 

https://help.sap.com/docs/identity-provisioning/identity-provisioning/target-sap-concur

Check the authorization token. If your setup uses the Concur Identity Provisioning connector's company request token, verify that it is valid. SAP documents a 24-hour validity period for the initial token and a six-month validity period for the refresh token.

Review the provisioning job logs. Identify whether the failure occurs when authenticating with Concur or when creating/updating the user.

error_description: Authtoken was not issued for you

Based on the error message, I suspect this might be related to the company request token. Could you please try generating a new request token, update the configuration with the newly generated token, and test whether this resolves the issue?

SAP Concur Developer Center | Company Request Token Self-Service Tool

If this answers your query, then please mark solution as accepted.

[yacoulibaly]

Hi Pooja,

Thank you fot your insight, but I updated the scope, changed app type back to Development, generated a new auth token and i have the same and exact issue.

I felt like, whatever I do in Concur, the error remains the same. when i don't enter the correct auth tken, i get the message token doesn't start with "at-" but that is the only different message I am getting, all the reste is the same below message ""Authtoken was not issued for you""

[samasuraj]

Hi @yacoulibaly 

Topic: User Provisioning from IAS/IPS to SAP Concur!

Please check the below. Hope this helps.

-----

The HTTP 403 / Error Code 136 – "Authtoken was not issued for you" indicates that SAP Concur is rejecting the OAuth token request. This points to an authentication/authorization issue before user provisioning or SCIM attribute mapping begins.

Recommended checks:

1. SAP Concur application authorization: Ask SAP Concur Support to verify that the application is correctly registered and authorized for the intended Concur company.
2. Partner Solution linking: Since SAP Concur cannot link the Partner Solution in SAP for Me, request investigation of the application entitlement/authorization relationship. This is a potential cause, not yet a confirmed root cause.
3. IPS target configuration: Verify concur.api.version = 3 for SCIM v4, the correct concur.datacenter, Company UUID, and company domain.
4. Company Request Token: Verify that the token was generated for the correct company and used within its 24-hour validity period. If necessary, generate a new token and rerun provisioning.
5. Existing refresh token: If provisioning previously worked, check whether the stored refresh token is still valid.

Changing the App Stage between Test, Dev, and Prod would not resolve a missing company OAuth authorization by itself.

Recommendation: Escalate to SAP Concur API Support with Error Code 136 and the correlation ID so they can identify the exact reason for the token rejection.

Official Verification:

SAP's Identity Provisioning documentation confirms that:

• concur.api.version = 3 uses the SCIM v4 API.
• A Company Request Token and Company UUID are required.
• The Company Request Token is valid for 24 hours.
• The refresh token normally remains valid for six months, with its validity extended after successful provisioning runs.

Official documentation: SAP Help – Identity Provisioning: SAP Concur Target System

Thanks & Regards

--

Samantha Prathikantam

SF_EC & ECP / SAP Concur Consultant

[yacoulibaly]

Thank you @samasuraj I have sent an escalation email...hopefully it will move. Basically, Concur is requesting to purchase some consulting hours...for something I did following SAP official document, and I do not have anything on my end to check in concur what is going. on there. 

[yacoulibaly]

Hi all,

I got a very useful comment from Concur Support finally.

The APP ID that is required to create the toke is a specific APP ID, provided in the document as

so it is mandatory to use that ID and not the APP ID you create in SAP Concur under Authentication Admin and for which you are setup the scopes. This was very useful, and it definitely helped me to move to the next step. 
I have seen this in the doc, but for me it was just an exemple of APP ID.

I am getting another error, but I think I will be able to move further now.

Thank you all for your support and special thanks go to Vlado 🙂