Hi, I am Denys van Kempen, SAP Partner Innovation Lab and the SAP HANA Academy.
In this video tutorial series we are going to cover the user and team provisioning API
of SAP Analytics Cloud.
This video was recorded in October 2021; for the latest video tutorials on the topic, please
check the playlist.
In this tutorial we will cover collection 602 for user and role actions on teams.
This video is part of a series and in the previous tutorials we have already covered
most topics related to using Postman collections for the SCIM API,
so in this video we will only hightlight what’s specific to this collection.
Quick look at the user guide.
Updates or creates teams, add users or assign the team to roles.
For larger environments, 30 teams or more, with some 5,000 users each, collection 612
is recommended, for batching.
The scripts are fairly complex, as we will see, for all the processing,
a “net” difference is calculated between the current situation and the desired state.
and a chunk size is calculated, we have seen this before with collection 802,
so our code wakthrough will be with big steps In the data file we provide team name, user
action, role action, with the list of users and roles
possible actions are add, keep, remove, and replace.
and here we have an example For team management, we want to replace users
and roles.
Here we only have single entries, but you provide an array.
For team painters, we are going to add a user and keep the role.
The role is in the same namespace, so no prefix is needed.
For team Viewer, we want to add both users and roles.
Here we are using a default role, and hence have to provide the sap.epm namespace.
READ team A GET request for the Groups endpoint with
file team from the input file.
Params, Authorization, Headers, prerequest scripts as before.
Same for most of the code in the post call tests.
Expecting 200 In case of 404 not found, that is, team does
not exist, we set variable current team and next request create team
otherwise, in case of 200, we parse the response body,
validate the SCIM schema, and then the processing starts,
reading in the body, building the arrays,
calculating chunk size, For the role action a function is defined
to handle namespaces Then we are going to process the users
add remove
replace keep means nothing to do
same for the roles and then for each team in the array, we call
next request, UPDATE team otherwise we exit, for example in case the
schema is not valid.
UPDATE team; A PUT request on the Groups endppoint with
current team from the environment In the body we provide schema, id, displayname,
metadata, members, and roles - same as with collection 802
In the prerequest script we read in the variables set in the previous request for current team,
about 160 lines of codes for processing and here at the end we set the environment
variables that will be picked up when making the request in the body we just saw.
Test as before, expecting 200
reading the response body, with a few more function to manage processing,
re-calculating the chunksize depending on the response times obtained
Updating the array with the next team until we are done, and then we exit the loop
Again, this is all very similar to collection 802
CREATE team a POST request to the Groups endpoint with
nothing added this time.
called when read team returns 404 In the body, as with the PUT we provide schema,
id and displayname.
We cannot switch this off.
Preequest and test as before expecting 201
a few lines to get a new access token should this have been expired
with the error handling found in most scripts with one difference,
create team fails if a folder with the same name exist.
This cannot be managed programatically, so we just log a line to the console, to the
log.
Let’s run the collection Select File
Preview JSON files are a bit harder to read but it
is the same file as we saw earlier Quick switch to Analytics Cloud
Security Users
Here we have our users Our teams, with Mondriaan as manager,
and Rembrandt and van Gogh as regular employees then we have also created two custom roles
using the same names, but you can use any name you like of course,
with no users or teams assigned Run the collection,
The access token has expired First call returns 401
Next request is a POST for a token Second GET on Groups for team number 1 in
the file returned 200 OK. and the SCIM schema test passed
Second interation: same result Third iteration: 404 not found.
Triggers a POST request on Groups 201 created
we return to read team, this time the team exists
schema is valid Then we get a number of PUT requests on Groups
with for currentteam, all returning 200 OK A summary
8 read team calls 1 for an access token,
one to create a team and 7 update calls
let’s take a look at the console, here we can see exactly the sequence
reading team management, fetching new access token
reading team management, painters, viewer, team not found, creating
reading updating management, removing 1 user
update management, adding 1 role
adding 1 user throughput
completed; team management has 1 users and is member of 1 roles
and so on for the other groups If we then switch to Analytics Cloud
and refresh the Roles page we can see that both our custom roles now
have a team assigned if we then switch to Teams
we can see that team Viewer has been added with all three users
Same for team painters, where we added Mondriaan and management, where we replaced Mondriaan
with Rembrandt Now, if we take a look at our data file again,
this also illustrates the effect of replace, add, and keep
We replaced Mondriaan with Rembrandt in group management and added Mondriaan to Painters.
However, we did not specify to also remove Rembrandt from Painters because of his promotion.
So you need to configure your data file carefully.
Finally, if we take a look at BI Content Viewer, we see 1 team and 1 user
The Viewer group including Rembrandt and Rembrandt as separate user.
This is not what we specified in the data file.
However, if we then take a look at the Users view,
and as a reminder, we created the environment with collection
103 which, as we have seen in previous videos,
assigns roles directly to users, generally not considered a best practice,
we see that our users also still have roles assigned, and hence the double count for Rembrandt.
We need to clean this up, programmatically,
using a PUT on the Users endpoint and this we will do in the next video
That’s it So much for user and role actions on teams.
See the description below for more information.
Don’t forget to subscribe.
Denys van Kempen, SAP HANA Academy / Partner Innovation Lab
Thanks for watching.