Integration of SAP Joule AI Copilot with SAP Ariba Sourcing
Follow the below blog from Nageshcaparthy and want to highlight couple of things which this blog didn’t cover and couple of changes were needed in SAP help document which is informed to SAP product team during my interaction.
https://help.sap.com/docs/joule/integrating-joule-with-sap/integration-with-sap-ariba
We should consider 2 scenarios
- Customers who have already integrated SAP Ariba with SSO.
- Those who are 1st time implementing SAP Ariba with SSO and integrating with SAP Joule
Scenario 1:
Since we belong in this category I want to share changes observed during this whole process and my experience through this article.
Activation of Joule and formations were already in place and SAP Successfactor integration completed successfully.
Comparing the steps from the blog and at the same time highlighting the changes
- Steps involved during this integration
- SAP Ariba SSO with SAP Cloud Identity Services (ICM Process) – completed
- OAuth Credentials for CDM API (SAP Ariba Developer Portal) – We needed not only these keys but SCIM API for User and Group Master Data.
- Configure Identity Provisioning Service from SAP Ariba Applications to IAS
- Create Ariba to IAS User Sync – Source System
- Create Ariba to IAS User – Target System
- Integrating Joule
- Have an existing Joule setup, and a formation has been created
- Post-integration checks
- Validate Application List
- Validate the Attributes
- Trusted Domains
- Conditional Authentication
- Destination Setup
- SAP Ariba Sourcing Destinations
- SAP Ariba Sourcing Destinations – DT
- SAP Ariba Sourcing Destinations – RT
- SAP Build Work Zone – Content Provider
- Content Provider for SAP Ariba Sourcing Solutions
- Channel Updates
- Configure Identity Provisioning Service from IAS to SAP Build Work Zone
- Configure the Source System
- Configure Target Systems
- SAP Ariba Sourcing – Target
- Run Sync Job
During my session along with SAP Development team it was clarified that the users sync from IAS to Ariba were not required as it was not required since SAP Ariba was already integrated with IAS for SSO and users in both were already in Sync.
please read the disclaimer from referred blog.
- SAP Ariba SSO with SAP Cloud Identity Services
since this configuration is already in place and ensured that joule activation was done using the same IAS tenant which was used earlier for integration with SAP Successfactor and the same should be used for other LOB’s. If other LOBs are configured with different IAS tenants then you may have to migrate them to this IAS tenant it will be really challenging. As highlighted in my earlier blog this requires proper planning for unification of all the SAP LOBs into a single IAS tenant.
We had details discussion with SAP Team about the critical aspect of GUID (SCIM ID) – All along I had an impression that GUID were required for user authentication and conversations and it requires to send this information from IAS to Ariba which was not required as Ariba doesn’t depend on it entirely rather it uses other attributes of the user like email ID and Login name even though Ariba uses S4HANA in the backend it is completely controlled from Application side.
The question will arise what about S4HANA either cloud or on-premise systems to be integrated with Joule how the GUID will be taken care of. It entirely depends on the way the users from IAS to these LOBs are sync. Once we achieved it part of Task center implementation is that the GUID of uses from IAS were updated into S4HANA on premise (existing setup) using BADI. You can refer to any blog or online information you will find the details.
As per the blog we changed the url from ondemand.com to cloud.sap with the help of Ariba team since as customer you don’t have an option to change it.
Since already we had the existing setup of Ariba integration with IAS there are no source and target systems created in IDP.
Thankfully the blog has provided the json files for source system and target system which we used and manually created them for replication of users and groups from Ariba to IAS.
In the blog and in help document it is mentioned that once the above step is completed we should have the necessary bundled applications, Source, target systems in IAS which didn’t happen in our case since we already had the necessary application defined manually for integration of Ariba with IAS. I recommend this to be included in any of the blogs or in the help document so that customer is aware of it.
Sourcing system
Target system
- OAuth Credentials for SCIM API (SAP Ariba Developer Portal)
Follow the steps mentioned in the blog and the difference is we faced issue with replication of users and groups from Ariba to IAS and after session with Ariba team advised us to create SCIM API in place CDM API created using workzone CDM Content and these details are meant to use in source system of users and groups replication from IAS to Workzone. The details of SCIM API requested through SAP Ariba Development Portal. It is possible to get both API’s by creating the incident as we didn’t find the workzone CDM API in the portal and it is created and sent to us by Ariba team except creation of secret which can be done by the administrator of portal.
3.1 Create Ariba to IAS User Sync – Source System
Created the source system using the json files provided in the blog and used the SCIM API created earlier in the Development portal.
3.2 Create Ariba to IAS User – Target System
The user and password are taken from a system user created in the administrator console with client ID and secret by providing only the necessary auth. to manage users and groups.
Followed other recommendations provided in the blog to remove some property parameters
Replication of users and groups from Ariba to IAS is successful. check the below details from provisioning logs.
Note: Moment of caution again don’t sync user replication from IAS to Ariba which is not required it may differ in terms of specific cases and would advise to take the help of Ariba team.
- Integrating Joule
As we already had the existing setup of joule with formations ready we added the Ariba realm and ended with the issue below. Not providing complete details as they are already covered in the blog.
Synchronization was failing as it was unable to identify already created application in IAS. After weeks long investigation by Joule and Ariba product development team they created one more application other than already existing one added the missing client ID inside the attributes of the application, and we were able to add the Ariba tenant successfully into the formation.
Production development still they are trying to figure out the issue and hopefully in subsequent release the process will identify the existing application in IAS which will create the necessary bundle application under the main application.
After successfully adding the Ariba tenant still joule icon was not appearing in the Ariba tenant and further it was resolved by Ariba team after activating feature toggles in Ariba tenant.
- Post-integration checks
Follow the validation of attributes, application, Changes in the trusted domain, Conditional authentication at IAS as mentioned in the blog.
- Destination Setup
Follow and create destination of Design time and runtime as mentioned in the blog and use the files provided in github.
https://github.com/SAP-samples/btp-onboarding/tree/main/docs/Joule-with-SAP-Ariba/JSON-Files
- SAP Build Work Zone – Content Provider
- Content Provider for SAP Ariba Sourcing Solutions
Following the steps mentioned in the blog and initial update will fail since still users and groups were not replicated from IAS to Ariba.
- Configure Identity Provisioning Service from IAS to SAP Build Work Zone
We had issue with creation of source system in IDP for replication of users and groups ( As per the blog it should create automatically once the IAS tenant is added in to ICM which didn’t create in our case) json files were also missing in the blog. Requested the product development to add them into the same github repository.
Followed the help document to create the source and target systems in IDP.
Execution of sync job should be successful once you ensured that property parameters in both source and target systems are properly maintained.
Now if a refresh is done for SAP Ariba strategic sourcing in Workzone it should be updated successfully.
verify whether the groups are assigned to the users..
I had an interesting discussion with SAP Product team why not Ariba also follows the same way users and groups are replicated from SF to WZ during integration of SAP Successfactor with Joule (where they are directly moved from SF to WZ by passing the IAS where IAS is used only for authentication). In Ariba the users and groups are replicated from Ariba-IAS-WZ. The explanation is that both products are different in the way they interact with BTP. SF is part of BTP whereas Ariba is completely different SAAS product.
- Joule Test Scenarios
Follow the use cases from the below link. Test each case end to end understand all the scenarios application like Informational, Transactional, Navigational.
Note that beyond the scenarios what are explained and configured to work in Joule don’t execute in you natural language as you won’t find a proper response.
Each interaction user make with joule and response received will be treated as one token and as I mentioned in my earlier blog “Ariba integration with SAP successfactor “you are entitled for fixed number messages free and after that you will be charged so understanding the scenarios and educating the business users adhering to it is critical as of now. Not sure if SAP increases the number of messages free.
https://help.sap.com/docs/joule/capabilities-guide/joule-in-sap-ariba-solutions
Conclusion: The Next Generation of Procurement
The integration of SAP Joule AI Copilot with SAP Ariba Sourcing is a significant step toward an AI-driven, friction-less procurement process. This implementation journey, especially for customers with existing SSO configurations, underscores that while official documentation is really useful but it requires changes for both scenarios mentioned.
Key Takeaways and Future Focus
This experience highlights several vital points for organizations embarking on this integration:
-
IAS Unification: The seamless integration of Joule across multiple Line of Business (LOB) applications, like SuccessFactors and Ariba, hinges on the unification of all LOBs to a single SAP Cloud Identity Services (IAS) tenant. This prevents complex migration challenges and ensures a cohesive user experience.
-
User Sync: For customers already integrated via SSO, the blog’s requirement for a separate IAS-to-Ariba user sync can be potentially eliminated or simplified, as Ariba primarily relies on existing attributes like email and login name for authentication, not the GUID/SCIM ID for conversation context, which is the main dependency for other applications like S4HANA, SuccessFactors and SAP concur.
-
Beyond the Standard API: The need to request the SCIM API in addition to the standard OAuth Credentials (CDM API) for user and group replication from Ariba to IAS is a practical detail that requires a proactive approach with the SAP Ariba development team.
-
The Maturing Platform: The initial issues faced with the Joule application identification in IAS and the subsequent need for Ariba team intervention to activate feature toggles demonstrate that the Joule integration architecture, while robust, is still actively maturing. Future releases are expected to streamline the automatic identification and bundling of applications within IAS.
In summary, this integration has successfully delivered the conversational and transactional capabilities of the Joule AI Copilot into the SAP Ariba Sourcing landscape. As SAP continues to invest in generative AI, understanding these practical implementation insights will be crucial for other enterprises to achieve a truly unified, intelligent, and highly efficient procurement experience while maximizing the value of their existing SAP ecosystem.
#abap