Set up a Ariba connector

Capabilities
Gather Ariba credentials
Configure the Ariba connector

Capabilities

The Ariba connector syncs the following resources:

Resource	Sync	Provision
Accounts
Groups

Provisioning support includes:

Account provisioning: create and delete user accounts
Group membership: add and remove users from groups
Account actions: enable and disable user accounts

Gather Ariba credentials

To configure the Ariba connector, you need administrator permissions in SAP Ariba and access to the SAP Ariba developer portal (API Center).

The connector authenticates using OAuth 2.0 client credentials against the SAP Ariba API. You’ll need to create an OAuth application in the SAP Ariba developer portal.

Create a new application for ConductorOne:

Click Create application and name it ConductorOne
Select Production environment
Add the following API access:
- SAP Ariba SCIM API — required for reading and provisioning users and groups
Note your Application (client) ID and generate a Client Secret; save both securely

Note your realm (site name) — visible in the URL of your Ariba tenant, e.g. https://<realm>.ariba.com.

Configure the Ariba connector

Cloud-hosted
Self-hosted

Follow these instructions to use a built-in, no-code connector hosted by ConductorOne.

In ConductorOne, navigate to Integrations > Connectors and click Add connector.

Search for Ariba and click Add.

Choose how to set up the new Ariba connector:

Add the connector to a currently unmanaged app
Add the connector to a managed app
Create a new managed app

Set the owner for this connector.

Click Next.

Find the Settings area of the page and click Edit.

Enter the required configuration:

Runtime URL (BATON_RUNTIME_URL): SAP Ariba SCIM API base URL (e.g. https://openapi.ariba.com/api/scim/v2)
Ariba Client ID (BATON_ARIBA_CLIENT_ID): OAuth2 client ID for SAP Ariba API access
Ariba Client Secret (BATON_ARIBA_CLIENT_SECRET): OAuth2 client secret for SAP Ariba API access
Realm (BATON_REALM): SAP Ariba realm (site) name
Password Adapter (BATON_PASSWORD_ADAPTER): (optional) Filter users by authentication type (e.g. UniversalID)

Click Save.

The connector’s label changes to Syncing, followed by Connected. You can view the logs to ensure that information is syncing.

That’s it! Your Ariba connector is now pulling access data into ConductorOne.

Follow these instructions to use the Ariba connector, hosted and run in your own environment.When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with ConductorOne, automatically syncing and uploading data at regular intervals.

Step 1: Set up a new Ariba connector

In ConductorOne, navigate to Integrations > Connectors > Add connector.

Search for Baton and click Add.

Choose how to set up the new Ariba connector:

Add the connector to a currently unmanaged app
Add the connector to a managed app
Create a new managed app

Set the owner for this connector.

Click Next.

In the Settings area of the page, click Edit.

Click Rotate to generate a new Client ID and Secret.Carefully copy and save these credentials.

Step 2: Create Kubernetes configuration files

Create two Kubernetes manifest files for your Ariba connector deployment:

Secrets configuration

# baton-ariba-secrets.yaml
apiVersion: v1
kind: Secret
metadata:
  name: baton-ariba-secrets
type: Opaque
stringData:
  # ConductorOne credentials
  BATON_CLIENT_ID: <ConductorOne client ID>
  BATON_CLIENT_SECRET: <ConductorOne client secret>

  # Ariba credentials
  BATON_RUNTIME_URL: <SAP Ariba SCIM API base URL>
  BATON_ARIBA_CLIENT_ID: <OAuth2 client ID>
  BATON_ARIBA_CLIENT_SECRET: <OAuth2 client secret>
  BATON_REALM: <SAP Ariba realm name>
  # BATON_PASSWORD_ADAPTER: <optional — filter users by auth type>

See the connector’s README or run --help to see all available configuration flags and environment variables.

Deployment configuration

# baton-ariba.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: baton-ariba
  labels:
    app: baton-ariba
spec:
  selector:
    matchLabels:
      app: baton-ariba
  template:
    metadata:
      labels:
        app: baton-ariba
        baton: "true"
        baton-app: ariba
    spec:
      containers:
      - name: baton-ariba
        image: public.ecr.aws/conductorone/baton-ariba:latest
        imagePullPolicy: IfNotPresent
        env:
        - name: BATON_HOST_ID
          value: baton-ariba
        envFrom:
        - secretRef:
            name: baton-ariba-secrets

Step 3: Deploy the connector

Create a namespace in which to run ConductorOne connectors (if desired), then apply the secret config and deployment config files.

Check that the connector data uploaded correctly. In ConductorOne, click Applications. On the Managed apps tab, locate and click the name of the application you added the Ariba connector to. Ariba data should be found on the Entitlements and Accounts tabs.

That’s it! Your Ariba connector is now pulling access data into ConductorOne.

All versions of this connector are available at dist.conductorone.com.

Set up an Argo CD connector

Set up an Asana connector

⌘I

Welcome

Manage connectors

Deploy connectors

Upload connector data

Configurable connectors

Pre-built connectors

Set up a Ariba connector

Capabilities

Gather Ariba credentials

Configure the Ariba connector

Step 1: Set up a new Ariba connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector

Welcome

Manage connectors

Deploy connectors

Upload connector data

Configurable connectors

Pre-built connectors

​Capabilities

​Gather Ariba credentials

​Configure the Ariba connector

​Step 1: Set up a new Ariba connector

​Step 2: Create Kubernetes configuration files

​Secrets configuration

​Deployment configuration

​Step 3: Deploy the connector

Capabilities

Gather Ariba credentials

Configure the Ariba connector

Step 1: Set up a new Ariba connector

Step 2: Create Kubernetes configuration files

Secrets configuration

Deployment configuration

Step 3: Deploy the connector