Connect SAP HANA to Claude: Automate User Directory Provisioning

If your team needs to connect SAP HANA to Claude to automate user directory provisioning, manage SCIM lifecycle updates, or audit enterprise identity access, you need a Model Context Protocol (MCP) server. This server acts as the translation layer between Claude's natural language tool calls and SAP Cloud Identity Services' REST APIs. You can either build and maintain this infrastructure yourself, or use a managed integration platform like Truto to dynamically generate a secure, authenticated MCP server URL. If your team uses ChatGPT, check out our guide on /connect-sap-hana-to-chatgpt-manage-identity-and-group-access/ or explore our broader architectural overview on /connect-sap-hana-to-ai-agents-orchestrate-scim-lifecycles/.

Giving a Large Language Model (LLM) read and write access to a sprawling enterprise identity directory like SAP HANA is a massive engineering challenge. You have to handle complex SCIM 2.0 token lifecycles, map massive nested enterprise JSON schemas to MCP tool definitions, and deal with strict SAP API constraints. Every time an enterprise extension attribute is added or an endpoint is updated, you have to update your server code, redeploy, and test the integration.

This guide breaks down exactly how to use Truto to generate a secure, managed MCP server for SAP HANA, connect it natively to Claude Desktop, and execute complex identity management workflows using natural language.

The Engineering Reality of the SAP HANA API

A custom MCP server is a self-hosted integration layer. While the open MCP standard provides a predictable way for models to discover tools, the reality of implementing it against SAP HANA's APIs is painful. SAP HANA relies heavily on SAP Cloud Identity Services, which exposes a SCIM 2.0 (System for Cross-domain Identity Management) API. While SCIM is a standard, SAP's implementation carries specific enterprise-grade complexities that an LLM cannot guess on its own.

If you decide to build a custom MCP server for SAP HANA, you own the entire API lifecycle. Here are the specific integration challenges you will face:

SCIM 2.0 Partial Updates vs Full Replacements SAP enforces strict rules around how resources are updated. If you use a standard PUT request to update a user (update_a_sap_hana_user_by_id), you must send the entire user representation. If your LLM omits an existing group membership or an extension attribute in the PUT payload, SAP will wipe that data from the user profile. To avoid this, you must either enforce a strict "read-before-write" pattern in your prompt engineering, or rely on PATCH operations (sap_hana_users_partial_update). However, PATCH requires a highly specific Operations array syntax (e.g., op: "replace", path: "active", value: false). Hardcoding these rules into a custom MCP server is a brittle, error-prone process.

Deeply Nested Enterprise Extension Attributes Enterprise users in SAP HANA do not just have a first name and email. They carry deeply nested SCIM extension payloads, such as urn:ietf:params:scim:schemas:extension:enterprise:2.0:User for manager structures, or custom SAP-specific extensions for system assignments. An LLM needs precise, strictly enforced JSON schemas to successfully generate these payloads. Truto solves this by dynamically generating tool schemas directly from integration documentation records, ensuring the LLM understands exactly where extension attributes belong in the payload hierarchy.

Strict Rate Limiting and Retry Responsibility SAP HANA enforces strict API quotas for identity queries. When integrating with Truto, it is critical to understand the architectural boundary: Truto does not retry, throttle, or apply backoff on rate limit errors. When the upstream SAP API returns an HTTP 429, Truto passes that error directly to the caller. Truto normalizes the upstream rate limit information into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) per the IETF specification. The caller - whether that is your custom agent orchestrator or the Claude client - is entirely responsible for implementing retry and backoff logic. Truto will not absorb these errors for you.

Generating a Managed MCP Server for SAP HANA

Instead of building a proxy layer from scratch, Truto allows you to generate a fully managed MCP server scoped to a single integrated SAP HANA account. Tools are generated dynamically at runtime based on the integration's documented resources - there are no hardcoded tools, ensuring your agent only has access to curated, documented endpoints.

You can generate the MCP server using either the Truto UI or the API.

Method 1: Via the Truto UI

For teams testing workflows manually, the UI provides a fast path to a secure server URL.

1. Navigate to the integrated account page for your SAP HANA connection in the Truto dashboard.
2. Click the MCP Servers tab.
3. Click Create MCP Server.
4. Select your desired configuration (e.g., name, method filters like read or write, and tool tags).
5. Copy the generated MCP server URL (e.g., https://api.truto.one/mcp/a1b2c3d4e5f6...).

Method 2: Via the Truto API

For production deployments and automated agent provisioning, you can generate the MCP server programmatically. The API validates that the SAP HANA integration has AI-ready tools, generates a secure cryptographically hashed token, stores it in a distributed key-value store, and returns a ready-to-use URL.

Make a POST request to /integrated-account/:id/mcp:

curl -X POST https://api.truto.one/api/integrated-account/{sap_hana_account_id}/mcp \
  -H "Authorization: Bearer YOUR_TRUTO_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "SAP HANA Identity Agent",
    "config": {
      "methods": ["read", "write"],
      "tags": ["identity", "scim"]
    },
    "expires_at": "2026-12-31T23:59:59Z"
  }'

The response will contain your active MCP server URL:

{
  "id": "abc-123",
  "name": "SAP HANA Identity Agent",
  "config": { "methods": ["read", "write"], "tags": ["identity", "scim"] },
  "expires_at": "2026-12-31T23:59:59.000Z",
  "url": "https://api.truto.one/mcp/a1b2c3d4e5f67890"
}

This URL is entirely self-contained. It encodes the authentication and tenant context needed to route JSON-RPC 2.0 messages directly to the underlying SAP HANA account.

Connecting the MCP Server to Claude

Once you have the Truto MCP server URL, you must connect it to your Claude client. You can do this via the Claude application UI or by modifying the Desktop configuration file.

Method 1: Via the Claude UI

If your organization supports UI-based connector configuration (similar to ChatGPT's custom connector setup):

1. Open Claude Desktop or Web.
2. Navigate to Settings -> Integrations (or Developer -> MCP Servers depending on your plan tier).
3. Click Add MCP Server.
4. Paste the Truto MCP URL generated in the previous step.
5. Click Add. Claude will immediately perform the initialize handshake and execute a tools/list request to discover the SAP HANA capabilities.

Method 2: Via Manual Configuration File

For Claude Desktop developers, you can configure the server manually using the claude_desktop_config.json file. Because Truto's MCP servers communicate over HTTP POST via JSON-RPC, you will use the official @modelcontextprotocol/server-sse package to bridge the standard I/O connection to Truto's SSE/HTTP endpoint.

Open your config file (located at ~/Library/Application Support/Claude/claude_desktop_config.json on macOS or %APPDATA%\Claude\claude_desktop_config.json on Windows) and add:

{
  "mcpServers": {
    "sap_hana_identity": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-sse",
        "https://api.truto.one/mcp/YOUR_GENERATED_TOKEN"
      ]
    }
  }
}

Restart Claude Desktop. When you open a new chat, you will see a tool icon indicating the SAP HANA resources are available to the model.

SAP HANA Hero Tools for Claude

Truto automatically derives tools based on the documentation records of your integration. When Claude calls a tool, Truto uses a flat input namespace, extracting query and body parameters from the LLM's payload based on the JSON schemas, and delegates execution directly to the proxy API handlers.

Here are the highest-leverage hero tools exposed for SAP HANA.

list_all_sap_hana_users

This tool allows Claude to query the SCIM 2.0 /service/scim/Users endpoint. It supports SCIM filter expressions, sorting, and pagination. It returns the core userName, emails, active status, and enterprise extension attributes.

"Audit our SAP HANA directory and list all active users in the engineering department who were modified in the last 30 days."

get_single_sap_hana_user_by_id

Retrieves a specific user's full SCIM resource profile by their UUID. This is a critical prerequisite tool for any full PUT update, as the LLM must read the entire profile to ensure it doesn't accidentally overwrite existing extension attributes.

"Pull the complete SAP Identity profile for the user with ID 8a9b2c3d-4e5f-6789-abcd-ef0123456789 so we can review their current group assignments."

create_a_sap_hana_user

Creates a new user via POST /service/scim/Users. Claude can dynamically populate the required schemas, userName, email arrays, and SAP extension fields (like sendMail: true to trigger an activation email).

"Provision a new SAP HANA identity for Jane Smith (jane.smith@example.com). Make her active, assign her to the Enterprise user type, and trigger the welcome email."

sap_hana_users_partial_update

Executes a SCIM PatchOp (PATCH /service/scim/Users/{id}). This is the safest way for Claude to modify specific fields - such as deactivating a user or updating a department name - without risking data loss on nested SAP attributes.

"Deactivate the SAP HANA user account for john.doe@example.com immediately by setting their active status to false."

list_all_sap_hana_groups

Queries the /service/scim/Groups endpoint. Claude can use this to resolve group names to UUIDs, returning displayName, member lists, and the SAP group extension (technical name and description).

"Find the exact group ID for the 'Production Data Admins' group in SAP Cloud Identity Services so we can audit its current members."

sap_hana_groups_partial_update

Adds or removes members from a group without needing to resend the entire member list. Claude constructs the specific op: "add" or op: "remove" SCIM patch syntax.

"Add user ID 8a9b2c3d-4e5f-6789-abcd-ef0123456789 to the 'Production Data Admins' group."

To view the complete tool inventory, request schemas, and detailed response formats for this integration, visit the SAP HANA integration page.

Workflows in Action

When Claude is equipped with the SAP HANA MCP server, it can autonomously chain multiple SCIM endpoints to complete complex provisioning tasks.

Scenario 1: Automated Employee Provisioning

IT teams spend countless hours provisioning new hires across various enterprise directories. With Claude, this process becomes a single natural language command.

"We have a new Senior Backend Engineer starting on Monday named Sarah Connor (sarah.connor@example.com). Provision her in SAP HANA, trigger the activation email, and add her to the 'Engineering_Core' group."

How the agent executes this:

1. Tool Call: create_a_sap_hana_user - Claude constructs the SCIM payload with the required schemas, sets userName to her email, sets the SAP extension sendMail to true, and creates the user. It extracts the new user UUID from the response.
2. Tool Call: list_all_sap_hana_groups - Claude queries the groups endpoint using a SCIM filter (displayName eq "Engineering_Core") to resolve the target group's UUID.
3. Tool Call: sap_hana_groups_partial_update - Claude sends a PATCH request to the group ID, using op: "add" with the value of Sarah's newly created user UUID.

Result: The user is fully provisioned, notified via email, and correctly permissioned in seconds.

Scenario 2: Emergency Offboarding

When a contractor leaves or a security incident occurs, revoking access immediately across the enterprise stack is critical.

"Emergency offboarding: Deactivate alex.contractor@example.com in SAP HANA and remove him from all active groups immediately."

sequenceDiagram
    participant User as User Prompt
    participant Claude as Claude Desktop
    participant MCP as Truto MCP Router
    participant SAP as SAP HANA API
    
    User->>Claude: "Emergency offboarding: Deactivate Alex..."
    Claude->>MCP: Call list_all_sap_hana_users (filter by email)
    MCP->>SAP: GET /service/scim/Users?filter=userName eq 'alex...'
    SAP-->>MCP: Returns User ID (UUID-123)
    MCP-->>Claude: JSON Payload
    
    Claude->>MCP: Call get_single_sap_hana_user_by_id (UUID-123)
    MCP->>SAP: GET /service/scim/Users/UUID-123
    SAP-->>MCP: Returns User + Group Array
    MCP-->>Claude: JSON Payload
    
    Claude->>MCP: Call sap_hana_users_partial_update (active=false)
    MCP->>SAP: PATCH /service/scim/Users/UUID-123
    SAP-->>MCP: 200 OK
    MCP-->>Claude: Deactivation Confirmed
    
    Claude->>MCP: Call sap_hana_groups_partial_update (remove member)
    MCP->>SAP: PATCH /service/scim/Groups/{group_id}
    SAP-->>MCP: 200 OK
    MCP-->>Claude: Removal Confirmed
    Claude-->>User: "Alex has been deactivated and removed from all groups."

How the agent executes this:

1. Tool Call: list_all_sap_hana_users - Claude finds Alex's user UUID by filtering for the email address.
2. Tool Call: get_single_sap_hana_user_by_id - Claude retrieves the full profile to see exactly which groups Alex currently belongs to.
3. Tool Call: sap_hana_users_partial_update - Claude executes a SCIM replace operation, setting the active attribute to false, cutting off login access.
4. Tool Call: sap_hana_groups_partial_update - Claude iterates through the groups identified in step 2, executing a remove operation on each group to strip privileges entirely.

Security and Access Control

Exposing an enterprise identity store like SAP HANA to an LLM requires strict boundary control. Truto's MCP servers provide several layers of security configuration at the token level:

• Method Filtering: By defining config.methods: ["read"] during server creation, you can force the MCP server to act in read-only mode. The server will only expose get and list tools to Claude, completely eliminating the risk of the model altering user data.
• Tag Filtering: By passing config.tags: ["identity"], you restrict the server to only expose tools relevant to that functional area, keeping unrelated integration endpoints out of the LLM's context window.
• Extra Authentication (require_api_token_auth): For higher security, setting this flag to true means possession of the MCP URL is not enough. The client connecting to the server must also provide a valid Truto API token in the Authorization header, enforcing a second layer of identity verification.
• Time-to-Live (expires_at): You can bind MCP servers to an expiration timestamp. Truto utilizes durable scheduling primitives to automatically clean up the database records and cached tokens when the time expires, instantly revoking the LLM's access. This is ideal for granting an AI agent temporary access to complete a specific audit.

Strategic Wrap-Up

Connecting Claude to SAP HANA transforms how IT and security teams manage enterprise identities. By relying on a managed MCP server, you offload the massive technical debt of maintaining SCIM 2.0 tool definitions, pagination logic, and authentication lifecycles. Truto's documentation-driven architecture ensures that your AI agents only have access to strictly validated, schema-accurate tools, preventing hallucinations when interacting with critical directory data.

Stop writing custom Python scripts for every new provisioning workflow. Give your models secure, direct access to the source of truth.