docs(coupa): add v0.1.13 account provisioning details

baton/coupa.mdx

@@ -1,13 +1,13 @@
 ---
 title: "Set up a Coupa connector"
 og:title: "Set up a Coupa connector"
 description: "C1 provides identity governance for Coupa. Integrate your Coupa instance with C1 to run user access reviews (UARs) and enable just-in-time access requests."
 og:description: "C1 provides identity governance for Coupa. Integrate your Coupa instance with C1 to run user access reviews (UARs) and enable just-in-time access requests."
 sidebarTitle: "Coupa"
 ---
 
 <Tip>
 **This is an updated and improved version of the Coupa connector!** If you're setting up Coupa with C1 for the first time, you're in the right place.
 </Tip>
 
 ## Capabilities
@@ -21,61 +21,92 @@
 | Roles | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> |
 | Licenses | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> | <Icon icon="square-check" iconType="solid"  color="#c937ae"/> |
 
 ¹ Account Groups sync is opt-in. To enable it, select **Account Groups** in the resource types to sync when configuring the connector in C1, and ensure the `core.accounting.read` OAuth scope is added to your Coupa OAuth client.
 
 The **Licenses** resource surfaces each user's Coupa license assignments — such as Analytics, Purchasing, Sourcing, CLM Advanced, Navi AI Agent, and Intake — as license profiles, so they can be reviewed and provisioned through C1 License Management.
 
 ### Account provisioning
 
 C1 can create Coupa user accounts. When you configure account provisioning for the app, map these profile fields:
 
 | Field | Description |
 |-------|-------------|
 | First name | First name of the person who will own the Coupa user. |
 | Last name | Last name of the person who will own the Coupa user. |
 | Email | Email address of the Coupa user. Defaults to the C1 user's primary email. |
 | Login | Login for the Coupa user. Defaults to the C1 user's username. |
 | SSO identifier | Single sign-on identifier for the Coupa user. |
 | Employee number | Employee number for the Coupa user. |
 | Manager login | Login of the user's manager in Coupa. |
 | Purchasing user | Assign a Purchasing license when the account is created. |
 | Invoicing user | Assign an Invoicing license when the account is created. |
 | Sourcing user | Assign a Sourcing license when the account is created. |
 | Account security type | Numeric Coupa account security type. |
-| Authentication method | `coupa_credentials`, `ldap`, or `saml`; values are case-sensitive. |
+| Authentication method | `coupa_credentials`, `ldap`, or `saml`; values are case-sensitive. Only the methods enabled on your Coupa instance are accepted. |
 | Default locale | Default locale, such as `en` or `en-GB`. |
 | Default account type | Name of the user's default Coupa account type. |
 | Default currency | ISO currency code, such as `USD`. |
-| Custom fields | Map of instance-specific Coupa user field names to values. |
+| Custom fields | Map of your Coupa instance's custom user field names to values, for example `{"cost-center": "CC-100"}`. |
 
 Every field is optional to C1. Map **First name** and **Last name** regardless — Coupa has no other source for a new user's name.
 
 Accounts are created active. The connector does not set a password.
 
 Custom fields are sent in Coupa's `custom-fields` namespace. License assignments can also be managed after account creation through C1 License Management.
 
+The connector trims surrounding whitespace from **Email**, **Login**, **SSO identifier**, **Employee number**, **Manager login**, **Authentication method**, **Default locale**, **Default account type**, and **Default currency**. A value that is only whitespace counts as unmapped. **First name** and **Last name** are sent as-is.
+
+**Purchasing user**, **Invoicing user**, and **Sourcing user** must be mapped to boolean values, and **Account security type** to a number. A value of any other type, such as the text `"false"`, is ignored and not sent to Coupa. Custom field values are sent with the type they are mapped with.
+
+<Note>
+The extended attributes are set only when the account is created. The connector does not update SSO identifier, employee number, manager, security and authentication settings, locale, default account type, default currency, or custom fields on existing Coupa users. It also does not sync these attributes back into C1: synced Coupa accounts carry only login, email, name, and status.
+</Note>
+
+#### Mapping examples
+
+Mappings in C1 are expressions. Wrap text constants in quotes; booleans and numbers take no quotes. The C1 user has no separate first and last name, so derive them from the display name.
+
+| Field | Example mapping |
+|-------|-----------------|
+| First name | `subject.display_name.split(" ")[0]` |
+| Last name | `subject.display_name.substring(subject.display_name.indexOf(" ") + 1)` |
+| Email | `subject.email` |
+| Login | `subject.username` |
+| Employee number | A value unique per user, such as `subject.id`. Coupa requires employee numbers to be unique, so a constant fails from the second account on. |
+| Manager login | `"jane.manager"` |
+| Purchasing user | `true` |
+| Default currency | `"USD"` |
+| Custom fields | `{"cost-center": "CC-100", "remote": true, "desk-number": 42}` |
+
+#### How Coupa applies some values
+
+- **License flags.** If an account would be created with no license at all — for example, with **Purchasing user**, **Invoicing user**, and **Sourcing user** all mapped to `false` — Coupa assigns the Purchasing license anyway. To create a user without Purchasing, map at least one other license flag to `true`.
+- **Custom field names.** Coupa accepts either the hyphenated or the underscore form of a custom field name (for example `cost-center` or `cost_center`) and reports it in the hyphenated form. A name that doesn't match an existing custom user field is ignored without an error, so check the spelling against an existing user's `custom-fields` in the Coupa Users API.
+- **Integer custom fields** are returned by Coupa as decimal strings, for example `"42.0"`.
+- **Rejected values.** If Coupa rejects a value — an authentication method your instance doesn't enable, or an account type, currency, or manager that doesn't exist — the account isn't created and the connector returns Coupa's error message, for example `Authentication Method must be one of Coupa Credentials`.
+
 ### Connector actions
 
 Connector actions are custom capabilities that extend C1 automations with app-specific operations. You can use connector actions in the [Perform connector action](/product/admin/automations-steps-reference#perform-connector-action) automation step.
 
 | Action name | Additional fields | Description |
 |-------------|-------------------|-------------|
 | enable_user | `user_id` (string, required) — the Coupa user's numeric ID, the `id` field on `/api/users` | Enables a disabled user account in Coupa, allowing them to access the system |
 | disable_user | `user_id` (string, required) — the Coupa user's numeric ID, the `id` field on `/api/users` | Disables an active user account in Coupa, preventing them from accessing the system |
 
 ## Gather Coupa credentials
 
 Configuring the connector requires you to pass in credentials generated in Coupa. Gather these credentials before you move on.
 
 <Warning>
 A user with **Admin** access in Coupa must perform this task.
 </Warning>
 
 ### Look up your Coupa domain
 
 <Steps>
   <Step>
   Log into your Coupa control panel and copy the URL from your browser.
   </Step>
 </Steps>
 
@@ -83,7 +114,7 @@
 
 <Steps>
   <Step>
   In the Coupa control panel, click **Setup**.
   </Step>
   <Step>
   Search for "OAuth" and click **OAuth2/OpenID Connect Clients**.
@@ -105,7 +136,7 @@
     - core.user_group.read
     - core.user.read
     - login
     - openid
     - profile
 
   **If you also want to sync Account Groups, add:**
@@ -119,7 +150,7 @@
     - core.user.read
     - core.user.write
     - login
     - openid
     - profile
 
   **If you also want to sync and provision Account Groups, add:**
@@ -146,13 +177,13 @@
 
 **Done.** Next, move on to the connector configuration instructions.
 
 ## Configure the Coupa connector
 
 <Warning>
 To complete this task, you'll need:
 
 - The **Connector Administrator** or **Super Administrator** role in C1
 - Access to the set of Coupa credentials generated by following the instructions above
 </Warning>
 
 <Tabs>
@@ -185,7 +216,7 @@
   Find the **Settings** area of the page and click **Edit**.
   </Step>
   <Step>
   Enter your Coupa domain in the **Domain** field.
   </Step>
   <Step>
   Paste the client ID into the **Client ID** field.
@@ -201,12 +232,12 @@
   </Step>
 </Steps>
 
 **Done.** Your Coupa connector is now pulling access data into C1.
 
 </Tab>
 <Tab title="Self-hosted">
 
 **Follow these instructions to use the Coupa connector, hosted and run in your own environment.**
 
 When running in service mode on Kubernetes, a self-hosted connector maintains an ongoing connection with C1, automatically syncing and uploading data at regular intervals. This data is immediately available in the C1 UI for access reviews and access requests.
 
@@ -216,7 +247,7 @@
 
 * [GitHub repository](https://github.com/conductorone/baton-coupa): Access the source code, report issues, or contribute to the project.
 
 ### Step 1: Set up a new Coupa connector
 
 <Steps>
   <Step>
@@ -251,7 +282,7 @@
 
 ### Step 2: Create Kubernetes configuration files
 
 Create two Kubernetes manifest files for your Coupa connector deployment:
 
 #### Secrets configuration
 
@@ -315,14 +346,14 @@
 
 <Steps>
   <Step>
   Create a namespace in which to run C1 connectors (if desired), then apply the secret config and deployment config files.
   </Step>
   <Step>
   Check that the connector data uploaded correctly. In C1, click **Apps**. On the **Managed apps** tab, locate and click the name of the application you added the Coupa connector to. Coupa data should be found on the **Entitlements** and **Accounts** tabs.
   </Step>
 </Steps>
 
 **Done.** Your Coupa connector is now pulling access data into C1.
 
 </Tab>
 </Tabs>