Security and Data Protection and Privacy

SAP Solution Sales Configuration, cloud edition provides a multi-tenant application with a user interface (SaaS) and an API (Service) component that can be consumed by subscribed tenants. To support these scenarios, it relies completely on the following security mechanisms provided by the SAP Business Technology Platform:

• XSUAA Security and Authentication with Application router (approuter) for the SSC Configuration UI and SSC Admin UI

A trust relationship is maintained between the identity provider (IDP) and the XSUAA. When the application receives an initial unauthenticated request, the approuter redirects the request to the configured IDP for authentication. Once the authentication is successful, the IDP responds back with a SAML assertion (Bearer assertion token) confirming the users identity. These SAML assertions are then used by the authorization server (XSUAA) to determine the authorizations (roles and scopes) of the user.

• Service brokers for SSC Configuration service component

Service to service authentication can be performed using open standard for access delegation (OAuth 2.0). Client applications need get an access token from tenant’s XSUAA using the client credentials (from service binding for corresponding SSC service instance).

To use SSC configuration service, all the customizing and master data (knowledge base, external variant tables, pricing records etc.) must be available in the underlying cloud database. This is available as part of Security Guide for SAP Variant Configuration and Pricing.