Identity Authentication

Follow this procedure to set up SAP Cloud Identity Service – Identity Authentication as a proxy system.

Prerequisites

To establish the connection between Identity Provisioning and Identity Authentication, you need to set up the technical user (of type System) in Identity Authentication and assign this user the necessary authorizations. You have the option to do it either now, as a prerequisite, or while configuring Identity Authentication as a proxy system, as described in step 5.

Context

Identity Authentication provides authentication and single sign-on for users in the cloud.

You can use the Identity Provisioning user interface (UI) to configure Identity Authentication as a proxy system for hybrid integration, where Identity Authentication is connected to an external identity management system for user and group provisioning. Using the Identity Provisioning you can read corporate users from the external system and provision them to the Identity Authentication user store (and the other way around) without making a direct connection between these systems. This way, you can implement secure authentication, single sign-on (SSO), strong authentication, and mobile SSO so that the provisioned users to Identity Authentication have access to the business applications of your company.

The proxy systems consume SCIM 2.0 API which is provided by Identity Authentication.

There are two versions of the Identity Authentication SCIM API. They are handled by the ias.api.version property as follows:

  • When the value is set to 1 or the property is not defined (typical for systems created before versioning was introduced on July 9, 2021) - Identity Authentication SCIM API (in short, SCIM API version 1) is used.

  • When the value is set to 2 - Identity Directory SCIM API (in short, SCIM API version 2) is used. This value is set automatically for all manually created systems in the Identity Provisioning UI after versioning was introduced on July 9, 2021.

SCIM API version 2 is enhanced to support patch operations for proxy systems only, paging for group members and user’s groups, custom attributes, delta read mode for users. Also, the group resource mapping in the transformation is not ignored by default, as it is in SCIM API version 1.

To create Identity Authentication as a proxy system, proceed as follows:

Procedure

  1. Open your subaccount in SAP BTP cockpit (valid for OAuth authentication to the Identity Provisioning proxy system).
  2. Create a technical user with the necessary authorizations. It will later be used by the external consumer to connect to Identity Provisioning.

    • For Certificate-based authentication, follow the procedure in Manage Certificates for Inbound Connection → SAP BTP, Neo Environment

    • For OAuth authentication, proceed as follows:

      1. Go to Start of the navigation pathSecurity Next navigation step OAuth Next navigation step ClientsEnd of the navigation path and choose Register New Client.

      2. From the Subscription combo box, select <provider_subaccount>/ipsproxy.

      3. From the Authorization Grant combo box, select Client Credentials.

      4. In the Secret field, enter a password (client secret) and remember it. You will need it later, for the repository configuration in the external system.

      5. Copy/paste and save (in a notepad) the generated Client ID. You will need it later, too.

      6. From the left-side navigation, choose Start of the navigation pathSubscriptions Next navigation step Java Applications Next navigation step ipsproxyEnd of the navigation path .

      7. From the left-side navigation, choose Start of the navigation pathRoles Next navigation step IPS_PROXY_USEREnd of the navigation path.

      8. Choose Assign and enter oauth_client_<client_ID>.

        For <client_ID>, enter the one you have saved in the previous main step.

  3. Access the Identity Provisioning UI.
  4. Add Identity Authentication as a proxy system. For more information, see Add New Systems.
  5. Set up the communication between Identity Provisioning and Identity Authentication and configure your authentication method (basic or certificate-based).
    1. In your newly added Identity Authentication proxy system, select the Certificate tab and choose Start of the navigation pathGenerate Next navigation step DownloadEnd of the navigation path, as described in Manage Certificates.

      Skip step a. if you want to use basic authentication.

      In SAP Cloud Identity Services administration console, perform the next steps. They are relevant for both basic and certificate-based authentication.

    2. Add System as administrator and provide the respective credentials.

      For basic authentication, provide a password. The user ID will be generated automatically when you set the password for the first time.

      For certificate-based authentication, upload the certificate you have generated in SAP Cloud Identity Services administration console on the previous step.

    3. Save your changes.
    4. Make sure Manage Users and Manage Groups authorization roles are enabled for the technical user. This way, you can create, edit and delete users and groups in the Identity Authentication user store.
  6. Choose the Properties tab to configure the connection settings for your system.

    Mandatory Properties

    Property Name

    Description & Value

    Type

    Enter: HTTP

    URL

    Specify the URL of the Identity Authentication tenant of your company.

    For example: https://mytenant.accounts.ondemand.com

    ProxyType

    Enter: Internet

    The Identity Authentication is a cloud solution and is outside of your company on-premise infrastructure.

    Authentication

    Enter your authentication method:

    • BasicAuthentication

    • ClientCertificateAuthentication

    User

    Valid if BasicAuthentication is configured as authentication method.

    Enter the Client ID (previously User ID) of the Identity Authentication technical user. It is generated automatically for the administrator of type system, when choosing Start of the navigation pathSecrets Next navigation step Add Next navigation step  SaveEnd of the navigation path. For example: 1ab7c243-5de5-4530-8g14-1234h26373ab

    If your technical user was created before January 2020, enter the T-user. For example: T000003

    Password

    (Credential) Valid if BasicAuthentication is configured as authentication method.

    Enter the Client Secret (previously Password) of the Identity Authentication technical user. It is generated automatically for the administrator of type system, when choosing Start of the navigation pathSecrets Next navigation step Add Next navigation step  SaveEnd of the navigation path.
    Optional Properties

    Property Name

    Description & Value

    • ias.<property_name>

    • scim.<property_name>

    When using SCIM API version 2, property names start with ias prefix, for example: ias.user.filter.

    When using SCIM API version 1, property names start with scim prefix, for example: scim.user.filter.

    For more information, see List of Properties. Use the main search or filter properties by Name or System Type columns.

    ias.user.filter

    When specified, only those users matching the filter expression will be read.

    For example: name.familyName eq "Smith" and addresses.country eq "US"

    This filter will read only users whose family name is "Smith" and are living in the United States.

    For more information, see Identity Directory SCIM API: User SearchInformation published on SAP site.

    ias.group.filter

    When specified, only those groups matching the filter expression will be read.

    For example: displayName eq "ProjectTeam1"

    This filter will read only groups, whose display name is "ProjectTeam1".

    For more information, see Identity Directory SCIM API: Group SearchInformation published on SAP site.
  7. (Optional) Configure the transformations.

    Transformations are used to map the user attributes from the data model of the source system to the data model of the target system, and the other way around. The Identity Provisioning offers a default transformation for the Identity Authentication proxy system, whose settings are displayed under the Transformations tab after saving its initial configuration.

    You can change the default transformation mapping rules to reflect your current setup of entities in your Identity Authentication system. For more information, see: Manage Transformations

    Identity Authentication: SCIM REST API Identity Authentication: SCIM REST API

    SCIM API version 2: Identity Directory SCIM APIInformation published on SAP site

    Default read and write transformations:

    Default transformations for SCIM API version 1:

    Read Transformation

    Write Transformation

    Default transformations for SCIM API version 2:

    Read Transformation

    Write Transformation

  8. Connect the external consumer to Identity Provisioning with the technical user you have created in step 2.

    If the external consumer system is SAP Identity Management, you can export the newly created proxy system as a SCIM repository from Identity Provisioning and import it in SAP Identity Management. This will create a SCIM repository in SAP Identity Management where most of the repository constants will be automatically filled in. You need to provide the technical user credentials that you have set up in step 2 and the SCIM assignment method as described below:

    • For AUTH_USER and AUTH_PASSWORD, enter your client ID and secret.

    • For the SCIM_ASSIGNMENT_METHOD constant, make sure the value is PUT.

Next Steps

When a proxy system is connected to an external backend system (in the case of SAP Identity Management this means the exported CSV file is imported into the Identity Management Admin UI and a repository is configured), you can start managing the users and groups into this external system. Usually, the first operation is the initial load of the existing entities into your external system. When this load has finished, changes in the external system, such as creating new users or updating existing ones, can trigger CRUD requests back to the proxy system.

To see an example with SAP Identity Management, see Hybrid Scenario: SAP Identity Management → sections Next Steps and Future Identity Lifecycle.

Related Information