Defining Shadow User Concept

All users in Subaccounts of SAP BTP are stored in identity providers. This could be the default SAP ID service, SAP Cloud Identity Services, or also a third-party identity provider. Users that are created on SAP BTP are called shadow users, which are user copies from the identity provider.

Especially in Subaccounts, this concept is relevant. SAP BTP automatically creates a copy (shadow user) of the user in the Subaccount as soon as the user that exists in the identity provider logs on to the Subaccount or an application of it.

However, the user does not have any authorizations, so an administrator needs to assign role collections to the user.

For more information, read the official documentation: Mapping Role Collections in the Subaccount

Although the actual user is created in the identity provider, you can't assign authorizations to a user in an identity provider. You need a shadow user in the SAP BTP to permit access. When you create a shadow user, you must know and specify which identity provider stores the user.

If you want shadow users to be created automatically, for example, when using the self-registration process, you can switch on the automatic creation of shadow users for the respective identity provider. This would mean that when a user exists in the identity provider and shadow user creation is allowed, the copy of the user is created once the user logs on to the SAP BTP cockpit or an respective SAP BTP application or service.

If, however, you want control over applications to which users can log on, you can switch off automatic creation of shadow users for an identity provider. This ensures that only those shadow users who have been manually created by the administrator, will be able to log on.

Regardless of whether the shadow user was created manually or automatically, if the user exists, you can assign a role collection to the user.

On the Subaccount level, administrators assign SAP BTP role collections to users so they can use the services and applications of SAP BTP. If available, they can assign predefined role collections that are deployed after subscribing to an application. The role collections contain the pre-delivered roles.

After the application is subscribed, it appears in the Instances and Subscriptions area. To review the roles that are delivered with the application, you can choose the three dots and select Manage Roles next to the subscribed application.

On the Details screen (which you can expand), you'll see a list of Role Templates, Role Names, and the Description delivered with the applications.

In the Attributes column, you can see if a role has been created from a role template and if any attributes have been defined for the role.

Attributes can be used to specify roles and refine authorizations. For more information, see Attributes

In the Role Collections column, you can see if the role is already included in a role collection

In the SAP BTP cockpit, you can display information about the role collections that have been maintained as well as the roles available in a role collection by navigating to Security→Role Collections and Security→Roles.

In Security→Roles, you can find additional information, such as: which templates the roles are based on, and which applications the roles apply to.

In Security→Role Collections, you can display available role collections and see which roles they include. From here, you can assign role collections to users.

When assigning role collections, administrators can assign predefined role collections. However, predelivered role collections don't always exist, or they don't meet the business requirements. Therefore, administrators can create new role collections by copying the existing ones or creating them from scratch.

Administrators then add predelivered roles to their own role collection. These can be default roles that already exist and are used in other role collections, or these can be roles that are created from a template.

Afterward, administrators can assign the role collection to the appropriate user. A user can have one or many role collections assigned. Roles and permissions contained in role collections are then automatically assigned to the user.

For more information, see Define a Role Collection.

In the navigation pane, under Security→Roles, you can see a complete list of all existing Roles, sorted by the application name the roles belong to. It also contains the role template, role names, and role description.

• Shadow users represent IAS identities in XSUAA and enable subaccount-specific authentication and role assignment control.
• Automatic creation settings prevent unauthorized broad access by restricting shadow user provisioning across subaccounts.
• Manual provisioning processes target consumer subaccounts for precise, least-privilege access assignments and auditability.