Maintaining Business Users

As mentioned previously, predefined role collections are deployed with the SAP Cloud Identity Access Governance service. These role collections ensure that users can access and use specific apps that are relevant for their job function and their dedicated tasks. Within the framework of access governance, tasks have different levels of risk and sensitivity. By assigning the right role collections, you can ensure that users can only perform administrative tasks in line with their job function.

Business users are not created in the default identity provider but rather in the Identity Authentication, that is, part of the bundle solution. You can make users available on a connected LDAP server. For this, Identity Authentication must be configured.

Role collections are not directly assigned to users in the SAP BTP cockpit. Instead, users in Identity Authentication (IAS) are assigned to groups. These groups are mapped with SAP BTP role collections. The group information is synchronized between the Identity Authentication tenant and the SAP Cloud Identity Access Governance on SAP BTP. The defined role collections will be indirectly assigned to the users based on the users included in the mapped IAS user groups.

The required steps are the following:

1. Create user groups in Identity Authentication and assign users to them.
2. Map role collections in the SAP BTP Cockpit to the created user groups.
3. Synchronize user groups information between the Identity Authentication and SAP Cloud Identity Access Governance subaccount.

For more information, refer to the official documentation: https://help.sap.com/docs/SAP_CLOUD_IDENTITY_ACCESS_GOVERNANCE/e12d8683adfa4471ac4edd40809b9038/d62c01ecdf314eaa8aa73a46ecb9d74f.html

1. Log on to the Identity Authentication service. Access the tenant's administration console for Identity Authentication by using the console's URL.

   The URL has the following pattern:

   https://<tenant ID>.accounts.ondemand.com/admin

2. Under Applications and Resources, choose the Applications tile.
3. Choose the service provider, which is the SAP Cloud Identity Access Governance subaccount.

   The name of the service provider has the format XSUAA_<Subaccount Name>, but you can change it if needed.

4. On the Trust tab, choose Assertion Attributes.
5. Ensure the following user attributes are maintained and the assertion attributes are entered as a value.

   Assertion Attributes

   Groups	Groups
   First Name	first_name
   Last Name	last_name
   E-mail	mail

6. Optional: Add the user attribute Groups, if it is missing by choosing Add.
   Note

   The assertion attribute name is case-sensitive. Make sure that the letter G is in upper case.
7. Choose Save.

For more information, read the official documentation on the SAP Help Portal: https://help.sap.com/docs/SAP_CLOUD_IDENTITY_ACCESS_GOVERNANCE/e12d8683adfa4471ac4edd40809b9038/1691c1f23b2743ba95dfc2cb4b039e31.html

SAP Cloud Identity Access Governance services look for groups with specific names representing different owner groups. These groups have to be created in Identity Authentication. The overview of the required groups can be found on the SAP Help Portal: https://help.sap.com/docs/SAP_CLOUD_IDENTITY_ACCESS_GOVERNANCE/e12d8683adfa4471ac4edd40809b9038/d62c01ecdf314eaa8aa73a46ecb9d74f.html

1. In the administration console of Identity Authentication, choose Users & Authorizations.
2. Choose User Groups.
3. Choose Create to create a new user group.
4. Fill in the required information: the name of the user group, the display name, and the description.
   Note

   When you create user groups for the SAP Cloud Identity Access Governance, you must follow this naming convention: IAG_<TYPE>_<NAME>.

   There are also specific groups that are required by SAP Cloud Identity Access Governance services. The overview of the required groups can be found on the SAP Help Portal: https://help.sap.com/docs/SAP_CLOUD_IDENTITY_ACCESS_GOVERNANCE/e12d8683adfa4471ac4edd40809b9038/d62c01ecdf314eaa8aa73a46ecb9d74f.html

5. Choose Create.
6. Add users to the group by selecting the newly created group from the list and choosing Add.

   Now you can select the users that are maintained in the Identity Authentication and them to the group.