Managing Users and Authorizations on SAP BTP

Objectives

After completing this lesson, you will be able to:

Manage users in a Global Account
Manage users in Directories
Manage users and authorizations in Subaccounts

User Management in a Global Account

Screenshot from SAP BTP cockpit Global Account screen highlighting the user management and user creation sections.

In a Global Account, you can create platform users and assign predefined role collections to them.

To create a user, you need to navigate to Security → Users, and choose the Create button in the top-right corner.

When creating a new user, you always have to specify the identity provider. By default, users are created using the default identity provider SAP ID service. If you've configured a custom identity provider in a global account, you can change the IdP in the Identity Provider field.

Screenshot from SAP BTP cockpit Global Account screen highlighting Role Collections.

There's one predefined role collection for administrative tasks and one for read-only access to the global account.

With the Global Account Administrator role collection, the user can perform the following tasks:

Create new and edit existing Subaccounts, within the Global Account
Manage entitlements
Manage users
Manage role collections

With the Global Account Viewer role, the user only gets read access to the mentioned items.

With the authorizations from predefined roles for Global Accounts, the user is not permitted to access any Subaccount that has been not created by them.

User Management in a Directory

Two screenshots: One showing where to enable User Management of a Directory and the other highlighting where to Create a Directory User.

You can create directories for better structuring. Furthermore, you can enable user management for the directories. You can create and maintain directory administrators and viewers. This is an optional step, and you can always disable it again if you need to.

If you want to have more directory administrators next to yourself, enable user management. If not, keep it disabled.

When adding a new user, you always have to specify the identity provider. By default, a user's origin is the default identity provider, SAP ID service. If you have configured a custom identity provider in a Global Account, you can change the IdP in the Identity Provider field.

User Management in a Subaccount

Screenshot showing how to create a user.

If a user should be able to access a Subaccount, the user needs to be added under Security → Users on the Subaccount level.

To add a new user to the Subaccount, perform the following steps:

Open the SAP BTP cockpit.
Go to your Subaccount.
Choose Security → Users.
Choose Create. The SAP BTP Cockpit displays a dialog box where you can enter the user data.
Enter the user e-mail in the User Name and E-Mail fields.
Choose the identity provider where the user is stored. The dropdown list in the Identity Provider field displays the identity providers for which the trust connection has been configured in the Subaccount.
If you've configured a custom identity provider in a Global Account and you want to create a new platform user for the Subaccount, choose the IAS tenant in the Identity Provider field that's used for platform users.
Choose Create.

You can now proceed with assigning Role Collections to the new user.

Note

Users from the SAP ID service are identified by their e-mail address and not their user ID. This is why, when using the default identity provider to create a new user, you need to enter the e-mail address as the user name. If you have multiple user accounts that share the same e-mail address in SAP ID service, they all get the same authorizations.

For more information, see Create Users.

Default Role Collections in a Subaccount

Screenshot of SAP BTP cockpit Subaccount screen highlighting Role Collections.

There are several predefined rolecCollections that you can use when adding platform users to a Subaccount. These are the two most important ones:

Subaccount Administrator
Subaccount Viewer

If you assign the Subaccount Administrator role collection to a user, you grant the user administration permissions for the Subaccount. The user is then able to view and configure the entitlements for the Subaccount, create users, assign role collections, configure trust, create destinations, and so on.

The user who creates the Subaccount automatically gets the administrator permissions. All other users must explicitly be added as Subaccount users and have the corresponding role collections assigned.

After initially deploying your accounts, there are also other default role collections available in the cloud management tools. If you do not want to provide all administration rights to a user, but narrow it down to a specific task (for example, connectivity administration), you only assign the relevant role collection.

Create Administrator User in a Subaccount

ExerciseStart Exercise

Concept of Shadow Users in a Subaccount

All users in Subaccounts of SAP BTP are stored in identity providers. This could be the default SAP ID service, SAP Cloud Identity Services, or also a third-party identity provider. Users that are created on SAP BTP are called shadow users, which are user copies from the identity provider.

Especially in Subaccounts, this concept is relevant. SAP BTP automatically creates a copy (shadow user) of the user in the Subaccount as soon as the user that exists in the identity provider logs on to the Subaccount or an application of it.

Note

The feature for automatic shadow user creation is switched off by default. This means that you have to create shadow users manually and provide them with permissions.

However, the user does not have any authorizations, so an administrator needs to assign role collections to the user.

For more information, read the official documentation: Mapping Role Collections in the Subaccount

Screenshot showing how to automatically create shadow users.

Switch On/Off Automatic Creation of Shadow Users

Although the actual user is created in the identity provider, you can't assign authorizations to a user in an identity provider. You need a shadow user in the SAP BTP to permit access. When you create a shadow user, you must know and specify which identity provider stores the user.

If you want shadow users to be created automatically, for example, when using the self-registration process, you can switch on the automatic creation of shadow users for the respective identity provider. This would mean that when a user exists in the identity provider and shadow user creation is allowed, the copy of the user is created once the user logs on to the SAP BTP cockpit or an respective SAP BTP application or service.

If, however, you want control over applications to which users can log on, you can switch off automatic creation of shadow users for an identity provider. This ensures that only those shadow users who have been manually created by the administrator, will be able to log on.

Regardless of whether the shadow user was created manually or automatically, if the user exists, you can assign a role collection to the user.

Assigning Application-Specific Authorizations to Users

On the Subaccount level, administrators assign SAP BTP role collections to users so they can use the services and applications of SAP BTP. If available, they can assign predefined role collections that are deployed after subscribing to an application. The role collections contain the predelivered roles.

Two screenshots from SAP BTP cockpit Subaccount Instances and Subscriptions showing how to manage roles for an application.

After the application is subscribed, it appears in the Instances and Subscriptions area. To review the roles that are delivered with the application, you can choose the three dots and select Manage Roles next to the subscribed application.

On the Details screen (which you can expand), you'll see a list of Role Templates, Role Names, and the Description delivered with the applications.

In the Attributes column, you can see if a role has been created from a role template and if any attributes have been defined for the role.

Attributes can be used to specify roles and refine authorizations. For more information, see Attributes

In the Role Collections column, you can see if the role is already included in a role collection.

Note

If you inspect roles like this, not all of the application roles might be displayed. To view all roles within a Subaccount, navigate to Security → Roles.

Two screenshots from SAP BTP cockpit Subaccount Role Collections highlighting Roles and Role Collections.

In the SAP BTP cockpit, you can display information about the role collections that have been maintained as well as the roles available in a role collection by navigating to Security → Role Collections and Security → Roles.

In Security → Roles, you can find additional information, such as: which templates the roles are based on, and which applications the roles apply to.

In Security → Role Collections, you can display available role collections and see which roles they include. From here, you can assign role collections to users.

Inspect and Assign Predefined Role Collections for Applications

ExerciseStart Exercise

Creating Custom Role Collections

Two Screenshots from SAP BTP cockpit Subaccount Role Collections. The first screenshot highlights Role Collections and the second highlights Name of custom Role Collection.

When assigning role collections, administrators can assign predefined role collections. However, predelivered role collections don't always exist, or they don't meet the business requirements. Therefore, administrators can create new role collections by copying the existing ones or creating them from scratch.

Administrators then add predelivered roles to their own role collection. These can be default roles that already exist and are used in other role collections, or these can be roles that are created from a template. Afterward, administrators can assign the role collection to the appropriate user. A user can have one or many role collections assigned. Roles and permissions contained in role collections are then automatically assigned to the user.

For more information, see Define a Role Collection.

Screenshot of SAP BTP cockpit Subaccount Roles showing how to work with roles. Roles, Role Details, and Adding role to Role Collections are highlighted.

In the navigation pane, under Security → Roles, you can see a complete list of all existing Roles, sorted by the application name the roles belong to. It also contains the role template, role names, and role description.

Next lesson