SAML 2.0 and AD Security Group Membership

[former_member80124]

In ADFS 2.0, as a part of the token, I can pass the AD
security groups the user is in. Does SAP SSO have the ability to send and
receive SAML 2.0 tokens with AD security group membership?

[stefan_petrov · Accepted solution]

Hi Jeff,

SAP SAML 2.0 Identity Provider is able to include any group (or role) assignment of the user (available in the NetWeaver AS Java UME) as SAML Attribute in the generated SAML 2.0 Assertion.

These group assignments of the user can be local (maintained in local UME database) or remote ones if the UME is configured with other Data Source.

So in order to be able send the AD group assignments of the user you need to change the NetWeaver UME Data Source to your AD. More information how to do that you can find at this page: Identity Management - SAP Library.

Then in your Identity Provider you can configured so called "Authorization-Based Assertion Attributes" in the "Identity Federation" tab of your trusted Service Provider configuration. An example with such attributes is provided at this page: Configuring Identity Federation with Transient Users - Identity Provider for SAP Single Sign-On and ... (although the page is for Transient federation these attributes are supported for all supported NameID formats).

Regarding the receiving part:

In SAP SAML 2.0 Service Provider of NetWeaver AS Java received SAML 2.0 Attribute can be either assigned to any UME attribute of the authenticated user, or to be used in rules that assign specific role(s) or group(s) to the user. For more details see these pages: Configuring Federation Type Persistent Users (Advanced) - User Authentication and Single Sign-On - S... and Configuring Federation Type Virtual Users - User Authentication and Single Sign-On - SAP Library

Regards,

Stefan

[former_member191660 · Accepted solution]

Perfect Answer, Stefan

[former_member182254]

For completeness here are links to the relevant features in AS ABAP:

- mapping to service users: Configuring Federation Type Service Users - User Authentication and Single Sign-On - SAP Library

- automatically create and update users: , Automatic User Account Creation and Update using SAML 2.0 in AS ABAP - Security and Identity Managem...

Regards,

Dimitar