SSO user mapping Using SAML 2.0

[Ahmed-Ibrahim]

Dear Expert ,

hope you have nice day all of you.

i am planning to implement SSO using SAML 2.0 , our MS Active directory already integrated to our AS JAVA SSO System as IDP is configured as well Service provider, my login ID for Domain same as Login ID to the IDP (AS JAVA SSO SYSTEM) authenticated using kerberos for Example TEST1 but my login to S/4 HANA System is different for example TEST2 as well Email Registered in user master record is different then the Email Registered on IDP

kindly, advice regarding how to map between user TEST1 and TEST2

actually, i tried to use the following SAPNOTE but it is not working

1254821 - SAML authentication for Web services in AS ABAP

thank you

Ahmed

[Matt_Fraser]

Hi Ahmed,

I slightly edited your question to fix a typographical error in the title. You wrote "SMAL" when you clearly meant "SAML." Fixing this should help with its searchability for others.

Regards,
Matt Fraser
SAP Community Moderator

[Colt · Accepted solution]

Dear Ahmed,

so you have installed your SAP IdP (AS Java) using SPNEGO to authenticate your user, based on their Active Directory authentication. Now your IdP has a UME setup. Either local users only or LDAP or ABAP UME. On one of your Service Providers (S/4 HANA) you have different user IDs. Now you are facing the challenge of Identity Federation - a normal challenge 😉

There are some solutions to federate identities between the IdP and SPs. As SAML is used to work cross-company, it happens often that you don't even have a clue about the user IDs or attributes of the connected SPs.

In general the User ID Mapping can happen at the IdP or the SP.

You can:

• Use an existing common, unique NAME to map the accounts: Seems to be not possible in your case, mostly here the email address is used
• Create a new common, unique IDENTIFIER to link the accounts: You "could" create a custom UME attribute (or use a LDAP/ABAP attribute such as Logon Alias etc.) where you maintain different attributes for your SPs and use them for Name ID creation. In that case your IdP would put TEST2 into the assertion issued for SP (S/4 HANA) and on your SP you just need to map the name ID with your Logon ID.
• You can also make use of interactive account linking by using Persistent Pseudonyms as your Name ID format for that SP: Persistent IDs are opaque, random values that are used for each log-on session to link the IdP and SP accounts. They are useful in federation scenarios where no common name exists and/or privacy of the real user name is a concern. In such case if the user is accessing the SP next time he will be asked to federate his account.

Besides this, you can also put TEST1 or the email-address into the assertion and map this on the S/4 HANA system using logon alias or USREXTID table.

Cheers
Colt

[Ahmed-Ibrahim · Accepted solution]

Hello Colt

thank you, great explanation :),

i use login alias mapping , it is working fine.

i am trying to use mapping in usrextid table , but it is not working

appreciate if you help my with one entry as an example for mapping in usrextid table

thank you

Ahmed