SAP Identity Provisioning Service for SAP Identity Authentication Service

[former_member494689]

Hi Experts,

I would like to set User Provisioning from SAP Identity Authentication Service as the source system to the following target systems.

Could you please provide the detail steps to proceed these requirements?

1. from SAP Identity Authentication Service to SAP Cloud Platform Cockpit

source sytem : SAP Identity Authentication Service

target system : SAP Cloud Platform Cockpit

2. from SAP Identity Authentication Service to S4 Hana Cloud

source system : SAP Identity Authentication Service

target system : S4 Hana Cloud

3. from SAP Identity Authentication Service to SAP Analytics Cloud

source system : SAP Identity Authentication Service

target system : SAP Analytics Cloud

4. from SAP Identity Authentication Service to SAP Fiori Launchpad on S/4 Hana

source system : SAP Identity Authentication Service

target system : SAP Fiori Launchpad on S/4 Hana

Best Regards,

Thiri

[TobiasPahlings · Accepted solution]

Hi Thiri,

generally you can find a good guide on the different target systems in the sapHelp scenario list.

Mostly the default-mappings should work perfectly except you have some other requirements.

BR
Tobias

[former_member494689 · Accepted solution]

Hi Tobias,

Noted. Thank you.

Best Regards,

Thiri

[former_member675302 · Accepted solution]

tobias.pahlings

Is there also an option to provision roles to the systems like S/4Hana? This is not clear for me from the help page.

Best regards

[TobiasPahlings · Accepted solution]

mdischer

Yes, S/4 Cloud and onPrem could be both source and target system.

BR

Tobias

[former_member675302 · Accepted solution]

tobias.pahlings

Thank you for your fast answer. I see that they can both be source and target systems but can we really provision roles (not only the user) from groups in IAS or LDAP source system?

The scenario is, that we want to create users in Active Directory, this user with its groups gets provisioned to S/4. Until this point, this should not be a problem. But can we also generate the users roles from the users groups in Active Directory?

I can't find any transformations that are relevant to roles. Only user atributes:

https://help.sap.com/viewer/f48e822d6d484fa5ade7dda78b64d9f5/Cloud/en-US/fd6de3ccee3e4ca09ed49b6c7d8...

If this is possible, do you have a link to the help site?

Thank you in advance!

[TobiasPahlings · Accepted solution]

mdischer

The S/4HANA onPrem connector takes care of the Business Users of the System. If you would like to create SU01 Users with PFCG roles, you need to use the ABAP connector.

With this method it would be possible to assign PFCG roles from LDAP Groups. (Keep in mind that an ABAP System might have a lot of PFCG roles)

if you require also the Business users an additional step needs to be taken.

According to the documentation this scenario requires that you first provision the users to AS ABAP. The created ABAP users will have PFCG roles assigned. Once this is done, the users will have ABAP IDs. Then, after the provisioning to SAP S/4HANA On-Premise, business users will be created and linked to the relevant ABAP IDs via the User_Assignment attribute. According to your use case, you can decide whether to integrate HR (human resources) logic in your system or not.

[former_member675302 · Accepted solution]

tobias.pahlings

Ok That helped. Thank you!