Subject Name Identifiier in IAS

[tskwin]

Hello all,

I have a question regarding the Subject Name Identifier in IAS.

I’ve been experimenting in my test environment and here's what I did:

• In Azure, I created a Claim employee_id=user.employee_id.
• In IAS, I set the Subject Name Identifier to Corporate Identity Provider=employee_id.
• The user was created in SAC/BTP with the User Name being the employee_id (User Name filed = 131414)

Then I changed the employee_id in Azure, but the user was still able to log in.

Only when I removed the email=user.email claim in Azure (ODIC), the user could no longer log in to BTP.

I thought the SNI was the main factor for identifying the user in the cloud app.

So, for example, if the user with SNI=234324 is sent to BTP, and only the user with SNI (User Name in Cloud App) 1111 exists in BTP, the user should no longer be able to log in – but this is not the case. It seems that, even though the setting in IAS - Subject Name Identifier=employee_id , the user is identified/found by the email address in BTP

Why is that? Or did I misunderstand the purpose of the Subject Name Identifier?

Do I understand it correctly that the Subject Name Identifier is always equal to the User Name in a cloud app (SNI = User Name in SAC)

Thank you very much.

Best Regards

[MSo · Accepted solution]

Hi tskwin  

I recommend to check the config for 'Identity Federation' in the trust config from IAS to Entra.
https://help.sap.com/docs/cloud-identity-services/cloud-identity-services/integration-configure-iden... 
If Identity Federation is switched off, then IAS will simply forward the assertion provided by the corp. IdP to the application.
If however Identity Federation is on and IAS user store to be used, then IAS will perform a user lookup based on the subject name identifier sent by Entra and 'compile' a new assertion based on the application config in IAS.
Marko

[paula_augedahl · Accepted solution]

Dear tskwin, since an answer was provided to your question, and there has been no other activity on the topic, we have accepted the answer as a solution on your behalf. You can unaccept it anytime if the answer provided was not helpful enough or if you have further questions. Thank you for bringing this question to SAP Community! Best regards, Paula