Step by Step instruction to Setup / Update IAS User Passwords in Mass using Postman

[yashkhanna]

Step by Step instruction to Setup / Update IAS User Passwords in Mass using Postman

Background:

As per SAP Note “3001615 - How to mass update user password in Identity Authentication” there are below options to update password of IAS users in mass:

1. Use SCIM Rest API, Update User Resource option. Provide the "password" attribute during the update, as a result, the password will be changed.
2. Create a collection of users to mass update more users at the same time. For Postman, following the document: Using the Collection Runner.
3. In case Identity Provisioning Service (IPS) is integrated, use it to set initial passwords for all users: Passwords Are Stored in Identity Authentication (initial password).

This blog focuses on step-by-step instruction on how to setup passwords in mass through Postman using Collection runner ( option 2).

Section 1 – Setup a system user in IAS:

To be able to update passwords for IAS users using the SCIM API, we need a system user in IAS for authentication in Postman. Follow below steps to create a system user:

1. Login to the IAS tenant admin console (https://<tenant ID>.accounts.ondemand.com/admin)
2. Open the “Administrators” tab in “Users & Authorizations” and click on Add. Create a System user by clicking on “System”.

3. Give the Display name:

4. In Configure Authorizations, select Manage Users and Manage Groups:

5. Click on Save button and next we must set the Secrets for authentication.

6. Click on Secrets and then add Secret. Make note of the Client ID and Client secret as this cannot be retrieved from system later. This will be required during authentication in Postman.

Section 2: Setup Postman:

1. Ensure you have installed POSTMAN and have logged in. It can be downloaded here: https://www.getpostman.com/.
2. Pick PUT with the following endpoint https://<tenantID>.accounts.ondemand.com/service/scim/Users/{{USERID}}. Here USERID is used as a variable.

3. Goto Authorizations. Select Basic Auth. In Username enter Client ID and in Password enter Client Secret you have setup earlier for the system user in IAS:

4. In Headers change Content-Type = application/scim+json. Keep all the other entries as is:

5. In Body, select RAW and JSON and enter the below code and save the settings:

{

    "id": "{{USERID}}",

    "passwordStatus": "enabled",

    "password": "Enter Password of your choice"

}

Password status = enabled will set password as productive for users. If you want to set password as initial use Password status = initial

You can provide password of your choice within quotes.

6. Define USERID as a variable in system. Click on the “USERID” and you will get option of “Set as variable”.

Section 3: Updating passwords in mass:

1. Prepare a list of IAS USER IDs for which you want to reset password in a file with .csv format. Ensure you give header name same as the variable name. In our example its USERID. Here we must use the system generated P IDs of users in IAS. Refer to screenshot below:

2. Execute the Script you saved earlier in Runner and give the number of iterations = number of entries you have in your upload file. Upload the load file in Data section and run the collection:

3. In run results you should see return code = 200 OK which confirms run was successful and password was setup for the user.

4. Password is configured for the users in IAS:

[meenakshi_si]

Hi Yash,

This is really nice blog and very helpful. However , am getting authorizations 401 error...Do you have idea about it?

-  can the passwords be added differently instead of a common password for all users

- To run this process, is there a pre-requisite like any codeto be added in transformation or SCIM API version 2 is required or anything else?

Thanks,

Meenakshi

[yashkhanna]

Hi @meenakshi_si ,

Yes, you can provide different passwords for different users... its just that you have to define password also as a variable, instead a fixed value. And then pass that value through upload file.

To avoid errors... ensure that client id and client secret you have added is correct. Also if you try to assign the same password, for ex. Newuser@12345, by running the script for the same users, it will throw error, as same password cannot be assigned repatedely to the same user. This is by design.

To make this process work, no code or transformation logic changes are required.

Regards,

Yash

[meenakshi_si]

Thanks Yash!

How to add password as variable if you can advise please.

[yashkhanna]

@meenakshi_si - Please follow my other blog below which detials the steps:

https://community.sap.com/t5/technology-blogs-by-members/step-by-step-instruction-to-setup-user-in-i...

Regards,

Yash

[sobbaia]

Hello, @yashkhanna, thank you for the guide!
However, I'm getting this error: Successful POST request | AssertionError: expected 503 to be one of [ 200, 201 ]
I think I've set everything up correctly but I'm still getting this error, and in the response body in the console this is what it displays: “No server is available to handle request for this tenant , or the application is temporarily down for maintenance. Excuse us for the inconvenience.”
Could you help me to find out what could be the origin of the error?
Thanks

[ritian2023]

We have tried it, and it worked, however could you please let us know the maximum iteration that can be run at a time?

[ahrbmartin]

As per the Note, the APIs mentioned on line #1# are deprecated:

• The SCIM Rest API's mentioned above are deprecated with limited availability, these are replaced with the new Identity Directory Service SCIM Rest API's available at the API Business Hub 
  
  Is there any update to using the new APIs, or any major difference? Or what you have in the blog ARE showing with the new APIs?

[AyushiGeorge]

I am getting 403 forbidden access error, please help to remove it, thank you!