Community
Technology Blog Posts by SAP
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 

This is my test in setting up IPS to provision user and groups to my Cloud ABAP developer Trial system which is on my home docker.

My test scenario, I have

  1. A Cloud Identity Service in US East region
  2. my BTP subaccount in US East region
  3. Subscribed to Cloud Identity Services Connectivity Plan in my BTP subaccount
  4. I have my Abap Cloud Developer 2023 trial system running on docker
  5. Configured the Cloud Connector in the docker to connect to my BTP subaccount

Since I don’t have a Corporate iDP proxied in my Cloud Identity Service (SCI) , I will use the SCI identity stored as my iDP (user store)  and IPS source.  The goal is to be able to provision the user and groups in IAS into my ABAP Cloud Identity.

So, roughly it will look like this.

Laurence_0-1756858302450.png

 

This is important for IPS to be able to access the RFC destinations in that subaccount. The subaccount needs to be in the same region as the IPS tenant. See here. 

Note that trial version of Cloud Identity Services will not work with on-premise as it does not come with "Connectivity plan". See blog.

Some notes about SCI plans.

The rest of the configuration, follow the sap help documentation that provided a concise step by step procedure that includes setting up IAS/Cloud Connector/Tenants/ABAP role/ABAP Technical user/RFC Destinations:

How to connect Identity Provisioning with IAS as the source and S/4 HANA On-Premise as the target

Instead of repeating the steps, I'll put screenshots of my setup.

My Setup Screenshots

BTP Subaccount

Laurence_1-1756858302459.png

 

SCI connectivity plan subscribed.

Cloud Connector on docker

Laurence_2-1756858302476.png

Cloud Connector is available in BTP subaccount

Laurence_3-1756858302486.png

 

Cloud Connector is active

Subaccount RFC Destination to Cloud ABAP on-premise

Laurence_4-1756858302499.png

 

IPS Source:

Laurence_5-1756858302506.png

 

In my example, ias.user.filter parameter is used to filter to just one test user.

The recommendation is to filter based on your needs and not provision every groups and users,  which might overwhelm the ABAP system with unnecessary users.  

IPS Target:

Laurence_6-1756858302512.png

 

Laurence_7-1756858302518.png

 

 

Lessons learned:

  1. Cloud Identity Service must not be NEO. 
  2. Subaccount tenant for the on-premise system must be in the same region as the Cloud Identity Service.
  3. Connectivity Plan is needed for the subaccount with the on-premise RFC destinations.
  4. IAS group provisioned as Business Role in ABAP, not in SUGR. The business Role must exist in ABAP for it to be provisioned to the user.
  5. IAS user must have a Login Name. This is mapped to user field in SU01.

 

Hopefully these learnings and screenshots will help the community.

 

 

Comment
Labels in this area