User provisioning from SAP Cloud Identity Authentication Service (IAS) to SAP S/4 HANA Cloud

[harjeetjudge]

This blog will cover how we can provision users from SAP Cloud Identity Authentication Service (IAS) to SAP S/4HANA Cloud.  I will use SAP Cloud Identity Provisioning Service (IPS) to accomplish this.

If you are familiar with S/4HANA Cloud you will know that the user onboarding process involves:

1. Creating employees and business users in S/4HANA Cloud system.  This can be done by importing the employees from an HCM system like SAP SuccessFactors or from a csv file.


2. Exporting the business users from S/4HANA Cloud system and importing them into SAP Cloud Identity Authentication Service (IAS) that is pre-configured with the S/4 instance.

Here are couple links to help you get familiar with the user onboarding process in S/4HANA Cloud:

• https://blogs.sap.com/2017/12/07/sap-s4hana-cloud-system-setup/


• https://microlearning.opensap.com/media/User+Management+Overview+-+SAP+S+4HANA+Cloud+Deployment/1_26...

Now, you might be wondering why would I need to provision users from IAS into S/4HANA Cloud? In step 2 of the onboarding process, aren't we doing the exact opposite?

One reason is to ensure that the S/4HANA Cloud user profile has the Global User ID populated with a value that matches the User UUID field from IAS.  The Global User ID field in the S/4HANA Cloud user profile will be empty unless we actually run a job to provision users from IAS to S/4.  The User UUID field in IAS is used by applications such as SAP Task Center to uniquely identity a user record across different SAP applications.  I covered SAP Task Center integration with S/4HANA Cloud in another blog where I also highlight the importance of the User UUID field.

 



The second reason is that you may also want to manage S/4 business roles assignment based on user's group membership in IAS.  This way the user can be added/removed from group(s) in IAS and that change will be reflected in the S/4 system after the provisioning job is run.

NOTE: It's not possible to add new business roles to S/4HANA Cloud via provisioning job.  The roles must already exist in the S/4 system.  It's also not possible to create a new business users during the provisioning job, unless the employee record already exists in S/4 system.  For eg, I can't just add a new user in my IAS tenant and expect it to be created in the S/4 system during the provisioning process.

To prove my point, I've create a "DEMO" user in my S/4Cloud system.  Since it's a brand new user the Global User ID field is empty.  I've also created a Business Role "BR_DEMO" in my S/4 system, but notice that the user is not assigned this business role.

The user onboarding process in S/4 requires that the user from S/4 is imported into the IAS tenant.  When my demo user is imported into IAS, it will get a User UUID field.  I've also created a group in IAS called "BR_DEMO" and assigned the user to that group.  The screenshot below shows the user attributes in IAS and its group membership.

Now that we know why we need to do this, let's look at the mechanics of how to use SAP Cloud Identity Provisioning Service (IPS) to replicate the users from SAP Cloud Identity Authentication Service (IAS) to SAP S/4HANA Cloud.  Following steps are required to provision users:

1. Create a Communication System in S/4HANA Cloud


2. Setup IAS as a source system in IPS


3. Setup SAP S/4HANA Cloud as a target system in IPS


4. Run the source provisioning job

Create a Communication System in S/4HANA Cloud

1. Log into your S/4HANA Cloud system and access Maintain Communication Users.


2. Click New and create a new communication user.  Specify a User Name, Description, and Password.  Click Create.


3. Access Communication Systems.


4. Click New and specify a System ID and System Name and click Create.


5. Specify a value for Host Name to match your IAS tenant hostname.  For eg. xxxxxxx.accounts.ondemand.com


6. Click + under Users for Inbound Communication.


7. Select the Communication user created earlier and click OK.


8. Save your Communication System.


9. Access Communication Arrangements


10. Click New and choose the value help icon to open up the list of available communication scenarios.


11. Search for SAP_COM_0193 and select it from the list.  This communication scenario is relevant for Identity Provisioning integration.


12. Specify a name for the arrangement and click Create.


13. Use the value help icon and select the Communication System created earlier.  The User Name for inbound communication should automatically populate.  Save your configuration.

Setup IAS as a source system in IPS

1. Access your IAS Administration Console.


2. Under Administrators, click Add >> System.


3. Specify a name for your user and ensure the following authorizations are enabled:
   
   
   
   • Manage Users
   
   
   • Manage Groups
   
   
   • Manage Tenant Configuration
   
   
   
   


4. For Set Password section, click Not Configured.


5. Specify a password for your user and click Save.  After saving, you will redirected back to the previous screen.  Navigate back to the password screen and copy the User ID using the Copy icon.  We need this User ID and the password later when setting up IAS as a source system in IPS.


6. Access your SAP Cloud Identity Services – Identity Provisioning (IPS) tenant.


7. Click on Source Systems.


8. Click Add.


9. Specify the following and click Save:
   
   
   
   • Type: Identity Authentication
   
   
   • System Name: <name of your choice>
   
   
   
   


10. Click Properties. You will see a list of pre-created properties.


11. Click Add to add new properties.  Use the Standard option for non-sensitive properties and Credential option for password fields.


12. Add the additional properties below and click Save. Take a look at the help guide for the complete list of properties that are possible with Identity Authentication as a target system.
    
    
    
    • Type: HTTP
    
    
    • ProxyType: Internet
    
    
    • URL: <your IAS tenant URL>
    
    
    • Authentication: BasicAuthentication
    
    
    • User: <IAS system user>
    
    
    • Password: <IAS system user password>
    
    
    
    

Screenshot below shows the setup of my source job setup in IPS.  Notice that I've also added some additional properties to filter the user and group that is read from IAS.  It's good idea to test the provisioning job with couple users and groups before you remove the filter and run the job for all users and groups.  For the purpose of this blog, I am just going to provision the "DEMO" user and "BR_DEMO" group.

Setup SAP S/4HANA Cloud as a target system in IPS

1. Access your SAP Cloud Identity Services – Identity Provisioning (IPS) tenant.


2. Click the Target System icon and click Add.


3. Specify the following and click Save:
   
   
   
   • Type: SAP S/4HANA Cloud
   
   
   • System Name: <name of your choice>
   
   
   • Source System: <your IAS source system created earlier>
   
   
   
   


4. Under Properties, add the additional properties below and click Save. Take a look at the help guide for the complete list of properties that are possible with S/4HANA Cloud as a target system.
   
   
   
   • Type: HTTP
   
   
   • ProxyType: Internet
   
   
   • URL: <S4/HANA Cloud URL>
   
   
   • Authentication: BasicAuthentication
   
   
   • User: <Communication User created in S/4 system earlier>.
   
   
   • Password: <Password of the communication user>
   
   
   
   

The screenshot below shows the setup of my target system in IPS.

Run the source provisioning job

1. Switch to Source Systems.


2. Select your source job and click Jobs icon.  Click Run Now icon to start the Read Job.


3. Monitor the status of your job under the Job Logs until you see a Success or Failure status.  You will need to navigate away and come back to this page to see the updated status.


4. View the details of the job execution.  In my case 1 users and 1 group is created successfully.

Once the provisioning job is successfully executed, the demo user in S/4 system has the Global User ID and Business Role assigned.

 

While the focus of this blog is on S/4HANA Cloud, majority of the steps covered here can easily be adapted to provision users to other ABAP based cloud systems, such as: SAP Integrated Business Planning (IBP) and SAP BTP ABAP Environment.

[DeepikaB]

Hi Harjeet,

 

Thanks for the useful doc.

I have a requirement to map s/4 HANA ABAP on premise to IAS for authentication.

I could successfully map the WEBGUI ( URL) of on premise to IAS. But the client wants the authentication from SAP Logon PAD. That is when the user tries to enter user ID & Password it should route to IAS - IS it even possible if yes , please let me know the config guide link to check the same.

 

Thanks,

Deepika

[harjeetjudge]

Hi Deepika,

SAML auth will not work with desktop clients like SAP GUI.  You will need to use the approach covered in the blog below:

https://blogs.sap.com/2012/08/17/how-to-configure-sap-netweaver-single-sign-on-for-sap-gui-for-windo...

Harjeet

[former_member621650]

Hello Harjeet,

Many thanks for the writeup.

One question:

NOTE: It’s not possible to add new business roles to S/4HANA Cloud via provisioning job.  The roles must already exist in the S/4 system.  It’s also not possible to create a new business users during the provisioning job, unless the employee record already exists in S/4 system.  For eg, I can’t just add a new user in my IAS tenant and expect it to be created in the S/4 system during the provisioning process.

Does this mean that this configuration can somehow help us create a Business User from automatically using the IPS job, if the employee record is set up? Because that is the scenario which we are currently exploring -> The employee record will be created in S4 via an interface from Workday. However, we need an automated way to generate the Business User and link it to this generated employee record.

Any help would be greatly appreciated, thanks! 🙂

[Rachelhsu]

Hi,

Does your scenario fit for the 3-system of S/4HANA Cloud?

Right now, we met that we can't logon S/4 because there is only initial user ID in hand-over email.

[harjeetjudge]

Hi Rohit,

"Does this mean that this configuration can somehow help us create a Business User from automatically using the IPS job, if the employee record is set up? Because that is the scenario which we are currently exploring -> The employee record will be created in S4 via an interface from Workday. However, we need an automated way to generate the Business User and link it to this generated employee record.""

[HJ] That is exactly what I did in this blog.  Business users were provisioned to S/4 Cloud and business roles were mapped based on the user group assignment in IAS.

Thanks,

Harjeet

[JTR]

Hello Rachel,

This behavior has been enhanced with the S/4HANA Cloud 2208 release.

Please check here the update description.

The SAP IAS Solution can manage authentication and authorization for all systems in scope.

Therefore it can manage S4HC DEV and TEST. However, it's advisable to differentiate IAS Test and Prod tenants.

License provides 2 tenants - TEST and PROD. You may also check this information here.

Hope this helps your question.

Thank you

[SubbuIyer]

Thanks Harpreet.

However, I think still you have not covered the scenario that Rohit has asked. He says that employees are created through an external HR interface such as Workday in S/4HANA Cloud. The business user does not exist at this point. In your scenario you have already created the user DEMO in S/4HANA Cloud.

So, will this work if the business user does not exist in the system? i.e. we create the user in IAS, assign a group and then sync S/4 using IPS then the user is created in S/4, mapped to the employee and assigned the role?

regards,

 

Subbu Iyer

[harjeetjudge]

The provisioning job will create the business users and assign them to roles.  The employee record must exist as the job will not create the employee records.

[SubbuIyer]

Thanks for the confirmation Harjeet.

Is there a way to automate the creation of IAS users (in the absence of SuccessFactors) without manually doing the file upload and also considering the fact that the employeeID and User Name need to be identical.

 

[marhol]

Identity Directory of SAP Cloud Identity Services offers a SCIM REST API to manage resources (users, groups and custom schema): API Reference | Identity Directory Service | SAP API Business Hub. (see e.g. also Identity Directory SCIM REST API | SAP Help Portal)

IPS can also connect to IAS as target system to provision user from a corporate user store to the Identity Authentication user store: Identity Authentication | SAP Help Portal

[SubbuIyer]

Thank you Marco.

Does this process work for deactivation as well. If the user status is inactive in IAS, does it lock the user in S/4HANA cloud? My apologies for flooding this blog with questions.

Regards,

 

Subbu Iyer

[SubbuIyer]

Hello Harjeet,

This has been a very useful blog. I have one more question.

Where do you map the IAS group to S/4HANA business role? How does the system know that IAS group BR_DEMO is eq to S/4 role BR_DEMO?

 

Regards,

Subbu Iyer

[rahuljain257]

Hello Harjeet ji,

Thanks for the article !!! I have 1 query - 

We are looking to create a new tile on the S/4 HANA Home screen, tentatively named "Web Portal." The goal is for this tile to serve as a gateway, redirecting users to our Web Portal hosted within the Cloud Foundry environment of BTP. Upon redirection from the S/4 HANA Tile to the Web Portal, we aim to transmit certain information, such as the details of the currently logged-in user.

Is there a provision to facilitate this transfer, and if so, how can it be implemented?

Regards

Rahul Jain

[Alterman]

Can SAP make it more cumbersome?  Many don't want to create employees.  Many don't want to have anything to do with SAP HR.

This is an incredibly weak argument:

"
Now, you might be wondering why would I need to provision users from IAS into S/4HANA Cloud? In step 2 of the onboarding process, aren't we doing the exact opposite?

One reason is to ensure that the S/4HANA Cloud user profile has the Global User ID populated with a value that matches the User UUID field from IAS.  The Global User ID field in the S/4HANA Cloud user profile will be empty unless we actually run a job to provision users from IAS to S/4.  The User UUID field in IAS is used by applications such as SAP Task Center to uniquely identity a user record across different SAP applications.  I covered SAP Task Center integration with S/4HANA Cloud in another blog where I also highlight the importance of the User UUID field."