How can I obtain groups assigned to a user in Cloud Identity Services within my OData service in S4?

[LuizZanella]

We have an application hosted on BTP Cloud Foundry with authentication configured through Cloud Identity Services. So far, everything works fine.

We can retrieve the logged-in user's data via the approuter and then obtain the user's data from Identity, including their groups and additional information.

The problem is that we need to check some user authorizations based on the groups they are assigned to.

For example, if they are in an approvers group, they can approve certain discount requests.

Once the discount request is approved, it is processed in S4 via an OData service, which is called by the UI5 app through the destination. In the backend, I cannot determine which user is logged into the app or which groups they belong to.

How can we achieve this?

[MSo]

Making the 'backend' application aware of the user context can be achieved by protecting/authenticating the call with a token that contains a user identifier ('principal propagation'); e.g. the OIDC token issued by IAS could be an option. And beforehand one should provision the user-group assignments from a central user store or access governance system to the backend system. This can be done with the Identity Provisioning service.