IAS Proxy System: Is fixed group assignment possible without sending groups in the inbound payload?

[#1]

IAS Proxy System: Is fixed group assignment possible without sending groups in the inbound payload?

Hi all,

we are working with SAP Identity Provisioning and Identity Authentication as a proxy system. Our client calls the proxy SCIM endpoint like this:

/ipsproxy/service/api/v1/scim/<system_id>/Users

Our user provisioning itself works fine, including custom attributes via proxy read/write transformations.

What we are trying to achieve now is this: A newly created user should automatically be assigned to one fixed group that already exists in IAS.

What makes this a bit confusing is that in standard provisioning from a source system to a target system, SAP documents group assignment via assignGroup, where groups are identified by ID in the target transformation. So for source-to-target provisioning, assigning groups by target group ID seems to be supported.

However, in our case we are not using a normal source-to-target provisioning flow, but an IAS proxy system.

We found SAP KBA 3520458: Provision user's group assignment in Identity Authentication IPS proxy system

The KBA suggests the following mappings:

Read transformation

{
  "sourcePath": "$.groups",
  "targetPath": "$.groups",
  "optional": true,
  "preserveArrayWithSingleElement": true
}

Write transformation

{
  "sourcePath": "$.groups[*].value",
  "targetPath": "$.groups[?(@.value)]",
  "optional": true,
  "preserveArrayWithSingleElement": true
}

Our understanding is:

• In standard source-to-target provisioning, assignGroup by group ID is supported in the target transformation.
• In proxy mode, the KBA mapping seems to only pass through groups if they are already present in the inbound payload.
• That would mean the calling system must send the IAS group ID in groups[*].value.

So our actual question is:

Is it supported in an IAS proxy system to assign a fixed, already existing IAS group purely inside the proxy transformation, even if the inbound payload does not contain groups?

Or is the only supported option in proxy mode one of these two?

1. The calling system sends the group ID in the user payload.
2. The user is assigned afterwards via a separate PATCH /Groups/{groupId} call.

Any confirmation, SAP guidance, or working example would be very helpful.

Thanks.