SAC User Attribute Mapping

[tskwin]

Hello Experts,

I understand there are multiple ways to create users in SAP Analytics Cloud (SAC):

1. Dynamic User Creation and

2. Provisioning via IPS.

Which method is generally recommended, and under what cases?

Similarly, for assigning user attributes, there are two options:

1. SAML Attribute Mapping and

2. IPS Transformation.

"targetPath": "$['urn:sap:params:scim:schemas:extension:sac:2.0:group-roles']['roles'][1]['value']",
"condition": "$.displayName == 'group'",
"constant": "PROFILE:sap.epm:Admin",

Which method is recommended, and when should each method be used?

Many thanks

[MatthiasL]

I create and delete users with IPS (thus groups are ignored) The authorizations are fetched upon login

[MatthiasL]

Using both. The first for always accurate Authorizations upon login, the second to clean up users 

[tskwin]

Hello @MatthiasL 

Thank you for your reply.

I’m still a bit unclear on how to use both methods together.

If users are created via Dynamic User Creation, why is an IPS transformation still needed for user creation?

Should group->teams assignments be managed via SAML, while IPS only applies the default transformation without assigning groups/teams, used for deleting/updating users?

many Thanks

Best Regards

[MatthiasL]

I don't know about 'should', that's the thing with CIS, it's really modular and everyone is free to use it for their usecase. But yes, this is how I've done it.

[tskwin]

thanks