SAP CIS - User shows undefined when authentication to an application using corporate IDP

[AnkitaGhosh1]

Hi Community,

We have an OIDC application created within SAP BTP and it has trust with SAP Cloud identity services. The application works as expected when we use Identity authentication as IDP. But when we switch the IDP to Corporate IDP (which is Entra ID), the authentication is successful however the app launches with no tiles and user shows as undefined. 

Identity federation (user store) is disabled and we have enriched the assertion attributes. Any thoughts on what could be the issue?

[dyaryura]

Hi

The most common issue would be an incorrect mapping of attributes from entraID. The login itself might be successful but the user created in BTP subaccount (shadow user creation enabled) might be a random number of characters (using some OIDC 'sid' attribute or similar) without name, lastname and other attributes

I would have a look at the shadow user created in BTP subaccount and understand how the user is created. if you're not using identity federation you need to make sure to pass the atributes from your corporate IDP in the app configuration. make sure the atributes match with the ones from your corp IDP. Also in IAS, have a look at the "troubleshooting logs" to understand how OIDC token is generated and the attributes used.

Diego

[AnkitaGhosh1]

Thank you Diego - this helped.