SAP Cloud ALM ; SAP Cloud Identity Services ;
Dear SAP Community,
I am working on getting more details and understanding of capabilities of SAP Cloud Identity Services through implementing cases focused on the integration of SAP Cloud Identity Services with local or customer identity providers, such as AD, ADFS, or local LDAP.
Currently, I would like to set the connection to SAP ALM for users who belong to a local identity provider (business users). We have many people who would like to work in ALM but I don't want to create manually the account for each user. The best is the user can login in ALM with the password of local identity provider and if the user belongs to the specific group in local Idp, then it should get a basic rights in ALM tenant. Specifically and most interesting, I am aiming to configure a scenario where users can log in to SAP ALM using their local identity provider passwords. From my understanding, there are three possible approaches:
User provisioning operates in real-time, creating users upon their first connection to ALM. However, it appears that there is no target application related to ALM within IPS documentation.
User provisioning operates in real-time, where the user is first created in IAS, with provisioning configured so that both source and target are set as IAS. A specific group can then be assigned to the user in IAS based on their group membership in the local identity provider. Using AD as a source in IPS is not good for us because we don't want to synch all AD users with IAS. *but may be we can use group as a filter to restrict the user list, however, AD as a source in IPS should be the last option if nothing else is available.
Using the shadow user feature within the ALM tenant.
Questions:
I have not found any documentation on configuring a scenario where a user can login to a BTP application using the login and password from a local identity provider. Is there guidance on this setup?
Which of the three integrations above do you think would be the most effective for this task?
Thank you in advance for your feedback.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.