This article provides step-by-step instructions for connecting EmpowerID to SAP Cloud Identity Service IASBTP XSUAA. By following this article, administrators can efficiently integrate the two systems, enabling seamless synchronization and management of user and group data. This integration ensures that identity and access management processes are streamlined and consistent across both platforms.
...
Before connecting EmpowerID to the SAP Cloud Identity Service IAS XSUAA SCIM Connector, ensure the following prerequisites are met:
System-Type Administrator Account: Create a system-type administrator account and secret in the SAP Cloud Identity Service XSUAA service instance with the following permissions:
Manage Users
Read Users
Manage Groups
Access Real-Time Provisioning API
Required Information: Obtain the following details from SAP for onboarding the system in EmpowerID:
Base URL of the Instance
Access Token URL of the instance
ClientID of the Admin User
ClientSecret of the Admin User
Procedure
Step 1 – Create an Account Store for SAP
...
BTP XSUAA
Sign in to EmpowerID as an administrator.
Expand Admin > Applications and Directories on the navbar and select Account Stores and Systems.
Select the Actions tab and then click Create Account Store.
Under System Types, search for SAP Cloud Identity ServiceAuthorization and Trust Management Service SCIM.
Click the record for SAP Cloud Identity Service IAS SCIM Authorization and Trust Management Service SCIM to select the type and then click Submit.
This opens the Account Store Details form for the system.
Enter the following information in the form:
Name – Name of the account store
XSUAA Base URL – The base URL of the SAP IAS XSUAA service instanceClient Secret
Access Token URL – The URL to get the access token for XSUAA service instance
Client Api Key – The Client Secret ID of the admin useruser
Client IDSecret – The Client ID Secret of the admin user
When ready, click Submit to create the account store.
...
On the Account Store Details page for the SAP Cloud Identity Service IAS XSUAA account store, select the Attribute Flow Rules tab.
Review the attribute flow and revise as needed. EmpowerID translates the attributes in SAP IAS XSUAA to SCIM for use with the connector and represents those attributes in EmpowerID as External Directory Attributes. You map these attributes to EmpowerID Person attributes to ensure that any changes occurring to user attributes in SAP IAS XSUAA flow to the EmpowerID Person and any other user accounts owned by the Person.
To change the score for any available CRUD operations (Create, Update, and Delete), enter the new score in the appropriate field. By default, scores are weighted evenly, which means that a change to an attribute originating in one connected external directory has the same authority as a change to an attribute occurring in another connected external directory.
...
Click the Edit link on the Account Store Details page for the SAP Cloud Identity Service IAS XSUAA object to put the account store in Edit mode.
Edit the settings shown below as needed and save your changes.
...
On the Account Store Settings page, select the Inventory tab.
Change the Inventory Schedule Interval as needed. By default, EmpowerID inventories account stores once every 10 minutes.
Toggle Inventory Enabled.
Click Save to save your changes to the account store.
...
Step 4 – Enable the Group Membership Reconciliation Job for the Account Store
Select the Resource System tab on the Account Store Settings page and then select the Server Jobs subtab.
Under Membership, toggle Enable Group Membership Reconciliation.
Step 5 – Enable the Account Inbox Permanent Workflow
Expand Infrastructure Admin > EmpowerID Server and Settings on the navbar and select Permanent Workflows.
On the Permanent Workflows page, click the Display Name link for Account Inbox.
On the Permanent Workflow Details page that appears, click the pencil icon to put the workflow in edit mode.
Check Enabled.
Click Save to save your changes.
Additionally, EmpowerID provides Provisioning policies or Resource Entitlements that allow you to automatically provision XSUAA accounts for any person within your organization based on your policy requirements. When using Provisioning policies with XSUAA, “origin” must be added to the policy as a configuration parameter. If you need to provision users for multiple origins, you need to create multiple policies with the origin parameter set to the appropriate value. For more information, see Create Provisioning Policies for SAP XSUAA.