Connect to SAP BTP XSUAA

Owned by Phillip Hanegan
Last updated: Aug 15, 2024
6 min read

This article provides step-by-step instructions for connecting EmpowerID to SAP BTP XSUAA. By following this article, administrators can efficiently integrate the two systems, enabling seamless synchronization and management of user and group data. This integration ensures that both platforms have streamlined and consistent identity and access management processes.

Prerequisites

Before connecting EmpowerID to the XSUAA SCIM Connector, ensure the following prerequisites are met: 

  1. System-Type Administrator Account: Create a system-type administrator account and secret in the XSUAA service instance with the following permissions:

    • Manage Users

    • Read Users

    • Manage Groups

    • Access Real-Time Provisioning API

  2. Required Information: Obtain the following details from SAP for onboarding the system in EmpowerID:

    • Base URL of the Instance

    • Access Token URL of the instance 

    • ClientID of the Admin User

    • ClientSecret of the Admin User

Procedure

Step 1 – Create an Account Store for SAP BTP XSUAA

  1. Sign in to EmpowerID as an administrator.

  2. Expand Admin > Applications and Directories on the navbar and select Account Stores and Systems.

  3. Select the Actions tab and then click Create Account Store.

    image-20240724-205043.png

     

  4. Under System Types, search for SAP Authorization and Trust Management Service SCIM.

  5. Click the record for SAP Authorization and Trust Management Service SCIM  to select the type and then click Submit.

     

    image-20240815-171821.png


    This opens the Account Store Details form for the system.

  6. Enter the following information in the form:

    • Name – Name of the account store

    • XSUAA Base URL – The base URL of the XSUAA service instance

    • Access Token URL – The URL to get the access token for XSUAA service instance 

    • Client Api Key – The Client ID of the admin user 

    • Client Secret – The Client Secret of the admin user

  7. When ready, click Submit to create the account store.

Step 2 – Configure Attribute Flow

  1. Select the Attribute Flow Rules tab on the Account Store Details page for the XSUAA account store.

  2. Review the attribute flow and revise as needed. EmpowerID translates the attributes in SAP XSUAA to SCIM for use with the connector and represents those attributes in EmpowerID as External Directory Attributes. You map these attributes to EmpowerID Person attributes to ensure that any changes occurring to user attributes in XSUAA flow to the EmpowerID Person and any other user accounts owned by the Person.

  3. Enter the new score in the appropriate field to change the score for any available CRUD operations (Create, Update, and Delete). By default, scores are weighted evenly, which means that a change to an attribute originating in one connected external directory has the same authority as a change to an attribute occurring in another connected external directory.

Step 3 – Configure the SAP Cloud Identity Service IAS Account Store

  1. Click the Edit link on the Account Store Details page for the SAP XSUAA object to put the account store in Edit mode.

  2. Edit the settings shown below as needed and save your changes.

Account Store Settings

Account Store Settings

Setting

Description

Authentication and Password Settings

Password Manager Policy for Accounts without Person

Specifies the Password Manager Policy to be used for user accounts not joined to an EmpowerID Person.

Provisioning Settings

Allow Person Provisioning (Joiner Source)

Specifies whether EmpowerID Persons can be provisioned from user accounts in the account store.

Allow Attribute Flow

Specifies whether attribute changes should flow between the account store and EmpowerID.

Allow Provisioning (By RET)

Allows or disallows the Resource Entitlement (RET) Inbox process to auto-provision accounts for this domain for users who receive RET policy-assigned user accounts, but have not yet had them provisioned.

Allow Deprovisioning (By RET)

Allows or disallows the Resource Entitlement Inbox process to auto de-provision accounts for this domain for users who still have RET policy-assigned user accounts, but no longer receive a policy that grants them a user account in the domain. De-provisioning only occurs if the de-provision action on the Resource Entitlement policy is set to De-Provision.

Max Accounts per Person

This specifies the maximum number of user accounts from this domain that an EmpowerID Person can have linked to them. This prevents the possibility of a runaway error caused by a wrongly configured Join rule. It is recommended that this value be set to 1 unless users will have more than 1 account and you wish them to be joined to the same person.

Business Role Settings

Allow Business Role and Location Re-Evaluation

Specifies whether Business Role and Location re-evaluation should occur for the account store

Business Role and Location Re-Evaluation Order

This is an optional policy setting that can be used by provisioning workflows to determine which Account Store has priority when determining the roles and locations that should be assigned to a person. Account Stores with a higher value take precedence.

Inventory Auto Provision OUs as IT System Locations

Specifies whether OUs in the external system are added as IT System locations in EmpowerID. If true, the OUs appear under the All IT Systems location node.

Inventory Auto Provision External Roles as Business Roles

Specifies whether EmpowerID should provision Business roles for external account store roles

If you are using Dynamic Hierarchy policies to generate custom external roles and locations, this options should be left disabled.

Default Person Business Role

Specifies the default EmpowerID Business Role to be assigned to each EmpowerID Person provisioned from the user accounts in the account store.

Default Person Location (leave blank to use account container)

Specifies the default EmpowerID Location to be assigned to each EmpowerID Person provisioned from the user accounts in the account store.

Special Use Settings

Automatically Join Account to a Person on Inventory (Skip Account Inbox)

Specifies whether EmpowerID should attempt to join user accounts in the account store to an existing EmpowerID Person during the inventory process. When enabled, the Account Inbox is bypassed.

Automatically Create a Person on Inventory (Skip Account Inbox)

Specifies whether EmpowerID should create new EmpowerID Persons from the user accounts discovered in the account store during the inventory process. When enabled, the Account Inbox is bypassed.

Inventory Settings

Inventory Schedule Interval

Specifies the time span that occurs before EmpowerID performs a complete inventory of the account store. The default value is 10 minutes.

Inventory Enabled

Allows EmpowerID to inventory the user information in the account store.

Step 4 – Enable Inventory on the Account Store

  1. On the Account Store Settings page, select the Inventory tab.

  2. Change the Inventory Schedule Interval as needed. By default, EmpowerID inventories account stores once every 10 minutes.

  3. Toggle Inventory Enabled.

  4. Click Save to save your changes to the account store.

Step 5 – Enable the Group Membership Reconciliation Job for the Account Store

  1. Select the Resource System tab on the Account Store Settings page, then select the Server Jobs subtab.

  2. Under Membership, toggle Enable Group Membership Reconciliation.

Step 6 – Enable the Account Inbox Permanent Workflow

  1. Expand Infrastructure Admin > EmpowerID Server and Settings on the navbar and select Permanent Workflows.

  2. On the Permanent Workflows page, click the Display Name link for Account Inbox.

     

  3. On the Permanent Workflow Details page that appears, click the pencil icon to put the workflow in edit mode.

     

  4. Check Enabled.

     

  5. Click Save to save your changes.

EmpowerID provides Provisioning policies or Resource Entitlements that allow you to automatically provision XSUAA accounts for any person within your organization based on your policy requirements. When using Provisioning policies with XSUAA, “origin” must be added to the policy as a configuration parameter. If you need to provision users for multiple origins, you need to create multiple policies with the origin parameter set to the appropriate value. For more information, see https://dotnetworkflow.jira.com/wiki/spaces/EAGV24R2/pages/3728091309.