In this blog post, you’ll learn how SAP BTP role collections can be centrally managed using SAP Cloud Identity Services.

SAP BTP allows the deployment of multiple services and applications, each with its own role collections. These services are often deployed across different subaccounts. It's possible to manage users and roles separately in each subaccount.

However, it is also possible to centralize user and role management by using a single identity service by establishing trust between the identity service and BTP subaccounts.

This post will guide you through setting up role collection mappings between BTP and Identity Authentication Service (IAS). This allows you to manage role collections for multiple subaccounts from a single identity provider.

Prerequisites

If you have an identity provider, you can configure it as a custom provider for a BTP subaccount. It can be used as the source for users and role collections.
There are some prerequisites for setting up role collection mappings:

• You must have the Subaccount Administrator role in the subaccount that will be linked (trusted) with SAP Cloud Identity Services.
• The SAP Cloud Identity Services tenant can be subscribed to in a different subaccount, but it must be part of the same global account and in the same region.

You can follow the steps in this SAP Help document to configure the trust between your subaccount and the SAP IAS tenant:

👉 You can follow the steps in this SAP Help document to configure the trust between your subaccount and the SAP IAS tenant:

NOTE: To be able to use the role collection mapping, you must log in to the application with a user that is defined in the identity provider. - Not with a BTP user.

Configurations

1. BTP Role Collections

Before creating a role collection mapping, make sure that you have the necessary role to access “Role Collections” in your subaccount.

Navigate to:

<Ihr Subaccount>          →    Security     →   Role Collections 

You can use default role collections that are defined for the standard BTP applications.

Alternatively, you can create a new custom role collection by clicking on the Create button in the top right corner.

SAP BTP Role Collections

In this example, a new custom role collection called “My_Custom_Role” is created.

• SAP Cloud Identity Services

Before starting to configure role collection mapping, we must ensure that we send necessary attributes to the application. In the SAP Cloud Identity Service, navigate to

 Application & Resources   →  <Ihr Anwendung>  →  Single Sign-On  →  Assertion Attributes

Application Page on SAP Cloud Identity Services

In the assertion attributes, you must have a Groups attribute. This is what we will send to the application as a BTP role.

Assertion Attributes of an Application on SAP Cloud Identity Services

Then we should create a group for a BTP role that we will be mapping. Navigate to
                        Users & Authorizations   →  Groups

Create a new group, if you have already one, add members who will have this BTP role.

Groups and its Users on SAP Cloud Identity Services

• BTP Role Collection Mapping

Now we are ready to make role collection mapping. Go to your BTP subaccount and navigate to
                        <Ihr Subaccount>   →   Security   →   Trust Configuration,

and click on the custom identity provider that you have established in the beginning.

SAP BTP Trust Configurations

Click on the New Role Collection Mapping and choose your BTP role collection (1). You can also choose your BTP custom role collection.

For “Attribute”, you should write what you defined in IAS as a Groups attribute (2). In this case, we can leave it as “Groups”.

In the “Value” section, you should write your IAS group’s name which corresponds to your BTP role collection (3).

Then save it.

SAP BTP Role Collection Mapping

You can see your mapping from Role Collections.

SAP BTP Role Collections Mapped with IAS Groups

Conclusion:

• You can manage this role collection on SAP Identity Authentication Service with managing the corresponding group’s members.
• In the BTP subaccount, you cannot see the user's role assigned by IAS. These roles are assigned to users when they are authorized to your application via SAP IAS.

Note:

Please be aware that your IAS user must be created in your SAP BTP subaccount as well. You can check more about to create user on BTP from here:

👉 Managing SAP BTP Users

Hope this blog will help you to manage your BTP roles from your identity provider!

Feyza Sahin