SAP GRC Access Request for Cloud systems

Overview

SAP Cloud Identity and Access Governance is a Cloud based GRC solution to integrate cloud and on-premise applications. Access Request service is a service that will be used to perform the access request functionality and we are focusing on integration of SAP Access Control to SAP Cloud SAP Cloud Identity Access Governance.

Possible Scenarios 

There are so many questions regarding the Access Request for cloud applications and how to extend the solution for existing SAP Access Control implementation. This blog post gives you a complete overview of options and steps for Access Request for both standalone SAP Cloud Identity Access Governance implementation and SAP Access Control bridge scenario.

1. SAP Cloud Identity Access Governance only option – You have only SAP Cloud Identity Access Governance solution and wanted to integrate with cloud and on-premise solutions for access request.
2. SAP Cloud Identity Access Governance with bridge option – You have existing SAP Access Control solution with on-premise integrations and now want to integrate the cloud applications. There is no direct integration with SAP Access Control and hence you are using SAP Cloud Identity Access Governance solution for access request.

Note: Please refer the integration and bridge documents at help.sap.com for technical details to setup the below scenarios.

Scenario 1: Access Request in SAP Cloud Identity Access Governance

This is a simple scenario where the Access Request service in SAP Cloud Identity Access Governance is used for cloud and on-premise applications. Follow the below steps for provisioning to on-premise and cloud applications such as SAP Ariba.

Prerequisite – SAP Cloud Identity Authentication Service setup is completed under Trust Configuration in SAP Business Technology Platform cockpit (previously called as SAP Cloud Platform). For more information, check the User Management section in Administration Guide.

1. Create an incident to SAP Support for component GRC-IAG to load the default business rule for workflow.
2. Upload the Workflow Templates from Template Upload tile under Administration.
3. Create a destination for target application, for ex, SAP Ariba in SAP Business Technology Platform cockpit (previously called as SAP Cloud Platform)
4. Create a system entry in System tile pointing to the destination. While creating the system, make sure you enter the exact destination name you created in step 1 (case sensitive)
5. Run the SCI User Group Sync Job to get all the user to group mapping. This is important step for getting approvers. Before running the job, make sure you have the relevant user groups assigned to the approvers in SAP Cloud Identity Authentication Service. The user group details are available in Admin guide under User Management section.
6. Run the Repository Sync job from Job Scheduler tile for SAP Ariba, for ex. This needs to be done to get the existing assignments for the users and the groups to be requested in request.
7. Once completed, make sure you see the Roles/Groups in Access Maintenance tile and Users in Maintain User Data tile.
8. Make sure the Common Master Data and Master Data for Access request is completed as per the Admin Guide under Business Configuration.
9. Create a request for group assignment and submit for approval. By default, it will go to 3 stage process (manager, Role Owner and Security). You can change to Manager only or Manager-Security Owner path.
10. After the approval process is completed, you can find the request with the provisioning items in Provisioning Report tile. The provisioning process is not automatic.
11. Schedule the recurring Provisioning Job from Job Scheduler to provision the items in target application.
12. You can check the status in Provisioning Report and in case of any failures, you can reprocess the provisioning items and schedule the job again. You must run the provisioning job to process the failed attempts if you have not setup the recurring job.

Scenario 2: Access Request from SAP Access Control via SAP Cloud Identity Access Governance

You have SAP Access Control and you would like to provision for cloud applications. Provisioning for cloud applications are not supported directly from SAP Access Control and hence the bridge scenario is used. SAP Cloud Identity Access Governance is used as a bridge between the SAP Access Control and the cloud applications.

Prerequisite:

• Working workflow setup for SAP Access Control.
• IAG_PROVISION_STATUS_UPDATE_SRV service in SICF is activated.
• SAP Cloud Connector is setup for SAP Access Control system.
• Two connectors (BRIDGE_SOD_AUTH and BRIDGE_SOD_CHECK) setup as part of bridge solution and the parameters 1091 and 1092 set.
• Third connector in SM59 should be created for Target Cloud system, ex ARIBA_DEST. The name should be same as the target connector name in System tile in SAP Cloud Identity Access Governance.
• The repository sync was completed in SAP Cloud Identity Access Governance with data populated in Access Maintenance and Maintain User Data as per Scenario 1.

Follow the below steps to provision for cloud applications using bridge scenario

1. You have the connector created for target cloud system (ex, ARIBA_DEST) and assigned to SAP Cloud Identity Access Governance connector type in SPRO configurations in SAP Access Control. This is a similar step as any other on-premise systems you set up in SAP Access Control.  Please check the steps in SAP Cloud Identity Access Governance Bridge document for complete details.
2. Run the repository sync job in SAP Access Control for target connector (ex, ARIBA_DEST) with IAG import option. This will make sure that the roles are synchronized and automatically imported. You don’t need to do manual role import for role search in access request. Maintain configuration parameters 3000 to 3004 is set in SPRO before running the job.
3. Create access request for cloud application and follow the workflow process.
4. The risk analysis from request will go to SAP Cloud Identity Access Governance if the configuration parameter 1090 set o YES. If you set to NO, then risk analysis for cloud applications will not work.
5. The mitigation date comes from SAP Cloud Identity Access Governance to mitigate the risk.
6. Once the approval process is completed, based on the connector type, the provisioning will happen from SAP Access Control or SAP Cloud Identity Access Governance. If the connector type is IAG, it will send to SAP Cloud Identity Access Governance for provisioning.
7. You can check the request number and the provisioning items in Provisioning Report tile.
8. Run the provisioning job from Job Scheduler to provision the items.
9. The job will send the provisioning status to ProvisioningStatusUpdate service from SAP Cloud Identity Access Governance through the SAP Cloud Connector.
10. You can check the status in Provisioning Report and in case of any failures, you can reprocess the provisioning items and schedule the job again. You must run the provisioning job to process the failed attempts if you have not setup the recurring job.
11. The access request audit log will be updated, and request will be closed.

Conclusion

The above explanation should have given you a complete picture of how this whole integration works. Based on this, you can setup your Access Request solution and this is a functional overview only. For more details document on how to setup the bridge solution, you should check the help.sap.com for SAP Cloud Identity Access Governance.

References

Please check the below documents from https://help.sap.com/viewer/product/SAP_CLOUD_IDENTITY_ACCESS_GOVERNANCE

• (IAG Bridge) SAP Access Control 12.0 (on-premise) to IAG and Cloud Target Application
• Integration Scenarios

Note: Please share your feedback or thoughts in a comment below or ask questions in the Q&A tag area here about SAP Cloud Identity Access Governance  or https://answers.sap.com/tags/01200615320800000796