Introduction

S/4 HANA Cloud, Public Edition is SaaS based ready to adopt/consume cloud ERP that delivers the latest industry best practices and continuous innovation.

This blog is aimed to elaborate the concept of Identity and Access Management (IAM) in S/4 HANA  Cloud, Public Edition covering end-to-end implementation journey.

Architecture

S/4 HANA Cloud, Public Edition is delivered to customers in 2 possible architectures based on customer requirements

3 System Landscape

3 system landscape

 

2 System Landscape

2 system landscape

 

Systems in S4HC Landscape

 

Identity Access Management – Implementation Journey

S/4HANA Cloud, public edition is a closely knit landscape of multiple tenants and access is granted in each tenant during respective phases of implementation journey

IAM S4HC Implementation Journey

 

Prepare Phase

Setup of SAP Central Business Configuration (CBC) with Cloud Identity Services (CIS) and sync CBC standard groups to CIS

SAP CBC system is central point of configuring the system. SAP provides pre-delivered standard SAP CBC groups to perform scope activation and other configurations in the S/4HC system. Projects are created in SAP CBC system with respect to each system to perform system configuration.

From IAM perspective, pre-delivered standard SAP CBC groups needs to be synced to Test IAS tenant so that they can be assigned to Technical/Functional Administrators

Procedure

• Configure Subject Name Identifier for CBC Application as “Login Name”

Login to Cloud Identity Services and navigate to Applications & Resources tab à Applications. Select SAP Central Business Configuration application and maintain Subject Name Identifier as “Login Name”

Figure 1 Subject Name Identifier for CBC Application

 

Figure 2 Subject Name Identifier for CBC Application

 

• Sync CBC roles as groups in Cloud Identity Services (CIS)

Login to Cloud Identity Services and navigate to Identity Provisioning tab à Source Systems. Select CBC application as source and run Read job. This will sync/enrich CBC roles as groups in CIS.

You can verify the synced groups from Users & Authorizations tab à User Groups

Figure 1 Sync CBC roles as groups in Cloud Identity Services

 

Figure 2 Sync CBC roles as groups in Cloud Identity Services

 

Figure 3 Sync CBC roles as groups in Cloud Identity Services

 

Figure 4 Sync CBC roles as groups in Cloud Identity Services

 

Onboarding of Technical/Functional Administrators in SAP Central Business Configuration (CBC)

Procedure

• Create User in Cloud Identity Services (CIS)

Login to Cloud Identity Services and navigate to Users & Authorizations tab à User Management. Click on Add and enter First Name, Last Name, Email, Login Name. Click on Save

Open the User and add the CBC groups. Click on Save

Figure 1 Create User in Cloud Identity Services

 

Figure 2 Create User in Cloud Identity Services

 

• Sync User from Cloud Identity Services (CIS) to CBC

Login to Cloud Identity Services and navigate to Identity Provisioning tab à Source Systems. Select IAS application as source and run Read job. This will create user-group assignment in CBC system

Users can verify by logging into CBC system tenant URL.

Figure 1 Sync User from CIS to CBC

 

Figure 2 Sync User from CIS to CBC

 

Figure 3 Sync User from CIS to CBC

 

Create Business Roles in S/4HC Starter System

Pre-requisite – Scope Items activation

Once S/4HC system is provisioned to Customers, it only contains below 3 standard roles.

SAP_BR_ADMINISTRATOR, SAP_BR_BPC_EXPERT, SAP_BR_MANAGER

Scope items for in-scope business processes needs to be activated in SAP CBC system by creating a project in it. This activity is usually handled by business process consultants/SMEs.

From IAM perspective, once Scope Items are activated, it creates standard “Business Catalogs” and “Business Role Templates” which can be consumed to create Business Roles.

Procedure

• Business Role Creation

Business Roles in S/4HC public edition can be created in 2 possible ways as below.

Possbility 1- Create Business Roles from Business Role Templates

If we intend to create a copy or reference business role from standard role templates, this scenario needs to be used.  Once Business Role is created, we can maintain appropriate “restrictions” in the role based on customer requirement

Figure 1 Create Business Role from Business Role Template

 

Figure 2 Create Business Role from Business Role Template

 

Figure 3 Create Business Role from Business Role Template

 

Possibility 2 – Create Business Roles as “New” from scratch

Use this option if we need to create role from scratch by adding business catalog. Once we add business catalog, it may/may not show pop up to add “dependent” catalog. It is recommended to add the dependent catalog as well in the role to ensure users don’t face any access issues.

Figure 1 Create Business Role from scratch

 

Figure 2 Create Business Role from scratch

Keynote– In S/4HC, we cannot create custom business catalog. We can add standard delivered catalog which are created by scope activations in the business roles.

Figure 3 Create Business Role from scratch

• Maintain Restrictions

Maintain Restriction functionality in S/4HC helps to restrict the functioning of the business role when assigned to Users. There are 3 levels of restrictions (analogous to Activity ACTVT field in S/4HANA private cloud edition) as below

Figure 1 Maintain Restrictions

 

Figure 2 Maintain Restrictions

 

Figure 3 Maintain Restrictions

 

Figure 4 Maintain Restrictions

Keynote– S/4HC public edition is released each quarter which can bring in new business catalog or deprecate an existing catalog. These changes get reflected in “Business Role Templates” and customers can adapt them in business roles manually, if needed. Deprecated Catalogs are also visible in the App “Business Catalogs” with status field.

Onboard Users in S/4HC Starter System

Users in S/4HC are created as “Worker” and then maintained as “Business Users” by assigning appropriate business roles.

Figure 1 Onboard Users in S4HC Public Cloud

 

Authentication/Login – S/4HC Starter system is connected to test tenant of Cloud Identity Services and users are authenticated from it. Hence, business users need to be present and activated in Test IAS as well with same email ID.

Direct password login to S/4HC system is not available. Direct password login to S/4HC system is not available.

Procedure

• Create Worker using “Manage Workforce” Fiori app

Users in S/4HC system are closely linked with “workers” (employees and contingent workers) including work agreements and change employment situations.

Figure 2 Onboard Users in S4HC Public Cloud

 

• Click on “Maintain Business User” or alternatively use “Maintain Business Users” Fiori app and click on Add appropriate Business Roles.

Once worker is created, we can setup the user as “Business User” and assign business roles for access to fiori apps.

Figure 3 Onboard Users in S4HC Public Cloud

 

Figure 4 Onboard Users in S4HC Public Cloud

 

• Create the user in Test IAS tenant.

Figure 5 Onboard Users in S4HC Public Cloud

 

Explore Phase

During explore phase, IAM/Security consultant will provide system demonstrations/workshops. It covers designing roles/authorizations to align as much as possible to Fit-to-Standard.

 

Realize Phase

Realize phase marks the start of role creation and other developments in the Development tenant (in 3-system landscape) OR Test/Quality tenant (in 2-system landscape).

Roles once created in Development tenant can be transported to Test/Quality and production using “Export Software Collection” Fiori app.

Keynote– S/4HC public edition Starter System is a temporary system provisioned for Fit to standard workshops and perform hands-on/understand the operation of the system. Starter system is de-provisioned 30 days after Production S/4HC system is delivered. Hence, business role creation and other configurations must be re-done in development tenant.

 

Deploy Phase

Business roles created in Development tenant (in 3-system landscape) OR Test/Quality tenant (in 2-system landscape) are transported/” Imported” in Production S/4HC and User are created.

As Production S/4HC is connected to production IAS tenant, all users must be created in it for successful authentication/login.

 

Conclusion

Users and Roles administration in S/4HC, public edition is lot more simplified from traditional/S4HC private edition and provides a user-friendly Interface for Security Administrators to manage all the activities using Fiori Apps.

Idea behnd consumption and adoption of S/4HC, public cloud edition to adapt to “Fit to Standard” as much as possible

Limitation

As the whole essence of S/4HC, public cloud edition is Fit to Standard, extensive customizations are not possible like creation of custom business catalogs, seggragate between different actions/activities within “Write” umbrella (like create/edit/post/delete etc.)

 

List of Important Links

SAP Roadmap Viewer – IAM

SAP S/4HANA Cloud, Public Edition 2302 – Localization, Identity and Access Management (IAM), and Security

RISE with SAP: Comparing the Security of SAP S/4HANA Cloud, private edition Vs SAP S/4HANA Cloud, public edition

 

Feedbacks, questions and comments are most welcome!!

Please follow my profile for future posts on SAP Security and GRC. Also, follow myself via LinkedIn

 

Happy Learnings!

Karanbir Singh.