on 05-13-2022 2:50 PM
Hi experts,
i am currently working on WorkZone Poc.
I followed the onboarding documentation
https://help.sap.com/docs/WZ/b03c84105ff74f809631e494bd612e83/f8c6eab5b9c8437f9367271863ac90eb.html?...
and also crosschecked the blog
Within the IAS the groups are created and also my user is within the Workzone_Admin group:
The IPS source system (IAS) job is also running without errors:
I can access the WorkZone and everything seems ok but i am not getting access to Administration Console
(Missing in the User Menu and Access denied when accessing from the App Finder):
I am out of ideas, what could be wrong?
Thank you!
Sakib
Hi - I had this same problem and after hours of troubleshooting I figured out what was wrong.
It seems that the Transformation added by default to the Work Zone Target System in the Identity Provisioning Service for Administrator role was incorrect. It came in as:
{
"condition": "$.groups[?(@.value == 'Workzone_Admin')] EMPTY false",
"constant": "Administrator",
"targetPath": "$.roles[0].value"
}
But in the documentation florian.buech provided, it shows it should be:
{
"condition": "$.groups[?(@.display == 'Workzone_Admin')] EMPTY false",
"constant": "Administrator",
"targetPath": "$.roles[0].value"
}
Which I assume would work... except that the default Source System (IAS idp) outbound transformation includes:
{
"targetPath": "$.groups[*].display",
"type": "remove"
},
I'm not 100% familiar with the mapping syntax, but it seems clear this would remove the `display` value from `groups` on the way out of the Source System (IAS), meaning the Target System (WZ) cannot read and react to it as expected.
So when I went back to the Target System (Work Zone) and set the condition for `value` equal to the UUID of the Group (found in the `Users & Authorizations -> User Groups` path in IAS cockpit under property `Group ID`) which fixed it, finally:
{
"condition": "$.groups[?(@.value == '<Group ID UUID>')] EMPTY false",
"constant": "Administrator",
"targetPath": "$.roles[0].value"
}
I really think SAP should fix either the defaults in the IPS or at the very least mention this in the documentation for Work Zone onboarding.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.
User | Count |
---|---|
65 | |
8 | |
7 | |
7 | |
6 | |
5 | |
5 | |
5 | |
4 | |
4 |
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.