Script
Hi, I am Denys van Kempen, SAP Partner Innovation Lab and the SAP HANA Academy.
In this video tutorial we are going to look into Cloud Identity Services as platform service
for SAP BTP, SAP Business Technology Platform.
This video was recorded in March 2021; for the latest video tutorials on the topic, please
check the playlist.
Here have the tile for Cloud Identity Services and from the elipsis, we can create a service
instance, or, alternatively, we could select the tile,
and then create a service instance on the blade using the Create button here in the
top right corner, or here ,again via an elipsis menu, on the
plan entry.
Some services have different plans, here we only have one
application which,
as mentioned here, registers an application into your identity
authentication tenant.
Cloud Identity Services is available from the Cloud Foundry, Kyma, Kubernetes, and Other
environments If you would like to learn more about Cloud
Identity Services services, I’d suggest you click the link to visit the documentation.
There are different sections, Development, Administration, Security, End-User,
but these all point to the same guide.
also of interest, is the catalog entry for the service on the
SAP Discovery Center identity authentication
with an illustration that nicely covers the main concept
end user here to the left SAP Cloud business applications to the right:
S/4HANA, SuccessFactors, Customer Experience, and so on,
Cloud Identity Services provides a single sign-on experience to our end user,
with the actual user store typically located elsewhere,
with the corporate identity provider, be it on-premises or in the cloud, say, using
Microsoft Active Directory, or Azure AD.
Of course, we could register the business applications one by one as enterprise applications,
but using Cloud Identity Services makes this easier,
enabling a single branding, a single acess policy, and so on,
lot’s of information here, some links go back to the documentation we
already looked at but there are also tutorials, discovery center
missions, the roadmap, and customer stories.
ok, back to the cockpit now, as mentioned, when we create a service
instance of cloud identity service, we are not really creating a service instance, but,
as mentioned here, we are registering our BTP subaccount environment as application.
If you have worked with Azure AD, this is the same as registering an enterprise application.
Now, before we can do this, we first need to establish a trust between our BTP subaccount
and Identity Services If we return to the root level, our global
account, Trust Configuration
under Security here we see the default identity provider
listed: SAP ID Service, which, at this is level, is not configurable.
If we then go one level down, at the subaccount level,
we can establish trusts with alternative identity providers,
For third party IdP’s we can do this manually, we have covered how to establish a trust with
Microsoft Azure AD, for example, in another tutorial,
but, in case of Cloud Identity Services,
we can also do this automagically, using this Establish Trust button.
Select it and we will be prompted to select our Cloud
Identity tenant, typically, only a single entry will be listed,
but you could request another tenant for testing purposes for example,
and then select Establish Trust for the connection, the trust, between both systems to be created.
Takes a few seconds and we are done.
The entry is configurable Status active/inactive
and we can make the IdP available for user logon and toggle the creation of shadow users.
Typically, you would want to have shadow users created, as this allows you to grant role
collections, for authorization purposes.
But if you want to stay in control, you can disable this and manually create the users
you need yourself using the cockpit UI, or more commonly
programmatically using the BTP CLI Same for the default IdP; in most cases you
want to make sure it is no longer available for user log on.
Less is more Okay
let’s briefly switch to our Identity Authentication Service tenant,
and navigate to Applications The two entries under system applications
are included with the tenant, one is the administration console we are looking at now,
new is the XSUAA entry, the suffix is the BTP subaccount name,
the entries under the Trust tab have been set up for us,
optionally, you could make changes to authentication and access,
for example, to enable social sign-on, whether you want to enable e-mail verification, the
password policy to use, and many other of the capabilities that Identity
Authenticaiton Service provides, like for example the branding and layout options
of the logon page, back to BTP
Now that we have established a trust between both systems, we can return to the service
marketplace, cloud identity services,
and select create, most of the fields are already populated,
if you have multiple Cloud Foundry orgs or spaces, you can pick the right one here,
but for now, all we need to do is enter a name,
this could be any name you want, I’ll go for idp4businessapp
the second screen enables us to configure instance parameters in JSON format,
not required for our purpose here and then select create to create
we are warned that it might take a while we are directed to the instances and subscriptions
page to monitor the progress.
takes a few seconds to refresh and here we have our service instance.
works the same as for any other service instance, we have covered this topic in the onboarding
series, you can create service keys,
bind applications, update, and delete the instance,
If we then return to IAS under applications,
we see our entry listed, as advertised,
creating a service instance in BTP registers an application with Identity Services, which
we can then configure as needed, ok
so much for creating service instances of the identity authentication service
See the description below for this video our YouTube channel for more information
Don’t forget to subscribe Denys van Kempen, SAP HANA Academy / Partner
Innovation Lab Thanks for watching