Skip to main content

Unified architecture with a Line-of-Business–Scoped Experience

Last updated on by sapgunnar

This is the first stage of the SAP-managed integration model. The SAP-managed experience is introduced for a single line-of-business application — for example activating Joule for SAP S/4HANA Cloud, or for SAP SuccessFactors — without yet requiring a landscape-wide consolidation of identities.

Each line-of-business application continues to keep its own users. What makes this stage managed rather than merely isolated is that every user is cached (hidden) in the Identity Directory of SAP Cloud Identity Services from the connected applications. This allows the SAP Business AI Platform to use SAP Cloud Identity Services as its Identity and Access Management interface and as a central user and role store for filtering agentic communication.

Architecture​

Component View​

The architecture diagram shows the Stage 1 setup: a single line-of-business application (for example SAP SuccessFactors or a Cloud/Private Cloud Solution from SAP) is integrated with SAP Cloud Identity Services in an SAP-managed way, alongside the customer-managed IAM integration. SAP Cloud Identity Services (Identity Authentication, Identity Provisioning, Identity Directory and Authorization Management) provides authentication and caches the application users, while SAP Joule WORK is consumed through the embedded clients of the connected application. The governance components (Agent Hub by LeanIX, application and integration provisioning via SAP for Me, Agent Lifecycle Governance via SAP Cloud ALM) complete the landscape picture.

image of solution diagram
Copy to clipboard
Solution Diagram Resources
You can download the Solution Diagram as a .drawio file for offline use. Alternatively, you may view and edit the Solution Diagram directly on draw.io.
Please note that any changes made online will need to be saved locally if you wish to keep them.
DownloadEdit

Sequence​

image of solution diagram
Copy to clipboard
Solution Diagram Resources
You can download the Solution Diagram as a .drawio file for offline use. Alternatively, you may view and edit the Solution Diagram directly on draw.io.
Please note that any changes made online will need to be saved locally if you wish to keep them.
DownloadEdit

Concept​

  • Cached users exist per line-of-business application, scoped to that application's experience.
  • These users can later be consolidated into a unified experience without re-onboarding — this is what enables the move to Stage 2.

Authentication for the scoped experience runs through SAP Cloud Identity Services for the SAP Business AI Platform (and SAP Joule WORK). Each connected SAP business application remains with the configured authentication and user lifecycle flows; each of those tenants acts in this scenario like an IdP. The successful authentication within one of the business applications is enough to initiate the session in Cloud Identity for the Business AI Platform. Authorization for the application remains defined and assigned within that application's domain.

Flow​

  1. The customer activates the SAP-managed experience (for example Joule) for one or more line-of-business applications.
  2. The application is integrated with SAP Cloud Identity Services. All roles or groups from the connected application get replicated as (visible) application-groups into the Identity Directory.
  3. Each application user gets (hidden) cached in the Identity Directory with the assigned application-groups.
  4. The user interacts with the scoped experience; identity and authentication are governed by SAP Cloud Identity Services, while authorization stays within the application.

Characteristics​

  • Scope: one line-of-business application at a time.
  • Users: application-owned, but consolidatable.
  • Lead for identity data: the application.
  • Role of SAP Cloud Identity Services: authentication interface and identity-linking anchor.
  • Typical use: first adoption of Joule or another managed experience, before landscape-wide unification.

Services and Components​