Skip to main content

Customer-Managed IAM Integration

Last updated on by sapgunnar

In the customer-managed integration model, the customer owns and operates the IAM integration for an SAP landscape in which SAP is one vendor among several. SAP Cloud Identity Services is configured as the single, trusted interface between the customer's enterprise IAM tooling (third-party Identity Providers, Identity Management solutions, Identity Governance) and the SAP solutions in the landscape.

This model standardizes how IAM is implemented for SAP SaaS. It provides a centralized location to authenticate users, create and maintain SAP SaaS identities, and assign authorizations — while leaving the heterogeneous enterprise edges under customer control.

Architecture​

image of solution diagram
Copy to clipboard
Solution Diagram Resources
You can download the Solution Diagram as a .drawio file for offline use. Alternatively, you may view and edit the Solution Diagram directly on draw.io.
Please note that any changes made online will need to be saved locally if you wish to keep them.
DownloadEdit

The Three Pillars​

Customer-managed IAM is organized around three pillars, each covered by its own reference architecture:

  1. Authentication & Single Sign-On — How SAP applications authenticate users through SAP Cloud Identity Services, acting either as an Identity Provider for the SAP landscape or as a broker (facade) that federates to the customer's corporate Identity Provider via SAML2 or OIDC.

  2. Identity Lifecycle — How a digital identity is derived from a Workforce Person in a leading master-data system, replicated into the Identity Directory of SAP Cloud Identity Services, and provisioned into target SAP applications via SCIM2 and the Identity Provisioning service.

  3. Authorization — How domain-specific authorizations (for example SAP S/4HANA roles or SAP BTP Role Collections) are published into the Identity Directory and assigned centrally to identities, while the authorizations themselves remain owned by the respective application domain.

Characteristics​

  • The customer is the integrator: trusts, federations, provisioning jobs, and authorization assignments are configured and operated by the customer.
  • SAP Cloud Identity Services provides a single interface for third-party Identity Provider integration (authentication) and for identity lifecycle, giving a centralized place to create and maintain SAP SaaS users.
  • The model is designed for heterogeneous landscapes where SAP coexists with non-SAP vendors and non-SAP target systems.
  • Authorizations remain domain specific; only the assignment is centralized in the Identity Directory.

Services and Components​