Episode 29: Cloud Identity Services Introduction

Summary

In this episode, we explore Cloud Identity Service, a crucial tool for securing PTP environments. It includes three key services: Identity Authentication, Identity Directory, and Identity Provisioning. These services enable single sign-on, manage user authorization, and streamline user provisioning from various systems. The authentication service connects your corporate identity provider to ensure seamless access across cloud solutions, while the directory manages user groups and roles. Provisioning automates user creation and synchronization. By using Cloud Identity Services, organizations can enhance security, improve user management, and simplify integration across multiple platforms.

Takeaways

• 😀 Identity Cloud Service is made up of three key services: Identity Authentication, Identity Provisioning, and Identity Directory.
• 😀 Identity Authentication service helps secure the environment by integrating with your corporate identity provider for single sign-on (SSO) capabilities.
• 😀 Cloud Identity service acts as a proxy between BTP (Business Technology Platform) and the corporate identity provider, enabling seamless authentication.
• 😀 Without a corporate identity provider, you won't be able to set up SSO, but it is possible to authenticate without it.
• 😀 The goal of Cloud Identity services is to allow integration across all SAP cloud solutions, ensuring consistent authentication through a single token.
• 😀 Cloud Identity service offers additional security features such as two-factor authentication, risk-based authentication, and conditional authentication.
• 😀 Conditional authentication allows different authentication strategies for internal vs external users, such as routing internal users to a corporate identity provider and external users to Cloud Identity.
• 😀 The Identity Directory service stores user information within Cloud Identity Services, but this is not mandatory for all use cases. It can be enabled if needed.
• 😀 Newer services like Built Apps and SuccessFactors require user data to be available in Cloud Identity, making it important to enable the user store when using those services.
• 😀 Identity Provisioning allows users to be provisioned from external systems (e.g., S/4 HANA) into Cloud Identity's identity directory using the SCIM protocol.
• 😀 Even though single sign-on can be set up without Cloud Identity services by directly integrating with a corporate identity provider, using Cloud Identity services is recommended for better efficiency and support for new services in BTP.

Q & A

What are the three services included in Cloud Identity Service?

Cloud Identity Service includes three services: Identity Authentication, Identity Provisioning, and Identity Directory.

How does Identity Authentication service work?

The Identity Authentication service focuses on enabling Single Sign-On (SSO) by integrating with a corporate identity provider (e.g., RDFS, Okta). It acts as a proxy between the Business Technology Platform (BTP) and your corporate identity provider, forwarding authentication requests.

What is the role of the Identity Directory service in Cloud Identity?

The Identity Directory service stores user data within Cloud Identity Service. It is optional but recommended for managing authorizations, user groups, and providing context across different applications, particularly for newer services like SuccessFactors.

Is it necessary to enable the Identity Directory service?

No, enabling the Identity Directory service is optional. However, it is recommended for better management of users and authorizations, especially for newer services that require it, such as SuccessFactors.

Can you use Cloud Identity Service without a corporate identity provider?

Yes, you can use Cloud Identity Service without a corporate identity provider, but you won't be able to configure Single Sign-On (SSO). The integration with a corporate identity provider is necessary for SSO functionality.

What additional functionalities does the Identity Authentication service provide?

The Identity Authentication service includes additional functionalities such as two-factor authentication, risk-based authentication, and conditional authentication. These features allow flexible control over how users authenticate based on factors like internal/external status or risk.

What is the purpose of Identity Provisioning in Cloud Identity Service?

Identity Provisioning is used to import and create users in the Cloud Identity Directory from other systems (e.g., S4 HANA) using the SCIM protocol. This ensures that user data is available for authentication and authorization across the Cloud Identity ecosystem.

Can Single Sign-On (SSO) be achieved without Cloud Identity Service?

Yes, Single Sign-On can still be achieved without Cloud Identity Service by using your corporate identity provider directly in BTP. However, using Cloud Identity Service is recommended for smoother integration and to avoid additional authentication round trips.

Why is Cloud Identity Service recommended for newer BTP solutions?

Cloud Identity Service is recommended for newer BTP solutions because many of them require Cloud Identity for features like Single Sign-On, user context persistence, and integration across different cloud applications. It streamlines authentication and authorization processes.

What are the future topics that will be discussed in upcoming episodes related to Cloud Identity Service?

Future episodes will focus on identity authentication and directory authentication for Single Sign-On, as well as explore various strategies for leveraging Cloud Identity Services in different scenarios.