Menu
Topic

Authorization

Authorization concepts, roles, security.

Picked up · Authorization

Users and role collections via the MCP server: the origin key mistake

Three admin tasks, each done twice: once in the SAP BTP cockpit and once through the MCP server for administration. Checking access, onboarding users, creating and assigning a role collection. The most instructive part is about the origin key: pick SAP ID Service by mistake when your users …

community.sap.com ↗picked up by SigiDEENPicked up · Authorization

Mapping Entra groups to role collections: the Identity Federation trap

At sign-in, Microsoft Entra ID is generous with groups. Very generous. Some SAP applications then turn those groups into role collections.

community.sap.com ↗picked up by SigiDEENPicked up · Authorization

SAP Cloud ALM: where authorisations across SAP’s cloud portfolio are heading

SAP sets out where authorisations in SAP Cloud ALM are going: first finer-grained role templates and custom role collections, then identity and authorisation managed centrally in SAP Cloud Identity Services, and finally attribute-based access via AMS. The genuinely interesting sentence is tucked away in the middle: SAP cloud …

community.sap.com ↗picked up by SigiDEENPicked up · Authorization

From XSUAA to AMS: the whole authorisation flow, end to end

Authentication over here, authorisation over there, principal propagation somewhere in between. That is how security on SAP BTP usually gets explained. This post walks the whole route in one go: corporate IdP, Identity Authentication, Authorization Management Service (AMS), the CAP application and finally the ABAP authorisation in SAP …

community.sap.com ↗picked up by SigiDEENPicked up · Authorization

Cloud Integration: monitoring-only access to selected iFlows with Access Policies

The forum question: how does a group get to see the status of selected iFlows, with no design access and no payloads? The answer is Access Policies. The catch: anything not covered by a policy is visible to everyone with PI_Business_Expert.

community.sap.com ↗picked up by SigiDEEN

Picked up

community.sap.comUsers and role collections via the MCP server: the origin key mistakecommunity.sap.comMapping Entra groups to role collections: the Identity Federation trapcommunity.sap.comSAP Cloud ALM: where authorisations across SAP’s cloud portfolio are headingcommunity.sap.comFrom XSUAA to AMS: the whole authorisation flow, end to endcommunity.sap.comCloud Integration: monitoring-only access to selected iFlows with Access Policies