SAML user ID mapping for ABAP system

[Former Member]

Hi

Has anyone tried working on this "report RSUSREXTID" while configuring "SAML"

If I have 700+ users , what should I do, I am new to this

I was thinking it will be time consuming and laborious to map one at a time.

Any ideas for mass mapping / upload to ABAP system.

[Former Member]

It works (700 users is not a problem...) but for + 1 million you might want to use the "DESTINATION in GROUP" contruct to trigger the loads in parrellel without delays.

If you have an ABAPer on site who understands performance tuning then it should not be a problem.

Cheers,

Julius

[mvoros]

Hi,

I haven't used it but according to note 1362866 the report RSUSREXTID does waht you need. It's in German only but Google Translate returns a reasonable translation. Since some releases SAP provide BADI which can be used to implement own logic for external IDs.

Cheers

[Former Member]

Hi Martin,

I dont know if I am misunderstanding your reply, that is report I am using

on the ABAP system, but the issue is how do I map the externalid to ABAP user id ?

It will be time consuming if I take the external id and map to each ABAP userid.

I wanted help in understanding what will be the easy way for mass upload of mapped users for ABAP systems.

Also when I execute the report in my backend system it does show up in English.

Please correct me if we are not on the same page.

Thanks a lot for many of SAML replies you have provided.

[Former Member]

Hi Martin,

I realised now that the note mentioned was in GERMAN. I dont understand why they dont have this note in English.

its going to kill a day for me to understand this document with few pointers.

[mvoros]

As you know, the report RSUSREXTID allows you to assign external ID to users. There is External ID type SA - SAML NameIdentifier (PartnerID:NameQualifier:Name). It's a pretty simple report and therefore it has some limitations. Basically, the external ID is created from prefix, username and suffix. Check Note 1254821 - SAML authentication for Web services in AS ABAP which describes how to use this report for SAML.

Since some releases SAP provide enhancement spot USREXTIDMAPPING mentioned in that note which gives you more flexibility. Basically, you can create your own logic for SAML external ID. For example if you want to use email address as SAML user ID then and you mantain user's email address in SU01 then it's pretty easy to implement logic to fetch email address from user master record, change it to required format and pass it back as SAML user ID.

If your system does not have this enhancement spot then I would just create a copy of report RSUSREXT (this report is called from RSUSREXTID) and I would modify routine CREATE_EXTID. I guess that you will use thi report just once during migration. If yes then you don't need to care about creating a copy of standard object. There is also attached example of custom report in note 1254821.

Yes, that note is only in German but as I said Google Translate returns a reasonable translation of that note.

Cheers

[Former Member]

Hi Martin,

Do you read and understand German?

Martin first of all thank you for the steps you explained

Here is the result after I executed with SA , I went one step forward

System ECD Date 08/02/2010 16:59:31 Started by 130 FJAYASIM

Clients Checked

130 Init Testing Client

External name added 130 XXXXXXXXX CN=XXXXXXXXX, OU=&WPOU, O=mySAP.com User, C=DE

External name added 130 YYYYYYYY CN=YYYYYYYY, OU=&WPOU, O=mySAP.com User, C=DE

Three questions here lets say the domain name is "Corp"

1.can I edit "O=Corp.com" User instead of "O=mySAP.com User"

2.What is OU=&WPOU?

3. is C=DE ( language ? )

I am absolute 0/100 in understanding active directory

[mvoros]

Hi,

those fields correspond to org. unit definition used in certificates (for example check the field Issuer in any SSL certificate). C is country, OU is organizational unit and O is organization.

The note 1254821 contains how to generate SAML external names.

External ID type: SA
Prefix of external name: <name of SAML issuer as in saml:Assertion/@Issuer, e.g. BXI/000>:<name identifier as in saml:Assertion/saml:Subject/saml:NameIdentifier/@NameQualifier>
Suffix of External Name:
Optional: Issuer's Name: For SAML, this field is mandatory and must be the subject name of the signature certificate as contained in the System PSE in transaction STRUST.

There is an example for user USER123. The SAML assertions are issued by issuer "BXI/000" and the issuer does not use name qualifier. The key has format "issuer":"name qualifier":"user name". In this example the external ID for user USER123 is BXI/000::USER123. Therefore the prefix field needs to be set to BXI/000:: and the suffix field needs to be left blank.

Just to summarize it. Your identity provider generates the SAML assertions. You need to know how the provider is identified and what name qualifier it uses. These two values define prefix field. It's possible that you need to implement enhancement to convert SAP user name to user named used by identity provider. Don't forget to fill field Issuer's name where you need to use values from certificate used for signing SAML assertions. The public part of this certificate needs to imported into consumer system.

Cheers

[Former Member]

Hi Martin,

The documentation for SAML mentions :

Identity provider & SERVICE provider.

I wanted to clarify if Enterprise portal ( Java only ) linked with LDAP can be considered/configured as identity provider.

or SAP is making it mandatory to have SAP IDM 7.1/7.2 installed for SAML2.0.

This is becoming a concern.

I am planning to map the userid from (AD=EP UME) map to the email-id for all the backend(ABAP) systems.

of course like "Julius" had stated ( regarding http request ) I will maintain a JCO(RFC) connection from ABAP to JAVA stack.

The term Identity provider is confusing my plan.

[Former Member]

Here some companies use "company.com" for employees and "company.contractor.com" for externals.

This distinction can be usefull from the AD side as source to "provision" prefixes to the SAP user IDs... and other consequences such as password management / deactivation and tolerance threasholds and reporting.

Your BP users should be clearly distinguished, but that is hopefully clear.

Cheers,

Julius

[mvoros]

Hi,

identity provider is a Java application which can be deployed to any Java AS with sufficient SP level (7.2 SP3). Check the document which I have mentioned in this thread. You can download this application from service.sap.com/swdc as a SCA file. I am not sure about licensing. That document also mentions that you must have IdM 7.1 SP5 but I am not sure why you should not be able to use only identity provider except licensing issues.

I also got confused. Aren't you looking for scenario described [here|http://help.sap.com/saphelp_nwce72/helpdata/en/f2/1d7a4a9cb7486db6b439d35741c51f/frameset.htm]?

Cheers

[Former Member]

Hi Martin,

Everything you posted is right on target , but the problem is Installing and configuring IDM7.1/7.2 that is not in scope atleast for the next six months.

The goal is to have EP( Java only ) , move ESS & MSS from the present NW system[ABAP+JAVA( SRM/HR/ECC )] to the new EP and configure the SSO. EP will be pointing to the corporate LDAP.

My concern was can we make SAML2.0 work without installing IDM7.1/7.2 most of the documents seem to enforce the install of Identity management.

[MichaelShea]

Hi Martin,

To use SAP's IdP, yes you must have a SAP NetWeaver IDM 7.1 SP 5 license. See the implementation guide for the IdP. If you have another IdP, SAPs SP should be inter operable. It did pass SP lite certification.

-Michael

[mvoros]

Hi Michael,

I could see that requirement but I was thinking more about technical point of view. As far as understnad Identity Provider is a java application which authenticates a user against UME and returns a SAML message which is used to prove identity to service provider. I don't see why you need to have other compoments of IdM deployed to your landscape.

Cheers

[MichaelShea]

Hi Martin,

There is no other technical requirement than licensing at this time. It is my opinion that SAP hopes to offer tighter integration advantages between the IdP and the rest of the SAP NetWeaver IDM product. This licensing requirement sets the stage, so to speak.

-Michael

[Former Member]

> ... no other technical requirement than licensing at this time ...

I had one little function module I wanted to use it for and now have to start a mutli-national wide IdM project to get my FM to work...

> ...This licensing requirement sets the stage ...

The temptation to look for "hacks" is hopefully clear to you, but I also realized that I am one of the "guitly ones"..

I do agree with you 100% that IdM is a cool thing to federate the identities through to the backend and set a stage for the longer term - which is exactly that which IdM does. Understandable and correct approach and should be enforced in the programming as well!

I have already seen some "for user" parameters in customer systems as well and there are anyway lots of RFC FM's which do not make checks which someone might use intentionally and possibly "innocently" use from Se37 because it did the task but was not released... (hey, who checks that field..)

Released or not... it is a risk "in the wild".

PFCG and SU25 is not user friendly yet for WS security either in my opinion and it is very easy to make mistakes. CRM folks are forced into it. Certainly for development systems it is almost guaranteed that an admin will "give up" on it sooner than what they did on tcodes in role menus in the past... and these roles need to be build in test systems.

I think you will only have a few guru customers..and then all the rest. As before as well with RFC.

Just my opinion and speculation

Julius

[Former Member]

Hi Franklin,

Were you able to map external id, Is it working for you. I configured ABAP engine to accept saml assertions from ADFS2.0 and getting claims from adfs 2.0 with out any issues. but while trying to map in SAP using vusrextid view i am struggling. SAP is not accepting any format. IS there any way to identify how adfs2.0 is sending and what sap is receiving to map. I am doing simple mapping with email id or windows sama name or kerberos id but none of them works.

Best regards,

Kiran.

[former_member269672]

Hi Kiran,

What is the version and SP level of the ABAP system you are using? You can check ABAP server traces to see what is received and why the mappings failed.

Regards,

Desislava