SAP Build Work Zone advanced: configuring CIS and IPS on BTP

SAP Build Work Zone, advanced edition offers a single, personalized entry point to applications, content and business processes. Its rollout in SAP BTP does not start with the service, but with identity: without synchronized users and groups, no one can log in or administer Work Zone.

This article walks through the end-to-end configuration in a Development subaccount with the Cloud Foundry environment, with SAP Cloud Identity Services (CIS) as the identity provider and Identity Provisioning (IPS) to provision users and groups to Work Zone. The concepts of subscription, instance, entitlements and role collections are explained in more detail in the articles on subscriptions and instances in SAP BTP, entitlements and quotas and role collections and shadow users.

Objective and scope

The desired outcome is an operational Work Zone, with centralized authentication (SAML 2.0) and automatic provisioning, so that the administrator can log in, administer and start building sites.

Included in this configuration

• Entitlement assignment (Advanced and Advanced (Application) plans).
• Execution of the Work Zone advanced Booster.
• Creation of user groups in CIS and validation of role collections.
• Configuration Wizard and SAML 2.0 application in CIS, with Global User ID as the identifier.
• Technical user IPS_ADMIN with certificate and secret.
• Source system (CIS) and target system (Work Zone) in IPS, with their transformations.
• Activation and validation of the read and simulation Jobs.

Out of scope

• Migration from SAP Jam and use of SAP SuccessFactors Work Zone.
• Custom domain: the default ondemand.com is used.
• Optional add-ons: SAP Business Application Studio and SAP Build Process Automation.
• Site design, content and themes.

Prerequisites

• Global account and subaccount with the Cloud Foundry environment enabled.
• Subscription to SAP Cloud Identity Services, with the trust relationship validated.
• Global account and subaccount administrator available to run the Booster.
• An administrator user of type employee in CIS.

Process overview

flowchart TB
  A["1. Assign rights"] --> B["2. Run the Booster"]
  B --> C["3. Create groups in CIS"]
  C --> D["4. Configuration Wizard and SAML"]
  D --> E["5. Technical user IPS_ADMIN"]
  E --> F["6. Source system: CIS"]
  F --> G["7. Target system: Work Zone"]
  G --> H["8. Activate the Jobs"]

Entitlements and Booster

First, the entitlements for the Advanced and Advanced (Application) plans are assigned to the subaccount. With these visible in Entitlements, the administrator of the global account and the subaccount runs the Work Zone advanced Booster.

The Booster leaves the service subscription and instance created. This is verified in Instances and Subscriptions of the BTP Cockpit.

Role groups and collections

Work Zone advanced includes standard role collections in the subaccount. You can filter by WorkZone in Role Collections, and each one links to the user groups that grant access.

In CIS, the corresponding user groups are created (for example Workzone_Admin, Workzone_Area_Admin or Workzone_End_User). When you assign the administrator to them, they gain access to Work Zone with administration and development permissions.

Configuration Wizard and SAML application

With administrator access, the next step is to complete the Work Zone Configuration Wizard and create the SAML 2.0 application in CIS, with the metadata uploaded. The Global User ID is used as the identifier.

Technical user IPS_ADMIN

IPS needs a technical user, IPS_ADMIN, to read from CIS and write to Work Zone. Creating it delivers three elements: the certificate, the Client ID and the Client Secret.

Two points deserve attention from this step:

• The Client Secret cannot be retrieved after it is created. It must be saved in a password manager and, if lost, a new one must be generated.
• Every time the certificate of the source system is regenerated, it must be uploaded again in IPS_ADMIN.

Source and target systems in IPS

In Identity Provisioning, two systems are configured, each with its own properties and transformation:

1. Source system (CIS), from which users and groups are read.
2. Target system (Work Zone), to which they are provisioned.

If the administrator is left without a role in Work Zone, the solution is to use their Global User ID (userUuid) in the target transformation.

Provisioning jobs

With both systems saved, the jobs are activated. The configuration is correct when the READ and SIMULATION jobs finish successfully in Provisioning Logs, Job Logs tab.

Acceptance criteria

• The Work Zone advanced plans appear in the subaccount and the instance is created.
• The administrator user accesses the service with administration and development permissions.
• The READ and SIMULATION jobs complete successfully.
• The service onboarding is completed in the Configuration Wizard.

Risks and how to mitigate them

Conclusion

The key to Work Zone advanced lies in the identity foundation: entitlements, groups, the SAML application and provisioning with IPS. With the READ and SIMULATION jobs in green, the service is ready for the administrator to build sites. If your organization needs support with the SAP BTP rollout, take a look at our consulting services.