SAP Cloud Identity Services – IPS ( How to Assign default groups and Unassign groups on Condition)

Managing user groups efficiently is crucial for maintaining security and ensuring that users have the appropriate access within your organization. SAP Cloud Identity Services, specifically the Identity Provisioning Service (IPS), offers robust capabilities to automate and streamline this process. In this blog post, we’ll explore how to assign default groups to users and unassign groups based on specific conditions using IPS Transformtion logic.

Below is the scenario or example

Assigning Default Groups

Assigning default groups to users can be essential for ensuring that active users have the necessary permissions from the moment they are onboarded or access to the certain applications.

Here’s a step-by-step guide to achieve this:

Assign “DefaultGroup” in IPS Configuration:
Navigate to the Identity Services – Identity Provisioning tab and to your Target System.
Under the Transformation tab, modify according to your condition in transformation rule.

Note : below JSON is sample with having 1 group

{
“condition”: “$.userType == ’employee'”,
“constant”: “DefaultGroup”,
“targetPath”: “$.groups[0].value”
}

Note : below JSON is sample which is good practice to define your multiple groups having Target Variable

{
“condition”: “$.active == true”,
“constant”: [
{
“id”: “SAP Build Apps”
},
{
“id”: “SAP Build Code”
}
],
“targetVariable”: “assignGroup”
},
{
“condition”: “$.active == false”,
“constant”: [
{
“id”: “SAP Build Apps”
},
{
“id”: “SAP Build Code”
}
],
“targetVariable”: “unassignGroup”
}

Apply the Transformation:

Save the transformation rule and applyGo to the relevant source system.Run the provisioning job to ensure that all active users are assigned to the default group upon creation/modification and Inactive Users are unassigned from the default group defined.

Best Practices

Regularly Review and Update Rules: Ensure that your transformation rules are up-to-date with your organization’s policies and structure.Test in a Sandbox Environment: Before applying any new rules to your production environment, test them in a sandbox to avoid unintended access issues.Monitor Provisioning Jobs: Regularly monitor the results of your provisioning jobs to ensure that groups are being assigned and unassigned as expected.

By leveraging the capabilities of SAP Cloud Identity Services – IPS, you can automate the management of user groups, ensuring that your users always have the appropriate access based on their roles and conditions. This not only enhances security but also improves operational efficiency.

Managing user groups efficiently is crucial for maintaining security and ensuring that users have the appropriate access within your organization. SAP Cloud Identity Services, specifically the Identity Provisioning Service (IPS), offers robust capabilities to automate and streamline this process. In this blog post, we’ll explore how to assign default groups to users and unassign groups based on specific conditions using IPS Transformtion logic.Below is the scenario or exampleAssigning Default GroupsAssigning default groups to users can be essential for ensuring that active users have the necessary permissions from the moment they are onboarded or access to the certain applications.Here’s a step-by-step guide to achieve this:Assign “DefaultGroup” in IPS Configuration:Navigate to the Identity Services – Identity Provisioning tab and to your Target System.Under the Transformation tab, modify according to your condition in transformation rule.Note : below JSON is sample with having 1 group {
“condition”: “$.userType == ’employee'”,
“constant”: “DefaultGroup”,
“targetPath”: “$.groups[0].value”
} Note : below JSON is sample which is good practice to define your multiple groups having Target Variable {
“condition”: “$.active == true”,
“constant”: [
{
“id”: “SAP Build Apps”
},
{
“id”: “SAP Build Code”
}
],
“targetVariable”: “assignGroup”
},
{
“condition”: “$.active == false”,
“constant”: [
{
“id”: “SAP Build Apps”
},
{
“id”: “SAP Build Code”
}
],
“targetVariable”: “unassignGroup”
} Apply the Transformation:Save the transformation rule and applyGo to the relevant source system.Run the provisioning job to ensure that all active users are assigned to the default group upon creation/modification and Inactive Users are unassigned from the default group defined.Best PracticesRegularly Review and Update Rules: Ensure that your transformation rules are up-to-date with your organization’s policies and structure.Test in a Sandbox Environment: Before applying any new rules to your production environment, test them in a sandbox to avoid unintended access issues.Monitor Provisioning Jobs: Regularly monitor the results of your provisioning jobs to ensure that groups are being assigned and unassigned as expected.By leveraging the capabilities of SAP Cloud Identity Services – IPS, you can automate the management of user groups, ensuring that your users always have the appropriate access based on their roles and conditions. This not only enhances security but also improves operational efficiency. Read More Technology Blogs by SAP articles