2757461 - What is the Scope of Implementing Information Security Control in C4C?

You have a requirement to do information security control in the system. The security strategy requirements are the following two points:

1. System to be bound to the MAC address of the user's computer.
2. Two steps of validation, for example: you can generate dynamic encoding to the mailbox, and then log in according to the dynamic encoding.

SAP Cloud for Customer

In C4C, we don't have any such existing functionality to support the requirements. Alternatively, user can use SSO processes, where IDP is enabled with the required functionality in place to handle the requirements. In case of SSO, C4C system will by default redirects the users to the IDP, where, IDP can perform required pre-processing before allowing the user to take next steps (like generating the token in their device, which is dealing with requirements like based on MAC address and then entering it in the IDP, which takes next steps).

Is there any documentation or guidelines for SSO+IDP?

This is not standard functionality in C4C, it might be possible with IDP which supports such functionality. So, we wont have guidance documents or blogs related to it, it needs to be checked if there is some IDP provider which can provide such possibility.

KBA , information security control , sso+idp , SRD-CC-IAM , Identity & Access Management , Problem

SAP Cloud for Customer add-ins all versions ; SAP Cloud for Customer core applications all versions