Symptom
Using IAS with IPS for Signavio we need to assign licenses in Signavio for each user.
Resolution
You can assign licenses as a stable value, or using attributes already existing in IAS. The easiest option would be to use a group attribute. A user belonging to groups called "Process Modeler" and "Workflow" could potentially be automatically be assigned to a license "Process Modeler" and "Workflow". Here is how we can utilize this:
- In IAS, create a dedicated group for licensing (for example, a group representing the “Process Modeler” license). The name of the group doesn't really matter. You can name it "Licensing for modelers". This group doesn't need to be synched to Signavio, so doesn't need to have the special prefix. During synchronization will be skipped.
- In the next step, during the group creation select the Signavio application, and use the field "external name". Here you need to use the correct name of the license. I.e. "Process Modeler", "Enterprise Plus Edition", "Workflow".
- Make sure, all users, which should get these licenses are assigned to these groups
- In IAS application attribute mappings (Applications & Resources -> Applications -> Signavio), add the attribute “signavio_licenses_v2” and map it to "Identity Directory" -> “Application Groups - External name”.
- You don't need to run the read job, as the groups don't need to be synched to Signavio. These groups are used during login process over SAML
Keywords
SAML, SSO, JIT, IAS, IPS, auto provisioning, user not created, external name, Application Groups - External name, signavio_licenses_v2, license assignment, signavio , KBA , BPI-SIG-CA-SEC-UM , User Management for SAP Signavio , Problem
SAP Knowledge Base Article - Public