280 lines
8.0 KiB
Markdown
280 lines
8.0 KiB
Markdown
# Security and Roles Guide - SAP BTP Intelligent Situation Automation
|
|
|
|
**Source**: [https://github.com/SAP-docs/sap-btp-intelligent-situation-automation/tree/main/docs](https://github.com/SAP-docs/sap-btp-intelligent-situation-automation/tree/main/docs)
|
|
**Last Verified**: 2025-11-22
|
|
|
|
---
|
|
|
|
## Overview
|
|
|
|
Intelligent Situation Automation uses role-based access control through SAP BTP role templates and role collections. Users must be assigned appropriate role collections to access application features.
|
|
|
|
---
|
|
|
|
## Role Templates
|
|
|
|
Intelligent Situation Automation provides two role templates:
|
|
|
|
| Role Template | Purpose | Attributes |
|
|
|---------------|---------|------------|
|
|
| SituationAutomationKeyUser | Key user for daily operations | None |
|
|
| SituationAutomationAdminUser | Admin user for system management | None |
|
|
|
|
**Note**: Since these templates have no attributes, corresponding roles are created automatically. Templates with attributes require manual role creation with specified attribute values.
|
|
|
|
---
|
|
|
|
## SituationAutomationKeyUser
|
|
|
|
### Purpose
|
|
Key user access for managing situation automation on a daily basis.
|
|
|
|
### Access Level
|
|
Full application access including all operational tiles.
|
|
|
|
### Available Tiles
|
|
|
|
| Tile | Function |
|
|
|------|----------|
|
|
| **Manage Situation Actions** | Create and manage custom actions |
|
|
| **Manage Situation Automation** | Configure automation rules and conditions |
|
|
| **Situation Dashboard** | View situation overview and status |
|
|
| **Analyze Situations** | Analyze resolution flows and outcomes |
|
|
| **Delete Data Context** | Manage data retention and cleanup |
|
|
| **Explore Related Situations** | View relationships between situations |
|
|
|
|
### Typical Users
|
|
- Business process owners
|
|
- Operations managers
|
|
- Situation analysts
|
|
- Automation administrators
|
|
|
|
---
|
|
|
|
## SituationAutomationAdminUser
|
|
|
|
### Purpose
|
|
Admin access for system onboarding and technical configuration.
|
|
|
|
### Access Level
|
|
Limited to system onboarding tasks only.
|
|
|
|
### Available Functions
|
|
|
|
| Function | Description |
|
|
|----------|-------------|
|
|
| Onboard System | Add and configure S/4HANA systems |
|
|
| Edit System | Modify onboarded system details |
|
|
| Retry Onboarding | Retry failed onboarding attempts |
|
|
|
|
### Typical Users
|
|
- System administrators
|
|
- Technical architects
|
|
- Initial setup personnel
|
|
|
|
---
|
|
|
|
## RuleRepositorySuperUser
|
|
|
|
### Purpose
|
|
Business rules management for authoring automation rules.
|
|
|
|
### Origin
|
|
This role comes from SAP Business Rules service, not Intelligent Situation Automation.
|
|
|
|
### Requirement
|
|
Key users who need to author rules must have both:
|
|
- SituationAutomationKeyUser
|
|
- RuleRepositorySuperUser
|
|
|
|
---
|
|
|
|
## Role Collections
|
|
|
|
### What Are Role Collections?
|
|
|
|
Role collections bundle one or more roles from one or more applications. They provide a convenient way to assign multiple permissions at once.
|
|
|
|
### Creating Role Collections
|
|
|
|
1. Navigate to SAP BTP Cockpit
|
|
2. Go to your subaccount
|
|
3. Navigate to **Security** → **Role Collections**
|
|
4. Click **Create**
|
|
5. Enter name and description
|
|
6. Add roles from role templates
|
|
|
|
### Recommended Role Collections
|
|
|
|
| Role Collection Name | Included Roles | Target Users |
|
|
|---------------------|----------------|--------------|
|
|
| ISA Key Users* | SituationAutomationKeyUser, RuleRepositorySuperUser | Business users |
|
|
| ISA Administrators* | SituationAutomationAdminUser | Technical admins |
|
|
|
|
*Example names; customize based on your organization's naming conventions.
|
|
|
|
**Reference**: See [Building Roles and Role Collections for Applications](https://help.sap.com/docs/BTP/65de2977205c403bbc107264b8eccf4b/eaa6a26291914b348e875a00b6beb729.html)
|
|
|
|
---
|
|
|
|
## Assigning Role Collections to Users
|
|
|
|
### Prerequisites
|
|
|
|
Users must exist in one of:
|
|
- SAP ID service
|
|
- Identity Authentication service (IAS)
|
|
- Another configured identity provider (IdP)
|
|
|
|
### Assignment Methods
|
|
|
|
| Identity Provider | Assignment Method |
|
|
|-------------------|-------------------|
|
|
| SAP ID service | Individual user assignment only |
|
|
| Identity Authentication | Individual users OR user groups |
|
|
| Other IdP | Individual users OR user groups |
|
|
|
|
### Individual User Assignment
|
|
|
|
1. Navigate to SAP BTP Cockpit
|
|
2. Go to your subaccount
|
|
3. Navigate to **Security** → **Users**
|
|
4. Select the user
|
|
5. Click **Assign Role Collection**
|
|
6. Select appropriate role collection
|
|
7. Confirm assignment
|
|
|
|
### User Group Assignment (IAS/Custom IdP)
|
|
|
|
1. Navigate to SAP BTP Cockpit
|
|
2. Go to your subaccount
|
|
3. Navigate to **Security** → **Role Collections**
|
|
4. Select the role collection
|
|
5. Go to **User Groups** tab
|
|
6. Add user group from IdP
|
|
7. All users in group receive the role collection
|
|
|
|
---
|
|
|
|
## Required Role Collections by User Type
|
|
|
|
### For Key Users (Daily Operations)
|
|
|
|
| Role Collection | Required |
|
|
|-----------------|----------|
|
|
| SituationAutomationKeyUser | Yes |
|
|
| RuleRepositorySuperUser | Yes (for rule authoring) |
|
|
|
|
### For Admin Users (Setup Only)
|
|
|
|
| Role Collection | Required |
|
|
|-----------------|----------|
|
|
| SituationAutomationAdminUser | Yes |
|
|
|
|
---
|
|
|
|
## Trust and Federation
|
|
|
|
### Identity Provider Configuration
|
|
|
|
For detailed guidance on configuring trust with identity providers, see SAP BTP documentation for Trust and Federation with Identity Providers.
|
|
|
|
### Common Configurations
|
|
|
|
| Configuration | Use Case |
|
|
|---------------|----------|
|
|
| SAP ID service | Default BTP identity provider |
|
|
| SAP Cloud Identity Services | Enterprise SSO integration |
|
|
| Corporate IdP (SAML/OIDC) | Integration with existing IdP |
|
|
|
|
---
|
|
|
|
## Authorization Flow
|
|
|
|
```
|
|
User Login
|
|
│
|
|
▼
|
|
Identity Provider
|
|
│
|
|
▼
|
|
BTP Authentication
|
|
│
|
|
▼
|
|
Role Collection Check
|
|
│
|
|
├─── SituationAutomationKeyUser ───► Access operational tiles
|
|
│
|
|
└─── SituationAutomationAdminUser ──► Access onboarding only
|
|
```
|
|
|
|
---
|
|
|
|
## Best Practices
|
|
|
|
### Role Assignment
|
|
|
|
- ✅ Create dedicated role collections for your organization
|
|
- ✅ Use descriptive names for role collections
|
|
- ✅ Document which users/groups have which roles
|
|
- ✅ Assign minimum necessary roles (least privilege)
|
|
- ✅ Use group-based assignment when possible (with IAS)
|
|
|
|
### Security
|
|
|
|
- ✅ Review role assignments regularly
|
|
- ✅ Remove roles when users change responsibilities
|
|
- ✅ Separate admin and key user roles
|
|
- ✅ Track changes via audit logs
|
|
|
|
### Common Mistakes
|
|
|
|
- ❌ Assigning SituationAutomationAdminUser to all users
|
|
- ❌ Forgetting RuleRepositorySuperUser for rule authors
|
|
- ❌ Not removing roles when users leave
|
|
- ❌ Over-permissioning for convenience
|
|
|
|
---
|
|
|
|
## Troubleshooting Access Issues
|
|
|
|
### "Server Error" on Application Access
|
|
|
|
**Symptom**: Error message when accessing Manage Situation Automation app
|
|
|
|
**Cause**: User not assigned required role collection
|
|
|
|
**Solution**: Assign SituationAutomationKeyUser role collection to the user
|
|
|
|
### Cannot Access Onboard System
|
|
|
|
**Symptom**: Onboard System app not visible or accessible
|
|
|
|
**Cause**: Missing admin role
|
|
|
|
**Solution**: Assign SituationAutomationAdminUser role collection
|
|
|
|
### Cannot Create/Edit Rules
|
|
|
|
**Symptom**: Rule authoring functions unavailable
|
|
|
|
**Cause**: Missing rule repository role
|
|
|
|
**Solution**: Assign RuleRepositorySuperUser role collection in addition to SituationAutomationKeyUser
|
|
|
|
---
|
|
|
|
## External Links
|
|
|
|
For a comprehensive list of SAP documentation links with document IDs, see `references/external-links.md`.
|
|
|
|
Key resources for role and security management:
|
|
- **Building Roles and Role Collections**: [https://help.sap.com/docs/BTP/65de2977205c403bbc107264b8eccf4b/eaa6a26291914b348e875a00b6beb729.html](https://help.sap.com/docs/BTP/65de2977205c403bbc107264b8eccf4b/eaa6a26291914b348e875a00b6beb729.html)
|
|
- **Trust Configuration**: [https://help.sap.com/docs/BTP/65de2977205c403bbc107264b8eccf4b/cb1bc8f1bd5c482e891063960d7acd78.html](https://help.sap.com/docs/BTP/65de2977205c403bbc107264b8eccf4b/cb1bc8f1bd5c482e891063960d7acd78.html)
|
|
- **Authorization Management**: [https://help.sap.com/viewer/65de2977205c403bbc107264b8eccf4b/Cloud/en-US/6373bb7a96114d619bfdfdc6f505d1b9.html](https://help.sap.com/viewer/65de2977205c403bbc107264b8eccf4b/Cloud/en-US/6373bb7a96114d619bfdfdc6f505d1b9.html)
|
|
|
|
---
|
|
|
|
**Document Version**: 1.0.0
|
|
**Last Updated**: 2025-11-22
|