Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Technology Blogs by Members
Explore a vibrant mix of technical expertise, industry insights, and tech buzz in member blogs covering SAP products, technology, and events. Get in the mix!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 

Integration of SAP Task Center, Azure and ServiceNow - SSO, User Provisioning and Token exchange

ITCE
Newcomer
‎2024 Jul 19 3:10 PM
927

During the configuration of Task Connect, an integration between ServiceNow and SAP Task center, we devoted significant effort to addressing security concerns, particularly focusing on user authentication and user provisioning. Given the widespread use of Azure as an identity and token provider, we developed a method to synchronize users and groups across ServiceNow, SAP Task Center, and Azure. 

In this document, you will find the scenario overview, related architectural diagrams presenting the different components and how they interact with each other and what are the steps to follow to configure the connection between ServiceNow, SAP Task Center and Azure. 

1. Scenario overview

The starting point in this scenario is the user's authentication and access token issued by the SAP Cloud Identity tenant's authentication service (IAS), indicated as AT (IAS) APP in returned by step 2 in figure 1 below and following the notation <token type> (<issuer>) <audience>. The complete token exchange is orchestrated by the OAuth 2.0 and OpenID Connect (OIDC) authorization and authentication frameworks and their respective token types, which are access tokens (AT), refresh tokens (RT), and identity tokens (ID). Thus, AT (IAS) IAS is an access token, issued by the IAS tenant's OAuth 2.0 authorization server, with an audience set to the IAS tenant's client ID. All tokens except for refresh tokens are formatted as JWTs. Compared to the token exchange in the previous parts of this blog series (see part I, Interoperability and standards, for more details), SAML 2.0 - or more precisely the SAML assertion as an OAuth 2.0 authorization grant defined in section 2.1 of RFC 7522 - is no longer used in this scenario. Instead of transforming between different token formats (JWT to SAML and back to JWT), this scenario only uses JWTs for the token exchange. It is important to note that for this token exchange no direct trust relationship between the application on BTP and Azure AD is required. The application only has a trust relationship to the IAS tenant, and the IAS tenant maintains the trust relationship to the Azure AD tenant (and vice versa).   

All authentication requests for the business application on BTP (SAP TASK CENTER) are forwarded by the IAS tenant to the Azure AD tenant which is configured as a corporate identity provider (IdP) in IAS. IAS acts as a proxy and delegates authentication to Azure AD in the role of the relying party to the corporate identity provider. The IAS tenant therefore requires an application registration in Azure AD.  

Note: For the TaskConnect integration configuration to work, the SAP Task Center should be configured according to the following documentation: https://help.sap.com/docs/task-center/sap-task-center/initial-setup

2. Users authentication and token exchange

ITCE_0-1721388770253.png

  1. The user accesses the BTP business application's SAP Task Center. The app delegates authentication to the IAS tenant using OIDC. It starts the authentication process by redirecting the user' browser to the IAS tenant's OAuth server authorization endpoint at https://<IAS tenant name>.accounts.ondemand.com/oauth2/authorize and sending an OAuth authorization request. 
  2. Because the user is not yet authenticated at the IAS tenant, the user's browser is redirected to the IAS tenant's single sign-on (SSO) endpoint at https://<IAS tenant name>.accounts.ondemand.com/saml2/idp/sso. 
  3. The business application is configured in IAS to pass all authentication requests to Azure AD as its corporate IdP. Therefore, IAS sends an OAuth authorization request to the Azure AD tenant's OAuth authorization endpoint. 
  4. The user gets prompted by Azure AD to enter the credentials. Upon successful authentication, Azure AD sends the authorization code to IAS by redirecting the user's web browser to the URI specified in the previous request. 
  5. IAS receives the authorization code and sends an access token request to Azure AD's token. Azure AD issues an access token and refresh token (RT(AAD)IAS which is cached for later use in step for the authenticated user with an audience set to the IAS tenant's OIDC name. 
  6. The BTP business application requests a client assertion from the IAS tenant to use it in the subsequent requests for the token exchange via the IAS tenant's OIDC proxy. The client application sends a token request to the IAS tenant's token endpoint. The POST request is authenticated with the client ID and secret of the business application in IAS. The client assertion from IAS takes the form of a signed JWT that proofs the application's identity to AAD when requesting tokens via the IAS corporate IdP OIDC proxy. 
  7. The business application exchanges the IAS-issued ID token into an Azure AD-issued access token via the IAS tenant's OIDC proxy token exchange endpoint. The POST request uses the assertion parameter to pass the base64-encoded IAS ID token of the user. 
  8. IAS token service sends a refresh token request using RT(AAD)IAS cached in step 5 to obtain a new access token AT(AAD)APP for the business application, 
  9. The business application uses the Azure AD On-behalf-Of (ObO) flow for requesting the access token  
  10. Finally, the business application calls the ServiceNow to take actions to the signed-in user's tasks. 
  11. ServiceNow validate the token using OIDC provider to verify ID tokens configuration with the same application registered in Azure which issues an access token and refresh token in step 5. 

3. User provisioning - Azure SAP

Use SAP Cloud Identity Services - Identity Provisioning to provision users from Microsoft Azure Active Directory to SAP Cloud Identity Services - Identity Authentication. 

4. User provisioning & SSO - Azure-ServiceNow

  1. Use ServiceNow enterprise application in Azure to provision users from Microsoft Azure Active Directory to ServiceNow instance 
  2. Use the same ServiceNow enterprise application created in step 13 in Azure to authenticate users from Microsoft Azure Active Directory to ServiceNow instance 

5. Technical service flow

ITCE_1-1721389027561.png

You need to create integration user for SAP Technical connection and choose how SAP Task Center will authenticate when technical connection is used (delta jobs in SAP are using this technical connection)

For example, you can use Basic Auth or OAuth: 

  1. For basic auth provide username and password to the team who is configuring the connection to ServiceNow. 
  2. The BTP business application requests a client assertion from the IAS tenant to use it in the subsequent requests for the token exchange via the IAS tenant's OIDC proxy.
  3. For OAuth follow these steps in ServiceNow (account with admin role is required) 
    1. Open System OAuth -> Application Registry. Click New and choose "Create an OAuth API endpoint for external clients". Configure the record and share username, user password, client id and client secret with the team configuring the connection to ServiceNow 

6. Register the applications in Azure AD for IAS tenant and SN OIDC provider to verify ID tokens. 

The token exchange and OIDC proxy setup between the SN, IAS, and the Azure AD tenant, requires a trust relationship which is established by registering one application in the Azure AD tenant    

“SAPIASTenant” represents the SAP Cloud Identity Service tenant.

Step 1
Login to Azure Portal (e.g. with your Microsoft 365 E5 developer subscription’s admin account) and select Azure Active Directory from the portal menu.  

Select App registrations from the left-side menu.  

Step 2
Click + New registration 

ITCE_4-1721391713497.png

Step 3 
Enter "<SAP IAS Tenant>" for the Name of the new application registration.  

Replace <SAP IAS Tenant> with your friendly name  

Select "Web" from the dropdown list in the Redirect UR I section.  

Enter your IAS tenant's redirect UR Iin the Redirect URI section's text field:https://<IAStenant name>.accounts.ondemand.com/oauth2/callback.Replace <IAS tenant name> with your tenant's name.

Click Register.  

ITCE_5-1721391793724.png

Step 4
Copy the newly generated Application (client) ID to a temporary text file. You will need it in the next step for deploying the sample application.  

ITCE_6-1721391924140.png

Step 5
Select Manifest from the navigation menu to edit the application registration's manifest file.  
Change the value for the field "accessTokenAcceptedVersion" from null to 2.    
Click Save.  

ITCE_7-1721391960742.png


7. Configure trust to the IAS tenant in Azure AD

Trust to the IAS tenant is configured in Azure AD with a new federated identity credential. In addition, a client secret is required for the initial token exchange in step 5 of figure 1. Both credentials will be configured for the application registrations in the following step.  

Step 6
Select the SAPIASTenant app from the list. (created in step 3)  
Select Certificates & secrets from the menu and switch to the Client secrets tab.  
Click + New client secret.  

ITCE_8-1721392162592.png

Step 7
Enter "<SAPOIDCProxy>" for the Description.  
Click Add.  

ITCE_9-1721392189260.png

Step 8
Click Copy to clipboard in the Value column and paste it to a temporary text file. You will need it later in the setup process.

ITCE_10-1721392218908.png

Step 9
Create another one secret for ServiceNow   
Enter "<ServiceNow>" for the Description.  
Click Add.  

ITCE_11-1721392246014.png


8. Configure permissions and scopes in Azure AD

To request the Outlook calendar event on behalf of the user, the business application (SAPBTPGraphApp) requires the Graph API permission Calendars.Read. SAPBTPGraphApp also exposes the custom scope "token.exchange".This scope is referred to as a (downstream) API permission for the SAPIASTenant application registration and required for steps 7 and 8 in figure 1. For the initial token request to Azure AD (see step 5 in figure 1 and figure 2), the SAPIASTenant application exposes the custom scope "ias.access".  

Step 10
Go to Expose an API in the navigation menu.  
Click + Add a scope.  

ITCE_12-1721392320639.png

Step 11
Accept the default value for the Application ID URI.  
Click Save and continue.  

ITCE_13-1721392351197.png

Step 12
Enter "ias.access" for the new Scope name. Provide an Admin consent display name and description.  
Click Add scope.  

Scope name: 
ias.access 

Admin consent display name: 
IAS Tenant Access 

Admin consent description: 
Access to SAP Cloud Identity service Application

ITCE_14-1721392410098.png

Step 13
Copy the full-qualified URI of the new scope (api://<client id>/ias.access) from the clipboard to temporary text file. It will be used in a later setup step.  

ITCE_15-1721392473937.png

Step 14
Add Optional claim to the token.  
Navigate to Token configuration  
+ Add optional claim  
Token Type - ID  
Select "email" and add  

ITCE_16-1721392521039.png

Step 15
If message about API permissions required appear  
select the checkbox - Turn On Microsoft Graph email permission (required for claim to appear in token)  
Click "add"

ITCE_17-1721392551461.png

Step 16
Grant Admin Consent 

ITCE_18-1721392573010.png

Step 17
Navigate to authentication  
Scroll down to Implicit grant and hybrid flows  
Select the tokens you would like to be issued by the authorization endpoint:  
Select the checkbox ID tokens  
Click Save 

ITCE_19-1721392604385.png


9. Configure Azure as an OAUTH OIDC provider on ServiceNow

Step 18
Open the ServiceNow instance  
Navigate to All > System OAuth > Application Registry.  
Click New, click Configure an OIDC provider to verify ID tokens.

ITCE_20-1721392708919.png

Step 19
Fill the form.    

Field  

Description  

Name  

A unique name that identifies the OAuth OIDC entity.  

Client ID  

The client ID of the application registered in Azure in step 4. The instance uses the client ID when requesting an access token.  

Client Secret  

The client secret of the application registered in Azure in step 31.  

OAuth OIDC Provider Configuration  

The OIDC provider (ADFS, Auth0, Azure AD, Google, Okta) can be used to validate the JWT token. Click the record of your OIDC provider configuration to validate the User Claim and User Field are set appropriately. If you check Enable JTI claim verification, the ServiceNow JWT token validation also validates the JTI sent by the provider.  

See next step for more details  

  

Clock Skew  

The number, in seconds, for the constraint to be considered valid. The default is 300.  

Comments  

Additional information to associate with the application.  

Application  

The name of the application containing this entity.  

Accessible from  

Select an option to make it accessible from all application scopes, or this application scope only. (all scope by default)  

Enforce Token Restrictions  

Select to only allow tokens to be used with APIs set to allow the authentication profile. You can set grant access using an API access policy. For more information, seeCreate REST API access policy.  

Default: Unselected.  

Active  

Select the check box to make the OAuth application active.  

Redirect URL  

The URL of the OAuth application for receiving the authorization code. (automatically added when save the application  

End Session Endpoint URL  

The URL endpoint which enables after a session ends.(not required  

Enable force authentication  

Option to enable force authentication for users. (not required)  

ITCE_22-1721392758973.png

Step 20
OAuth OIDC Provider Configuration  
Click on the search icon and then New

OIDC Provider - A unique name that identifies the OIDC provider  

OIDC Metadata URL - the OIDC provider OpenID Connect metadata document  (details in next step)  

User claim: email  
User Field: the field in SN which contain mail value  

Enable JTI claim verification: Disable

ITCE_24-1721392870114.png

Step 21
Navigate to azure application which created in step 3 - Overview - Endpoints - OpenID Connect metadata document  

ITCE_25-1721392902312.png

Step 22
Navigate to Oauth Entity Scope and add  
offline_access,   
Open id  

Click Update.

ITCE_26-1721392944387.png

Step 23
Navigate to the Oauth Entity Profiles which is automatically created when Save Oauth OIDC entity.  

Verify that the Grant type is is Resource Owner Password Credentials and then add the OAuth Entity Scopes created in the above step.

ITCE_27-1721392984612.png

ITCE_28-1721392990570.png

Step 24
Add Auth Scope: 
useraccount

ITCE_29-1721393015741.png

Step 25
Navigate to the created in step 34 Oauth OIDC Entity and copy the redirect url  

ITCE_31-1721393042174.png

ITCE_32-1721393043578.png

Step 26
Navigate to Azure App registered in step 3  
Authentication  
Add the url from the previous step. (do not remove or replace the url added in step 3 when create the application)  
Save

ITCE_33-1721393081723.png

10. Setup user provisioning - Azure >> SAP

Step 27
Launch a browser window and access your Azure portal using the URL: https://portal.azure.com/. 

You will need to authenticate to your Azure AD using your admin credentials. 

Step 28
Click Microsoft Entra ID. 

ITCE_34-1721393313874.png

Step 29
Click App Registration >> New registration. 

ITCE_35-1721393339071.png

Step 30
Specify a name for your app and click Register 

Step 31
Click API permission >> Add a permission. 

ITCE_36-1721393393375.png

Step 32
Select Microsoft Graph.

ITCE_37-1721393415459.png

Step 33
Click Application permissions. 

ITCE_38-1721393439583.png

Step 34
From the list of API permissions, expand User and select User.Read.All. 

ITCE_39-1721393458635.png

Step 35
From the API list also select Group >> Read.All and Directory >> Read.All.  Click Add permissions at the bottom of the screen once done. 

Step 36
The permissions are not granted by default.  To grant the permissions, click Grant admin consent for Default Directory. 

ITCE_40-1721393500214.png

Step 37
Click Yes on the popup message and confirm that all permissions are granted.

ITCE_41-1721393517168.png

Step 38
Click Overview from the left panel.  Make a note of the Application (client) ID.  You will need this later when creating the source system in IPS.   Click Add a certificate or secret. 

ITCE_42-1721393534448.png

Step 39
Click New client secret. 

ITCE_43-1721393550840.png

Step 40
Specify a description and expiry time for the client secret.

ITCE_44-1721393570018.png

Step 41
You should have client secret added successfully.  Make a note of the value field as you will need it later when creating the source system in IPS. 

ITCE_45-1721393595594.png

Step 42
Navigate to the main overview page of Azure AD and make a note of your Primary domain.  You will need this value when creating the source system in IPS. 

ITCE_46-1721393612994.png

Step 43
Follow the blog  https://community.sap.com/t5/technology-blogs-by-sap/provision-users-from-microsoft-azure-ad-to-sap-... and specific hint on filtering users by a group in Identiy Provisionning Source system Properties, add aad.group.filter=displayName eq '<group_name>': 

ITCE_47-1721393638444.png


11. Establish trust between task sub account and IAS

Step 44
Go to BTP Cockpit->Security->Trust Configuration 

Step 45
Select "Establish trust" and choose the IAS

Step 46
Select "Establish trust" and choose the IAS 

Note: This creates an OIDC application in IAS for the subaccount 

NB: Task Center/Service Now integration works only with OIDC trust between Task Center subaccount and IAS

Step 47
This would create an application in iAS 

For more information, you can check: https://help.sap.com/docs/btp/sap-business-technology-platform/establish-trust-and-federation-betwee...

12. Setup the corporate identity provider and OIDC proxy in SAP Cloud Identity tenant

Step 48
Login as an administrator to your SAP Cloud Identity service administration console at 
https://<IAStenant name>.accounts.ondemand.com/admin 

ITCE_48-1721393838179.png

Step 49
Go to Identity Providers > Corporate Identity Providers and click Create.  
Enter a Display name(e.g. "Azure Active Directory") and click Save. 

ITCE_0-1721395913437.png

Step 50
Click on Identity Provider Type from the Trust settings of the new corporate identity provider.

ITCE_1-1721395934806.png

Step 51
Select OpenID Connect Compliant from the list.  
Click Save.

ITCE_2-1721395961468.png

Step 52
Click on OpenID Connect Configuration from the Trust settings of the new corporate identity provider. 

ITCE_3-1721395983702.png

Step 53
Enter your Azure AD tenant's OIDC Discovery URL (https://login.microsoftonline.com/<AAD tenant ID>/v2.0) Click Load.  

The Issuer field gets populated from the loaded Azure AD tenant's OIDC metadata.

ITCE_4-1721396016741.png

Step 54
Enter the SAPIASTenant's client ID in the Client ID field. In the Client Secret field, enter the value of theOIDCProxysecret copied in step 8.  

Click Validate. 

ITCE_5-1721396041390.png

Step 55
Verify a successful validation of the OIDC configuration.  

Click OK. 

Step 56
Click + Add  

ITCE_6-1721396081656.png

Step 57
Copy and paste the full-qualified URI of the SAPIASTenant application's custom scope (api://<client id>/ias.access) copied in step 13 for the new scope.  

Click Save.  

Step 58
Click+ Add again and add the scope: 
"email" 
"openid" 
"offline_access" 

Click Save. 

Step 59
Click Save.  

Step 60
Go to Applications & Resources > Applications  
Select the application from "Establish trust between Task subaccount and IAS" step – step 47

Click Attributes

ITCE_7-1721396184485.png

Step 61
Navigate to Attributes and add  

Name: "xsuaa-persist-corporate-idp-token" 
Source: Expression 
Value: true 

Save

ITCE_8-1721396237130.png

Step 62
Select "Conditional Authentication"  
In the "Default Identity Provider", choose the Azure provider configured in steps 48-59, Click Save

ITCE_9-1721396411574.png


13. Configure destinations for SAP in the BTP sub-account

SAP Task Center uses destinations to connect to Service Now task provider 

 Client Specific configuration: 

  • aadTokenEndpoint: Azure AD token endpoint athttps://login.microsoftonline.com/<AAD tenant ID>/oauth2/v2.0/token  
  • iasTokenEndpoint: SAP Cloud Identity service tenant's token endpoint athttps://<IAStenant name>.accounts.ondemand.com/oauth2/token  
  • iasTokenExchange: SAP Cloud Identity service's token exchange service endpoint athttps://<IAStenant name>.accounts.ondemand.com/oauth2/exchange/corporateidp  

Step 63
Go back to the SAP BTP Cockpit and navigate to your CF subaccount.  
Select Connectivity > Destinations from the navigation menu.  
Click New Destination.

Step 64
Enter the following values for the first destination:  
Refer to 6. TECHNICAL SERVICE FLOW

Click Save.

ITCE_10-1721397811178.png

Step 65
Repeat steps 63 and 64 with following values for the second destination:  

Refer to 10. CONFIGURE AZURE AS AN OAUTH OIDC PROVIDER ON THE SERVICENOW , step 21.

AuthnContextClassRef = urn:oasis:names:tc:SAML:2.0:ac:classes:X509 
clientKey = token service password=client secret 
Token service user = client id 

Task Center documentation for Third Party destination setup: https://help.sap.com/docs/task-center/sap-task-center/connect-third-party-task-provider-and-sap-task...  

Click Save.  

ITCE_11-1721397858391.png

14. Test the scenario 

Step 66
Use SAP Task Center Administration app to check the status of the configured connector destination, following: https://help.sap.com/docs/task-center/sap-task-center/working-with-task-center-administration-app

Step 67
Use SAP Task Center Web app, to validate that tasks from the new destination are seen by business users (for more information, see: https://help.sap.com/docs/task-center/sap-task-center/sap-task-center-web-app)

1 Comment
vbalko-claimate
Contributor
‎2024 Jul 20 7:31 AM
0 Kudos

Thank you, really long and detailed guide also containing a lot of additional stuff. Kudos

Vlado

Labels in this area
Popular Blog Posts