SAP Cloud Platform Identity Authentication Service

1 Administration GuidePUBLIC2018-03-22 SAP Cloud Platform Identity Authentication ServiceContent1 SAP Cloud Platform Identity Authentication what 's New for Identity Logon Getting Operation Tenant Password Privacy Terms of E-Mail Identity Identity Change Logs with a History of Administration Existing Users of a Tenant of SAP Cloud Platform Identity Authentication Usage for User the Remember Me Option ..2392 PUBLICSAP Cloud Platform Identity Authentication ServiceContentAccess Applications with Single Sign-On on Mobile for Developer Logon Overlays in Customer Clickjacking for Integration with SAP Cloud with SAP Web with SAP Document with SAP Identity Management with Microsoft Azure Get Updates and Cloud Platform Identity Authentication ServiceContentPUBLIC31 SAP Cloud Platform Identity Authentication ServiceGetting StartedWhat's NewOverview [page 20]Product Details [page 21]Getting Started [page 27] what 's New for Identity Authentication [page 4]ScenariosResourcesBusiness-to-Consumer Scenario [page 28]Business-to-Business Scenario [page 30]Business-to-Employee Scenario [page 31]Operation Guide [page 33]User Guide [page 232]Developer Guide [page 244]Security [page 327]Integration Scenarios [page 329]Get Support [page 350]

2 Download This Documentation as PDFT erms of UseCopyright and TrademarksPrivacyLegal what 's New for Identity AuthenticationThis page lists the release notes of SAP Cloud Platform Identity Authentication Service for 2018. To see the release notes for the previous years, visit Archive [page 7].4 PUBLICSAP Cloud Platform Identity Authentication ServiceSAP Cloud Platform Identity Authentication Service21 March 2018 - Identity AuthenticationNewCustomer DocumentsTenant administrator can upload terms of use and privacy policy documents, and e-mail templates in Romanian, Hungarian, Serbian, Azerbaijani, Bulgarian. See Configuring Terms of Use [page 140], Configuring Privacy Policies [page 135], and Con figuring E-Mail Templates [page 144].NewProfile PageA user can view the signed Terms of Use and Privacy Policy documents. See User Guide [page 232].NewProfile Page .Extended the data in the Your Profile Information screen with all user attributes that are kept in SAP Cloud Platform Identity Authentication Service .

3 See User Guide [page 232]NewProfile PageA user can download all the attributes that are kept for him or her in SAP Cloud Platform Identity Authentication Service . See User Guide [page 232].NewREST APIE xtended the User Management REST API. You can delete SP user in a tenant via API. See SP User Deletion [page 258].8 March 2018 - Identity AuthenticationNewAuthenticating Identity ProviderYou can allow users to log on via SAP Cloud Platform Identity Authentication Service when a corporate Identity provider (IdP) is selected as default. See Configure Logon via Identity Authentication when a Corporate IdP is Chosen as Default [page 86].SAP Cloud Platform Identity Authentication ServiceSAP Cloud Platform Identity Authentication ServicePUBLIC5 NewSCIM REST APISCIM REST API implementation of Identity Authentication was extended. You can create, update, and delete user groups in a tenant. See Create Group Resource [page 301], Update Group Resource [page 304], and Delete Group Resource [page 306].

4 AnnouncementSocial Identity ProvidersYou should update your Valid OAuth redirect URIs list in the Facebook Login Seetings by March 14, 2018. See Configure So cial Identity Providers [page 219].22 February 2018 - Identity AuthenticationNewSAML ConfigurationYou can define a different location to which logout response messages should be sent. See Configure a Trusted Service Pro vider [page 44].6 February 2018 - Identity AuthenticationNewConditional AuthenticationYou can define rules for authenticating Identity provider according to e-mail domain, user type, and user group. See Config ure Conditional Authentication for an Application [page 91].9 January 2018 - Identity AuthenticationNewBranding and LayoutImplemented Google reCAPTCHA to protect the self-registration form against machine registrations. See Protecting Appli cation Forms with Google reCAPTCHA [page 79].6 PUBLICSAP Cloud Platform Identity Authentication ServiceSAP Cloud Platform Identity Authentication ServiceNewEnd User ScreensAdded Swedish to the supported languages for end user screens.

5 See Supported Languages [page 26].NewCustomer DocumentsTenant administrator can upload terms of use and privacy policy documents, and e-mail templates in Swedish. See Config uring Terms of Use [page 140], Configuring Privacy Policies [page 135], and Configuring E-Mail Templates [page 144].NewREST APIA dded Swedish to the default languages for the predefined master data for each resource, and the predefined texts and messages for end user screens available per tenant in Identity Authentication . See Change Tenant Texts REST API [page 308] and Change Master Data Texts REST API [page 314].Archived Release Notes 2017 [page 7] 2016 [page 12] 2015 [page 16] 2014 [page 19] ArchiveRelease Notes 2017 [page 7]Release Notes 2016 [page 12]Release Notes 2015 [page 16]Release Notes 2014 [page 19] Release Notes 2017 The following document provides information about what was released in 2017. For more information about the latest release notes, see what 's New for Identity Authentication [page 4].

6 SAP Cloud Platform Identity Authentication ServiceSAP Cloud Platform Identity Authentication ServicePUBLIC729 November 2017 - Identity AuthenticationNewRisk-Based AuthenticationExtended the configuration of risk-based Authentication with the Authentication Method and User Type options. See Config ure Risk-Based Authentication [page 62].NewUser ProvisioningYou can provision users to SAP Cloud Platform Identity Provisioning Service instances. For more information, see Configure Identity Provisioning Target Systems for User Provisioning [page 181].1 November 2017 - Identity AuthenticationNewSCIM REST APISCIM REST API implementation of Identity Authentication was extended. You can list all the groups, and list the details of a specific group in a tenant. See Groups Search [page 297], and Group Resource [page 299].18 October 2017 - Identity AuthenticationNewIdP-Initiated SSOYou can enable IdP-initiated logon from all configured corporate Identity providers.

7 See Enable IdP-Initiated SSO from All Corporate Identity Providers [page 97].NewSCIM REST APISCIM REST API implementation of Identity Authentication was extended. You can list all the groups, and list the details of a specific group in a tenant. See Groups Search [page 297], and Group Resource [page 299].8 PUBLICSAP Cloud Platform Identity Authentication ServiceSAP Cloud Platform Identity Authentication Service21 September 2017 - Identity AuthenticationNewE-Mail TemplatesYou can create and configure custom e-mail template sets via the administration console for SAP Cloud Platform Identity Authentication Service . See Configuring E-Mail Templates [page 144].22 August 2017 - Identity AuthenticationNewSAML can set a default name ID format via the administration console; the options are Unspecified or E-Mail. See (Op tional) Configure the Default Name ID Format Sent to the Application under Configure the Name ID Attribute Sent to the Application [page 50].

8 7 August 2017 - Identity AuthenticationNewPassword StatusTenant administrators can unlock locked accounts. See Unlock User Password [page 167].NewPassword StatusTenant administrators can trigger the sending of an e-mail to the user with information how to reset the password. See Send Reset Password E-Mail [page 168].NewPassword StatusTenant administrators can reset the counter for the number of e-mails with reset password information that can be sent to the user. See Reset Counter for E-Mail Sending [page 169].SAP Cloud Platform Identity Authentication ServiceSAP Cloud Platform Identity Authentication ServicePUBLIC9 NewPassword StatusTenant administrators can set initial password for the user. See Set Initial Password [page 170].12 June 2017 - Identity AuthenticationNewSession TimeoutTenant administrators can configure the duration of the Identity provider (IdP) session via the administration console for Identity Authentication .

9 See Configure Session Timeout [page 104].EnhancementSAML ConfigurationTenant administrators can select the digest algorithm for signing outgoing messages. See step 7 in Configure a Trusted Service Provider [page 44].15 May 2017 - Identity AuthenticationAnnouncementFailover Mechanism ImprovementAs part of the failover mechanism improvement for Identity Authentication , we will add a new IP address ( ) for the domain in Europe. If you have whitelisted the current IP, you also have to whitelist the new IP for the corresponding sce narios to work. See Region Availability [page 23].11 May 2017 - Identity AuthenticationEnhancementUser CreationTenant administrators can set the user type at user creation via the administration console for Identity Authentication . See Create a New User [page 160].10 PUBLICSAP Cloud Platform Identity Authentication ServiceSAP Cloud Platform Identity Authentication Service24 April 2017 - Identity AuthenticationAnnouncementSPNEGO/Key Distribution Center (KDC) ConfigurationWe should change our DNS registration with CNAME records to the root host of our Service .

10 The change comes as part of our high availability efforts and decision to provide Identity Authentication in additional data DNS change might impact on the SPNEGO functionality and might make additional configuration necessary for the Key Distribution Center (KDC). See Configure Key Distribution Center (KDC) [page 123], the Caution section in Step March 2017 - Identity AuthenticationAnnouncementFailover Mechanism ImprovementTo improve the failover mechanism for Identity Authentication , we will add a new IP address ( ) for the domain in Europe. If you have whitelisted the current IP, you also have to whitelist the new IP for the corresponding scenarios to work. See Region Availability [page 23].7 March 2017 - Identity AuthenticationEnhancementSAP Cloud Platform Identity Authentication Service RebrandingSAP Cloud Identity Service is renamed as SAP Cloud Platform Identity Authentication Service (in short, Identity Authentication ).