As more and more of Syensqo's systems are hosted in the cloud using SaaS models, the usefulness of traditional network-based access controls such as firewalls as the perimeter of Syensqo's IT landscape continues to decline. Increasingly, identity serves as the security perimeter to both on-premises and cloud applications: Regardless of whether or not an application is "behind the corporate firewall", users must hold a valid corporate identity in order to gain access to applications. The consistent identification of users across various systems thus becomes increasingly important to the management of user identities and thus the management of Syensqo's security perimeter. 

The design outlined in this document aims to achieve: 

• Accurate User Identification: Ensuring that the same individual is recognized seamlessly to all in-scope Syway systems is fundamental to delivering secure authentication, appropriate authorization, and a unified user experience.
• Consideration for systems with differing and diverse format requirements for user IDs. Some systems have a length limitations in the primary user ID and thus do not support the User Principal Name directly as the primary user ID (e.g. S/4HANA). 
• Future-proofing for AI-driven capabilities: Consistency in user identity is also critical for AI-driven tools such as SAP Joule and SAP Task Center, both of which rely on harmonized user identities to operate effectively.
• A single user ID ensures cross-system Segregation of Duties analysis is possible without any manual intervention and complex user mapping logic.

Global User ID integration

SAP introduced the concept of the Global User ID as common identified that ties together the varying user master records from its systems, and serves as a common identifier for cross-system integrated solutions, such as Joule and Task Center. The Global User ID is defined as a foreign key attribute on the user master record of a growing number of SAP systems, and defines as a string of up to 32 characters. In principle it could thus store a UUID. After considering a number of options for the source of this value, the Person ID (technical name person_id_external) from SuccessFactors was chosen for a number of reasons explained in the expansion section below: 

By using the Person ID from SuccessFactors as the source of the Global ID field in SAP IAS/IdDS, we will be able to maintain a unique and human-readable user identifier across all downstream applications without the need to maintain complex local user mapping routines.

As a minimum, the below user attributes will be mapped from Entra through SCIM provisioning to SAP CIS (IAS/IdDS).

The transformation will also need to consider other attributes such as group association and other user attributes as these can be used for filtering, conditional authentication and other security policies.

The Global ID represents a single unique user identifier across all systems and platforms for the user. This is typically not the primary identifier in an application, but stored as an attribute on the user master. 

The transformation logic in IPS is crucial for creating and maintaining the global user ID. By mapping attributes consistently, IPS ensures that the correct global user ID is assigned and used, linking user identities and attributes across different systems, even if the user's username or email differs in each system.

Global ID Mapping Diagram