Authentication Service (SAP Business One)

Of the Authentication Service (SAP Business One) is the identity and authentication service from SAP Business One that provides access tokens for the service layer. It is based on Keycloak and can be connected to other identity providers.

Functionality

With active Identity and Authentication Management (IAM), an external application does not log in via a login call to the service layer. Instead, the application sends an access token and the client ID with each request. The service layer checks the token against the authentication server. Subsequently, it determines via the user binding in the SLD which user is meant for which user. A session cookie is thus not required. The authentication server is an embedded Keycloak and operates with the OIDC protocol or OAuth2. Applications determine its address via the SLD.

Registration of third-party applications

Starting with Feature Package 2208, the administrator registers external applications in the Extension Single Sign-On Manager. This application is installed with the Extension Manager. SAP distinguishes five client types: Web App, Daemon Service, Desktop App, Single Page App, and Mobile App. The Daemon Service is available starting with Feature Package 2502. It connects machines to each other and uses a technical user for this purpose.

External identity providers

Starting with Feature Package 2405, the administrator binds external identity providers via OIDC in the Cloud Control Center. AD FS, Microsoft Entra ID, and SAP IAS are supported (in this release as beta). The user then logs in with the external provider. However, the token for the service layer is still provided by the Authentication Server of SAP Business One. Starting with Feature Package 2508, the service additionally supports the OIDC back-channel logout.

Requirements

The service requires Feature Package 2208 or higher. The administrator must activate IAM in the SLD Control Center, and at least one identity provider must be active. Each end user needs a binding to their user in SAP Business One. In addition, the clocks need to be synchronized.

Demarcation

The Authentication Service is not an external identity provider. SAP IAS, for example, is an external identity provider and not the Authentication Service itself. The Authentication Service provides the tokens; the object authorization checks are still handled by the authorization model of SAP Business One, however.

SAP B1 blog