01 What happened
SAP BTP administrators facing 130 cockpit mappings of role collections to IAS user groups can reduce the work from close to 8 hours to about two minutes per environment by using the SAP Authorization and Trust Management Service REST API and a Node.js script.
02 Key details
- Manually mapping 130 BTP role collections to IAS user groups in the cockpit took close to 8 hours at 3–4 minutes per mapping and was repetitive and error-prone.
- Programmatic creation of the same mappings via the SAP Authorization and Trust Management Service REST API with a Node.js script delivers consistent and repeatable provisioning.
- Prerequisites include a Subaccount Administrator role collection, an IAS tenant as custom identity provider, existing IAS user groups, BTP CLI, a REST client, and Node.js v18+.
- Obtain credentials with `btp login --sso`, `btp target --subaccount <SUBACCOUNT_ID>`, and `btp create security/api-credential`; the older `cf create-service xsuaa apiaccess` approach is deprecated.
- The mapping payload requires `attributeName` exactly `Groups`, `attributeValue` as the IAS group name, `operator` as `equals`, and exact `roleCollectionName`; a successful call returns HTTP 201, and the script handles 409 and 404 statuses for reuse across environments.
03 Why it matters
Manual cockpit mapping does not scale across dozens of role collections and multiple environments; an API-driven workflow with a reusable script makes provisioning repeatable, consistent, and auditable.
04 Who it matters to
SAP Basis administrators and SAP Basis consultants.
Original source