Choosing the Identity Mode

Draft brief for authors. Replace with the final text; keep the concept-page structure. Include the decision table.

Page type: Concept · Audience: Administrator, Security officer

Contains

• Mode A, named user (destination with user propagation): SAP applies the person's authorizations to every change and its change documents show the person; MDM checks the user with SAP before a run; a background run pauses when the sign-in expires; such a table cannot be scheduled; integrations without a person cannot process it.
• The background opt-in (rikaiso.backgroundIdentity = technical-user): the person is still checked with SAP, the records of a background run are written by the communication user; scheduling and automatic resume work; what the check does not cover (per-object restrictions), whom the change documents show.
• Mode B, integration user (communication user): SAP applies the communication user's authorizations; MDM's roles and add-ons are checked first and fail closed; the history records the person; what to do (restrict the arrangement, separate users per scope, grant roles narrowly).
• Decision table and what belongs in your security concept.

Related information: application-destination, concept-identity, custom-role-collections, sap-business-users.

Source in the product repository: customer guide §3 and §5; srv/lib/sap-identity.js (D26, D80).