Create user in NetWeaver via SAML 2.0 – 5 – Create number range
In the SAML 2.0 SSO logon with automatic user creation scenario, the user is created in the SAP system by a BADI. The user information send by the SAML 2.0 IdP is contained in the SAML response. In my previous blog I have shown how the user profile is configured using mappers in Keycloak. With these mappers the mandatory information expected by the ABAP class is provided:
- First name,
- Last name
- Email address
In a SAP NetWeaver ABAP system, each user created has a unique user id. This user id is not part of the SAML response. You may now wonder how the SAP system is creating the user and assuring that the user id is unique to the target system. This is achieved by using a number range for the actual user id for the user going to be created via the SAML 2.0 SSO process.
The ABAP class called when creating a new user is calling a function named NUMBER_GET_NEXT. For this method to work, the number range must be configured.
NoteAnother user should not have a conflicting user id in the SAP system.
CALL FUNCTION 'NUMBER_GET_NEXT' EXPORTING nr_range_nr = '01' object = lc_number_range_object IMPORTING number = lv_number EXCEPTIONS OTHERS = 1.
lc_number_range_object is defined as lc_number_range_object TYPE inri-object VALUE ‘SAML2ID’. In the example code, the value of that variable is SAML2ID.
The function can be tested in transaction SE37.
In case you pass the value SAML2ID as a parameter and get back an error message you have to configure the corresponding number range. If not, the method for creating a user with SAML 2.0 will fail.
You need to create the number range for the object.
When you filter for the available objects (eg SA*), you can see that for SAML2ID nothing exists.
Create a new number range for object SAML2ID.
Object Name: SAML2ID
Short Text: SAML2ID Long Text: SAML2 User ID Number Length Domain: NUM8 (see explanation below) % Warning: 10,0
Provide a workbench request.
This should create a new number range for object SAML2ID. Next, add the interval
Click on “Interval Editing”.
The screen for adding an interval is shown.
Add a new interval. The Nr is given again by the ABAP class: 01 (see explanation below).
Nr: 01 From No. 1 To Number: 2000
Number Length Domain
The num8 number domain is defined by the ABAP class.
lv_number TYPE num8,
CALL FUNCTION 'NUMBER_GET_NEXT' EXPORTING nr_range_nr = '01' object = lc_number_range_object IMPORTING number = lv_number EXCEPTIONS OTHERS = 1