## 4.2.11  Identity and Access Management (IAM)
Learn more about the basic concepts and procedures for managing users and defining authorizations for business services and SAP Fiori applications.
## What Is Identity and Access Management?
The main components of Identity and Access Management are:
- User and Identity Management
- Roles and Authorization
- Authentication
<!-- image -->
In the configuration phase, an administrator registers and authorizes access rights.
In the operation phase, business users identify and authenticate themselves. The access to applications is based on previously authorized access rights.
In a business scenario, this means that an administrator manages the authentication and authorization of business users, including configuring trust and identity federation in the subaccount usually by configuring a custom identity authentication service tenant [page 206]. As a fallback, SAP ID service is configured as the default identity provider. Additionally, an administrator also creates roles using templates, adds roles to role collections, and assigns role collections to business users. The business users can then log on to SAP Fiori applications and get authenticated.
## Who Is This Guide For?
If you're an SAP customer developer or partner developer and you create business services in the ABAP environment using ABAP Development Tools for Eclipse, this guide is for you. It guides you through an example of a business service based on a service binding. Note that http services work in a similar way.
In addition, the guide also covers activities that need to be performed by an administrator , such as assigning users to business roles.
## What Is This Guide About?
The guide starts with an overview of the basic concepts of identity and access management. It then leads you step by step through the design and implementation of your authorization model using an example.
Why should you care about access control and authorizations? You must know that every new service is automatically available to all developers in a development system, provided the system administrator has assigned them a role that is derived from the developer role SAP\_BR\_DEVELOPER (which is typically the case). However, business users in nondevelopment systems can only access the business service if a developer has defined the appropriate authorizations and an administrator grants the business users access for each relevant system. The same is true for communication users that are needed in scenarios where you work with an API business service (inbound or outbound) from or into the ABAP environment.
The Identity Management section gives you an overview about Identity and User Management, which includes identity federation, user types, and user provisioning.
The Access Management section includes the following main scenarios about how you can implement and provide authorizations for your services:
- In chapter Providing (Unrestricted) Access for Business Users [page 886], you learn how to provide users in a nondevelopment system access to the service. Providing unrestricted access is the simplest scenario with only a few steps. The access is unrestricted, though, which means, for example, that you can't differentiate between write and read access.
- In chapter Providing Access Based on Activities for Business Users [page 890], you learn how to implement access for different activities, for example, separate read and write authorizations.
- In chapter Providing Access Based on Field Values for Business Users [page 901], you learn how to fine-tune your access restrictions depending on field values.
OData services that you develop using ADT can also be consumed in SAP Fiori applications (developed using the Business Application Studio). In this guide, you also learn how to provide access to an SAP Fiori application that consumes a business service.
## Custom Development and Testing
In SAP Business Technology Platform (SAP BTP), customers have the flexibility to develop their own code and services using ABAP. To test newly created services and applications in the development tenant, it is crucial that the developer role SAP\_A4C\_BC\_DEV\_TST\_PC is extended with every newly created custom Authorization Object (AO), ensuring that full authorizations are granted for testing purposes. This ensures that developers
can comprehensively test their applications without facing authorization issues, enhancing the development and deployment experience.