SAP HANA Cloud Platform Identity Authentication and Provisioning

Consumer Identity and Access Management (CIAM) has emerged as a specialized evolution of traditional Identity and Access Management (IAM) to satisfy growing demands for better consumer digital experiences and richer customer data collection. Organizations increasingly want to gather, store, and analyze consumer information to support new sales opportunities, build brand loyalty, and advance regulatory initiatives such as Know Your Customer (KYC), particularly in financial services. While CIAM can resemble CRM, the key distinction is that CIAM relies on consumers to provide and maintain their own identity and profile data rather than depending on internal sales or marketing staff for data entry.

Traditional IAM is optimized for inward-facing enterprise use, with defined user accounts, authoritative sources, and controlled environments that typically scale to hundreds of thousands of users. CIAM, by contrast, must handle consumer identities originating from many domains and often from unauthoritative sources, support multiple authentication methods (including social logins), and scale to millions of identities and extremely high volumes of logins and transactions. CIAM data may be used not only for access decisions but also for marketing analysis and Anti-Money Laundering (AML) efforts, and dedicated consumer profile hosting is positioned as an initial step toward KYC.

SAP has developed SAP HANA Cloud Platform (HCP) Identity Authentication and Identity Provisioning as complementary, multi-tenant, cloud-based services that can function as IDaaS and CIAM. They support password, OTP via the SAP Authenticator app, social logins, and enterprise options like SPNEGO Kerberos, with federated support for SAML and OAuth. Notable strengths include scalability (over one thousand tenant directories; up to 9 million users in a single tenant), GDPR-oriented consent and deletion controls, and bulk provisioning via LDAP and advanced SCIM. Key gaps include lack of built-in analytics, limited export and SIEM integration, no third-party threat intelligence feeds, and no FIDO support yet, with OIDC and Office 365 integration planned.

• CIAM has emerged in the last few years as a sub-genre of traditional IAM to meet evolving business requirements.
• CIAM differs from CRM because consumers themselves provide and maintain identity and profile information.
• Traditional IAM is generally deployed inward-facing to serve a single enterprise and typically scales to hundreds of thousands of users.
• CIAM systems must be able to manage millions of identities and potentially process billions of logins and transactions per day.
• SAP HANA Cloud Platform Identity Authentication and Identity Provisioning are cloud-based, complementary, and fully multi-tenant services.
• SAP HCP Identity Authentication supports password authentication, OTP via the SAP Authenticator mobile app, social logins, and SPNEGO Kerberos.
• Federated use cases in SAP HCP Identity Authentication currently accept SAML and OAuth.
• SAP HCP has over one thousand tenant directories; the largest single tenant hosts around 9,000,000 users and the average is 2,400 users per tenant.
• SAP HCP Identity Authentication integrates with Microsoft Active Directory and Azure AD, with no other IDaaS solutions supported presently.
• SAP HCP Identity Authentication provides “Single Log-Out” across SAP cloud services when a user initiates logout.

• “With CIAM, similar kinds of information can be collected, but the consumers themselves provide and maintain this information.”
• “Consumer IAM systems are designed to provision, authenticate, authorize, collect and store information about consumers from across many domains.”
• “Information collected about consumers can be used for many different purposes, such as authorization to resources, or for analysis to support marketing campaigns, or Anti-Money Laundering (AML) initiatives.”
• “Having IAM systems dedicated to hosting consumer identities and their associated profiles is a good first step toward KYC.”
• “The solution is fully multi-tenant.”
• “SAP HCP Identity Authentication does not expose an API to allow access by 3rd party data analytics solutions.”
• “Administrators can view logs on screen, but cannot currently export them.”
• “Users can opt-out of data collection processes after registration.”
• “Lastly, users may delete their identity profiles entirely.”
• “On the near-term roadmap, SAP plans to include integration with Microsoft Office 365 and support for OpenID Connect (OIDC).”