Enhancement to the MAS vs. Azure AD communication/connection

SAML

As an organization planning or having the Maximo Application Suite (MAS) running on Azure Cloud, it is requested that enhancement to the MAS vs. Azure AD communication/connection will be established, so that automation of user creation in MAS can be established.

As of now, the connection has been established between the MAS and the Azure AD (AAD). In the AAD a security group covering the Maximo users has been configured. The established connection between the MAS and the AAD controls/verifies if the user is a known user. That's first step in the validation of the user's request to login.

Next is that Maximo validates if the user has an access to MAS. This means that the user beforehand must be created and that he has been assigned necessary security groups.

As of now, though, it isn't possible to have an automated user creation, since the MAS vs. AAD communication only verifies if the user at all exists in the AAD. In other alike applications, the system is able to read not only in the complete AAD, but in a specific AAD security group based on the ID key belonging to that specific AD group. Such systems use the SAML identification as well.

https://www.onelogin.com/learn/saml

Being able to read directly from the specific AAD group, we can establish an automation in creating new users, since we know for sure that this specific user exists in the MAS assigned AAD group and not just somewhere in the AAD.

We do not seek to have automated deletion of users, since we won't remove users having transaction records. Such users will be deactivated.