Authentication

AS ABAP carries an OAuth 2.0 client, configured in transaction OA2C_CONFIG, that obtains an access token from an external provider such as Google Cloud Platform or Microsoft Azure and renews it with a refresh token. The flows it offers are the authorization code flow and the SAML 2.0 bearer assertion flow.

Not covered: At those two flows in the release checked. A self-signed JWT, an NTLM handshake with a Windows server and an AWS Signature v4 request are not among them, and each is written in ABAP by a repository in this batch.

Checked against the SAP NetWeaver 7.5 documentation; later ABAP Platform releases were not checked for further flows. The community answers the outbound direction, the ABAP system proving who it is to another API, and the inbound side with a logon ticket decoder such as decodesapsso2decodesapsso2packageA TypeScript library that decodes a MYSAPSSO2 logon ticket into its user, client, system and validity fields, and returns the signature without validating it, so it never shows a ticket is genuine.independent, abap by Marcello UrbaniMarcello Urbanipersonmaintains 14 entries, contributed to 21 entries, which does not validate the ticket. abap_cloud_platformabap_cloud_platformpackageA TypeScript library of the Cloud Foundry calls that walk down to an ABAP service instance, read its SAP_ADT service key and log a user in, so a tool outside the system can reach it.independent, btp obtains a token for an ABAP service instance from outside it, and SAP's Cloud ConnectorCloud ConnectorappSAP's on-premises agent that links SAP BTP applications to systems in a customer's own network, as a reverse invoke proxy that exposes only the systems and resources it is configured to allow.sap official, btp forwards the cloud user's identity to an on-premises system.