{"ref":"artifact:btp-authorization-and-trust-management","page":"/artifacts/btp-authorization-and-trust-management","json":"/artifacts/btp-authorization-and-trust-management.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"btp-authorization-and-trust-management","name":"SAP Authorization and Trust Management service","artifact_type":"service","ecosystem":"btp","serves_ecosystems":["cap"],"domain":"security-and-compliance","origin_ring":"sap-official","description":{"one_line":"The OAuth server behind a BTP application: issues the JWT the app checks, holds the scopes and role collections it checks against, and brokers trust to an identity provider. Bound, never installed.","short":"OAuth server issuing JWTs and holding scopes for BTP apps"},"links":{"homepage":"https://discovery-center.cloud.sap/serviceCatalog/authorization-and-trust-management-service","docs":"https://github.com/SAP-samples/btp-service-metadata/blob/main/v1/developer/xsuaa.json","whats_new":"https://help.sap.com/whats-new/cf0cb2cb149647329b5d02aa96303f56?Component=Authorization+and+Trust+Management+Service"},"provides":[{"capability":"capability:authentication","what_it_does":"Acts as the OAuth 2.0 authorization server of a business application. A subaccount cross-configures trust with an identity provider, the provider's SAML bearer assertion is presented to this service once the user has authenticated, and the service determines that user's authorizations and signs the JWT whose signature the application verifies with the public key in its binding. An API client skips the browser and authenticates against the service directly.","facets":[{"key":"no_user_token","value":true,"source":{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/60-security/what-is-the-sap-authorization-and-trust-management-service-649961f.md","title":"What Is the SAP Authorization and Trust Management Service? — Authentication Against Trusted Parties Only","checked":"2026-10-15","quote":"API clients receive their credentials directly from, and authenticate directly against, SAP Authorization and Trust Management service."}},{"key":"trusts_corporate_idp","value":true,"source":{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/60-security/what-is-the-sap-authorization-and-trust-management-service-649961f.md","title":"What Is the SAP Authorization and Trust Management Service? — SAP BTP documentation (SAP-docs/btp-cloud-platform)","checked":"2026-10-15","quote":"We recommend that you use an SAP Cloud Identity Services tenant, an SAP on-premise system, or a custom corporate identity provider."}}],"sources":[{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/60-security/what-is-the-sap-authorization-and-trust-management-service-649961f.md","title":"What Is the SAP Authorization and Trust Management Service? — OAuth 2.0, Resource Owner, Client, Resource Server","checked":"2026-10-15","quote":"It acts as the OAuth 2.0 authorization server and represents a typical reuse service."},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/60-security/what-is-the-sap-authorization-and-trust-management-service-649961f.md","title":"What Is the SAP Authorization and Trust Management Service? — Authentication Against Trusted Parties Only","checked":"2026-10-15","quote":"This SAML bearer assertion is presented to SAP Authorization and Trust Management service and the service determines the authorizations of that user."},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/60-security/what-is-the-sap-authorization-and-trust-management-service-649961f.md","title":"What Is the SAP Authorization and Trust Management Service? — JSON Web Tokens","checked":"2026-10-15","quote":"The credentials string contains, among other things, the public key corresponding to the private key of the UAA. This public key is used to verify the token signature."}]},"capability:authorization"],"connects":[{"ref":"artifact:btp-cloud-identity-services","kind":"trust","protocols":["oidc"],"for":"Using a Cloud Identity Services tenant as the identity provider of a subaccount, or as a proxy to a corporate one: the trust is established with OpenID Connect, one tenant per subaccount by this method.","sources":[{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/4f3e85964423fa5a0f2cb246ab6dc7b938b8b0c2/docs/50-administration-and-ops/establish-trust-and-federation-between-sap-authorization-and-trust-management-service-a-161f8f0.md","title":"Establish Trust and Federation Between SAP Authorization and Trust Management Service and SAP Cloud Identity Services — SAP BTP documentation (SAP-docs/btp-cloud-platform)","checked":"2026-09-19","quote":"This method avoids the upload and download of SAML meta data by using OpenID Connect \\(OIDC\\) to establish trust."},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/4f3e85964423fa5a0f2cb246ab6dc7b938b8b0c2/docs/50-administration-and-ops/establish-trust-and-federation-between-sap-authorization-and-trust-management-service-a-161f8f0.md","title":"Establish Trust and Federation Between SAP Authorization and Trust Management Service and SAP Cloud Identity Services — SAP BTP documentation (SAP-docs/btp-cloud-platform)","checked":"2026-09-19","quote":"You can only establish trust with a single tenant of SAP Cloud Identity Services per subaccount using this method."},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/4f3e85964423fa5a0f2cb246ab6dc7b938b8b0c2/docs/50-administration-and-ops/establish-trust-and-federation-between-sap-authorization-and-trust-management-service-a-161f8f0.md","title":"SAP-docs/btp-cloud-platform — the page's title","checked":"2026-09-22","quote":"Establish Trust and Federation Between SAP Authorization and Trust Management Service and SAP Cloud Identity Services"}]}],"provenance":{"discovered_via":[{"source":"source:sap-samples","channel":"btp-service-metadata"}],"first_seen":"2026-09-09"},"history":[{"date":"2026-09-10","field":"serves_ecosystems","from":"cap, ui5, abap","to":"cap","reason":"The same as Cloud Identity Services: ABAP's authorisation model is not XSUAA's, and a UI5 frontend does not validate the JWT — the router and the service do."},{"date":"2026-09-19","field":"connects","from":null,"to":"btp-cloud-identity-services","reason":"The two security services had no edge between them, although most BTP diagrams draw one. SAP's administration guide states the trust and the protocol it is established with."},{"date":"2026-09-22","field":"connects[0].sources","from":null,"to":"+1","reason":"The second reader read the connects batch of 2026-09-19 on 2026-09-22, after its acceptance, and found: neither quote names this service, and only one names Cloud Identity Services, so the page's title, which names both parties, is quoted beside them."},{"date":"2026-10-15","field":"provides[capability:authentication]","from":"a bare ref","to":"what it does, sources, two properties","reason":"The edge said only that the service answers authentication, so the page could not say which part of the concern it answers. SAP's architecture page states the three: the trust, the assertion it receives, and the token it signs. The two properties the BTP door now compares options on are stated from the same page: a token with no user present, and a corporate identity provider behind it."}],"drafted_with_ai":true},"effective_normative_relations":[],"readings":{"liveness":{"label":"Deprecation","tier":"good","evidence":"no plan deprecated, 4 plans"},"continuity":{"label":"Beta","tier":"good","evidence":"no plan in beta"},"reach":{"label":"Regions","tier":"reported","evidence":"46 regions"},"support":{"label":"Support","tier":"good","evidence":"BC-CP-CF-SEC-IAM"}},"signals":{"crawled_at":"2026-10-25","technical_id":"xsuaa","technical_ids":["xsuaa"],"joined_by":"docs","display_name":"SAP Authorization and Trust Management service","plans":[{"name":"apiaccess","category":"SERVICE","deprecated":false,"beta":false,"regions":["ae01","ap01","ap10","ap11","ap12","ap20","ap21","ap30","ap31","br10","br20","br30","ca10","ca20","ch20","eu01","eu02","eu10","eu11","eu13","eu20","eu22","eu30","eu31","eu32","il30","in10","in30","in31","jp01","jp10","jp20","jp30","jp31","sa30","sa31","uk20","us01","us02","us10","us11","us20","us21","us22","us30","us32"]},{"name":"application","category":"SERVICE","deprecated":false,"beta":false,"regions":["ae01","ap01","ap10","ap11","ap12","ap20","ap21","ap30","ap31","br10","br20","br30","ca10","ca20","ch20","eu01","eu02","eu10","eu11","eu13","eu20","eu22","eu30","eu31","eu32","il30","in10","in30","in31","jp01","jp10","jp20","jp30","jp31","sa30","sa31","uk20","us01","us02","us10","us11","us20","us21","us22","us30","us32"]},{"name":"broker","category":"SERVICE","deprecated":false,"beta":false,"regions":["ae01","ap01","ap10","ap11","ap12","ap20","ap21","ap30","ap31","br10","br20","br30","ca10","ca20","ch20","eu01","eu02","eu10","eu11","eu13","eu20","eu22","eu30","eu31","eu32","il30","in10","in30","in31","jp01","jp10","jp20","jp30","jp31","sa30","sa31","uk20","us01","us02","us10","us11","us20","us21","us22","us30","us32"]},{"name":"space","category":"SERVICE","deprecated":false,"beta":false,"regions":["ae01","ap01","ap10","ap11","ap12","ap20","ap21","ap30","ap31","br10","br20","br30","ca10","ca20","ch20","eu01","eu02","eu10","eu11","eu13","eu20","eu22","eu30","eu31","eu32","il30","in10","in30","in31","jp01","jp10","jp20","jp30","jp31","sa30","sa31","uk20","us01","us02","us10","us11","us20","us21","us22","us30","us32"]}],"regions":46,"deprecated_plans":0,"support_components":["BC-CP-CF-SEC-IAM"]},"whats_new":{"crawled_at":"2026-10-25","url":"https://help.sap.com/whats-new/cf0cb2cb149647329b5d02aa96303f56?Component=Authorization+and+Trust+Management+Service","feed":"cf0cb2cb149647329b5d02aa96303f56","components":["Authorization and Trust Management Service"],"entries":[{"id":592662796,"date":"2026-10-01","component":["Authorization and Trust Management Service"],"title":"Deactivation of Default Identity Provider","type":["New"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2609b"],"description_sha256":"53e0f52a9bb1d01153b53c20a7838d03a120916a31d599d58bc01062c27767d1"},{"id":592662797,"date":"2026-09-03","revised":"2026-08-28","component":["Authorization and Trust Management Service"],"title":"Custom Platform Identity Provider Support for Chinese SAP BTP Universe","type":["Changed"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2608b"],"description_sha256":"b63d6c9f9bd38b8627a0143f620811b274bcdee1ab53fbf0ec33a6b96a6a2b14"},{"id":592662798,"date":"2026-08-20","component":["Authorization and Trust Management Service"],"title":"Critical Security Authorizations Now Marked in Role Collections","type":["New"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2608a"],"description_sha256":"7e30594867ef608ae786222a03582b44c610b1c0b2a829a77f3690e85c6cddd3"},{"id":592662799,"date":"2026-08-18","revised":"2026-08-17","component":["Authorization and Trust Management Service"],"title":"SameSite=None Cookie Support Now Required","type":["Changed"],"action":["Required"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2608a"],"description_sha256":"95d3ec70a85b65104c46d649499a6a163c12d2de4efea21b3fe9dfb2171bd9c9"},{"id":592662803,"date":"2026-06-30","revised":"2026-02-02","component":["Authorization and Trust Management Service"],"title":"Deprecate GET Method for Token Retrieval","type":["Changed"],"action":["Required"],"lifecycle":["Deprecated"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2606b"],"description_sha256":"be4db90e6d712165d414a86034ff2b50ab1102835f9e636b65e46ae76cb05bf5"},{"id":592662800,"date":"2026-04-27","component":["Authorization and Trust Management Service"],"title":"Resilience Improvement for Retrieval of Authorized Accounts","type":["Changed"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2604a"],"description_sha256":"fc210de70a371fbc45805fef934d28242fa6f26bd806200ee4e62db74f4bfe95"},{"id":592662801,"date":"2026-04-27","component":["Authorization and Trust Management Service"],"title":"Replacement of Library for the Security Assertion Markup Language (SAML)","type":["Changed"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2604a"],"description_sha256":"0c4eda989dd4696b52efbe67f46ad8162252b126ff8c6c075d899441d0d04b9d"},{"id":592662802,"date":"2026-02-19","revised":"2026-02-27","component":["Authorization and Trust Management Service"],"title":"Change Priority of Security Recommendation BTP-UAA-0003 to Critical","type":["Changed"],"action":["Required"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2601b"],"description_sha256":"6f32827d5abcce9b5e669a8ff01da79c8db5509e49278a457fab6ca3e2a7378a"},{"id":592662806,"date":"2026-01-19","revised":"2025-08-07","component":["Authorization and Trust Management Service"],"title":"Automatic Signing Key Rotation for Access Tokens as Default","type":["Changed"],"action":["Required"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2513b"],"description_sha256":"a6cf33296232656f2ac2802b6b5c114b5c08a07e695314557a4e5f0b865d6d56"},{"id":592662807,"date":"2026-01-19","revised":"2025-08-07","component":["Authorization and Trust Management Service"],"title":"End-of-Life for Synchronous Creation or Update of Service Instances","type":["Changed"],"action":["Required"],"lifecycle":["Deprecated"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2513b"],"description_sha256":"f0f9264074a70023a272a1e0f9fd72f414d61f35bdb659676830d87f05491333"},{"id":592662808,"date":"2026-01-19","revised":"2025-11-13","component":["Authorization and Trust Management Service"],"title":"End-of-Life for Instance Secret Credential Type","type":["Changed"],"action":["Required"],"lifecycle":["Deprecated"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2513b"],"description_sha256":"f08afaaad75a0c649787315e3dc90f100fe42efeaa8879ada73b1dcaccf4e089"},{"id":592662809,"date":"2026-01-19","revised":"2025-08-07","component":["Authorization and Trust Management Service"],"title":"End-of-Life for Service Plans","type":["Changed"],"action":["Required"],"lifecycle":["Deprecated"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2513b"],"description_sha256":"a36877ebebf49f2b314a0a700ea6734dcbcafa1b71d312dbb96561acc3996917"},{"id":592662804,"date":"2025-10-30","component":["Authorization and Trust Management Service"],"title":"New and Existing Custom Trusts for Business Users Changed to Token-Based Authentication","type":["Changed"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2510b"],"description_sha256":"b6e044bd689669d4d9952c99daaeb85e37c2612bcfc5df755d514965fe1def86"},{"id":592662805,"date":"2025-10-13","revised":"2025-10-02","component":["Authorization and Trust Management Service"],"title":"Replacement of Library for JSON Web Tokens (JWT)","type":["Changed"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2510a"],"description_sha256":"a387806447e607a1ecc942ba10e68e0e4c9a896c7b17e6fd203c3ce60526975e"},{"id":592663842,"date":"2025-08-21","component":["Authorization and Trust Management Service","Cloud Identity Services","Connectivity"],"title":"Principal propagation from SAP BTP to an On-Premise Cloud Connector with a Token From a Corporate Identity Provider","type":["New"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["Cloud Foundry","Kyma"],"description_sha256":"390e6ac87caae19a5d48ea445de8a685b0255d1993a4eb754287293a503154c5"},{"id":592662820,"date":"2025-08-07","component":["Authorization and Trust Management Service"],"title":"Automatic Signing Key Rotation for Access Tokens","type":["Changed"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2507b"],"description_sha256":"a51cd33abcc489d75d636ef8f4f83bfc1cdcf3de7167d66fc4758c0e5d8607e0"},{"id":592662810,"date":"2025-06-26","component":["Authorization and Trust Management Service"],"title":"Existing Custom Trusts for Platform Users Changed to Token-Based Authentication","type":["Changed"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2506a"],"description_sha256":"1d7389f903040c8d87d7e19b2122242601131a68756818f1331de424044b6702"},{"id":592662811,"date":"2025-06-12","component":["Authorization and Trust Management Service"],"title":"New Custom Trusts for Platform Users Changed to Token-Based Authentication","type":["Changed"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2505b"],"description_sha256":"2beddc652fbcce84c0854d8a31803d91ee78e053c20313eb60b093447b41dc67"},{"id":592662812,"date":"2025-05-28","component":["Authorization and Trust Management Service"],"title":"Update Security Recommendation BTP-UAA-0003 for Default Credential Types for Bindings","type":["Announcement"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2505a"],"description_sha256":"3c9a79836b12afd71d64f26ad6221609d971bbf3c4deb0342ac554a348e323f7"},{"id":592662813,"date":"2025-05-28","component":["Authorization and Trust Management Service"],"title":"Increased Priority of Security Recommendation BTP -UAA-0008 for Custom Identity Providers","type":["Changed"],"action":["Required"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2505a"],"description_sha256":"60cbba8156a00e900bed93676258cc2de7a91f74acc1528467fa091345bae334"},{"id":592662815,"date":"2025-04-30","revised":"2025-04-03","component":["Authorization and Trust Management Service"],"title":"Deprecation of the xsenableasyncservice Element for Service Instances","type":["Changed"],"action":["Info only"],"lifecycle":["Deprecated"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2503a"],"description_sha256":"502ee4c5ecb025b0f4d1959c3c9a7ca398a320e1e8bc2292504ad02993c41329"},{"id":592662816,"date":"2025-04-30","revised":"2025-04-03","component":["Authorization and Trust Management Service"],"title":"Deprecation of the instance-secret Credential Type for Service Instances","type":["Changed"],"action":["Info only"],"lifecycle":["Deprecated"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2503a"],"description_sha256":"927c5d35957101804ba9b20648929f5c679be5ec32a1a59960e00bac0aeb5a3e"},{"id":592662814,"date":"2025-04-17","revised":"2025-04-03","component":["Authorization and Trust Management Service"],"title":"Security Hardening for Redirect URIs","type":["Announcement"],"action":["Required"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2503a"],"description_sha256":"4c9cc59cd2f10b545eba0c211149ff5df3413387b013d97b4836fd206569b637"},{"id":592662817,"date":"2025-03-20","revised":"2025-03-17","component":["Authorization and Trust Management Service"],"title":"Trust Configuration (New)","type":["New"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2502b"],"description_sha256":"a7b8456e966102df7ac1d8a80f6cfd178ba5556cea9f9dd0370a276a97af7e36"},{"id":592662818,"date":"2025-03-06","revised":"2025-02-11","component":["Authorization and Trust Management Service"],"title":"Existing Custom Trusts for Business Users Changed to Token-Based Authentication","type":["Changed"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2502a"],"description_sha256":"48b4fb07c1c84b28cb0944615897d73158423bc9a58f222b6246a551d1936619"},{"id":592662819,"date":"2025-02-20","revised":"2025-02-11","component":["Authorization and Trust Management Service"],"title":"New Custom Trusts for Business Users Changed to Token-Based Authentication","type":["Changed"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Neo","Other"],"version":["2501b"],"description_sha256":"2cf3b5eac903730c2078b7eb3bb769f63fbb2afbd11db757732e476d7b8d7a3f"},{"id":592662821,"date":"2025-01-23","revised":"2025-01-09","component":["Authorization and Trust Management Service"],"title":"Delay Between Operations for Token Signing Keys Increased","type":["Changed"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Other"],"version":["2413b"],"description_sha256":"3f0fdb078b3b649b4f8fec9b11603da8534be357004e54f6b624ffa7d14344ad"},{"id":592662831,"date":"2024-12-31","revised":"2025-05-28","component":["Authorization and Trust Management Service"],"title":"Deprecation of SAML for User-Interactive Authentication in Customer-Owned Accounts","type":["Changed"],"action":["Info only"],"lifecycle":["Deprecated"],"environment":["ABAP","Cloud Foundry","Kyma","Other"],"version":["2412b"],"description_sha256":"b3f5141bf13c57feace66f86c586ea3c3520855423c800b5774fe740e40d9ab7"},{"id":592662825,"date":"2024-11-12","revised":"2024-10-18","component":["Authorization and Trust Management Service"],"title":"No Default Values for Redirect URIs in New Cloud Foundry Landscapes","type":["Announcement"],"action":["Required"],"lifecycle":["General Availability"],"environment":["Cloud Foundry","Other"],"version":["2411b"],"description_sha256":"e8d398501d4edc10ee30a18988c126f72bf5d77ddffa71c721d82321e91506ff"},{"id":592662826,"date":"2024-11-12","revised":"2024-10-18","component":["Authorization and Trust Management Service"],"title":"Change of Default Credential Type to binding-secret","type":["Announcement"],"action":["Required"],"lifecycle":["General Availability"],"environment":["Cloud Foundry","Other"],"version":["2411b"],"description_sha256":"b61fa9ebc9bb34a88786cf8c3b2dc5381ac60538ce15c69bc7090780f4cf245c"},{"id":592662827,"date":"2024-11-12","revised":"2024-10-18","component":["Authorization and Trust Management Service"],"title":"Creation and Update of xsuaa Service Instances Becomes Asynchronous by Default","type":["Announcement"],"action":["Required"],"lifecycle":["General Availability"],"environment":["Cloud Foundry","Other"],"version":["2411b"],"description_sha256":"b0b889abe725f52211e436e24618cd27c19af33382c49f839aaf9963ca2653cb"},{"id":592662828,"date":"2024-11-12","revised":"2024-10-18","component":["Authorization and Trust Management Service"],"title":"Changed Behavior When Multitenant Applications Remove Predefined Role Collections","type":["Announcement"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Other"],"version":["2411b"],"description_sha256":"0e94265733b57bf8cfc0c2186bc5d6cdb750cd32ca46bb4076cb2892dde4157d"},{"id":592662822,"date":"2024-10-31","revised":"2024-10-28","component":["Authorization and Trust Management Service"],"title":"Provisioning of Members in the Cloud Foundry Environment (Organizations and and Spaces) Using SAP Cloud Identity Services - Identity Provisioning","type":["New"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Other"],"version":["2410b"],"description_sha256":"466953c6592e5ae31139dc06fc400269bb4d342d04b13bf8da93f32063c0703d"},{"id":592662823,"date":"2024-10-03","revised":"2024-10-11","component":["Authorization and Trust Management Service"],"title":"Removal of Security Recommendation BTP-UAA-0009","type":["Changed"],"action":["Info only"],"lifecycle":["Deleted"],"environment":["ABAP","Cloud Foundry","Kyma","Other"],"version":["2409b"],"description_sha256":"83a49c65c3b3bb29b135353b4ce9c9f143aa50396954f4736fedb91c9a9131da"},{"id":592662832,"date":"2024-07-25","revised":"2024-04-16","component":["Authorization and Trust Management Service"],"title":"Preservation of Case for Shadow Users in New Subaccounts","type":["Announcement"],"action":["Required"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Other"],"version":["2407a"],"description_sha256":"847468447662e024a333090cfafca39aaffb81d9e2017d715627c2c8bc69152b"},{"id":592662824,"date":"2024-05-30","component":["Authorization and Trust Management Service"],"title":"Deprecation of Third-Party Cookies","type":["Changed"],"action":["Required"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Other"],"version":["2405b"],"description_sha256":"fcb5bb2a865943212edde75918feaf82d3d2d3d34f4aa9bd77fb4467a116b891"},{"id":592662829,"date":"2024-05-16","component":["Authorization and Trust Management Service"],"title":"Deprecation of Service Plans","type":["Changed"],"action":["Info only"],"lifecycle":["Deprecated"],"environment":["ABAP","Cloud Foundry","Kyma","Other"],"description_sha256":"908aee77f76abdee4728e4f2e1ad761bb0a03f17225deba734048037785e2b98"},{"id":592662830,"date":"2024-05-16","component":["Authorization and Trust Management Service"],"title":"Deprecation of /check_token Endpoint for Online Token Validation","type":["Changed"],"action":["Info only"],"lifecycle":["Deprecated"],"environment":["ABAP","Cloud Foundry","Kyma","Other"],"description_sha256":"c8ac5f95f3edae5610e17b35d35f85edcd8a37611d27ca2ea35cb7dbdf13460d"},{"id":592662833,"date":"2024-04-04","component":["Authorization and Trust Management Service"],"title":"Own Origin Key at Creation of Trust (OpenID Connect) for Subaccounts","type":["Changed"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Other"],"description_sha256":"f98c8876a2d070a30d01a1a586a37a6064e34820657f60cf233122b8df57e844"},{"id":592662834,"date":"2024-02-22","component":["Authorization and Trust Management Service"],"title":"Pattern for Naming Application When Establishing Trust for Subaccounts","type":["Changed"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Other"],"description_sha256":"feafbb1159761be8573f2fcced3550cab23b2ff8427fed26b760c4f9999832b0"},{"id":592662835,"date":"2024-01-25","revised":"2024-01-11","component":["Authorization and Trust Management Service"],"title":"Management of API Credentials for Calling REST APIs of SAP Authorization and Trust Management Service","type":["New"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["ABAP","Cloud Foundry","Kyma","Other"],"description_sha256":"c65230fa0d55fd135e008c597a32d8c7408eb6eb768b85d9b5ad5f18c6b8f6d4"},{"id":592663911,"date":"2023-11-30","component":["Authorization and Trust Management Service"],"title":"OpenID Connect Authentication","type":["New"],"action":["Info only"],"lifecycle":["Beta"],"environment":["Neo"],"description_sha256":"e422e747830610abfab31e441f195fd7564410fcd0e9325c3560ea72ee727218"},{"id":592662836,"date":"2023-11-02","revised":"2023-10-19","component":["Authorization and Trust Management Service"],"title":"Limits for Roles, Role Collections, Trust, and Service Broker Instances","type":["Changed"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["Cloud Foundry","Kyma"],"description_sha256":"27052edaf47d49e34c54accf17a03de73e348d20faab78aae50e88628432de5f"},{"id":592662837,"date":"2023-10-19","revised":"2023-10-04","component":["Authorization and Trust Management Service"],"title":"Limits for the Application Security Descriptor and Service Broker Bindings","type":["Changed"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["Cloud Foundry","Kyma"],"description_sha256":"4d845ebdfe8380e7700fb0ff9f16a670a637a618dee09015da54f452273e14d2"},{"id":592662838,"date":"2023-09-12","component":["Authorization and Trust Management Service"],"title":"Update Security Recommendation BTP-UAA-0005","type":["Changed"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["Cloud Foundry","Kyma"],"description_sha256":"3f7fd69fbd53da41c571e3477a79d2237c5725d01c1d9f0beaf71dda102e4ff0"},{"id":592662839,"date":"2023-08-10","component":["Authorization and Trust Management Service"],"title":"Changed Behavior of Token Requests","type":["Changed"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["Cloud Foundry","Kyma"],"description_sha256":"e2444f2387a2a9d74562acfc6724edad0f31cc4a3168154f100173d39e4166a1"},{"id":592662840,"date":"2023-05-04","component":["Authorization and Trust Management Service"],"title":"Application Login Using a Custom Domain of the Identity Authentication Tenant","type":["New"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["Cloud Foundry","Kyma"],"description_sha256":"8d4447bc4e5f5607550b45b9b9694397fba606ea2adc401707d73f05f77d19e1"},{"id":592662841,"date":"2023-05-04","component":["Authorization and Trust Management Service"],"title":"Migrate SAML-Based Trust of Custom Identity Provider to OpenID Connect","type":["Changed"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["Cloud Foundry"],"description_sha256":"7f35798e83d15c4492fdfd183eb0e66efbfc7256c15d0bf48a29c81e148e9cf7"},{"id":592662842,"date":"2023-05-04","component":["Authorization and Trust Management Service"],"title":"Custom Identity Provider Trust with an Identity Authentication Tenant for Multiple Customer IDs","type":["Changed"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["Cloud Foundry"],"description_sha256":"a950bfea633e69d53e37ed6119f7daf3f5b7fd39e653d7b41b2e967cd6ae13e6"},{"id":592662843,"date":"2023-04-06","component":["Authorization and Trust Management Service"],"title":"Discontinue Support of jwt Format for Refresh Tokens","type":["New"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["Cloud Foundry"],"description_sha256":"c3e2af167847816008b9a5f17a436f35da5748f177e8ef19fd94f84da037065c"},{"id":592662845,"date":"2023-03-09","component":["Authorization and Trust Management Service"],"title":"Restriction in the Validity of Access and Refresh Tokens","type":["Changed"],"action":["Required"],"lifecycle":["General Availability"],"environment":["Cloud Foundry"],"description_sha256":"ad7d8a24191b1fec855ff1c6be3280adadc8c581382c1d594ef7d7f3e056b217"},{"id":592662846,"date":"2023-02-23","component":["Authorization and Trust Management Service"],"title":"Include Tokens from a Trusted Identity Provider in Tokens of the SAP Authorization and Trust Management Service","type":["New"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["Cloud Foundry"],"description_sha256":"953e593d0cc7e346821ae9b74706ce52e2136eb648a5ed56113c7be12a8aa686"},{"id":592662847,"date":"2023-02-09","component":["Authorization and Trust Management Service"],"title":"Update Security Recommendation BTP-UAA-0015","type":["Changed"],"action":["Recommended"],"lifecycle":["General Availability"],"environment":["Cloud Foundry","Kyma"],"description_sha256":"b0d0389e70266ba5d439b44fb88d03948b65b681415638744671712ef771ee03"},{"id":592662848,"date":"2023-02-09","component":["Authorization and Trust Management Service"],"title":"Security Recommendation for Access to REST APIs","type":["New"],"action":["Recommended"],"lifecycle":["General Availability"],"environment":["Cloud Foundry","Kyma"],"description_sha256":"4a9266c42ac5e1faeab726cd68c5dc397a3a70cb3d0a693edb1227e966d9900c"},{"id":592662849,"date":"2023-02-09","component":["Authorization and Trust Management Service"],"title":"Security Recommendation for Application User Logoff","type":["New"],"action":["Recommended"],"lifecycle":["General Availability"],"environment":["Cloud Foundry","Kyma"],"description_sha256":"e39388c4671c74c95966e655d5109de2a95387a6c0bfe780909b3500c012a9d8"},{"id":592662850,"date":"2023-01-12","component":["Authorization and Trust Management Service"],"title":"Application Login Using a Custom Domain of the Identity Authentication Tenant","type":["Announcement"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["Cloud Foundry","Kyma"],"description_sha256":"05ccb4466eacaf5c45a7685a642641fcd97d6eb6456df33bb7e9b368d7ddbbcd"},{"id":592662851,"date":"2023-01-12","component":["Authorization and Trust Management Service"],"title":"Sharing and Unsharing Service Instances","type":["Announcement"],"action":["Required"],"lifecycle":["General Availability"],"environment":["Cloud Foundry","Kyma"],"description_sha256":"36f356e56c446103b004d6e1af149303fc48de7b0c99ef3168ebfe499c92f791"},{"id":592662852,"date":"2022-12-15","component":["Authorization and Trust Management Service"],"title":"Update of Planned Restriction in the Validity of Access and Refresh Tokens","type":["Announcement"],"action":["Required"],"lifecycle":["General Availability"],"environment":["Cloud Foundry"],"description_sha256":"25951fafb01bc0a780648ef7f207db40412693dd707c3750d8eb72daf97fa52b"},{"id":592662854,"date":"2022-09-23","revised":"2022-12-15","component":["Authorization and Trust Management Service"],"title":"Planned Restriction in the Validity of Access and Refresh Tokens","type":["Announcement"],"action":["Required"],"lifecycle":["General Availability"],"environment":["Cloud Foundry"],"description_sha256":"e01cb655b4af4f21e0f936e565f47903cd2f7e9ff6a1acbaf93463779365f134"},{"id":592662855,"date":"2022-09-23","revised":"2022-11-04","component":["Authorization and Trust Management Service"],"title":"Creating Service Instances for API Access Supports Custom Identity Providers for Platform Users","type":["Changed"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["Cloud Foundry"],"description_sha256":"ce121e1d3378eaf3d71314e017639f1df9f997db4a5247f8979bd2e786e4e966"},{"id":592662856,"date":"2022-08-25","revised":"2024-01-01","component":["Authorization and Trust Management Service"],"title":"Issuer Change in X.509 Certificates Managed by the Service","type":["Changed"],"action":["Required"],"lifecycle":["General Availability"],"environment":["Cloud Foundry"],"description_sha256":"3bfca2b3ae70ef6fc71db991f2a20fdb1b184591bf42f6f4b561b4265b9efe97"},{"id":592662857,"date":"2022-07-28","revised":"2024-01-01","component":["Authorization and Trust Management Service"],"title":"Improvement of Cockpit Roles","type":["Announcement"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["Cloud Foundry"],"description_sha256":"31fad430f840cdec2cd66d1390abc6dfee621e5cd621019afea9438b8752c63f"},{"id":592662858,"date":"2022-07-28","revised":"2024-01-01","component":["Authorization and Trust Management Service"],"title":"Rate Limiting Extended","type":["Announcement"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["Cloud Foundry"],"description_sha256":"5b9094fea4e8d5110210b41a32103d73dbbef7805d67238f101e1d5f600e732b"},{"id":592662859,"date":"2022-06-16","revised":"2024-01-01","component":["Authorization and Trust Management Service"],"title":"Documentation of Token Support","type":["Announcement"],"action":["Info only"],"lifecycle":["General Availability"],"environment":["Cloud Foundry"],"description_sha256":"be1ad11199920def7094fb2f24da284b75b7c7d43044e6b1e1c3fba988982ec8"}]},"edges":{"maintainers":[],"contributors":[],"explained_by":[{"ref":"content:effective-from-june-30th-2026-xsuaa-deprecation-of-get-method-for-oauth-token-re","name":"Effective from June 30th 2026 - XSUAA Deprecation of GET Method for OAuth Token Retrieval","json":"/content/effective-from-june-30th-2026-xsuaa-deprecation-of-get-method-for-oauth-token-re.json"},{"ref":"content:sap-business-technology-platform-authorization-and-trust-management-service","name":"SAP Business Technology Platform: Authorization and Trust Management Service","json":"/content/sap-business-technology-platform-authorization-and-trust-management-service.json"}],"alternative_to_this":[],"needed_by":[{"ref":"artifact:arc-mcp-xsuaa-auth","name":"@arc-mcp/xsuaa-auth","json":"/artifacts/arc-mcp-xsuaa-auth.json","requirement":"required"},{"ref":"artifact:sap-approuter","name":"@sap/approuter","json":"/artifacts/sap-approuter.json"},{"ref":"artifact:sap-xssec","name":"@sap/xssec","json":"/artifacts/sap-xssec.json"},{"ref":"artifact:saptools-cf-xsuaa","name":"@saptools/cf-xsuaa","json":"/artifacts/saptools-cf-xsuaa.json","requirement":"required"},{"ref":"artifact:arc-mcp-arc-1","name":"arc-1","json":"/artifacts/arc-mcp-arc-1.json","requirement":"conditional","role":"authentication","condition":"XSUAA is selected as the authentication method"},{"ref":"artifact:miyasuta-auth-samples","name":"auth-samples","json":"/artifacts/miyasuta-auth-samples.json","requirement":"required"},{"ref":"artifact:miyasuta-auth-transport","name":"auth-transport","json":"/artifacts/miyasuta-auth-transport.json","requirement":"required"},{"ref":"artifact:miyasuta-auth-transport2","name":"auth-transport2","json":"/artifacts/miyasuta-auth-transport2.json","requirement":"required"},{"ref":"artifact:miyasuta-blog-bookshop","name":"blog-bookshop","json":"/artifacts/miyasuta-blog-bookshop.json","requirement":"required"},{"ref":"artifact:lemaiwo-btp-cf-mcp-server","name":"BTP CF MCP Server","json":"/artifacts/lemaiwo-btp-cf-mcp-server.json","requirement":"required"},{"ref":"artifact:lemaiwo-btp-agent","name":"btp-agent","json":"/artifacts/lemaiwo-btp-agent.json","requirement":"required"},{"ref":"artifact:sap-samples-btp-user-management-microservice","name":"btp-user-management-microservice","json":"/artifacts/sap-samples-btp-user-management-microservice.json"},{"ref":"artifact:consetto-calmcp","name":"calmcp","json":"/artifacts/consetto-calmcp.json","requirement":"conditional","condition":"the HTTP transport, which refuses to start unless XSUAA or a static API key is configured"},{"ref":"artifact:miyasuta-cap-openapi","name":"cap-openapi","json":"/artifacts/miyasuta-cap-openapi.json"},{"ref":"artifact:cap-java-cds-feature-identity","name":"com.sap.cds:cds-feature-identity","json":"/artifacts/cap-java-cds-feature-identity.json"},{"ref":"artifact:fr0ster-mcp-abap-adt","name":"fr0ster/mcp-abap-adt","json":"/artifacts/fr0ster-mcp-abap-adt.json","requirement":"conditional","role":"authentication","condition":"JWT authentication selected with a service key (ABAP or XSUAA)"},{"ref":"artifact:clementringot-lisa","name":"LISA","json":"/artifacts/clementringot-lisa.json","requirement":"conditional","condition":"deployed to SAP BTP Cloud Foundry, the production path"},{"ref":"artifact:mi8y-cap-agents-sdm-reports-assistant","name":"Reports Assistant with SAP Document Management","json":"/artifacts/mi8y-cap-agents-sdm-reports-assistant.json","requirement":"required","role":"authentication"},{"ref":"artifact:clementringot-rosa","name":"ROSA","json":"/artifacts/clementringot-rosa.json","requirement":"conditional","role":"authentication","condition":"HTTP transport running on SAP BTP Cloud Foundry with an xsuaa service binding (XSUAA auth mode)"},{"ref":"artifact:sap-samples-btp-ai-core-consumption-monitor","name":"SAP-samples/btp-ai-core-consumption-monitor","json":"/artifacts/sap-samples-btp-ai-core-consumption-monitor.json","requirement":"required"},{"ref":"artifact:sap-samples-btp-ai-core-usage-monitor","name":"SAP-samples/btp-ai-core-usage-monitor","json":"/artifacts/sap-samples-btp-ai-core-usage-monitor.json","requirement":"required"},{"ref":"artifact:sap-samples-btp-resource-consumption-monitor","name":"SAP-samples/btp-resource-consumption-monitor","json":"/artifacts/sap-samples-btp-resource-consumption-monitor.json","requirement":"required"},{"ref":"artifact:sap-samples-digital-manufacturing-extension-samples","name":"SAP-samples/digital-manufacturing-extension-samples","json":"/artifacts/sap-samples-digital-manufacturing-extension-samples.json","requirement":"conditional","condition":"The dm-custom-api in-app service extension sample is deployed."},{"ref":"artifact:sap-samples-joule-a2a-agent-toolkit","name":"SAP-samples/joule-a2a-agent-toolkit","json":"/artifacts/sap-samples-joule-a2a-agent-toolkit.json","requirement":"conditional","role":"authentication","condition":"the agent needs OAuth2 authentication"},{"ref":"artifact:dongitran-sapbruno","name":"sapbruno","json":"/artifacts/dongitran-sapbruno.json","requirement":"conditional","role":"authentication","condition":"the SAP BTP / xsuaa credential provider is configured"}],"available_via":[],"parts":[],"add_ons":[],"answered_through_parts":[]}}