ServiceServiceA BTP service you subscribe to and bind, rather than install. It has plans and regions, not versions, and may deliver a product that lives outside the atlas.See every one →What this type is →by SAPby SAPPublished by SAP itself. A visible facet, never an input to a reading — a dormant official plugin reads exactly like a dormant independent one.See every one →
SAP Customer Identity and Access Management for B2C
SAP's customer identity service: registration, login and consent for the users of a company's websites and apps, kept in one profile per customer, with regional data storage and risk-based authentication as options.
A consumer website or app has to register its users, log them in, record what they consented to and keep their data where local privacy law requires. SAP Customer Identity and Access Management for B2C handles customer identity, consent and authenticationAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. Authorization decides what that identity may do; identity provisioning manages its lifecycle across systems.SAP and community, narrow by design through a unified profile per customer. Screen-sets carry login, profile updates and consent, hosted pages show them without adding them to the site's code, and a site or site group can act as a SAML identity provider or an OIDC provider. Global Access stores each user's data in a data centre in their region, and Risk Based Authentication challenges a login according to its calculated risk, with third-party providers such as Google reCAPTCHA, Akamai, Arkose Labs and Transunion. Core is the base plan; the consent option package lifts its restrictions on consent, and the enhanced option package adds Global Access and Risk Based Authentication.
Where it sits
Lives in
Provides
AuthenticationBTPAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. [Authorization](capability:authorization) decides what that identity may do; [identity provisioning](capability:identity-provisioning) manages its lifecycle across systems.Data privacyBTPData privacyDoing what the law requires with personal data — knowing which fields are personal, answering a subject's request about them, and deleting them when the reason for holding them expires.
Who is behind it
SAPSAPMaintains this
In the atlas: maintains 137, wrote 14@SAPmaintainer
In the atlas: maintains 137, wrote 14@SAPmaintainer
What it declares
Every artifact
- Type
- Service
- Origin
- By SAP
Connections
Group by
NodeRelationBasis
Functional
AuthenticationAuthenticationEstablishing who is calling and making that identity availableSAP and community, narrow by design
provides
stated
provides Authentication
Logs in the end users of a website or app, challenges a login according to its calculated risk, and lets a site act as a SAML identity provider or OIDC provider.
“Have the ability to use your site or site group as a SAML IdP or an OIDC OP.”“RBA adds account security by calculating the level of risk associated with a given login attempt and presenting users with authentication challenges according to that risk level.”“Use an out of the box Account Take Over protectoin engine as well as a complete Risk Based Authentication system supporting many 3rd party providers, such as Google reCAPTCHA, Akamai, Arkose Labs, and Transunion to secure your websites and user data.”
Establishing who is calling and making that identity available
Data privacyData privacyHandling personal data the way the law requiresSAP only
provides
stated
provides Data privacy
Records the consent each end user gives to terms of service, privacy policies and custom statements, and with Global Access keeps a user's personal data in a data centre in their region to comply with local privacy laws.
“Manage user privacy, preferences, and consent in a way that is transparent to the end user, while helping you uphold rigorous standards so as to support your compliance with international privacy regulations.”“Store user data in the region they are from to comply with local privacy laws.”“Allows access to a basic package of services to get started using SAP Customer Data Cloud.”“Unlocks all restrictions of consent and allows use of 'other' consent statements, which are custom consents that do not have to be mandatory for end users.”“Use Global Access to maintain global sites or site groups while maintaining user data in their relvant region to comply with local privacy laws.”
Handling personal data the way the law requires
Download
Others providing
AuthenticationAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. Authorization decides what that identity may do; identity provisioning manages its lifecycle across systems.SAP and community, narrow by design
- abap_jwt_generatorabap_jwt_generatorGenerates a signed JSON Web Token in ABAP from an explicit header and claim, a stored profile in table ZJWT_PROFILE, or a shared secret, signing through a PSE profile or with the secret.independent, abapGenerates signed JSON Web Tokens in ABAPfrom ABAP
- @arc-mcp/xsuaa-auth@arc-mcp/xsuaa-authThe client-to-server authentication stack for an MCP server on SAP BTP: an XSUAA OAuth proxy, dynamic client registration, a chained bearer verifier, and a separate entrypoint for per-user principal propagation.independent, btpXSUAA authentication stack for an MCP server on SAP BTPfrom BTP/BAIP
- abap-pwnedpasswordsabap-pwnedpasswordsChecks from ABAP whether a password appears in the Have I Been Pwned breached-password list, wrapping the Pwned Passwords API V3 in one call that answers with a boolean.independent, abapChecks passwords against Have I Been Pwned from ABAPfrom ABAP
- SAP Authorization and Trust Management serviceSAP Authorization and Trust Management serviceThe OAuth server behind a BTP application: issues the JWT the app checks, holds the scopes and role collections it checks against, and brokers trust to an identity provider. Bound, never installed.sap official, btpOAuth server issuing JWTs and holding scopes for BTP appsfrom BTP/BAIP
- Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btpIdentity Authentication and Identity Provisioning as one tenantfrom BTP/BAIP
- OAuth 2.0 on SAP BTPOAuth 2.0 on SAP BTPOAuth 2.0 protection for applications and APIs on SAP BTP, listed in Neo regions: the authorization code grant for web applications and the client credentials grant for API and IoT scenarios.sap official, btpOAuth 2.0 grant flows for applications and APIs in Neo regionsfrom BTP/BAIP
- com.sap.cds:cds-feature-identitycom.sap.cds:cds-feature-identityThe CAP Java feature that validates OAuth2 tokens from XSUAA and SAP Cloud Identity Services and builds the request's security context from them.sap official, capOAuth2 token validation from XSUAA and SAP Cloud Identity Servicesfrom CAP
- com.sap.cds:cds-feature-xsuaacom.sap.cds:cds-feature-xsuaaThe CAP Java feature that validated XSUAA-issued JWTs, published up to 2.10.7 before CAP Java 3.0 removed it in favour of com.sap.cds:cds-feature-identity.sap official, capFormer XSUAA JWT validation for CAP Java, removed in CAP Java 3.0from CAP
- abapOAuthAzureabapOAuthAzureAn Enhancement Spot OA2C_SPECIFICS implementation for Microsoft Azure, written against ABAP's OAuth 2.0 Client API, with a one-sentence README that leaves configuration to SAP's help page.independent, abapOA2C_SPECIFICS implementation for Microsoft Azure OAuth 2.0 in ABAPfrom ABAP
- abap2oauth2abap2oauth2An ABAP API for OAuth 2.0 authentication that registers a provider's client ID and secret as a named consumer and implements signature method 3, the one Google uses.independent, abapABAP API for OAuth 2.0 authenticationfrom ABAP
- abapNTLMabapNTLMAn HTTP NTLM client for ABAP, with the RC4, MD4 and DES algorithms the protocol needs implemented in ABAP, which its maintainer says seems to work only some of the time.independent, abapHTTP NTLM client for ABAPfrom ABAP
- abap_cloud_platformabap_cloud_platformA TypeScript library of the Cloud Foundry calls that walk down to an ABAP service instance, read its SAP_ADT service key and log a user in, so a tool outside the system can reach it.independent, btpTypeScript library reaching ABAP service instances on Cloud Foundryfrom BTP/BAIP
- decodesapsso2decodesapsso2A TypeScript library that decodes a MYSAPSSO2 logon ticket into its user, client, system and validity fields, and returns the signature without validating it, so it never shows a ticket is genuine.independent, abapTypeScript decoder for MYSAPSSO2 logon ticketsfrom ABAP
- @marianfoo/sap-mcp-auth@marianfoo/sap-mcp-authA shared browser-login and session module for SAP MCP servers: it drives a Playwright browser through SAP Identity Authentication, caches the session cookies and returns a cookie header an HTTP client can send.independent, btpBrowser login and session module for SAP MCP serversfrom BTP/BAIP
- @sap/approuter@sap/approuterSAP's Node.js application router: the single entry point in front of a business application's microservices, which authenticates the user, forwards each request to a backend by route and serves static content.sap official, btpSAP's Node.js application router in front of business applicationsfrom BTP/BAIP
- @sap/cds@sap/cdsThe CAP Node.js runtime, which compiles the CDS model, serves the services declared in it, answers generic requests before any handler runs, and loads every cds-plugin.sap official, capCAP Node.js runtimefrom CAP
- Cloud ConnectorCloud ConnectorSAP's on-premises agent that links SAP BTP applications to systems in a customer's own network, as a reverse invoke proxy that exposes only the systems and resources it is configured to allow.sap official, btpSAP's on-premises agent linking SAP BTP to customer-network systemsfrom BTP/BAIP
- @sap/xssec@sap/xssecToken validation and security context for XSUAA and IAS.sap official, capToken validation and security context for XSUAA and IASfrom CAP
- cds-azure-adcds-azure-adAzure AD and Azure AD B2C as a custom-defined authentication strategy for CAP through passport-azure-ad, implementing the hook capire documents so the application does not validate tokens itself.independent, capAzure AD and Azure AD B2C authentication strategy for CAPfrom CAP
- @saptools/cf-xsuaa@saptools/cf-xsuaaA command line and Node.js API that reads the XSUAA binding of a Cloud Foundry app and prints an OAuth2 client_credentials token for it, cached until it expires.independent, btpOAuth2 token fetcher for a Cloud Foundry app's XSUAA bindingfrom BTP/BAIP
- cds-common-jwt-supportcds-common-jwt-supportJWT authentication for CAP without xsuaa or xssec, validating tokens with jose instead, for a service that authenticates against an identity provider other than XSUAA; last released in April 2022.independent, capJWT authentication for CAP without xsuaa or xssecfrom CAP
- abap-aws-sigv4abap-aws-sigv4Signs outbound HTTP calls to AWS APIs with AWS Signature Version 4, directly from ABAP.independent, abapSigns outbound HTTP calls to AWS APIs with AWS Signature Version 4, directly from ABAP.from ABAP
Data privacyData privacyDoing what the law requires with personal data — knowing which fields are personal, answering a subject's request about them, and deleting them when the reason for holding them expires.SAP only
- SAP Data Privacy IntegrationSAP Data Privacy IntegrationA reuse service whose APIs an application calls for its data privacy duties: retention rules and deletion at the end of purpose, reports of the personal data held, and anonymisation of unstructured data.sap official, btpAPIs for retention, deletion and personal data reportsfrom BTP/BAIP
- SAP Data Retention ManagerSAP Data Retention ManagerA BTP service that holds residence and retention rules for applications' personal and transactional data, and triggers blocking, deletion, archiving and destruction.sap official, btpRetention rules triggering blocking, deletion and archivingfrom BTP/BAIP
- SAP Personal Data ManagerSAP Personal Data ManagerA BTP service that finds data subjects, tells them which of their personal data an application or service stores and uses, and handles their requests about it.sap official, btpService answering data subjects about their stored personal datafrom BTP/BAIP
- @cap-js/data-privacy@cap-js/data-privacyIntegration with SAP Data Privacy Integration, driven by the personal-data annotations already on the model — the annotation that marks a field is the one the service acts on.sap official, capCAP integration with SAP Data Privacy Integrationfrom CAP
- @sap/cds@sap/cdsThe CAP Node.js runtime, which compiles the CDS model, serves the services declared in it, answers generic requests before any handler runs, and loads every cds-plugin.sap official, capCAP Node.js runtimefrom CAP
- DSTDSTIrreversibly anonymises PII and PHI data in non-production SAP systems, against a scrambling template the user creates.independent, abapIrreversibly anonymises PII and PHI data in non-production SAP systems, against a scrambling template the user creates.from ABAP
Details
Sources
Sources are graph entities: the same page may back several entries, and an unreachable source flags every row that rests on it.
Compatibility and provenance
discovered viaAdded by hand
first seen in the atlas
ecosystem and domainbtp, security-and-compliance
History in the atlas
- First seen.
For your agent
- Ref
artifact:btp-customer-identity-and-access-management- JSON
- /artifacts/btp-customer-identity-and-access-management.json
- MCP
- Connecting an agent