Cloud Identity Services
Identity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.
Where it sits
What it declares
Every artifact
- Type
- Service
- Origin
- By SAP
As a service
- Plans
- 1
- Regions
- 46
- Support component
- BC-IAM-IDSBC-IAM-IPSBC-IAM-OID
Parts and add-ons
Parts 1
Connections
Establishing who is calling and making that identity available
Getting users, groups and roles into every system that needs them
CAP integration with SAP Integration Suite advanced event mesh
CAP integration with SAP Integration Suite advanced event mesh
Browser login and session module for SAP MCP servers
Authorization from DCL policies for Node.js apps on SAP Cloud Identity
SAP's Node.js application router in front of business applications
Token validation and security context for XSUAA and IAS
OAuth server issuing JWTs and holding scopes for BTP apps
Extracts header fields and line items from business documents
Authorization from DCL policies for Node.js apps on SAP Cloud Identity
Identity Provisioning jobs syncing SAP Concur users for Joule
Business notifications from CAP Java via SAP Alert Notification
SAP's Node.js application router in front of business applications
Token validation and security context for XSUAA and IAS
OAuth2 token validation from XSUAA and SAP Cloud Identity Services
Terraform template for a BTP subaccount set up for Joule Studio
SAP's AI engagement layer across SAP applications
Hands-on applying SAP BTP security recommendations to a trial account
Hands-on integrating Cloud Identity Services with Microsoft Entra
Business sites and digital workspaces with collaboration tools
Role-based business site for SAP and third-party apps
Provisioning jobs carrying users and groups between systems
Download
Learn more
- How to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationHow to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationWalks through wiring SAML 2.0 single sign-on between SAP Cloud Identity Services (IAS) and SAP Cloud Logging so its OpenSearch dashboards accept IAS logins instead of a service key: creating the SAML application in IAS, editing the instance's saml parameters (admin_group, idp.metadata_url, idp.entity_id, sp.entity_id), setting the matching entity ID and endpoints on the IAS side, and mapping an IAS group to the all_access role through a groups attribute. It also shows how to read a 403 on the dashboard as SAML login succeeding while the group-to-role mapping is still missing.Umezuki, published 2025-12-30Umezuki, SAP Community
- Secure Service Consumption Across HyperscalersSecure Service Consumption Across HyperscalersSAP's design for a workload on SAP BTP that calls Amazon Web Services or Google Cloud services with short-lived credentials instead of stored keys, which is the outbound side of authentication: the BTP application proving who it is to another cloud. On AWS it draws two paths, an ID token from Identity Authentication in Cloud Identity Services exchanged through AWS STS for an IAM role, or an X.509 certificate kept in SAP Destination service and presented to IAM Roles Anywhere; on Google Cloud only the token path, through Workload Identity Federation and an impersonated service account. It is drawn for those two hyperscalers only, and Microsoft Azure has no page in it.published 2025-05-14SAP Architecture Center, SAP Architecture Center
- Integrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerIntegrating SAP Cloud Identity Services (Identity Authentication - IAS) with SAP Audit Log ViewerWalks through wiring an Identity Authentication tenant of Cloud Identity Services into the SAP Audit Log service on SAP BTP, Cloud Foundry: from the tenant's Monitoring & Reporting tile, adding the target BTP subaccount's tenant ID and subdomain ties the two together, and after a 15-20 minute wait the resulting Audit Log Viewer link surfaces logs of personal-data changes and of successful and failed authentications. Logs are then filtered by date and keyword, each entry carrying its event category, event and object type, timestamp, and the user who performed the action.Yogananda, published 2025-03-23Yogananda, SAP Community
8 more
- Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDWhy SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDA step-by-step configuration walkthrough for wiring SAP Cloud Identity Services as the trust and user-correlation layer behind SAP Task Center: establishing Identity Authentication as the sole trusted identity provider for the BTP subaccount, and generating the Global User ID — carried in the token's user_uuid claim rather than the SAML name identifier — that Task Center uses to match logged-in users to their tasks. It also covers syncing that ID between Microsoft Entra ID, the Identity Directory and SAP S/4HANA through Identity Provisioning jobs, and the principal-propagation trust the cloud connector needs to pass it through to an on-premise task provider.ivelinakiryakov, published 2024-11-25ivelinakiryakov, SAP Community
- Third-Party MCP Server Access to SAP Solutions on BTPThird-Party MCP Server Access to SAP Solutions on BTPDescribes external MCP servers and custom servers on BTP, assigning their operators responsibility for authentication, scoped identity, API limits, logging and lifecycle. The permitted use remains conditional on the SAP API Policy, while SAP Integration Suite and Joule Studio are described as SAP-provided paths. Hosting a server on BTP does not automatically supply its governance controls.Dhawal Joshi, Harut Ter-Minasyan, Mirko GüntherDhawal Joshi, Harut Ter-Minasyan, Mirko Günther, SAP Architecture Center
- Evolving the identity lifecycle for an AI-first futureEvolving the identity lifecycle for an AI-first futureCloud Identity Services as the foundation for authentication, identity lifecycle management and access across SAP landscapes, and the agent identity concepts and SAP-managed identity and access management scenarios SAP says reduce operational effort. The edges are to the service and to the two concerns the abstract names it for, Authentication and Identity provisioning; the abstract names the agent identity concepts and does not say what they are. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Sonia Petrescu and Swetta Singh, written here from SAP's abstract; the recording is not yet published.SAP TechEd — session catalogue
- How SAP secures enterprise AI agents with identity propagationHow SAP secures enterprise AI agents with identity propagationCloud Identity Services as the identity layer for AI agents as well as people: the abstract states that both are managed in one directory, that user context is propagated by token exchange, and that authorisation is enforced at every hop, so no agent holds back-end credentials. Agents from Microsoft, Google and partners take the same flow through the agent gateway. Token exchange across a hop is the authentication side and the per-hop check the authorisation side; what the agent gateway is, and whether it is a product, the abstract does not say. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Gunnar Kosche and Sebastian Ries, written here from SAP's abstract; the recording is not yet published.Gunnar Kosche, SAP TechEd — session catalogue
- Identity lifecycle and governance with SAP services and Microsoft EntraIdentity lifecycle and governance with SAP services and Microsoft EntraCloud Identity Services beside SAP Cloud Identity Access Governance and Microsoft Entra for one user lifecycle across SAP and third-party applications: the abstract states that SAP business roles can be included in Entra access packages, so that provisioning and governance run from Entra in a hybrid environment, which is the identity provisioning concern. Which SAP systems' roles, and over which protocol, is not stated. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Martin Raepple of Microsoft, Plamen Pavlov, Regine Schimmer and Swetta Singh, written here from SAP's abstract; the recording is not yet published.SAP TechEd — session catalogue
- Road map: SAP Business AI Platform security and SAP Cloud Identity ServicesRoad map: SAP Business AI Platform security and SAP Cloud Identity ServicesThe road map for SAP Business AI Platform's security and compliance services, Cloud Identity Services and SAP Key Management Service among them, and the upcoming changes SAP files under security, governance and compliance. The edge is to Cloud Identity Services, the one named service with an entry here; SAP Key Management Service has none, and the abstract names no item of the road map. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Michael Friedrich and Sascha Vierlinger, written here from SAP's abstract; the recording is not yet published.SAP TechEd — session catalogue
- What’s next for the core platform capabilities of SAP Business AI PlatformWhat’s next for the core platform capabilities of SAP Business AI PlatformA preview of the operations layer beneath SAP Business AI Platform: selected road map highlights across Joule Studio runtime, Cloud Identity Services and SAP Cloud Logging, on how enterprise AI is governed and run. The edges are to the two named services and to SAP Joule, whose agents the Joule Studio runtime runs; the abstract names the three areas and no highlight. A TechEd 2026 session (Tuesday 27 October, Berlin; also XP825V, virtual), presented by Andre Lamego and Jens Huesken, written here from SAP's abstract; the recording is not yet published.SAP TechEd — session catalogue
- Use Free Tier to Subscribe to SAP Document AI Basic UIUse Free Tier to Subscribe to SAP Document AI Basic UIEight steps from an entitled subaccount to the SAP Document AI basic UI open in a browser, and most of them are identity work rather than document work: getting a tenant for Cloud Identity Services, which the basic UI requires, activating the account and establishing trust with the subaccount, then subscribing, creating a user and assigning the Document_Information_Extraction_UI_Templates_Admin role collection. Using the UI to read a document is the subject of Use Machine Learning to Extract Information from Documents with the SAP Document AI Basic UI, which this tutorial names as what to read next.Juliana Morais, SAP Developer Center
What’s New
from SAP Help Portal, readIdentity Authentication API
Default Issuer Compliance Enabled for New Apps in Non-Compliant Tenants
Tenant Migration
API Authentication
Sync SSO Cookie Between Domains
Regular Upgrade
Regex Validation in Transformations
Certificate Authentication
Off-Cycle Upgrade
Regional Availability
Regular Upgrade
Regular Upgrade
Off-Cycle Upgrade
Off-Cycle Upgrade
User Token Requests Rejected When Subject Matches Application Client ID
Regular Upgrade
Handling Transformations Exceeding 500 Mappings
Validating Transformation Change Descriptions
Identity Directory API
Off-Cycle Upgrade
Tenant Migration
Identity Directory API
Regular Upgrade
Total Results Strategy Property
SAP HANA Database Connector Now Generally Available
Off-Cycle Upgrade
SAP Fieldglass - Patch Support
Regular Upgrade
SAP Analytics Cloud (SCIM API v2) supports userUUID
Off-Cycle Upgrade
Off-Cycle Upgrade
Regular Upgrade
Regular Upgrade
Default Value Applied When patch.group.members.above.threshold Is Not Configured
SAP Ariba Proxy Systems: Base64 Encoding for Special Symbols
Groups
Groups
Groups
Groups
Groups
Off-Cycle Upgrade
Regular Upgrade
User Attributes
Corporate Identity Provider Authentication Enforcement Validation
User Attributes
Regular Upgrade
Configuration of Policy Authorizations for Authorization Policies
Automatic Creation of Identity Provisioning Tenants on SAP Cloud Identity for Neo Tenants
Off-Cycle Upgrade
Regular Upgrade
Identity Directory API
User Types
Profile Attributes
API Authentication
Regular Upgrade
SAP HANA Cloud, HANA Database connector - Renamed and Extended
Local Identity Directory - Compliance Status Updated in SAP Cloud ALM
Tenant Request via SAP for Me Documented
Block and Delete Users
SAP CPQ - Support for Paging-Related Properties
Regular Upgrade
Bulk Request Size Validation
Name Attribute Restructured
Application Scope Restricted
System Notifications
Regular Upgrade
Blocked Creation of Custom Attributes with sap_ Prefix
Regular Upgrade
Conditions Correctly Displayed in Graphical Editor
Support Multiple OIDC Identity Providers Configurations with Same Issuer
Tenant Migration
Off-Cycle Upgrade
SAP Sales Cloud and SAP Service Cloud version 3 – supported filter
Regular Upgrade
Job Execution Details Show API-Triggered Jobs
Added locale to preferredLanguage Mapping - SAP S/4HANA Cloud Public Edition version 3 and SAP Integrated Business Planning version 2
Off-Cycle Upgrade
User Attributes
SAP Cloud Identity Services Supports Nested Attributes
Reserved sap_ Prefix for Attribute Names
SAP Integrated Business Planning v2 and SAP S4HANA Cloud Public Edition v3 - Changes in Transformations
SAP Concur Connector Version 3 - Group Assignments are Ignored
SAP Data Custodian - New Mapping for the externalId
SAP Integrated Business Planning Version 2 - Support for Paging-Related Properties
Multi-Factor Authentication
Multi-Factor Authentication
Regular Upgrade
LDAP Attribute Validation for MS Active Directory
SAP Ariba Applications Connector - Support for Current and Next-Generation SCIM APIs
Regular Upgrade
Microsoft Active Directory - New Property
Support for externalName group attribute
TimeZone Format Update for SAP IBP 2602
Off-Cycle Upgrade
Regular Upgrade
Changes in Read and Proxy Read Transformations
SAP AS ABAP Proxy - Decoding Role ID
Support for externalName group attribute
Group Deletion and Removal of Assignments in SAP AS ABAP
Change in Status Code Behavior for Identity Provisioning Proxy Scenarios
Regional Availability
Regular Upgrade
Administration Console Look and Feel
Support for externalName in SAP Analytics Cloud
Identity Provisioning UI Improvements
Enhanced Confirmation Dialogs for Reset and Delete
Support for externalLocation Group Attribute
Changed Name for SAP S/4HANA Cloud Connector
User Interface for the Configuration of Refresh Token Lifetime Changed for OIDC Applications
Regular Upgrade
Corporate Identity Providers
Off-Cycle Upgrade
Regular Upgrade
SAP Concur - New Connector Version
SAP Signavio Process Transformation Suite Connector
convertLocaleCode Function Introduced
User Groups
Deprecated oauth.resource.name property
sf.company.id not required for certificate authentication
Data Control Language (DCL) for the Definition of Authorization Policies
Regular Upgrade
Provided APIs
Regional Availability
Off-Cycle Upgrade
Regular Upgrade
New SAP BTP Subscriptions and Applications Appear as Child Applications of the Subaccount Application
Issuer Name
User Attributes
SAP S/4HANA Cloud - New Connector Version
SAP Integrated Business Planning - New Connector Version
SAP S/4HANA Cloud - HR integration switch off
Handling group uniqueness in Identity Authentication and Local Identity Directory
SAP AS ABAP - Configuring Number of Users Read at Once
Change in the Behavior for User Managed Group Assignment
Regular Upgrade
Signing Certificate
Domains
Handling user unlock in SAP S/4HANA Cloud target systems
Central store logs – create and delete groups
Application-Specific Groups
SAP Ariba Applications
Support for externalName Attribute in Identity Authentication (using SCIM API version 2) and Local Identity Directory Transformations
Regular Upgrade
Mail Server
Support for Additional Schema and Attributes in SAP Ariba Applications Transformations
Off-Cycle Upgrade
Renamed System
Privacy Policy
Real-Time Provisioning Logs are Enhanced
Regular Upgrade
Provided APIs
Regular Upgrade
Subject Name Identifier
Deprecation of SAP Ariba Category Management Connector
convertTimezoneCode Function Introduced
Deprecation of SAP Ariba Category Management connector
Principal propagation from SAP BTP to an On-Premise Cloud Connector with a Token From a Corporate Identity Provider
Off-Cycle Upgrade
Regular Upgrade
Password Recovery
Identity Directory SCIM API
Mandatory email for job subscribers
Regional Availability
Off-Cycle Upgrade
Regular Upgrade
SAP Ariba Central Invoice Management supports userUUID
Meta attribute mapping reordered
Regional Availability
Regular Upgrade
Support for SAP extension schema for groups
Change in provisioning job behavior
Regional Availability
Change in provisioning job behavior (Effective July 15, 2025)
Off-Cycle Upgrade
CAPTCHA Protection
Regular Upgrade
Support for SAP extension schema for groups
Off-Cycle Upgrade
Override Conditional Authentication with URL Parameter
Off-Cycle Upgrade
Signing Certificates
Regular Upgrade
Identity Federation
User Attributes
SAP Revenue Growth Management connector
Job Execution Outcome introduced
System reset confirmation message extended
Support for SAP extension schema for groups
Support for extension enterprise schema for users
Regular Upgrade
Applications
SAP Analytics Cloud and SCIM System - new properties
Changed behavior of logging and tracing properties
REST API
Regular Upgrade
SAML 2.0 Configuration
Password Management
Cloud Identity Services Documentation
Support for SAP extension schema for groups
Regular Upgrade
SAP ODM User Schema Support
Download all deleted entities for a provisioning job
Client Certificates
REST API
Application Authorizations
Manage Corporate Identity Providers
Privacy Policy and Terms of Use
Application Protocol Type
SAP Sales Cloud and SAP Service Cloud - new version
SAP Build Work Zone, standard edition - schema support
Support for SAP extension schema for groups
Regional Availability
Regular Upgrade
Machine Translation
Support for SAP extension schema for groups
Identity Authentication (using SCIM API version 2) - changed behavior
Registration and Upgrade Forms
Provided APIs
OpenID Connect
Support for OAuth 2.0 Authorization Server Issuer Identification
Regional Availability
Regular Upgrade
OAuth Client Authentication
Download all updated entities for a provisioning job
Central store logs display source entity ID
SAP Ariba Applications - default transformations changes
Bundle options documentation
Regular Upgrade
Identity Federation for Applications
SAML 2.0 Configuration
Attributes Based on Flexible Expressions
Attributes Based on Flexible Expressions
User Attributes
User Attributes
Warning of unsupported entity
Support for externalId in UUID format
No restart for failed job
Authorizations Based on Policies
Regular Upgrade
Group Provisioning
Certificate Renewal
User Management
SAP Cloud Identity Services - Identity Authentication integration with SAP Cloud ALM
Increased Number of API Permission Groups Allowed
Central store-based provisioning
Intelligent Opportunity Analyzer connector
Group mapping changes
Provisioning sub-attributes of emails attribute
Troubleshooting entity deletion
Off-Cycle Upgrade
Central store logs
New conditional function implemented
Regular Upgrade
Authorizations Based оn Policies
Enforce Nonces for Authentication Requests to Corporate Identity Providers
Disabling ID Token Hints for Corporate Identity Providers During Logout
Group mapping changes
Provisioning sub-attributes of emails attribute
Authorizations Based оn Policies
Regular Upgrade
Invalid mapping in SAP AS ABAP
Group Provisioning
Provisioning sub-attributes of emails attribute
New conditional functions implemented
Group mapping changes
Reduced Set of Scopes for Credentials of Cloud Identity Services Instances
Off-Cycle Upgrade
Regular Upgrade
SAP Build Work Zone, advanced edition - userType provisioning
Tenant Reset renamed to Reset Provisioning Settings
Identity Directory API
Off-Cycle Upgrade
Off-Cycle Upgrade
Regular Upgrade
Create User Groups
Group Authorizations Based оn Policies
valueMappings transformation expression is enhanced
Download all created entities for a provisioning job
SAP BTP Platform Members (Cloud Foundry) and SAP BTP XS Advanced UAA (Cloud Foundry) - support for active and verified attributes
Off-Cycle Upgrade
Off-Cycle Upgrade
Regular Upgrade
Corporate IdPs
Granular access to Identity Provisioning
Provisioning system buttons relocated
SAP Sales Cloud and SAP Service Cloud - define threshold of group members for patch requests
Changed behavior of csrf.token.path for SAP Analytics Cloud
Regular Upgrade
SAP BTP Platform Members (Cloud Foundry) - write transformation
Identity Directory API
Regular Upgrade
Increased Maximum OIDC Token Validity
Password Recovery
Regional Availability
Changed behavior of skip create for SAP Application Server ABAP
SAP BTP Platform Members (Cloud Foundry) connector
Support for OAuth certificate authentication
Regional Availability
Regional Availability
Regional Availability
Regular Upgrade
User Management
Support for OAuth authentication
SAP Enable Now connector
SAP Ariba Applications extended schemas and attributes
Regional Availability
Regional Availability
Regular Upgrade
Off-Cycle Upgrade
Regular Upgrade
SAML 2.0 Metadata
SAML 2.0 Metadata
Password Recovery Options
SAP HANA Cloud, SAP HANA Database connector
SAP Ariba Central Invoice Management connector
SAP Datasphere connector
Support for OAuth certificate authentication
Condition and skip update - changed behavior
Skip create and delete operations of groups - removed
Reset of SAP Master Data Integration - changed behavior
SAP Data Custodian - filter users by group display name
Regional Availability
Off-Cycle Upgrade
Regular Upgrade
Mail Server Configuration
Deprecation of SAP Concur User v1 API
Separation of Signing Key for SAML and OIDC Tokens
SAP Central Business Configuration - bundle option documentation
Off-Cycle Upgrade
Regular Upgrade
Regional Availability
Regular Upgrade
Administrators
OpenID Connect
User Management
Condition and skip update - changed behavior
isValidEmail function supports new value
Read and proxy read transformation changes
Write and proxy write transformation changes
Regional Availability
Regional Availability
Regular Upgrade
Off-Cycle Upgrade
Administration Console Look and Feel
Profile Page
Regional Availability
SAP Cloud Identity Services - Identity Provisioning integration with SAP Cloud ALM
Regular Upgrade
Regional Availability
Regional Availability
User Management
Support for OAuth certificate authentication
Procurement Data Warehouse connector
Local Identity Directory - group mapping
SAP Business Ecology Management bundle is deprecated
ips.application.id property introduced
SAP Advanced Financial Closing - group mapping
Regular Upgrade
Regional Availability
Regional Availability
Security recommendations for SAP Cloud Identity Services - Identity Provisioning
skipOperations create is enhanced in SAP Analytics Cloud version 1 target systems
Off-Cycle Upgrade
Regular Upgrade
Custom Schemas
SAP Ariba Category Management connector
Off-Cycle Upgrade
User Management
Regular Upgrade
User update capability for SAP Build Work Zone, standard edition
SAP Market Communication for Utilities - bundle option documentation
Real-time logs show the origin of the users
Application-Specific Groups
Managing Groups
Integration of SAML and OIDC Logout Flows
Regular Upgrade
Logos
Manage Applications
User Details
Handling Third-Party Cookies
Handling rate limits for Microsoft Entra ID read operations
SAP SuccessFactors Employee Central Payroll connector
Data type name changed
Regular Upgrade
User Groups
Conditional Authentication
Regular Upgrade
Custom Schemas
User Tokens
Risk-Based Authentication
Risk-Based Authentication
Notifications
Social Identity Providers
Feedback Survey
Data type introduced for expressions in Identity Provisioning graphical editor
Changing totalResults attribute calculation mechanism
Renamed System
Regular Upgrade
IdP Proxy Scenarios
SAP Intelligent Agriculture connector
Identity Authentication Documentation and Release Notes Changes
Regular Upgrade
Authorizations Based on Policies
Configure Applications
Authenticate with System as Admin
External Providers
Off-Cycle Upgrade
Custom Domains
Off-Cycle Upgrade
Off-Cycle Upgrade
Regular Upgrade
Custom Schemas
OpenID Connect
OpenID Connect
Regular Upgrade
OpenID Connect
Subject Name Identifier
Regular Upgrade
Email Notifications
Off-Cycle Upgrade
Regular Upgrade
Manage Administrators
Application Authorizations Based on Policies
Off-Cycle Upgrade
Regular Upgrade
Branding and Layout
Upgrade Dates
Regional Availability
Regular Upgrade
Regular Upgrade
Regular Upgrade
User Attributes for Subscribed Applications
Custom Mail Server
Off-Cycle Upgrade
Regular Upgrade
Regular Upgrade
Tenant Texts
Regional Availability
Implicit Grant Type Not Enabled by Default
Refresh Token Flow of OIDC Protocol Restricted to Validity of Web Session
Regular Upgrade
Source System, Master Data Texts Configuration
Off-Cycle Upgrade
Application Development in Authorization Management
Root Certificate Replacement
End User Screens
Customer Documents
Integration of Default Attributes and Assertion Attributes in Applications
Regular Upgrade
Groups
Authorizations Based on Policies
In-App Help
Regular Upgrade
Corporate IdP
Off-Cycle Upgrade
Regular Upgrade
Manage Administrators
Subscribed Applications
Off-Cycle Upgrade
Regular Upgrade
Risk-Based Authentication
Regular Upgrade
Terms of Use Documents
Privacy Policy Documents
Support for Prompt Parameter
Off-Cycle Upgrade
Regular Upgrade
Removal of Applications of Type Reuse
OpenID Connect
OpenID Connect
User Management
Regular Upgrade
System Notifications
REST API
User Groups
Authentication
Off-Cycle Upgrade
Corporate IdPs
System Upgrade
Corporate IdP
OpenID Connect Configurations
System Upgrade
Corporate IdPs
System Upgrade
System Upgrade
OpenID Connect
Tenant Settings
System Upgrade
System Upgrade
Rewording of Security Recommendations
Deprecation of Security Recommendation BTP-IAS-0016
SMS Verification
Tenant Offering
Authorizations Based on Policies
System Upgrade
User Management
Global User ID
OpenID Connect Configurations
Corporate IdPs
Configuration of Authorization Policies
System Upgrade
Administration Console
Troubleshooting
OpenID Connect
System Upgrade
System Upgrade
User Management
Applications
Troubleshooting
OpenID Connect
OpenID Connect
Identity Service
Administration Console
System Upgrade
System Upgrade
System Upgrade
System Upgrade
Manage Applications
System Upgrade
User Management
System Upgrade
Regional Availability
Tenant Settings
Administration Console
User Management
Others providing
Compare all 8 on the Authentication page →- SAP Authorization and Trust Management serviceSAP Authorization and Trust Management serviceThe OAuth server behind a BTP application: issues the JWT the app checks, holds the scopes and role collections it checks against, and brokers trust to an identity provider. Bound, never installed.sap official, btpOAuth server issuing JWTs and holding scopes for BTP apps
- com.sap.cds:cds-feature-identitycom.sap.cds:cds-feature-identityThe CAP Java feature that validates OAuth2 tokens from XSUAA and SAP Cloud Identity Services and builds the request's security context from them.sap official, capOAuth2 token validation from XSUAA and SAP Cloud Identity Services
- com.sap.cds:cds-feature-xsuaacom.sap.cds:cds-feature-xsuaaThe CAP Java feature that validated XSUAA-issued JWTs, published up to 2.10.7 before CAP Java 3.0 removed it in favour of com.sap.cds:cds-feature-identity.sap official, capFormer XSUAA JWT validation for CAP Java, removed in CAP Java 3.0
- @sap/cds@sap/cdsThe CAP Node.js runtime, which compiles the CDS model, serves the services declared in it, answers generic requests before any handler runs, and loads every cds-plugin.sap official, capCAP Node.js runtime
- @sap/xssec@sap/xssecToken validation and security context for XSUAA and IAS.sap official, capToken validation and security context for XSUAA and IAS
- cds-azure-adcds-azure-adAzure AD and Azure AD B2C as a custom-defined authentication strategy for CAP through passport-azure-ad, implementing the hook capire documents so the application does not validate tokens itself.independent, capAzure AD and Azure AD B2C authentication strategy for CAP
- cds-common-jwt-supportcds-common-jwt-supportJWT authentication for CAP without xsuaa or xssec, validating tokens with jose instead, for a service that authenticates against an identity provider other than XSUAA; last released in April 2022.independent, capJWT authentication for CAP without xsuaa or xssec
Details
Sources
Sources are graph entities: the same page may back several entries, and an unreachable source flags every row that rests on it.
Compatibility and provenance
History in the atlas
- what it does, sources, one property
- ABAP authorisation is authorisation objects and roles, a different concern that an identity service does not answer, and on UI5 token validation happens in the router or the service rather than in the frontend. Listed behind both doors, it grouped under nothing on either.
- First seen.
For your agent
- Ref
artifact:btp-cloud-identity-services- JSON
- /artifacts/btp-cloud-identity-services.json
- MCP
- Connecting an agent