{"ref":"capability:authentication","page":"/capabilities/authentication","json":"/capabilities/authentication.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"authentication","name":"Authentication","domain":"security-and-compliance","ecosystems":["cap","btp","abap","ui5"],"universal":true,"description":"Establishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. [Authorization](capability:authorization) decides what that identity may do; [identity provisioning](capability:identity-provisioning) manages its lifecycle across systems.","short":"Establishing who is calling and making that identity available","core_coverage":{"state":"core-and-community","assessed_at":"2026-09-27","what_core_does":"Token validation and security context for XSUAA and IAS. In Node.js the strategies are middlewares that set cds.context.user: mocked with predefined users in development, jwt in production, with dummy, basic, XSUAA and IAS variants configured by kind. Authentication is one of four security building blocks capire separates, with CAP users, authorization and outbound authentication, each with a standard implementation; once a strategy is configured, every CAP endpoint is authenticated by default.","where_it_stops":"It stops at the platform identity providers. Anything else — custom IdPs, API keys, machine-to-machine patterns outside BTP — is yours to build. capire's own overview says CAP cannot guarantee end-to-end product security across all application layers by default; the platform's transport security and the application's own code are outside it.","sources":[{"url":"https://cap.cloud.sap/docs/guides/security/authentication","title":"Authentication","checked":"2026-08-31"},{"url":"https://cap.cloud.sap/docs/node.js/authentication","title":"Authentication (Node.js) — capire","checked":"2026-09-27","quote":"CAP ships with a few prebuilt authentication strategies, used by default: mocked during development and jwt in production."},{"url":"https://cap.cloud.sap/docs/node.js/authentication","title":"Authentication (Node.js) — capire","checked":"2026-09-27","quote":"This is done by authentication middlewares setting the cds.context.user property which is then used in authorization enforcement decisions."},{"url":"https://cap.cloud.sap/docs/guides/security/overview","title":"Overview of Security Concepts and Architecture — capire","checked":"2026-09-27","quote":"CAP divides the different security-related tasks into separate and independent building blocks, each with a standard CAP implementation suitable for most scenarios."},{"url":"https://cap.cloud.sap/docs/guides/security/data-protection","title":"Product Security Overview — capire","checked":"2026-09-27","quote":"On configured authentication, all CAP endpoints are authenticated by default."},{"url":"https://cap.cloud.sap/docs/guides/security/data-protection","title":"Product Security Overview — capire","checked":"2026-09-27","quote":"CAP provides several features to ensure data protection that meet industry standards and regulatory requirements."},{"url":"https://cap.cloud.sap/docs/guides/security/overview","title":"Overview of Security Concepts and Architecture — capire","checked":"2026-09-27","quote":"CAP cannot guarantee end-to-end product security across all application layers by default."}],"relationship":"narrow-by-design"},"facets":[{"key":"no_user_token","label":"Token with no user","kind":"flag","ecosystems":["btp"]},{"key":"propagates_user","label":"Passes the user on","kind":"flag","ecosystems":["btp"]},{"key":"trusts_corporate_idp","label":"Corporate IdP behind it","kind":"flag","ecosystems":["btp"]}],"changed_in":[{"version":"CAP Java 3.0.1","date":"2024-07-26","what_changed":"Before CAP Java 3.0, XSUAA token validation lived in its own cds-feature-xsuaa module, separate from IAS support. The 3.0 release removed cds-feature-xsuaa and unified XSUAA and IAS behind cds-feature-identity, the module that now provides both.","invalidates":"Guidance to add cds-feature-xsuaa as a Maven dependency for authentication in a CAP Java project. It was removed in the 3.0 line, mid-2024 — cds-feature-identity is the replacement for XSUAA as well as IAS.","source":{"url":"https://cap.cloud.sap/docs/releases/2024/jun24","title":"CAP release notes, June 2024 — Important Changes (Java)","checked":"2026-09-08","quote":"Removed some deprecated features: | cds-feature-xsuaa | cds-feature-identity |"},"applies_to":{"ecosystems":["cap"],"flavors":["java"]}}],"history":[{"date":"2026-08-31","field":"core_coverage.state","from":"left-open-on-purpose","to":"core-and-community","reason":"States renamed to describe who is present rather than to interpret intent. left-open-on-purpose asserted a motive; core-and-community states a fact, with relationship carrying the intent separately."},{"date":"2026-09-09","field":"ecosystems","from":"cap","to":"cap, btp","reason":"The BTP services answering this were in the corpus while the capability was not on the BTP map, so browse counted them behind the door and had no group to render them in. The BTP door is a reading of its own — a fallback to CAP's would assert something false about a service you bind rather than install."},{"date":"2026-09-14","field":"ecosystems","from":"cap, btp","to":"cap, btp, abap","reason":"abap_jwt_generator, abapOAuthAzure, abap2oauth2, abapNTLM and abap-aws-sigv4 in this batch authenticate an ABAP system to external APIs with JWT, OAuth 2.0, NTLM and AWS Signature v4, and abap-pwnedpasswords checks a password against a breach list, so the concern is decided on the ABAP door."},{"date":"2026-09-27","field":"core_coverage","from":"without the page","to":"cites the page","reason":"capire audit 2026-09-27: a page this capability owns was cited nowhere."},{"date":"2026-09-27","field":"core_coverage","from":"without the page","to":"cites the page","reason":"capire audit 2026-09-27, proposed pages read once more: the security overview and the product security overview were cited nowhere; the first carries a boundary SAP draws itself."},{"date":"2026-10-15","field":"coverage_by_ecosystem.btp.state","from":"core-only","to":"core-and-community","reason":"Two independently maintained entries stand behind this door now, @arc-mcp/xsuaa-auth and @saptools/cf-xsuaa, so core-only no longer reads the corpus. relationship stays unassessed: no page that was checked states an intent about where the platform stops, and the two packages sit on top of the SAP Authorization and Trust Management service rather than replacing it."},{"date":"2026-10-15","field":"coverage_by_ecosystem.btp.what_core_does","from":null,"to":"SAP's own pages, quoted","reason":"The note said no page had been checked that states what the core does here, so the BTP reading rested on the corpus alone. SAP's architecture page for the Authorization and Trust Management service, the trust and federation page, the default identity provider page and the application router's README were read: they state the login, the token, the gateway and the boundary at the backend."},{"date":"2026-10-15","field":"facets","from":null,"to":"no_user_token, propagates_user, trusts_corporate_idp","reason":"The options behind the BTP door answer three different questions and nothing on the page separated them: whether a token can be had with no person present, whether the signed-in identity reaches the next system, and whether a corporate identity provider can sit behind it. Each is scoped to btp; the CAP and ABAP options were not assessed against them in this pass."},{"date":"2026-10-15","field":"framing_by_ecosystem.btp.description","from":"two services","to":"three questions","reason":"The paragraph counted two services while seven entries stand behind the door, the router and the Cloud Connector among them, so it told a reader the door was smaller than it is."},{"date":"2026-10-17","field":"description","from":"Establishing who is calling — validating a token, resolving the user and their roles, and making that available for the rest of the request. Taking SAP [Cloud Identity Services](artifact:btp-cloud-identity-services) as the identity interface for everything SAP makes it SAML 2 or OIDC against Identity Authentication rather than XSUAA alone, with the user lifecycle carried by SCIM 2 replication into each service. [Authorization](capability:authorization) is still designed per system after that, since an S/4HANA role and a BTP role collection are different objects.","to":"Establishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. [Authorization](capability:authorization) decides what that identity may do; [identity provisioning](capability:identity-provisioning) manages its lifecycle across systems.","reason":"Keep the default capability wording neutral; preserve the previous wording in framing_by_ecosystem.cap. Maintainer-requested scope audit."},{"date":"2026-10-19","field":"ecosystems","from":"cap, btp, abap","to":"cap, btp, abap, ui5","reason":"ui5-middleware-oidc was staged in intake-20261019-bestofui5 under ui5-build-tooling because this capability was not open on the UI5 door. The UI5 reading comes from the README of SAP's backend-proxy-middleware."},{"date":"2026-10-26","field":"coverage_by_ecosystem.btp.what_core_does","from":"Two services, and the gateway in front of them.","to":"(sentence removed; the paragraph now starts with the service)","reason":"Reassessed against the graph (check:capabilities): the sentence counted services, which goes stale as entries arrive. The rest of the paragraph is unchanged."},{"date":"2026-10-26","field":"coverage_by_ecosystem.btp.community_adds","from":"Two independently maintained packages wrap the OAuth server for cases its own documentation does not cover. [@arc-mcp/xsuaa-auth] ... and [@saptools/cf-xsuaa] ...","to":"Independently maintained packages wrap the OAuth server and the identity provider for cases their own documentation does not cover: XSUAA OAuth in front of an MCP server, a deployed app's client_credentials token, and a scripted SAP Identity Authentication login that keeps the session.","reason":"Reassessed against the graph (check:capabilities): the text counted packages, and a package that signs a program in through SAP Identity Authentication, marianfoo-sap-mcp-auth, changes the shape of the answer."},{"date":"2026-10-26","field":"coverage_by_ecosystem.btp.note","from":"the SAP services and the router behind this door, and two independent packages that sit on top of ...","to":"SAP's services and router behind this door, and independently maintained packages that sit on top of ...","reason":"Reassessed against the graph (check:capabilities): the note counted packages."},{"date":"2026-10-26","field":"coverage_by_ecosystem.abap.note","from":"Checked against the SAP NetWeaver 7.5 documentation ... The batch answers the outbound direction ...","to":"Same check, with the kinds of providers now behind the door named: outbound token flows, a Cloud Foundry login that yields a token for an ABAP service, a logon ticket decoder, and SAP's Cloud Connector.","reason":"Reassessed against the graph (check:capabilities): marcellourbani-abap-cloud-platform, marcellourbani-decodesapsso2 and sap-cloud-connector arrived after the block was last looked at and the note never named their kinds."},{"date":"2026-10-26","field":"coverage_by_ecosystem.ui5.state, coverage_by_ecosystem.ui5.relationship, coverage_by_ecosystem.ui5.community_adds","from":"core-and-community, relationship unassessed, community_adds naming three UI5 middlewares","to":"core-only, no relationship, no community_adds","reason":"Reassessed against the graph (check:capabilities): no community artifact on the UI5 door provides this capability by an edge; the middlewares the text named provide ui5-build-tooling, and the only sample on the door is not a presence. what_core_does stays, so the core remains present."}],"coverage_by_ecosystem":{"btp":{"state":"core-and-community","assessed_at":"2026-10-15","what_core_does":"[SAP Authorization and Trust Management](artifact:btp-authorization-and-trust-management) is the OAuth 2.0 authorization server: a subaccount cross-configures trust with an identity provider, the provider confirms the user with a SAML bearer assertion, and the service determines that user's authorizations and signs the JWT an application reads; an API client authenticates against the service directly instead, with no user present. The identity provider is [Cloud Identity Services](artifact:btp-cloud-identity-services) where a tenant has been asked for, and SAP ID service, SAP's own tenant, where nobody has changed the trust. [@sap/approuter](artifact:sap-approuter) is the standard implementation of the gateway: it starts the authentication, checks for cross-site request forgery and forwards each request to the resource apps with the user information.","where_it_stops":"At the token it signs. The gateway does not hide the backends: its own README states that they stay directly reachable and must validate the JWT and check the scopes themselves, so a request is accepted or refused in the resource app and not on the platform. SAP ID service, the identity provider a subaccount trusts until someone changes that, has no mechanism to enforce multifactor authentication on its users. What a validated caller may then do is [authorization](capability:authorization), a different service and a different question.","community_adds":"Independently maintained packages wrap the OAuth server and the identity provider for cases their own documentation does not cover. [@arc-mcp/xsuaa-auth](artifact:arc-mcp-xsuaa-auth) puts the XSUAA OAuth flow, dynamic client registration and bearer verification in front of an MCP server's HTTP route, [@saptools/cf-xsuaa](artifact:saptools-cf-xsuaa) prints a deployed Cloud Foundry app's own client_credentials token out of its binding, and [sap-mcp-auth](artifact:marianfoo-sap-mcp-auth) completes the SAP Identity Authentication login in a browser and keeps the session for a program.","relationship":"unassessed","note":"core-and-community is a assessment of the corpus: SAP's services and the router behind this door, and independently maintained packages that sit on top of the SAP Authorization and Trust Management service and Identity Authentication. The pages checked state what the platform does and where the application takes over; none states an intent, which is why the relationship is left unassessed rather than called narrow by design.","sources":[{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/60-security/what-is-the-sap-authorization-and-trust-management-service-649961f.md","title":"What Is the SAP Authorization and Trust Management Service? — SAP BTP documentation (SAP-docs/btp-cloud-platform)","checked":"2026-10-15","quote":"The SAP Authorization and Trust Management service lets you manage user authorizations and trust to identity providers."},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/60-security/what-is-the-sap-authorization-and-trust-management-service-649961f.md","title":"What Is the SAP Authorization and Trust Management Service? — Authentication Against Trusted Parties Only","checked":"2026-10-15","quote":"This SAML bearer assertion is presented to SAP Authorization and Trust Management service and the service determines the authorizations of that user."},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/60-security/what-is-the-sap-authorization-and-trust-management-service-649961f.md","title":"What Is the SAP Authorization and Trust Management Service? — Authentication Against Trusted Parties Only","checked":"2026-10-15","quote":"API clients receive their credentials directly from, and authenticate directly against, SAP Authorization and Trust Management service."},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/60-security/what-is-the-sap-authorization-and-trust-management-service-649961f.md","title":"What Is the SAP Authorization and Trust Management Service? — Application Architecture","checked":"2026-10-15","quote":"The application router app is a standard implementation of the gateway and is used as the single point-of-entry for the application. It also serves static content, initiates the authentication process, checks on cross-site request forgery \\(XSRF\\) attacks, and forwards requests to the resource apps while propagating user information."},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/50-administration-and-ops/trust-and-federation-with-identity-providers-cb1bc8f.md","title":"Trust and Federation with Identity Providers — SAP BTP documentation (SAP-docs/btp-cloud-platform)","checked":"2026-10-15","quote":"SAP Cloud Identity Services is a multitenancy-enabled identity provider for all SAP cloud applications and optionally on-premise applications."},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/50-administration-and-ops/trust-and-federation-with-identity-providers-cb1bc8f.md","title":"Trust and Federation with Identity Providers — SAP ID service","checked":"2026-10-15","quote":"SAP ID service is the default identity provider of SAP BTP and where you register to get initial access to SAP BTP. Trust to SAP ID service is preconfigured by default."},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/50-administration-and-ops/default-identity-provider-d6a8db7.md","title":"Default Identity Provider — Multifactor Authentication","checked":"2026-10-15","quote":"There's **no** mechanism to enforce users in SAP ID service to use this function."},{"url":"https://unpkg.com/@sap/approuter@23.0.0/README.md","title":"@sap/approuter 23.0.0 — README, Overview","checked":"2026-10-15","quote":"the application router does not hide the backend microservices in any way. They are still directly accessible bypassing the application router."},{"url":"https://unpkg.com/@sap/approuter@23.0.0/README.md","title":"@sap/approuter 23.0.0 — README, Overview","checked":"2026-10-15","quote":"So the backend microservices _must_ protect all their endpoints by validating the JWT token and implementing proper scope checks."},{"url":"https://raw.githubusercontent.com/arc-mcp/xsuaa-auth/main/README.md","title":"arc-mcp/xsuaa-auth — README","checked":"2026-10-15","quote":"It gives an MCP server the SAP-native client→server auth stack"},{"url":"https://raw.githubusercontent.com/arc-mcp/xsuaa-auth/main/README.md","title":"arc-mcp/xsuaa-auth — README, what it contains","checked":"2026-10-15","quote":"an XSUAA OAuth proxy provider, a stateless RFC 7591 Dynamic Client Registration store (HMAC-signed `client_id`s, restart-resilient)"},{"url":"https://raw.githubusercontent.com/dongitran/saptools/main/packages/cf-xsuaa/README.md","title":"dongitran/saptools — packages/cf-xsuaa/README.md","checked":"2026-10-15","quote":"fetches `client_credentials` tokens straight from the XSUAA binding of any CF app"}]},"abap":{"state":"core-and-community","assessed_at":"2026-09-14","what_core_does":"AS ABAP carries an OAuth 2.0 client, configured in transaction OA2C_CONFIG, that obtains an access token from an external provider such as Google Cloud Platform or Microsoft Azure and renews it with a refresh token. The flows it offers are the authorization code flow and the SAML 2.0 bearer assertion flow.","where_it_stops":"At those two flows in the release checked. A self-signed JWT, an NTLM handshake with a Windows server and an AWS Signature v4 request are not among them, and each is written in ABAP by a repository in this batch.","relationship":"unassessed","note":"Checked against the SAP NetWeaver 7.5 documentation; later ABAP Platform releases were not checked for further flows. The community answers the outbound direction, the ABAP system proving who it is to another API, and the inbound side with a logon ticket decoder such as [decodesapsso2](artifact:marcellourbani-decodesapsso2) by [Marcello Urbani](actor:marcellourbani), which does not validate the ticket. [abap_cloud_platform](artifact:marcellourbani-abap-cloud-platform) obtains a token for an ABAP service instance from outside it, and SAP's [Cloud Connector](artifact:sap-cloud-connector) forwards the cloud user's identity to an on-premises system.","sources":[{"url":"https://help.sap.com/doc/saphelp_nw75/7.5.5/en-US/cd/b122d5b0784c77bf1bcce17f730e74/content.htm","title":"SAP Help — Configuring OAuth 2.0 for AS ABAP","checked":"2026-09-14","quote":"Currently SAP offers the following OAuth 2.0 flows."},{"url":"https://help.sap.com/doc/saphelp_nw75/7.5.5/en-US/2e/5104fd87ff452b9acb247bd02b9f9e/content.htm","title":"SAP Help — Configuring an OAuth 2.0 Client in the AS ABAP","checked":"2026-09-14","quote":"Start transaction OA2C_CONFIG"},{"url":"https://help.sap.com/doc/saphelp_nw75/7.5.5/en-US/0b/5cbbddd1e741f39dcb7dcc0ef13c51/content.htm","title":"SAP Help — Requesting an OAuth 2.0 Access Token","checked":"2026-09-14","quote":"the AS ABAP uses a refresh token to get new access tokens when the current access token has expired"}]},"ui5":{"state":"core-only","assessed_at":"2026-10-19","what_core_does":"SAP's [backend-proxy-middleware](https://github.com/SAP/open-ux-tools/tree/main/packages/backend-proxy-middleware), a custom middleware for the UI5 dev server, authenticates the requests it forwards to a backend: it uses credentials maintained with SAP Fiori tools, runs the OAuth routine of the ABAP environment on SAP BTP when `scp` is set, and supports a reentrance ticket as the authentication type in VS Code.","where_it_stops":"At the backend call. Its options describe how the proxied requests are authenticated; the README describes no login in front of the app the dev server serves.","sources":[{"url":"https://github.com/SAP/open-ux-tools/tree/main/packages/backend-proxy-middleware","title":"SAP/open-ux-tools — @sap-ux/backend-proxy-middleware README","checked":"2026-10-19","quote":"Additionally, if credentials are maintained with the SAP Fiori tools then these will be used."},{"url":"https://github.com/SAP/open-ux-tools/tree/main/packages/backend-proxy-middleware","title":"SAP/open-ux-tools — @sap-ux/backend-proxy-middleware README","checked":"2026-10-19","quote":"If set to true the proxy will execute the required OAuth routine for the ABAP environment on SAP BTP"},{"url":"https://github.com/SAP/open-ux-tools/tree/main/packages/backend-proxy-middleware","title":"SAP/open-ux-tools — @sap-ux/backend-proxy-middleware README","checked":"2026-10-19","quote":"Authentication mechanism to be used in VSCode."},{"url":"https://github.com/maxi1555/ui5-middleware-oidc","title":"maxi1555/ui5-middleware-oidc — README","checked":"2026-10-19","quote":"The middleware will authenticate the users using OIDC, behind the hood is express-openid-connect."},{"url":"https://www.npmjs.com/package/ui5-middleware-onelogin","title":"ui5-middleware-onelogin — npm","checked":"2026-10-19","quote":"Middleware for ui5-server, enabling a generic login support."},{"url":"https://www.npmjs.com/package/ui5-middleware-approuter","title":"ui5-middleware-approuter — npm","checked":"2026-10-19","quote":"UI5 middleware using the @sap/approuter to connect against Cloud Foundry or XS Advanced destinations"}]}},"framing_by_ecosystem":{"btp":{"description":"On BTP the concern splits three ways, and the pieces are not alternatives. [SAP Authorization and Trust Management](artifact:btp-authorization-and-trust-management) is the OAuth server that issues the JWT an application checks; [Cloud Identity Services](artifact:btp-cloud-identity-services) is the login itself, the user store or the federation to a corporate identity provider behind it; and carrying that identity onward, to a resource app or into the customer's own network, is a third question with its own entries. An application binds the first and usually inherits the second."},"abap":{"description":"On ABAP the repositories here face outward, the system authenticating itself to someone else's API: a JWT from [abap_jwt_generator](https://github.com/abapChaoLiu/abap_jwt_generator), Azure through SAP's own OAuth 2.0 client in [abapOAuthAzure](https://github.com/gregorwolf/abapOAuthAzure) by [Gregor Wolf](actor:gregorwolf), NTLM in [abapNTLM](https://github.com/larshp/abapNTLM) by [Lars Hvam](actor:larshp), and AWS Signature v4 in [abap-aws-sigv4](https://github.com/tmhew/abap-aws-sigv4). [abap-pwnedpasswords](https://github.com/atudor2/abap-pwnedpasswords) is the inbound one, checking a password against the Pwned Passwords breach list."},"cap":{"description":"Establishing who is calling — validating a token, resolving the user and their roles, and making that available for the rest of the request. Taking SAP [Cloud Identity Services](artifact:btp-cloud-identity-services) as the identity interface for everything SAP makes it SAML 2 or OIDC against Identity Authentication rather than XSUAA alone, with the user lifecycle carried by SCIM 2 replication into each service. [Authorization](capability:authorization) is still designed per system after that, since an S/4HANA role and a BTP role collection are different objects."},"ui5":{"description":"A UI5 app authenticates nobody itself: the server that delivers it, an application router, a launchpad or the ABAP server, asks for the login. On this door the question is the dev server, which has to put a login in front of the app or carry one to the backend the app calls."}},"drafted_with_ai":true},"sap_delivery":{"door":"cap","all":{"built_in":[{"ref":"artifact:sap-cds","name":"@sap/cds","json":"/artifacts/sap-cds.json"}],"documented_pattern":[],"announced":[],"packages":[{"ref":"artifact:sap-xssec","name":"@sap/xssec","json":"/artifacts/sap-xssec.json"},{"ref":"artifact:cap-java-cds-feature-identity","name":"com.sap.cds:cds-feature-identity","json":"/artifacts/cap-java-cds-feature-identity.json"},{"ref":"artifact:cap-java-cds-feature-xsuaa","name":"com.sap.cds:cds-feature-xsuaa","json":"/artifacts/cap-java-cds-feature-xsuaa.json"}]},"by_flavor":{"node":{"built_in":[{"ref":"artifact:sap-cds","name":"@sap/cds","json":"/artifacts/sap-cds.json"}],"documented_pattern":[],"announced":[],"packages":[{"ref":"artifact:sap-xssec","name":"@sap/xssec","json":"/artifacts/sap-xssec.json"}]},"java":{"built_in":[],"documented_pattern":[],"announced":[],"packages":[{"ref":"artifact:cap-java-cds-feature-identity","name":"com.sap.cds:cds-feature-identity","json":"/artifacts/cap-java-cds-feature-identity.json"},{"ref":"artifact:cap-java-cds-feature-xsuaa","name":"com.sap.cds:cds-feature-xsuaa","json":"/artifacts/cap-java-cds-feature-xsuaa.json"}]}}},"edges":{"use_cases":[{"id":"btp-token-with-no-user","name":"Get a token for a protected BTP endpoint with no user signed in","capability":"capability:authentication","ecosystem":"btp","outcome":"A script, a job or another service calls a protected endpoint of a deployed SAP BTP application and is accepted, with nobody at a browser.","boundary":"Obtaining the token and keeping it fresh. What the called endpoint then lets the client do is authorization, and carrying a named person's identity is a separate outcome.","origin":"Editorial hypothesis while curating the BTP door of this capability: three of the options state a grant that works with no user present and the rest name none, so the question separates them.","needs":[{"key":"no_user_token"}],"paths":[{"key":"xsuaa-token-endpoint","name":"Ask the authorization server for the token yourself"},{"key":"cf-xsuaa-command-line","name":"Print the deployed app's token with the cf-xsuaa command line"}],"contributions":[{"ref":"artifact:btp-authorization-and-trust-management","role":"authorization server","state":"documented","paths":["xsuaa-token-endpoint","cf-xsuaa-command-line"],"description":"Issues the token. SAP's architecture page separates the API client from the browser user: the client gets its credentials from this service and authenticates against it directly, and the client credentials grant is among the grant types the environment supports.","remaining_work":"Create the service instance and its OAuth client, keep the client secret somewhere the caller can read, call the token endpoint on each run and handle expiry. The endpoint being called still validates the JWT and checks its scopes itself.","sources":[{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/60-security/what-is-the-sap-authorization-and-trust-management-service-649961f.md","title":"What Is the SAP Authorization and Trust Management Service? — Authentication Against Trusted Parties Only","quote":"API clients receive their credentials directly from, and authenticate directly against, SAP Authorization and Trust Management service.","checked":"2026-10-15"},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/60-security/what-is-the-sap-authorization-and-trust-management-service-649961f.md","title":"What Is the SAP Authorization and Trust Management Service? — grant types note","quote":"The Cloud Foundry environment also supports the following token grant types of Cloud Foundry.","checked":"2026-10-15"},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/60-security/what-is-the-sap-authorization-and-trust-management-service-649961f.md","title":"What Is the SAP Authorization and Trust Management Service? — grant types note, second item of the list","quote":"Client credentials grant","checked":"2026-10-15"}]},{"ref":"artifact:saptools-cf-xsuaa","role":"token command line","state":"documented","paths":["cf-xsuaa-command-line"],"description":"Reads the XSUAA binding out of a deployed Cloud Foundry app and prints a client_credentials token for that app, which is the token a protected endpoint of it expects rather than the personal token `cf oauth-token` returns.","remaining_work":"Install it on Node.js 20 or later with the cf CLI on the PATH, and supply SAP_EMAIL and SAP_PASSWORD for the first secret fetch. Nothing about the called endpoint's own validation changes.","remaining_kinds":["configuration"],"sources":[{"url":"https://raw.githubusercontent.com/dongitran/saptools/main/packages/cf-xsuaa/README.md","title":"dongitran/saptools — packages/cf-xsuaa/README.md","quote":"fetches `client_credentials` tokens straight from the XSUAA binding of any CF app","checked":"2026-10-15"},{"url":"https://raw.githubusercontent.com/dongitran/saptools/main/packages/cf-xsuaa/README.md","title":"dongitran/saptools — packages/cf-xsuaa/README.md, requirements","quote":"Requires **Node.js ≥ 20** and the **`cf` CLI** on `PATH`.","checked":"2026-10-15"}]},{"ref":"artifact:btp-oauth","role":"authorization server, in the regions its one plan is listed in","state":"conditional","description":"Grants an access token on the client's credentials alone, with no user interaction, which the catalogue record names for protecting an API or an IoT device.","remaining_work":"Check the entitlement before anything else: the plan has to exist in the region the application runs in, and a subscription has an end date.","remaining_kinds":["configuration"],"conditions":["The one plan in the Discovery Center record is listed in regions marked Neo and in no Cloud Foundry environment.","SAP states the service is being removed from the Eligible Cloud Services List on December 31, 2028 in those regions."],"sources":[{"url":"https://discovery-center.cloud.sap/servicecatalog/api/v1/services/e355c898-e916-411a-aff8-61eb6949b946","title":"SAP Discovery Center — OAuth 2.0 on SAP BTP","quote":"Enable grant of an access token based on the client credentials only, without user interaction.","checked":"2026-10-15"},{"url":"https://discovery-center.cloud.sap/servicecatalog/api/v1/services/e355c898-e916-411a-aff8-61eb6949b946","title":"SAP Discovery Center — OAuth 2.0 on SAP BTP, plan availability","quote":"This Cloud Service, in the region/data center marked as \"Neo\", is being removed from the Eligible Cloud Services List on December 31, 2028 (\"Retired Service\").","checked":"2026-10-15"}]}],"readings":[{"ref":"content:execute-oauth2-client-credentials-protected-rest-request-from-cap","relevance":"The same grant seen from the calling side, a CAP application reaching a remote service protected by OAuth2 client credentials. It is a recipe for an application rather than for a script, and the caller there is CAP rather than BTP."},{"ref":"content:simplifying-sap-btp-authentication-in-pipelines-with-sap-passport","relevance":"A different route to the same problem: a pipeline that has to get in with nobody at the browser, there with a client certificate driven through Playwright rather than with a token for the app itself."}],"unknowns":["Whether an OAuth client registered in Cloud Identity Services answers this outcome for an application's own endpoint was not established. The pages read name Client Credentials for an Identity Provisioning technical user, which is a different job.","X.509 client certificates as a replacement for the client secret on the SAP Authorization and Trust Management service were not checked in this pass.","The grant types note was read on SAP's architecture page; no page was read that states the client credentials grant for a specific service plan of that service."],"assessed_at":"2026-10-15","drafted_with_ai":true,"omitted_contributions":0,"assessment_kind":"documented-contributions"},{"id":"btp-corporate-identity-provider-login","name":"Put the company's own identity provider behind a BTP application's login","capability":"capability:authentication","ecosystem":"btp","outcome":"People sign in to a BTP application with their corporate account, under the company's own password and multifactor policy rather than SAP's.","boundary":"The trust and the federation that make the corporate account the one that logs in. Mapping its attributes to what an application expects, and replicating the users themselves, are named here and not assessed.","origin":"Editorial hypothesis from SAP's trust and federation page, which names the default identity provider as where an account starts and a custom tenant with a corporate provider behind it as what it recommends instead.","needs":[{"key":"trusts_corporate_idp"}],"paths":[{"key":"ias-as-proxy","name":"Cloud Identity Services as the proxy to the corporate identity provider"}],"contributions":[{"ref":"artifact:btp-cloud-identity-services","role":"proxy to the corporate identity provider","state":"documented","paths":["ias-as-proxy"],"description":"Stands between the application and the company's own provider: the users are hosted in its tenant or read from the corporate provider behind it, and the password and authentication policies enforced are the company's own.","remaining_work":"Ask for a tenant, connect the corporate provider to it, and map the attributes the provider returns to the ones the applications expect.","sources":[{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/50-administration-and-ops/trust-and-federation-with-identity-providers-cb1bc8f.md","title":"Trust and Federation with Identity Providers — Recommendation","quote":"Enforce your own password and authentication policies, such as stronger passwords or multifactor authentication.","checked":"2026-10-15"},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/50-administration-and-ops/default-identity-provider-d6a8db7.md","title":"Default Identity Provider — Recommendation","quote":"We strongly recommend that you configure your custom tenant of SAP Cloud Identity Services as the identity provider and connect SAP Cloud Identity Services to your own corporate identity provider.","checked":"2026-10-15"}]},{"ref":"artifact:btp-authorization-and-trust-management","role":"the trust the subaccount holds","state":"documented","paths":["ias-as-proxy"],"description":"Holds the subaccount's side of the trust. Identity federation is what frees the platform and its applications from storing credentials and authenticating people themselves, and the trust is established by cross-configuring the endpoints of both systems.","remaining_work":"Cross-configure the endpoints, and move the subaccount off the trust it starts with: that is SAP ID service, where SAP states there is no mechanism to enforce multifactor authentication on its users.","remaining_kinds":["configuration"],"sources":[{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/50-administration-and-ops/trust-and-federation-with-identity-providers-cb1bc8f.md","title":"Trust and Federation with Identity Providers — SAP BTP documentation (SAP-docs/btp-cloud-platform)","quote":"Identity federation frees applications on SAP BTP as well as the platform itself from the need to obtain and store the credentials of users and to authenticate them.","checked":"2026-10-15"},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/50-administration-and-ops/trust-and-federation-with-identity-providers-cb1bc8f.md","title":"Trust and Federation with Identity Providers — establishing trust","quote":"To enable communication between SAP BTP and identity providers, you must cross-configure the communication endpoints of the involved systems, establishing a trust relationship between them.","checked":"2026-10-15"},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/50-administration-and-ops/default-identity-provider-d6a8db7.md","title":"Default Identity Provider — Multifactor Authentication","quote":"There's **no** mechanism to enforce users in SAP ID service to use this function.","checked":"2026-10-15"}]}],"readings":[{"ref":"content:ac-sap-iam-integration-with-sap-cloud-identity-services","relevance":"The design this outcome sits in when SAP is one vendor among several: Cloud Identity Services as the designated interface, single sign-on over SAML 2 and OpenID Connect, and the user lifecycle carried by SCIM 2 replication rather than by the login."},{"ref":"content:identity-and-access-management-in-sap-navigating-sso-across-web-and-on-prem-land","relevance":"Where the two web protocols stop. Applications reached over RFC rather than HTTP take Secure Login Client and Secure Login Service instead, which carries the same multifactor authentication into on-premise access by a different mechanism."}],"unknowns":["Whether a corporate identity provider can be trusted by a subaccount directly, with no Cloud Identity Services tenant in between, was not established in this pass; SAP's page recommends the tenant and does not say the direct trust is unavailable.","The limit of one Cloud Identity Services tenant per subaccount under the OpenID Connect trust method is recorded on the service's own entry from a page read in September 2026 and was not re-checked here.","Attribute mapping and SCIM replication are named in the boundary and were not assessed; the attached reference architecture is the only source read that describes them."],"assessed_at":"2026-10-15","drafted_with_ai":true,"omitted_contributions":0,"assessment_kind":"documented-contributions"},{"id":"btp-propagate-user-to-on-premise","name":"Reach a system in the customer's own network as the signed-in user","capability":"capability:authentication","ecosystem":"btp","outcome":"An application on SAP BTP calls a system inside the customer's network and that system sees the person who signed in, not a shared service user.","boundary":"Carrying the identity to the on-premise system. What that system then permits the person to do is its own, and the cloud login itself is a separate outcome.","origin":"Editorial hypothesis from the Cloud Connector's own page, which lists three authentication types towards an internal system and names which configuration chooses between them.","needs":[{"key":"propagates_user"}],"paths":[{"key":"destination-with-principal-propagation","name":"A destination set to principal propagation, through the Cloud Connector"}],"contributions":[{"ref":"artifact:sap-cloud-connector","role":"the tunnel, and the identity it forwards","state":"conditional","paths":["destination-with-principal-propagation"],"description":"Forwards the cloud user's identity to the internal system instead of a password of its own. Principal propagation is one of three authentication types it offers towards an internal system, beside basic authentication and technical user propagation.","remaining_work":"Install and register the connector, add the access control entry for the system, and set up the certificate and the subject pattern the internal system resolves a logon name from.","remaining_kinds":["configuration"],"conditions":["Trust has to be configured explicitly to the cloud entities whose user tokens are accepted as valid.","The calling application's destination configuration decides which of the three authentication types is used."],"sources":[{"url":"https://raw.githubusercontent.com/SAP-docs/btp-connectivity/main/docs/1-connectivity-documentation/authenticating-users-against-on-premises-systems-b643fbe.md","title":"Authenticating Users against On-Premises Systems — SAP BTP Connectivity documentation (SAP-docs/btp-connectivity)","quote":"Currently, the Cloud Connector supports **basic authentication**, **principal propagation**, and **technical user propagation** as user authentication types towards internal systems.","checked":"2026-10-15"},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-connectivity/main/docs/1-connectivity-documentation/authenticating-users-against-on-premises-systems-b643fbe.md","title":"Authenticating Users against On-Premises Systems — authentication types","quote":"To use **principal propagation** or **technical user propagation**, you must explicitly configure trust to those cloud entities from which user tokens are accepted as valid.","checked":"2026-10-15"}]},{"ref":"artifact:btp-destination","role":"the configuration that selects the type","state":"conditional","paths":["destination-with-principal-propagation"],"description":"Holds the named address the application calls, and with it the authentication type for the call. SAP's page puts the choice here rather than in the connector: the destination of the calling application is what decides whether the user is propagated.","remaining_work":"Create the destination with the on-premise proxy type and the propagation authentication, and keep one per backend the application reaches.","remaining_kinds":["configuration"],"conditions":["The destination belongs to the calling cloud application, so the choice is made per application and per backend rather than once for the connector."],"sources":[{"url":"https://raw.githubusercontent.com/SAP-docs/btp-connectivity/main/docs/1-connectivity-documentation/authenticating-users-against-on-premises-systems-b643fbe.md","title":"Authenticating Users against On-Premises Systems — SAP BTP Connectivity documentation (SAP-docs/btp-connectivity)","quote":"The destination configuration of the used cloud application defines which of these types is used for the actual communication to an on-premises system through the Cloud Connector","checked":"2026-10-15"}]},{"ref":"artifact:arc-mcp-xsuaa-auth","role":"per-user propagation for an MCP server","state":"documented","paths":["destination-with-principal-propagation"],"description":"Does the cloud half of this for an MCP server: it resolves a destination with the verified user's own JWT and returns the per-user credentials and a proxy descriptor for the Cloud Connector, so the call leaves as that user rather than as a service account.","remaining_work":"Assemble the outgoing request. Its README leaves the headers, the cookies and the forward-proxy call to the consuming server, and the destination and the connector still have to be configured as above.","remaining_kinds":["configuration","application-code"],"sources":[{"url":"https://raw.githubusercontent.com/arc-mcp/xsuaa-auth/main/README.md","title":"arc-mcp/xsuaa-auth — README","quote":"The `./btp` entrypoint maps the authenticated MCP user to their own SAP identity via the BTP Destination Service + Cloud Connector.","checked":"2026-10-15"},{"url":"https://raw.githubusercontent.com/arc-mcp/xsuaa-auth/main/README.md","title":"arc-mcp/xsuaa-auth — README, what stays with the server","quote":"header assembly, CSRF, cookies, stateful sessions, and the forward-proxy request are yours.","checked":"2026-10-15"}]}],"readings":[{"ref":"content:principal-propagation-from-btp-web-app-to-s-4hana-via-sap-integration-suite","relevance":"The configuration end to end, from a BTP web application through to an on-premise S/4HANA system, including the subject pattern that builds the certificate's common name from the token's user_name claim, which is where identity resolution on the backend usually fails.","shows":["artifact:sap-cloud-connector","artifact:btp-destination"]},{"ref":"content:architecting-multiple-s4hana-backends-with-principal-propagation-part-2","relevance":"The destinations and the trust for more than one backend rather than one, which is the part of the configuration that stops being a copy of the tutorial."}],"unknowns":["Technical user propagation, the Cloud Connector's third type, was not assessed here. It is named in the same sentence and answers a different outcome.","Nothing was read about which claim of the token the subject pattern should be built from in the general case; the attached reading records one project's answer and names it as the point identity resolution hinges on.","The SAP Connectivity service and the Kyma connectivity proxy are the route a cloud application takes to the connector and were not assessed as contributions in this pass."],"assessed_at":"2026-10-15","drafted_with_ai":true,"omitted_contributions":0,"assessment_kind":"documented-contributions"},{"id":"btp-browser-login-and-backend-trust","name":"Sign a browser user in to a BTP application and have its backends accept the result","capability":"capability:authentication","ecosystem":"btp","outcome":"A person opens a deployed SAP BTP application in a browser, logs in once, and each of the application's own backend endpoints accepts the request as that person.","boundary":"The login and the token the backends read. Which role collections the person holds is authorization, and reaching a system outside the subaccount is a separate outcome.","origin":"Editorial hypothesis from SAP's own architecture page for the SAP Authorization and Trust Management service, which draws the gateway, the resource apps and the identity provider as one picture and says what each of them does.","paths":[{"key":"gateway-and-security-library","name":"A gateway at the front door, and the security client library in each resource app"}],"contributions":[{"ref":"artifact:btp-cloud-identity-services","role":"identity provider","state":"documented","paths":["gateway-and-security-library"],"description":"Authenticates the person. It is the identity provider a subaccount trusts, and the place single sign-on across the SAP applications in the landscape is decided.","remaining_work":"Ask for a tenant and establish the trust: a subaccount trusts SAP ID service until someone changes that.","sources":[{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/50-administration-and-ops/trust-and-federation-with-identity-providers-cb1bc8f.md","title":"Trust and Federation with Identity Providers — SAP BTP documentation (SAP-docs/btp-cloud-platform)","quote":"SAP Cloud Identity Services is a multitenancy-enabled identity provider for all SAP cloud applications and optionally on-premise applications. The service provides capabilities for authentication, single sign-on, authorizations, identity lifecycle management, and on-premise integration as well as self-services like self-registration or password reset.","checked":"2026-10-15"},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/50-administration-and-ops/trust-and-federation-with-identity-providers-cb1bc8f.md","title":"Trust and Federation with Identity Providers — SAP ID service","quote":"SAP ID service is the default identity provider of SAP BTP and where you register to get initial access to SAP BTP. Trust to SAP ID service is preconfigured by default.","checked":"2026-10-15"}]},{"ref":"artifact:btp-authorization-and-trust-management","role":"authorization server","state":"documented","paths":["gateway-and-security-library"],"description":"Turns the successful login into the token the application reads. The identity provider's SAML bearer assertion is presented to this service, it determines that user's authorizations, and it signs the JWT with the key whose public half arrives in each app's binding.","remaining_work":"Cross-configure the trust with the identity provider, declare the application's authorizations in its security descriptor, and bind every app of the application to the one service instance.","remaining_kinds":["configuration"],"sources":[{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/60-security/what-is-the-sap-authorization-and-trust-management-service-649961f.md","title":"What Is the SAP Authorization and Trust Management Service? — Authentication Against Trusted Parties Only","quote":"This SAML bearer assertion is presented to SAP Authorization and Trust Management service and the service determines the authorizations of that user.","checked":"2026-10-15"},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/60-security/what-is-the-sap-authorization-and-trust-management-service-649961f.md","title":"What Is the SAP Authorization and Trust Management Service? — JSON Web Tokens","quote":"The credentials string contains, among other things, the public key corresponding to the private key of the UAA. This public key is used to verify the token signature.","checked":"2026-10-15"}]},{"ref":"artifact:sap-approuter","role":"gateway at the front door","state":"documented","paths":["gateway-and-security-library"],"description":"Is the single entry point: it starts the authentication for the routes that need it, checks for cross-site request forgery, serves the static content and forwards each request onward with the user information.","remaining_work":"The backends. Its own README states that they stay directly reachable past the router and must validate the JWT and check the scopes themselves, so the router alone does not make an endpoint safe to expose.","sources":[{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/60-security/what-is-the-sap-authorization-and-trust-management-service-649961f.md","title":"What Is the SAP Authorization and Trust Management Service? — Application Architecture","quote":"The application router app is a standard implementation of the gateway and is used as the single point-of-entry for the application. It also serves static content, initiates the authentication process, checks on cross-site request forgery \\(XSRF\\) attacks, and forwards requests to the resource apps while propagating user information.","checked":"2026-10-15"},{"url":"https://unpkg.com/@sap/approuter@23.0.0/README.md","title":"@sap/approuter 23.0.0 — README, Overview","quote":"the application router does not hide the backend microservices in any way. They are still directly accessible bypassing the application router.","checked":"2026-10-15"},{"url":"https://unpkg.com/@sap/approuter@23.0.0/README.md","title":"@sap/approuter 23.0.0 — README, Overview","quote":"So the backend microservices _must_ protect all their endpoints by validating the JWT token and implementing proper scope checks.","checked":"2026-10-15"}]},{"ref":"artifact:sap-xssec","role":"token validation inside the resource app","state":"conditional","paths":["gateway-and-security-library"],"description":"Is the security client library the resource app uses to do what the router leaves to it: authenticate the user from the JWT the BTP security services issued, and build the security context the app's own checks read.","remaining_work":"Wire it into each endpoint and write the scope checks; the library validates the token and does not decide what the caller may do.","remaining_kinds":["application-code"],"conditions":["The resource app runs on Node.js: the module's README names Node.js applications, and the Java runtime is a separate module that was not read in this pass."],"sources":[{"url":"https://unpkg.com/@sap/xssec@4.15.0/README.md","title":"@sap/xssec 4.15.0 — README","quote":"This module allows Node.js applications to authenticate users via JWT tokens issued by SAP Business Technology Platform (BTP) security services (SAP Cloud Identity Services and XSUAA).","checked":"2026-10-15"},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-cloud-platform/main/docs/60-security/what-is-the-sap-authorization-and-trust-management-service-649961f.md","title":"What Is the SAP Authorization and Trust Management Service? — Application Architecture","quote":"The resource apps can use the security client library, which also provides security functionality.","checked":"2026-10-15"}]}],"readings":[{"ref":"content:xsuaa-based-authentication-using-standalone-approuter","relevance":"The same setup end to end with an application router the project deploys and owns, which is the shape this record's one way takes.","shows":["artifact:sap-approuter","artifact:btp-authorization-and-trust-management"]},{"ref":"content:xsuaa-based-authentication-using-managed-approuter","relevance":"Its pair, published the same day, with the platform running the router and the application supplying configuration rather than a module. Read together they are the decision about who operates the gateway."}],"unknowns":["The Java side was not assessed: cds-feature-identity is in the corpus for the same job and no page was read for it in this pass, so the record's one way is stated for a Node.js resource app only.","Whether the SAP Application Frontend service answers this outcome was not established. Its entry states app hosting and carries no authentication edge, and no page was read that says what it does about the login.","No source was read that shows this outcome with Cloud Identity Services as the identity provider rather than SAP ID service; the two readings attached both use XSUAA with the default trust."],"assessed_at":"2026-10-15","drafted_with_ai":true,"omitted_contributions":0,"assessment_kind":"documented-contributions"}],"shared_tasks":[],"related_tasks":[],"options":[{"ref":"artifact:arc-mcp-xsuaa-auth","name":"@arc-mcp/xsuaa-auth","json":"/artifacts/arc-mcp-xsuaa-auth.json","ecosystem":"btp","origin_ring":"independent"},{"ref":"artifact:marianfoo-sap-mcp-auth","name":"@marianfoo/sap-mcp-auth","json":"/artifacts/marianfoo-sap-mcp-auth.json","ecosystem":"btp","origin_ring":"independent"},{"ref":"artifact:sap-approuter","name":"@sap/approuter","json":"/artifacts/sap-approuter.json","ecosystem":"btp","origin_ring":"sap-official"},{"ref":"artifact:sap-cds","name":"@sap/cds","json":"/artifacts/sap-cds.json","ecosystem":"cap","origin_ring":"sap-official"},{"ref":"artifact:sap-xssec","name":"@sap/xssec","json":"/artifacts/sap-xssec.json","ecosystem":"cap","origin_ring":"sap-official"},{"ref":"artifact:saptools-cf-xsuaa","name":"@saptools/cf-xsuaa","json":"/artifacts/saptools-cf-xsuaa.json","ecosystem":"btp","origin_ring":"independent"},{"ref":"artifact:marcellourbani-abap-cloud-platform","name":"abap_cloud_platform","json":"/artifacts/marcellourbani-abap-cloud-platform.json","ecosystem":"btp","origin_ring":"independent"},{"ref":"artifact:abapchaoliu-abap-jwt-generator","name":"abap_jwt_generator","json":"/artifacts/abapchaoliu-abap-jwt-generator.json","ecosystem":"abap","origin_ring":"independent"},{"ref":"artifact:tmhew-abap-aws-sigv4","name":"abap-aws-sigv4","json":"/artifacts/tmhew-abap-aws-sigv4.json","ecosystem":"abap","origin_ring":"independent"},{"ref":"artifact:atudor2-abap-pwnedpasswords","name":"abap-pwnedpasswords","json":"/artifacts/atudor2-abap-pwnedpasswords.json","ecosystem":"abap","origin_ring":"independent"},{"ref":"artifact:ivanfemia-abap2oauth2","name":"abap2oauth2","json":"/artifacts/ivanfemia-abap2oauth2.json","ecosystem":"abap","origin_ring":"independent"},{"ref":"artifact:larshp-abapntlm","name":"abapNTLM","json":"/artifacts/larshp-abapntlm.json","ecosystem":"abap","origin_ring":"independent"},{"ref":"artifact:gregorwolf-abapoauthazure","name":"abapOAuthAzure","json":"/artifacts/gregorwolf-abapoauthazure.json","ecosystem":"abap","origin_ring":"independent"},{"ref":"artifact:sapmentors-cds-azure-ad","name":"cds-azure-ad","json":"/artifacts/sapmentors-cds-azure-ad.json","ecosystem":"cap","origin_ring":"independent"},{"ref":"artifact:soontao-cds-common-jwt-support","name":"cds-common-jwt-support","json":"/artifacts/soontao-cds-common-jwt-support.json","ecosystem":"cap","origin_ring":"independent"},{"ref":"artifact:sap-cloud-connector","name":"Cloud Connector","json":"/artifacts/sap-cloud-connector.json","ecosystem":"btp","origin_ring":"sap-official"},{"ref":"artifact:btp-cloud-identity-services","name":"Cloud Identity Services","json":"/artifacts/btp-cloud-identity-services.json","ecosystem":"btp","origin_ring":"sap-official"},{"ref":"artifact:cap-java-cds-feature-identity","name":"com.sap.cds:cds-feature-identity","json":"/artifacts/cap-java-cds-feature-identity.json","ecosystem":"cap","origin_ring":"sap-official"},{"ref":"artifact:cap-java-cds-feature-xsuaa","name":"com.sap.cds:cds-feature-xsuaa","json":"/artifacts/cap-java-cds-feature-xsuaa.json","ecosystem":"cap","origin_ring":"sap-official"},{"ref":"artifact:marcellourbani-decodesapsso2","name":"decodesapsso2","json":"/artifacts/marcellourbani-decodesapsso2.json","ecosystem":"abap","origin_ring":"independent"},{"ref":"artifact:btp-oauth","name":"OAuth 2.0 on SAP BTP","json":"/artifacts/btp-oauth.json","ecosystem":"btp","origin_ring":"sap-official"},{"ref":"artifact:btp-authorization-and-trust-management","name":"SAP Authorization and Trust Management service","json":"/artifacts/btp-authorization-and-trust-management.json","ecosystem":"btp","origin_ring":"sap-official"},{"ref":"artifact:btp-customer-identity-and-access-management","name":"SAP Customer Identity and Access Management for B2C","json":"/artifacts/btp-customer-identity-and-access-management.json","ecosystem":"btp","origin_ring":"sap-official"}],"samples":[{"ref":"artifact:miyasuta-auth-samples","name":"auth-samples","json":"/artifacts/miyasuta-auth-samples.json"},{"ref":"artifact:miyasuta-btp-ui5-show-userinfo","name":"btp-ui5-show-userinfo","json":"/artifacts/miyasuta-btp-ui5-show-userinfo.json"},{"ref":"artifact:miyasuta-cap-ams-a2a","name":"cap-ams-a2a","json":"/artifacts/miyasuta-cap-ams-a2a.json"},{"ref":"artifact:gregorwolf-cap-azure-ad-b2c","name":"cap-azure-ad-b2c","json":"/artifacts/gregorwolf-cap-azure-ad-b2c.json"},{"ref":"artifact:sap-samples-teched2022-xp260","name":"teched2022-XP260","json":"/artifacts/sap-samples-teched2022-xp260.json"},{"ref":"artifact:sap-samples-teched2023-xp185v","name":"teched2023-XP185v","json":"/artifacts/sap-samples-teched2023-xp185v.json"}],"explained_by":[{"ref":"content:sap-just-became-ai-agent-ready-here-s-a-step-by-step-mcp-walkthrough","name":"SAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP Walkthrough","json":"/content/sap-just-became-ai-agent-ready-here-s-a-step-by-step-mcp-walkthrough.json"},{"ref":"content:ac-agentic-ai-and-ai-agents","name":"Agentic AI & AI Agents","json":"/content/ac-agentic-ai-and-ai-agents.json"},{"ref":"content:named-user-attribution-across-btp-subaccounts-a-two-hop-ias-token-exchange-for-c","name":"Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud Integration","json":"/content/named-user-attribution-across-btp-subaccounts-a-two-hop-ias-token-exchange-for-c.json"},{"ref":"content:building-a-pro-code-agent-on-sap-btp-part-3-joule-integration-via-a2a","name":"Building a Pro-Code Agent on SAP BTP — Part 3: Joule Integration via A2A","json":"/content/building-a-pro-code-agent-on-sap-btp-part-3-joule-integration-via-a2a.json"},{"ref":"content:connecting-a-custom-mcp-server-to-joule-work-desktop-a-seamless-and-secure-authe","name":"Connecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication Flow","json":"/content/connecting-a-custom-mcp-server-to-joule-work-desktop-a-seamless-and-secure-authe.json"},{"ref":"content:from-sap-integration-suite-iflow-to-mcp-tools-exposing-odata-apis-to-ai-agents","name":"From SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI Agents","json":"/content/from-sap-integration-suite-iflow-to-mcp-tools-exposing-odata-apis-to-ai-agents.json"},{"ref":"content:principal-propagation-from-btp-web-app-to-s-4hana-via-sap-integration-suite","name":"Principal Propagation from BTP Web App to S/4HANA via SAP Integration Suite","json":"/content/principal-propagation-from-btp-web-app-to-s-4hana-via-sap-integration-suite.json"},{"ref":"content:standardized-oidc-api-access-to-sap-s-4hana-via-sap-api-management-and-microsoft","name":"Standardized OIDC API Access to SAP S/4HANA via SAP API Management and Microsoft Entra ID","json":"/content/standardized-oidc-api-access-to-sap-s-4hana-via-sap-api-management-and-microsoft.json"},{"ref":"content:standardized-oidc-api-access-to-sap-successfactors-via-sap-api-management-and-mi","name":"Standardized OIDC API Access to SAP SuccessFactors via SAP API Management and Microsoft Entra ID","json":"/content/standardized-oidc-api-access-to-sap-successfactors-via-sap-api-management-and-mi.json"},{"ref":"content:ac-integrating-and-extending-joule","name":"Integrating and Extending Joule","json":"/content/ac-integrating-and-extending-joule.json"},{"ref":"content:sap-btp-platform-technical-user-for-ctms-integration","name":"SAP BTP Platform Technical User for CTMS Integration","json":"/content/sap-btp-platform-technical-user-for-ctms-integration.json"},{"ref":"content:sap-joule-implementation-in-an-s-4hana-private-cloud-3-system-landscape","name":"SAP Joule implementation in an S/4HANA private cloud 3 system landscape","json":"/content/sap-joule-implementation-in-an-s-4hana-private-cloud-3-system-landscape.json"},{"ref":"content:how-to-access-sap-cloud-logging-service-dashboards-using-ias-saml-authentication","name":"How to Access SAP Cloud Logging Service Dashboards Using IAS SAML Authentication","json":"/content/how-to-access-sap-cloud-logging-service-dashboards-using-ias-saml-authentication.json"},{"ref":"content:securing-cap-applications-with-cloud-identity-services-and-ams","name":"Securing CAP Applications with SAP Cloud Identity Services and AMS","json":"/content/securing-cap-applications-with-cloud-identity-services-and-ams.json"},{"ref":"content:building-custom-authentication-in-sap-cap","name":"Building Custom Authentication in SAP CAP","json":"/content/building-custom-authentication-in-sap-cap.json"},{"ref":"content:joule-studio-cap","name":"Joule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみた","json":"/content/joule-studio-cap.json"},{"ref":"content:identity-and-access-management-in-sap-navigating-sso-across-web-and-on-prem-land","name":"Identity and Access Management in SAP: Navigating SSO Across Web and On-Prem Landscapes","json":"/content/identity-and-access-management-in-sap-navigating-sso-across-web-and-on-prem-land.json"},{"ref":"content:connect-to-a-public-cloud-api-in-nodejs-via-authorisation-code","name":"Connect to Public Cloud API in Node.js via Authorisation Code","json":"/content/connect-to-a-public-cloud-api-in-nodejs-via-authorisation-code.json"},{"ref":"content:guide-to-process-automation-apis-part-i-getting-started","name":"Guide to Process Automation APIs - Part I - Getting Started","json":"/content/guide-to-process-automation-apis-part-i-getting-started.json"},{"ref":"content:making-the-case-for-enhanced-rest-adapter-in-sap-integration-suite","name":"Making the Case for Enhanced REST Adapter in SAP Integration Suite","json":"/content/making-the-case-for-enhanced-rest-adapter-in-sap-integration-suite.json"},{"ref":"content:ac-secure-service-consumption-across-hyperscalers","name":"Secure Service Consumption Across Hyperscalers","json":"/content/ac-secure-service-consumption-across-hyperscalers.json"},{"ref":"content:ac-sap-iam-integration-with-sap-cloud-identity-services","name":"SAP IAM integration with SAP Cloud Identity Services","json":"/content/ac-sap-iam-integration-with-sap-cloud-identity-services.json"},{"ref":"content:capm-basics-part-2","name":"CAPM Basics - Part 2","json":"/content/capm-basics-part-2.json"},{"ref":"content:enabling-authorization-policies-in-ias-with-ams-and-cap","name":"Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP","json":"/content/enabling-authorization-policies-in-ias-with-ams-and-cap.json"},{"ref":"content:cap-for-nodejs","name":"CAP for nodejs安全的暴露接口练习","json":"/content/cap-for-nodejs.json"},{"ref":"content:why-sap-cloud-identity-matters-for-sap-task-center-it-s-about-trust-and-global-u","name":"Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User ID","json":"/content/why-sap-cloud-identity-matters-for-sap-task-center-it-s-about-trust-and-global-u.json"},{"ref":"content:perform-sap-principal-propagation-with-microsoft-entra-id-for-sap-successfactors","name":"Perform SAP Principal Propagation with Microsoft Entra ID for SAP SuccessFactors!","json":"/content/perform-sap-principal-propagation-with-microsoft-entra-id-for-sap-successfactors.json"},{"ref":"content:simplifying-sap-btp-authentication-in-pipelines-with-sap-passport","name":"Simplifying SAP BTP Authentication in Pipelines with SAP Passport and Playwright","json":"/content/simplifying-sap-btp-authentication-in-pipelines-with-sap-passport.json"},{"ref":"content:nice-patch-sap-revisiting-your-sap-btp-security-measures-after-ai-core-vulnerabi","name":"Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fix","json":"/content/nice-patch-sap-revisiting-your-sap-btp-security-measures-after-ai-core-vulnerabi.json"},{"ref":"content:xsuaa-based-authentication-using-managed-approuter","name":"XSUAA Based Authentication - Using Managed Approuter","json":"/content/xsuaa-based-authentication-using-managed-approuter.json"},{"ref":"content:xsuaa-based-authentication-using-standalone-approuter","name":"XSUAA Based Authentication - Using Standalone Approuter","json":"/content/xsuaa-based-authentication-using-standalone-approuter.json"},{"ref":"content:making-the-ias-based-pkce-flow-great-again-mobile-first","name":"Mobile First - Making the SAP IAS-based Proof Key for Code Exchange (PKCE) great again! 🎉","json":"/content/making-the-ias-based-pkce-flow-great-again-mobile-first.json"},{"ref":"content:principal-propagation-in-sbpa-actions-with-a-cap-nodejs-service","name":"SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js Service","json":"/content/principal-propagation-in-sbpa-actions-with-a-cap-nodejs-service.json"},{"ref":"content:sap-cap-jwt-token-flow-in-code","name":"SAP CAP JWT Token Flow in code","json":"/content/sap-cap-jwt-token-flow-in-code.json"},{"ref":"content:architecting-multiple-s4hana-backends-with-principal-propagation-part-1","name":"Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]","json":"/content/architecting-multiple-s4hana-backends-with-principal-propagation-part-1.json"},{"ref":"content:architecting-multiple-s4hana-backends-with-principal-propagation-part-2","name":"Part2: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]","json":"/content/architecting-multiple-s4hana-backends-with-principal-propagation-part-2.json"},{"ref":"content:architecting-multiple-s4hana-backends-with-principal-propagation-part-3","name":"Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]","json":"/content/architecting-multiple-s4hana-backends-with-principal-propagation-part-3.json"},{"ref":"content:sap-business-technology-platform-authorization-and-trust-management-service","name":"SAP Business Technology Platform: Authorization and Trust Management Service","json":"/content/sap-business-technology-platform-authorization-and-trust-management-service.json"},{"ref":"content:execute-oauth2-client-credentials-protected-rest-request-from-cap","name":"Execute [OAuth2 client credentials] protected REST request with SAP CAP Application","json":"/content/execute-oauth2-client-credentials-protected-rest-request-from-cap.json"},{"ref":"content:understanding-security-approaches-in-cap-using-xsuaa-nodejs-and-mta","name":"Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.","json":"/content/understanding-security-approaches-in-cap-using-xsuaa-nodejs-and-mta.json"},{"ref":"content:sap-tutorial-cap-mocking-auth","name":"Use mocking to embrace auth in your domain model from the outset","json":"/content/sap-tutorial-cap-mocking-auth.json"},{"ref":"content:teched-2026-xp100","name":"Evolving the identity lifecycle for an AI-first future","json":"/content/teched-2026-xp100.json"},{"ref":"content:teched-2026-xp112","name":"How SAP secures enterprise AI agents with identity propagation","json":"/content/teched-2026-xp112.json"}],"normative_context":[]}}