{"ref":"content:named-user-attribution-across-btp-subaccounts-a-two-hop-ias-token-exchange-for-c","page":"/content/named-user-attribution-across-btp-subaccounts-a-two-hop-ias-token-exchange-for-c","json":"/content/named-user-attribution-across-btp-subaccounts-a-two-hop-ias-token-exchange-for-c.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"named-user-attribution-across-btp-subaccounts-a-two-hop-ias-token-exchange-for-c","title":"Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud Integration","url":"https://community.sap.com/t5/technology-blog-posts-by-sap/named-user-attribution-across-btp-subaccounts-a-two-hop-ias-token-exchange/ba-p/14471049","content_type":"blog","published_on":"source:sap-community","explains":[{"ref":"capability:authentication","applies_to":{"ecosystems":["btp"]}},{"ref":"capability:authorization","applies_to":{"ecosystems":["btp"]}},{"ref":"capability:audit-logging","applies_to":{"ecosystems":["btp"]}}],"summary":"A central BTP application that manages [Cloud Integration](artifact:btp-cloud-integration) across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared [Cloud Identity Services](artifact:btp-cloud-identity-services) tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the [AppRouter](artifact:sap-approuter) and [SAP Destination service](artifact:btp-destination) configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.","short":"Two-hop IAS token exchange for named users in Cloud Integration","author":"agnissh","published":"2026-08-24","provenance":{"discovered_via":[{"source":"source:sap-community","channel":"btp-tag"},{"source":"source:sap-community","channel":"integration-suite-tag"}],"first_seen":"2026-09-20"},"drafted_with_ai":true,"history":[{"date":"2026-10-17","field":"explains","from":null,"to":"applies_to on capability:authentication (btp); capability:authorization (btp); capability:audit-logging (btp)","reason":"Door scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md)."}]},"readings":{"liveness":[{"label":"Checked against the source","tier":"unknown","evidence":"nobody has checked it"},{"label":"Source reachable","tier":"unknown","evidence":"not crawled"},{"label":"Age","tier":"good","evidence":"published 2 months ago"}],"compatibility":[{"label":"Version","tier":"unknown","evidence":"no version declared"},{"label":"Moved since?","tier":"good","evidence":"no recorded change after 2026-08-24"},{"label":"Findings","tier":"good","evidence":"none flagged"}],"reach":[{"value":1254,"unit":"views"},{"value":0,"unit":"comments"},{"value":6,"unit":"likes"}]},"signals":{"views":1254,"likes":6,"comments":0,"metrics_at":"2026-10-25"},"series":null,"edges":{"authors":[]}}