BlogBlogA post on somebody's own site or a community platform. Nobody edits it after publication, so it dates from the day it was written.See every one →SAP Community
SAP Joule implementation in an S/4HANA private cloud 3 system landscape
Walks through enabling SAP JouleSAP JouleSAP's unified AI engagement layer across SAP applications: Joule Work is where a user expresses intent, Joule Assistants coordinate agents across business functions, and Joule Agents carry out the tasks, provisioned on BTP as a formation against SAP Cloud Identity Services.sap official, btp across a three-system S/4HANA Private Cloud landscape (DEV, QAS, PRD) rather than the common single-system setup: separate BTP subaccounts for the non-production systems, a shared Cloud Identity ServicesCloud Identity ServicesIdentity Authentication and Identity Provisioning as one tenant: the login, the user store or the federation to a corporate identity provider, and the provisioning of users into whatever sits behind it.sap official, btp tenant, and catalogs and roles transported from DEV through QAS to PRD. Covers single sign-on for Joule by setting Microsoft Entra ID as the corporate identity provider in SAP IAS, so authentication flows through Entra ID without the user existing in the IAS store, plus principal propagation through the Cloud ConnectorCloud ConnectorSAP's on-premises agent that links SAP BTP applications to systems in a customer's own network, as a reverse invoke proxy that exposes only the systems and resources it is configured to allow.sap official, btp into the production backend.
Where it sits
Explains
SAP JouleCAPBTPSAP JouleSAP's unified AI engagement layer across SAP applications: Joule Work is where a user expresses intent, Joule Assistants coordinate agents across business functions, and Joule Agents carry out the tasks, provisioned on BTP as a formation against SAP Cloud Identity Services.AuthenticationCAPBTPAuthenticationEstablishing who is calling: validating credentials or tokens, resolving the user, and making that identity available to the application. [Authorization](capability:authorization) decides what that identity may do; [identity provisioning](capability:identity-provisioning) manages its lifecycle across systems.
Source
reachable
Who is behind it
Arunrajjauthor
Properties
About this work
For authentication
Applies in
Group by64 of 64 pieces
Piece, what it offersStill applies
SAP BDC in Business AI Platform: Contextualize and ReasonSAP BDC in Business AI Platform: Contextualize and ReasonA Devtoberfest 2026 session (DAT-31) that places SAP Business Data Cloud as the contextualise-and-reason pillar of the SAP Business AI Platform, between the build pillar of Joule Studio and Integration Suite and the govern pillar of AI Agent Hub. It covers data products described with open resource discovery and core schema notation metadata, a data product creation agent that assembles a derived data product for overdue billing documents from the billing document and customer products and shows its lineage and fields; the data products a line-of-business application brings being readable by Joule without a BDC subscription; and the SAP-managed knowledge graph that maps business entities and their relationships for agents, held as graph data in the SAP HANA Cloud knowledge graph engine as RDF triples queried with SPARQL. The closing demo has SAP Joule answer head-count and purchase-order questions, with the generated SQL passed through a data product query that adds the restriction policy defined for that user in cloud identity services, which is why the session stands for cataloguing and lineage as much as for the products it names.SAP Developers, published 2026-10-06
How to implement business AI capabilities in ABAP CloudHow to implement business AI capabilities in ABAP CloudA Devtoberfest 2026 session (ABA-32) on embedding AI in an ABAP Cloud application and on making SAP Joule aware of what that application can do. The first demo implements two features of a RAP travel app with the ABAP AI SDK: a determination on an uploaded receipt that sends the image together with the allowed categories and transaction types to a model reached through an intelligent scenario, then writes the extracted description, category, currency and amount back to the expense entity; and a recommendation function, triggered by a side effect on the trip title, that proposes a trip type with a score the Fiori UI sorts the proposals by and leaves the business user to accept — which is LLM integration from ABAP code. The second demo builds a capability for SAP Joule in the Joule Studio code editor in VS Code, with a scenario that extracts a trip title from the user's intent and calls an OData service in the ABAP backend through a BTP destination, deploys it and asks the Joule test UI for the trip's details; the session states that agents reach ABAP only over governed remote APIs — OData, SQL and MCP — and that automatic grounding of custom OData services in the knowledge graph is upcoming rather than available.published 2026-10-05
SAP BDC and AI: A Perfect MatchSAP BDC and AI: A Perfect MatchA Devtoberfest 2026 data-track session (DAT-22) in which Business Data Cloud's CTO sets out how SAP Business Data Cloud feeds SAP's business AI platform: data products whose primary persistence is an object store and whose semantics are kept with them, the one domain model that links a supplier in Ariba to a supplier in S/4HANA, and the SAP knowledge graph, a triple store running in SAP HANA Cloud and queried with SPARQL, that SAP Joule consults before answering. The live demo asks Joule for the available data products and the top ten open purchase orders, with the data product query agent compiling SQL over virtual tables and a space rendering a dashboard, which is the cataloguing side of this: a central registry, the Unified Customer Landscape, that every activated data product is registered in. The Q&A covers where the knowledge graph lives and what a customer may extend, base policies that turn into filter conditions on an agent's queries, and Joule Studio as the place to build your own agents and data products.SAP Developers, published 2026-09-29
SAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughSAP Just Became AI-Agent Ready — Here's a Step-by-Step MCP WalkthroughBuilds an MCP Server on SAP Integration Suite's Integration Cell, in front of a Cloud Integration flow that passes an OData V4 backend through untouched, with three tools generated from an OpenAPI spec. Secures it with OAuth 2.0 on SAP BTP client_credentials against XSUAA, and walks through the scope mismatch — the service key issues ESBMessaging.send, not the server's default API.invoke — that returns 403 until corrected; the finished server is then registered as a tool in Claude Code.published 2026-09-04
Named-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationNamed-User Attribution Across BTP Subaccounts: A Two-Hop IAS Token Exchange for Cloud IntegrationA central BTP application that manages Cloud Integration across subaccounts with client_credentials collapses every user into one technical service principal: target subaccounts' role collections are bypassed and the audit log names a service key instead of a person. The post works through a two-hop exchange — an IAS app-to-app hop, then the target subaccount's XSUAA jwt-bearer hop — that carries the calling user's own identity across the subaccount boundary through a shared Cloud Identity Services tenant, so the target subaccount enforces the user's own role collection and records their identity in the audit log. It walks through the IAS app-dependency setup, the AppRouter and SAP Destination service configuration the exchange needs, and states the pattern applies to any XSUAA-protected service in a separate subaccount, not only Cloud Integration.agnissh, published 2026-08-24
Connecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowConnecting a Custom MCP Server to Joule Work Desktop: A Seamless and Secure Authentication FlowWalks through connecting a custom MCP server to Joule Work Desktop: a Dynamic Client Registration handshake (RFC 7591) followed by an Authorization Code + PKCE flow through the organisation's SSO via XSUAA or IAS, so authentication establishes the human identity that Joule then attaches to every subsequent tool call. That forwarded identity lets the BTP backend apply its existing authorization checks and row-level data filtering instead of a second permission model, and a role change in XSUAA revokes access on the next token refresh.published 2026-08-17
From SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsFrom SAP Integration Suite iFlow to MCP Tools: Exposing OData APIs to AI AgentsBuilds an MCP Server artifact inside SAP Integration Suite's Integration Cell runtime that fronts a Northwind OData V4 API through a Cloud Integration iFlow, turning each OpenAPI operation into a tool an agent can call. Walks through the OAuth2 client-credentials flow against XSUAA and the authorization policy scope — ESBMessaging.send in place of the default API.invoke — that gates access to the MCP server, then tests the server from Claude Code.published 2026-07-14
Principal Propagation from BTP Web App to S/4HANA via SAP Integration SuitePrincipal Propagation from BTP Web App to S/4HANA via SAP Integration SuiteWalks through configuring principal propagation from a BTP web app, through SAP Integration Suite and Cloud Connector, to an on-premise S/4HANA system, so the backend receives calls as the logged-in user rather than a shared service account. The BTP Destination service uses OAuth2JWTBearer to exchange the user's Cloud Identity Services JWT for an Integration Suite token, and the iFlow's OData V2 receiver adapter reaches S/4HANA through Cloud Connector with Principal Propagation authentication. The Cloud Connector Subject Pattern builds the outbound certificate's CN from the token's user_name claim, which is populated from the IAS email rather than the sub claim, so identity resolution on S/4HANA hinges on that email matching a resolvable logon name.Joni, published 2026-07-10
Standardized OIDC API Access to SAP S/4HANA via SAP API Management and Microsoft Entra IDStandardized OIDC API Access to SAP S/4HANA via SAP API Management and Microsoft Entra IDSAP API Management exchanges a Microsoft Entra ID access token for one issued by Cloud Identity Services, using an RFC 7523 JWT Bearer Token Exchange so an Azure service principal never holds S/4HANA credentials. SAP S/4HANA then validates that IAS token and resolves its claims to a single ABAP user before authorizing the call, which is the boundary authentication draws on BTP: the identity behind the token, not what it is then allowed to do.StigPraefcke, published 2026-04-29
Standardized OIDC API Access to SAP SuccessFactors via SAP API Management and Microsoft Entra IDStandardized OIDC API Access to SAP SuccessFactors via SAP API Management and Microsoft Entra IDAPI Management in SAP Integration Suite is the pattern's enforcement point: it intercepts a Microsoft Entra ID access token from a service principal and exchanges it, via the OAuth 2.0 JWT Bearer Token Exchange grant (RFC 7523), for a token issued by Cloud Identity Services, with Entra ID configured as a trusted corporate identity provider inside IAS. SAP SuccessFactors accepts only IAS-issued tokens, per SAP Note 3681224, so the exchange happens once at the gateway and client applications never hold SAP-specific credentials.StigPraefcke, published 2026-04-13
Integrating and Extending JouleIntegrating and Extending JouleSAP's reference architecture for SAP Joule across SAP cloud applications: a request is checked against a Scenario Catalog of the applications' skills and a Knowledge Catalog answered by retrieval-augmented generation, combined with the user's roles and history, sent to an LLM available through the generative AI hub, and, where a Joule function is needed, turned into a call to the backend. Its identity page is the authentication path: each user sits in the Identity Directory of Cloud Identity Services with a Global User ID, Identity Provisioning synchronises role assignments into SAP Build Work Zone, whose navigation service decides which functions a user may call, and the Destination service exchanges the user's token to call a function in the user's name. Its extension page covers Joule Studio in SAP Build, where Joule skills automate rule-based tasks over APIs and AI agents plan and reason with models and document grounding from SAP AI Core, the ground agent tooling covers; a later Joule Studio page describes a managed Joule Studio Runtime on the SAP Business AI Platform, which has no entry here.published 2026-03-16
SAP BTP Platform Technical User for CTMS IntegrationSAP BTP Platform Technical User for CTMS IntegrationWalks through creating a technical user in Cloud Identity Services (IAS) as a custom identity provider, adding it to a subaccount's org, space and role collections, and switching a Destinations entry's authentication to OAuth2Password with the Cloud Foundry login endpoint as token service URL and an origin property naming the custom IDP. The technical user lets CI/CD pipelines, API calls and transport automation authenticate without human credentials, keeping service accounts separate from people for audit and access control.Marudhu999, published 2026-03-09
How to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationHow to Access SAP Cloud Logging Service Dashboards Using IAS SAML AuthenticationWalks through wiring SAML 2.0 single sign-on between SAP Cloud Identity Services (IAS) and SAP Cloud Logging so its OpenSearch dashboards accept IAS logins instead of a service key: creating the SAML application in IAS, editing the instance's saml parameters (admin_group, idp.metadata_url, idp.entity_id, sp.entity_id), setting the matching entity ID and endpoints on the IAS side, and mapping an IAS group to the all_access role through a groups attribute. It also shows how to read a 403 on the dashboard as SAML login succeeding while the group-to-role mapping is still missing.Umezuki, published 2025-12-30
Securing CAP Applications with SAP Cloud Identity Services and AMSSecuring CAP Applications with SAP Cloud Identity Services and AMSIdentity Authentication and AMS together as the current answer for a CAP application — authentication, single sign-on and the identity lifecycle on one side, policies on the other.gopalanand, published 2025-12-04
How Redwood Software and SAP are shaping the next era of automation with Joule StudioHow Redwood Software and SAP are shaping the next era of automation with Joule StudioRedwood's Field CTO describes a tech preview where an SAP Basis administrator tells SAP Joule in natural language to pause background jobs and dependent Integration Suite iFlows for unplanned system maintenance; Joule acts as a control tower, triggering a pre-approved RunMyJobs workflow and asking for approval before the restart proceeds. The integration is built by publishing RunMyJobs operations to the SAP Business Accelerator Hub, securing access through SAP BTP with API keys and role-based permissions, and combining those actions into a skill inside Joule Studio's low-code design canvas.gmblom, published 2025-11-02
Building Custom Authentication in SAP CAPBuilding Custom Authentication in SAP CAPpublished 2025-10-25
Building Custom Authentication in SAP CAP
cds 9, maintenance until 2027-06. Affects A recipe.
Joule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたJoule Studioがリリースされたので早速CAPアプリを自然言語で操作するカスタムスキルを構築してみたA walkthrough of building a custom Joule Studio skill on a CAP bookshop app: cds add sample and cds add mta scaffold the project and its deployment descriptor, cds compile srv/ --to xsuaa generates the role template behind the @requires: 'admin' check on AdminService from the SAP Authorization and Trust Management service (XSUAA), and mbt build packages the app for deployment to the SAP BTP, Cloud Foundry Runtime. The skill reaches the deployed OData API through the SAP Destination service, configured with the OAuth2 Client Credentials grant using the client ID, secret and token endpoint from the app's XSUAA service key, so Joule answers a natural-language question about a book by its ID.takayuki_tanaka, published 2025-07-30
Connect to Public Cloud API in Node.js via Authorisation CodeConnect to Public Cloud API in Node.js via Authorisation CodeThe authorisation code flow rather than client credentials, which is the harder half: a service key, an XSUAA instance bound to the CAP app, and a destination, with the author saying plainly that this was challenging and they hope it saves somebody the same time.Egan, published 2025-07-22
Guide to Process Automation APIs - Part I - Getting StartedGuide to Process Automation APIs - Part I - Getting StartedExplains how to call SAP Build Process Automation's REST and OData APIs directly: OAuth2 client credentials with a service key runs as the service, while a user token (OAuth2JWTBearer) runs as the calling person, which matters wherever an API records who acted — approving a task, or reading instances from a shared environment. Since the Public environment is deprecated as of the end of 2025, a call into any other environment also needs an environmentId query parameter.Dan_Wroblewski, published 2025-07-14
Making the Case for Enhanced REST Adapter in SAP Integration SuiteMaking the Case for Enhanced REST Adapter in SAP Integration SuiteCatalogues what SAP Integration Suite's native HTTP adapter supports for authentication (Basic, OAuth 2.0 client credentials and client certificates on the sender; OAuth 2.0 client credentials and SAML bearer assertion on the receiver) and for error handling (retry on HTTP failure only, with no pattern-based retry, failure queues or dead-letter queues), and that it has no OpenAPI import or export. Three worked scenarios, FedEx shipment tracking, Avalara AvaTax and SAP Ariba's operational reporting API, name what that leaves to Groovy scripting: the other OAuth 2.0 flows, gzip and multipart payloads, and pagination that chains a nextPageToken by JSONPath, which is the case the piece makes for the third-party Advantco REST Adapter.peter_ha3, published 2025-07-14
Secure Service Consumption Across HyperscalersSecure Service Consumption Across HyperscalersSAP's design for a workload on SAP BTP that calls Amazon Web Services or Google Cloud services with short-lived credentials instead of stored keys, which is the outbound side of authentication: the BTP application proving who it is to another cloud. On AWS it draws two paths, an ID token from Identity Authentication in Cloud Identity Services exchanged through AWS STS for an IAM role, or an X.509 certificate kept in SAP Destination service and presented to IAM Roles Anywhere; on Google Cloud only the token path, through Workload Identity Federation and an impersonated service account. It is drawn for those two hyperscalers only, and Microsoft Azure has no page in it.published 2025-05-14
SAP IAM integration with SAP Cloud Identity ServicesSAP IAM integration with SAP Cloud Identity ServicesIdentity and access management for SAP SaaS in a landscape where SAP is one vendor among several: SAP Cloud Identity Services as the designated interface, single sign-on over SAML 2 and OIDC, identity lifecycle through SCIM 2 replication of users and groups, and authorization designed per domain — an S/4HANA role and a BTP role collection are different objects that both have to reach the user. Drawn from customer projects, and the source of what authentication here says about Cloud Identity Services.published 2025-05-13
Explaining SAP Joule for HR Business Users & Functional Consultants.Explaining SAP Joule for HR Business Users & Functional Consultants.Written for HR business users and functional consultants, this walks through how SAP Joule is provisioned on SAP BTP and wired into SuccessFactors: the Joule instance sits in a BTP subaccount, SAP Build Work Zone is created alongside it, and Identity provisioning syncs users from SuccessFactors into Build Work Zone while Cloud Identity Services authenticates the launch through an IAS tenant. It lists five prerequisites for the connection — a BTP global account, a Joule entitlement, Cloud Identity Service and SuccessFactors admin access, and the right personas — and notes that running BTP's booster adds the Joule permission to the SuccessFactors user's profile.santanuray_learner, published 2025-03-23
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPEnabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAPAuthorization policies defined in Identity Authentication and consumed by a CAP application through AMS — the configuration half of the move away from XSUAA scopes, from the identity service's side rather than the application's.Yogananda, published 2024-12-27
Enabling Authorization Policies in SAP Cloud Identity Services - IAS with AMS/CAP
Authorization changed in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
CAP for nodejs安全的暴露接口练习CAP for nodejs安全的暴露接口练习Starting from the risk-management sample, the walkthrough adds an open ExternalAPI service beside the existing RiskService, then moves every security annotation into a separate service-auth.cds file: @requires: authenticated-user on one entity, role-scoped @restrict grants for RiskViewer and RiskManager on another. It tests the unprotected action locally with cds watch, calling it from Postman with the session cookie read out of SAP Business Application Studio's preview tab. It then deploys to BTP and reads Risks with a client-credentials OAuth token fetched from a service key of the cpapp-auth instance, after changing that entity's READ grant from RiskViewer to authenticated-user, which the post, citing capire's CDS-based Authorization page, describes as a grant for a technical user integrating systems rather than for access from a front end.ArthurYang, published 2024-12-10
Why SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDWhy SAP Cloud Identity Matters for SAP Task Center: It’s About Trust and Global User IDA step-by-step configuration walkthrough for wiring SAP Cloud Identity Services as the trust and user-correlation layer behind SAP Task Center: establishing Identity Authentication as the sole trusted identity provider for the BTP subaccount, and generating the Global User ID — carried in the token's user_uuid claim rather than the SAML name identifier — that Task Center uses to match logged-in users to their tasks. It also covers syncing that ID between Microsoft Entra ID, the Identity Directory and SAP S/4HANA through Identity Provisioning jobs, and the principal-propagation trust the cloud connector needs to pass it through to an on-premise task provider.ivelinakiryakov, published 2024-11-25
Perform SAP Principal Propagation with Microsoft Entra ID for SAP SuccessFactors!Perform SAP Principal Propagation with Microsoft Entra ID for SAP SuccessFactors!Walks through SAP Principal Propagation for SAP SuccessFactors through SAP Integration Suite's API Management, using the OAuth2SAMLBearer flow with Microsoft Entra ID as the external identity provider. Covers the SuccessFactors-specific policy from the SAP Business Accelerator Hub, the API key and company id SuccessFactors uses in place of an OAuth2 client id, and the Entra ID app registration and key value map that exchange an Entra ID token for a SAP-authorized named user, so a consumer such as Power Automate runs under the mapped SAP user rather than a shared technical account.published 2024-11-20
Simplifying SAP BTP Authentication in Pipelines with SAP Passport and PlaywrightSimplifying SAP BTP Authentication in Pipelines with SAP Passport and PlaywrightClient-certificate login to BTP works locally and has historically not worked in automated pipelines. The post uses Playwright's then-new client certificate support to close that, which is a sideways use of a browser automation library and the reason it is worth recording — the constraint it removes is a CI constraint, not a testing one.published 2024-11-08
Nice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixNice patch SAP! Revisiting your SAP BTP security measures after AI Core vulnerability fixWritten after the SAPwned disclosure in SAP AI Core, it argues SAP BTP's shared-responsibility model still requires the customer's own hardening: scope SAP BTP, Cloud Foundry Runtime and SAP BTP, Kyma runtime app access, rotate OAuth2 client-credentials secrets, and enforce MFA and Conditional Access through a corporate identity provider rather than relying on SAP's patch alone. It then explains how the SAP Audit Log service writes standardized events for most Cloud Foundry BTP services, and walks through onboarding a BTP subaccount into Microsoft Sentinel for SAP BTP to query those logs with Kusto and build detection rules that flag unexpected login countries or known-bad IPs and trigger automatic user blocks.published 2024-07-25
XSUAA Based Authentication - Using Managed ApprouterXSUAA Based Authentication - Using Managed ApprouterOne half of a pair published the same day, both starting from capire's list of authentication kinds and then going end to end on XSUAA. This is the managed approuter route, where the platform runs the router and the application supplies configuration rather than a module.rahul_rajagopal, published 2023-09-25
XSUAA Based Authentication - Using Managed Approuter
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe.
XSUAA Based Authentication - Using Standalone ApprouterXSUAA Based Authentication - Using Standalone ApprouterThe other half: the same end-to-end XSUAA setup with an approuter you deploy and own. Published alongside the managed version, and the two are worth reading together because the difference between them is the whole decision.rahul_rajagopal, published 2023-09-25
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceSAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js ServiceThe follow-up that carries the identity through. It takes the CAP service from the Actions tutorial and puts the calling user's identity behind it — an XSUAA instance, a trust configuration, an OAuthSAMLBearerAssertion destination, and the service changed to use that instance — so a step runs on behalf of a person rather than as the process.TJe, published 2023-06-22
SAP Build Process Automation – Use Principal Propagation in Actions sample: CAP Node.js Service
Workflow integration has changed twice since this was published, most recently in @cap-js/n8n 0.0.1, 2026-08-27. Affects A recipe.
SAP CAP JWT Token Flow in codeSAP CAP JWT Token Flow in codeOne question, answered precisely: at what point does the JWT exist and how does it end up on req.headers.authorization in a CAP handler. XSUAA issues it and the approuter carries it, and the post follows it through both.sandeepmalhotra, published 2023-04-03
SAP CAP JWT Token Flow in code
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects Runnable code.
Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The opening of a three-part series on reaching more than one S/4HANA system from one CAP application with the user's identity carried through. This part sets up the business problem; the propagation itself is in the parts that follow.mohit_bansal3, published 2022-11-25
Part2: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part2: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The middle part: the destinations and the trust that make principal propagation work against several backends rather than one, which is where the configuration stops being a copy of the tutorial.mohit_bansal3, published 2022-11-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]The final part, and the one with the most CAP in it — the service consuming the propagated destinations, and what the handler sees. Read the three together; the series is one piece.mohit_bansal3, published 2022-11-25
Part 3: Architecting Complex Real Life Business Scenario on SAP BTP with ease [ Targeting Multiple backend S/4HANA Systems utilizing Principal Propagation ]
Destinations changed in @sap-cloud-sdk/connectivity 4.0.0, 2025-03-04. Affects A recipe.
SAP Business Technology Platform: Authorization and Trust Management ServiceSAP Business Technology Platform: Authorization and Trust Management ServiceWalks through how the SAP Authorization and Trust Management service secures a BTP application: scopes, attributes and role templates in the security descriptor, and the OAuth 2.0 resource-owner, client and resource-server roles it builds on. Covers the XSUAA microservice as the OAuth 2.0 authorization server bound to each application through its service broker, the signed JSON Web Token it issues after authentication, and the App Router's place in front of the resource apps as the gateway that starts authentication and checks for cross-site request forgery.SekhuteTK, published 2022-09-09
Execute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationExecute [OAuth2 client credentials] protected REST request with SAP CAP ApplicationA recipe, and the author calls it that — package.json, a .cds and a handler — for calling a remote service protected by OAuth2 client credentials from a CAP application. Short, complete, and addressed to CAP developers rather than to BTP administrators.Lachmish, published 2022-04-27
Execute [OAuth2 client credentials] protected REST request with SAP CAP Application
Authentication changed in CAP Java 3.0.1, 2024-07-26. Affects A recipe.
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.The long version, from the MTA project outward: what the deployment descriptor has to contain, how the authentication flow actually runs, and then the npm modules doing the work — @sap/xssec and @sap/xsenv named and explained rather than left as dependencies. Old, and the module names have moved on, but the flow it draws has not.balbinosoares, published 2020-03-16
Understanding security approaches in SAP CAP using XSUAA in node.js flavor and MTA.
Authorization has changed twice since this was published, most recently in CAP Java 3.7.1, 2025-01-30. Affects A recipe, Runnable code.
Generate agentic workflows using SAP-managed n8n in Joule StudioGenerate agentic workflows using SAP-managed n8n in Joule StudioSAP-managed n8n inside Joule Studio generates a workflow from a business intent a developer states, and the workflow is then tested and deployed, consuming line-of-business application APIs, events and agents in SAP Business AI Platform: process automation with the workflow generated from intent, and agent tooling where the workflow calls agents. The generated workflow sends notifications to the Joule Work mobile app of SAP Joule, to Microsoft Teams or to Slack. SAP's abstract names the pieces and not how the generation or the n8n hosting works. A two-hour hands-on TechEd 2026 session (Tuesday 27 October, Berlin), presented by Rama Sulakshani Murari, Rumen Dimitrov, Seshadri Sreenivas Ramanarayanan and Venugopal Chembrakalathil, written here from SAP's abstract; the recording is not yet published.
Building enterprise agent extensions with the Joule Studio solutionBuilding enterprise agent extensions with the Joule Studio solutionExtending SAP's standard agents with third-party integrations and business actions in Joule Studio: agents that run a process across systems, call an external service, put an approval step in the middle and bring the result back into the business context, which is what SAP Joule's agents do and what Joule Studio, classic edition is in the atlas. The abstract names Joule Studio without saying which edition the exercise uses, and lists outcomes rather than the steps built. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Charan Ravikumar, Jacob Hornberger, Maria Kondratyeva and Michael Zadikowitsch, written here from SAP's abstract; the recording is not yet published.
Zero token architecture for Joule AgentsZero token architecture for Joule AgentsA pattern for SAP Joule's agents in which an agent maps the solution path once, solves the problem, generates reusable code or configuration and validates it, and later requests reuse that output, so discovery is done by the model and execution is repeatable. The abstract states the pattern as an idea and names no Joule component and no case it was tried on. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by EDGAR ADRIAN MARTINEZ ARCE, written here from SAP's abstract; the recording is not yet published.
Transform business data into AI-supported insightsTransform business data into AI-supported insightsBusiness metrics turned into insights, narratives and recommendations by SAP Joule's agents, with People Intelligence, the SAP Snowflake solution extension for SAP Business Data Cloud and SAP Analytics Cloud connected in SAP Business Data Cloud. The abstract names what is connected and what comes out, and does not say what the exercise builds or where the Snowflake extension sits in it; People Intelligence and the extension are not atlas entries. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Babacar Toure, Maximilian Paul Gander, Neetha Pucknat and San Tran, written here from SAP's abstract; the recording is not yet published.
What’s next for agentic analytics and planning in SAP Business Data CloudWhat’s next for agentic analytics and planning in SAP Business Data CloudWhat is next for agentic analytics and planning in SAP Business Data Cloud: SAP Joule's agents automating insight delivery, analysis, narrative generation and modelling tasks. A road map session; the abstract names the four kinds of task and no agent or date. A TechEd 2026 session (Tuesday 27 October, Berlin; also DA806V, virtual), presented by Kristian Ruemmelin, written here from SAP's abstract; the recording is not yet published.
Get to know our AI-enhanced mobile apps across the Autonomous EnterpriseGet to know our AI-enhanced mobile apps across the Autonomous EnterpriseA demo of the Joule Work mobile app, part of SAP Joule, and selected SAP mobile apps, showing the mobile AI features meant for using SAP Autonomous Suite on the go, followed by the mobile AI patterns and how to build your own Mobile apps with SAP Business AI Platform. The abstract names the apps and the patterns and states no feature or tool, so what building your own involves is not said. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Sandeep Tetali and Thilo Berndt, written here from SAP's abstract; the recording is not yet published.
SAP’s compositional design system: Craft enterprise UIs with AI on the flySAP’s compositional design system: Craft enterprise UIs with AI on the flySAP's compositional design system is the engine behind the generated interface in Joule Work, the front of SAP Joule: SAP's abstract says AI assembles the UI at runtime from primitives and composites under a body of design knowledge, inside a brand-safe design system, and that the session covers the architecture that keeps the result consistent. A third shape of Generative UI beside the two the capability describes, since here the model composes the interface at runtime. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Philip Miseldine and Sophia Levens, written here from SAP's abstract; the recording is not yet published.
AI-enhanced analytics with SAP Business AI PlatformAI-enhanced analytics with SAP Business AI PlatformSAP Business Data Cloud data products joined to an ontology, a semantic layer the abstract says is supported by the Model Context Protocol, and read from Joule Work (SAP Joule) and SAP Analytics Cloud: that is the architecture SAP's abstract states for its AI-enabled analytics. The abstract names the parts and not how the semantic layer is modelled or what an analytics developer builds against. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Hacen Benkhedah, Joaquin Recio Huertas, Matilda Hyka and Oliver Huth, written here from SAP's abstract; the recording is not yet published.
Joule without walls: From personal skills to enterprise interoperabilityJoule without walls: From personal skills to enterprise interoperabilitySAP Joule connects outward over two protocols, A2A and MCP, which SAP's abstract names as the foundation of its open ecosystem, with Joule Assistants as composable agents and extensibility built in. The session draws the line between a personal extension of Joule and one that needs enterprise governance; the abstract does not say where that line falls. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Mathis Boerner and Thomas Mueller, written here from SAP's abstract; the recording is not yet published.
Joule and related AI offerings from SAP: One platform, many systemsJoule and related AI offerings from SAP: One platform, many systemsSAP Joule run across dozens of SAP systems: the SAP for Me portal, orchestration across systems, configuration and credential management, monitoring and tenant isolation are the topics SAP's abstract lists. It stays on the operating side and says nothing about building on Joule. A TechEd 2026 session (Wednesday 28 October, Berlin; also JW301V, virtual), presented by Lukas Lochner, Marvin Klaus and Mathias Rup, written here from SAP's abstract; the recording is not yet published.
The road map for SAP Joule for Consultants—your go-to SAP consulting toolThe road map for SAP Joule for Consultants—your go-to SAP consulting toolSAP's road map for SAP Joule for Consultants, which the abstract describes as becoming the tool for SAP software projects: landscape awareness and secure system connectivity, so that Joule understands an organisation's SAP environments and gives project teams more contextual guidance. The atlas holds no entry for Joule for Consultants, so the piece enters on SAP Joule, the product it is an edition of; the abstract states outcomes and no feature or date. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Natalie Han and Sachin Kaura, written here from SAP's abstract; the recording is not yet published.
Joule and SAP Knowledge Graph: Context-aware AI across SAP solutionsJoule and SAP Knowledge Graph: Context-aware AI across SAP solutionsThe catalogue carries RA107's abstract under this title, and what it describes is SAP AI Core as the management and orchestration layer of an AI architecture: extending Joule Agents in SAP Joule, the model library in Joule Studio for contextual reasoning, connecting data products from SAP Business Data Cloud, and embedding AI in SAP S/4HANA. The SAP Knowledge Graph the title names does not appear in that text, so the edges rest on the abstract as published, and whether the session follows the title or the abstract is not known until it is recorded. A TechEd 2026 session (Wednesday 28 October, Berlin; also RA110V, virtual), presented by Jan Portisch and Pavithra G K, written here from SAP's abstract; the recording is not yet published.
Building custom Joule Agents with SAP Knowledge GraphBuilding custom Joule Agents with SAP Knowledge GraphCustom Joule Agents built in a hands-on with SAP Knowledge Graph and Joule Studio: discovering APIs from a user's intent, grounding an agent's answers in business context, and integrating data products for SAP Business Data Cloud. The agents are SAP Joule's; the Knowledge Graph is not an atlas entry, and the abstract does not say which Joule Studio edition the exercises use. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Jan Portisch, Lucas Kiesow, Pavithra G K and Rafael Martin, written here from SAP's abstract; no recording is announced.
Discover fast-track implementation of SAP Cloud ERP with AIDiscover fast-track implementation of SAP Cloud ERP with AISAP's implementation practice for SAP S/4HANA Cloud Public Edition and the AI-driven tooling SAP says is changing stages of a project, with faster and more predictable deployments, less manual effort and lower risk as the stated outcomes. The abstract names the product, an external here, and no tool; the edge is to SAP Joule because SAP's AI tooling for implementation in the sibling sessions TM109, TM263 and TM265 is Joule for Consultants, and whether this session shows it is not stated. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Anurag Barua and Khaled MUSILHY, written here from SAP's abstract; the recording is not yet published.
Discover how SAP Joule for Consultants transforms cloud implementationsDiscover how SAP Joule for Consultants transforms cloud implementationsA customer's use of SAP Joule for Consultants in a cloud transformation: grounding project data, running fit-to-standard workshops faster and keeping teams aligned, followed by the technical architecture behind those capabilities and an early road map preview on feasibility for developers and enterprise architects. The edge is to SAP Joule, of which Joule for Consultants is the offering for consultants and has no entry of its own here; the abstract leaves the customer as a placeholder and the architecture to the session. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Philipp Kandziora and Yi Hsuan Lin, written here from SAP's abstract; the recording is not yet published.
From intent to extension: Joule and the future of solution extensibilityFrom intent to extension: Joule and the future of solution extensibilityHow Joule turns natural-language intent into extensions across SAP Autonomous Suite: intent-based agent extensions, enriching the agents SAP delivers, packaging options for partners and what SAP calls a harmonised extensibility experience. The edges are to SAP Joule, which does the translating, and to Extensibility, the concern; the abstract names the directions and no feature that ships today. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Amitha Kamath, Oren Shatil and Richard Kuba, written here from SAP's abstract; the recording is not yet published.
Agent-led test management: Hands-on lab with Joule in SAP Cloud ALMAgent-led test management: Hands-on lab with Joule in SAP Cloud ALMThe Test Management Assistant, a Joule capability in SAP Cloud ALM, worked through on project scenarios: scoping requirements, detecting coverage gaps and generating test cases with AI. The edge is to SAP Joule, which the assistant runs on; SAP Cloud ALM has no entry here, and the atlas's testing concern, proving a service's model and handlers, is not this session's test management. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Christina Pickhardt, Daniel Lorenz, Niclas Weidner and Tobias Keller, written here from SAP's abstract; the recording is not yet published.
Experience core foundational capabilities of SAP Cloud ERPExperience core foundational capabilities of SAP Cloud ERPGuided exercises in SAP S/4HANA Cloud Public Edition, which SAP calls the execution backbone of the Autonomous Enterprise: validating AI capabilities against master data for industry and domain needs, generating AI-driven KPIs and reporting summaries. The product is an external here and the abstract names no AI feature by name; the edge is to SAP Joule, SAP's AI layer across its applications and the one entry the AI capabilities of SAP Cloud ERP attach to, which the abstract itself does not name. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Akshat Kharial, Ankush Thareja and Nises Soni, written here from SAP's abstract; the recording is not yet published.
AI-accelerated RISE with SAP migration with the system transition workbenchAI-accelerated RISE with SAP migration with the system transition workbenchSAP Joule for Consultants and the RISE with SAP system transition workbench in a move to SAP S/4HANA Cloud Private Edition: readiness assessments, migration workflows and the SAP tools involved. The edge is to SAP Joule, of which Joule for Consultants is a part; the system transition workbench has no entry here, and Platform migration covers applications leaving older BTP platforms, not an ERP system's move. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Daniel Funkert, Kristin Aleksandrova, Mirja Kempin and Moritz Gysler, written here from SAP's abstract; the recording is not yet published.
SAP Joule for Consultants: Unified knowledge for requirements and designsSAP Joule for Consultants: Unified knowledge for requirements and designsFit-to-standard analysis as a consultant on a cloud transformation project: connecting an organisation's data to SAP Joule for Consultants through SAP AI Core, getting answers from SAP knowledge and that content, then building an expert, loading project files and running guided prompts. The edges are to SAP Joule, of which Joule for Consultants is a part, and to SAP AI Core, named as the connection path; how the data is grounded is left to the session. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Anantharaman Ravi, Natalie Han, Sachin Kaura and Yi Hsuan Lin, written here from SAP's abstract; the recording is not yet published.
Inside Joule Studio runtime: Agent deployment and integrationsInside Joule Studio runtime: Agent deployment and integrationsJoule Studio runtime from the inside: the tools and services SAP manages to deploy, integrate, run, extend and operate agents at scale, and the integrations through the agent gateway and SAP S/4HANA Cloud Private Edition. The edge is to SAP Joule, whose agents the runtime runs; the atlas reaches that runtime through @sap/joule-work-dev-cli-early-adopters, which deploys a solution to it, and the abstract names neither the CLI nor a service by name. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Andre Lamego and Jens Huesken, written here from SAP's abstract; the recording is not yet published.
Deploy, review, break, fix: Govern cloud transports with agility and AIDeploy, review, break, fix: Govern cloud transports with agility and AIFive BTP services in one delivery chain, as the abstract lays it out: a transport is triggered in SAP Content Agent Service, tested in SAP Cloud Transport Management, its failure is raised by SAP Alert Notification service for SAP BTP and remediated by a SAP Joule agent with SAP Automation Pilot, and SAP Cloud Logging keeps the history for root-cause analysis. The chain from alert to remediation is the operations automation concern; what the Joule agent decides on its own is not in the abstract. A TechEd 2026 session (Thursday 29 October, Berlin), presented by Biser Simeonov, Daniel Funkert, Sven Rullmann and Thorsten Sandfuchs, written here from SAP's abstract; the recording is not yet published.
What’s next for the core platform capabilities of SAP Business AI PlatformWhat’s next for the core platform capabilities of SAP Business AI PlatformA preview of the operations layer beneath SAP Business AI Platform: selected road map highlights across Joule Studio runtime, Cloud Identity Services and SAP Cloud Logging, on how enterprise AI is governed and run. The edges are to the two named services and to SAP Joule, whose agents the Joule Studio runtime runs; the abstract names the three areas and no highlight. A TechEd 2026 session (Tuesday 27 October, Berlin; also XP825V, virtual), presented by Andre Lamego and Jens Huesken, written here from SAP's abstract; the recording is not yet published.
Evolving the identity lifecycle for an AI-first futureEvolving the identity lifecycle for an AI-first futureCloud Identity Services as the foundation for authentication, identity lifecycle management and access across SAP landscapes, and the agent identity concepts and SAP-managed identity and access management scenarios SAP says reduce operational effort. The edges are to the service and to the two concerns the abstract names it for, Authentication and Identity provisioning; the abstract names the agent identity concepts and does not say what they are. A TechEd 2026 session (Tuesday 27 October, Berlin), presented by Sonia Petrescu and Swetta Singh, written here from SAP's abstract; the recording is not yet published.
How SAP secures enterprise AI agents with identity propagationHow SAP secures enterprise AI agents with identity propagationCloud Identity Services as the identity layer for AI agents as well as people: the abstract states that both are managed in one directory, that user context is propagated by token exchange, and that authorisation is enforced at every hop, so no agent holds back-end credentials. Agents from Microsoft, Google and partners take the same flow through the agent gateway. Token exchange across a hop is the authentication side and the per-hop check the authorisation side; what the agent gateway is, and whether it is a product, the abstract does not say. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Gunnar Kosche and Sebastian Ries, written here from SAP's abstract; the recording is not yet published.
Details
Graph
SAP Jouleartifact
Authenticationcapability, core and community
SAP Communitypublishing source
SAP Communityjoule-tag
Source
Type
blog
Published on
Host
community.sap.com
Discovered via
First seen
History
- explains → applies_to on capability:authenticationDoor scope derived from the artifacts this piece also explains, so a door page lists it only where it holds (docs/concepts/content-on-doors.md).
- Entered the atlasDiscovered via SAP Community · joule-tag.
For your agent
- Ref
content:sap-joule-implementation-in-an-s-4hana-private-cloud-3-system-landscape- JSON
- /content/sap-joule-implementation-in-an-s-4hana-private-cloud-3-system-landscape.json
- MCP
- Connecting an agent