Set Up Trust Between SAP Cloud Identity Services and SAP BTP Subaccount

To set up the trust from Identity Authentication to the SAP BTP subaccount you need the subaccount’s SAML metadata.

1. Enter the SAP BTP subaccount’s cockpit as an administrator and expand the Security area.

2. Open Trust Configuration.

3. Click Download SAML Metadata.

The metadata will be downloaded as XML file.

Open the SAP Cloud Identity Services administration console with its URL which follows the pattern:

https://<YOUR_TENANTS_ID>.accounts.ondemand.com/admin

The Tenant ID is an automatically generated ID by the system. The first administrator created for the tenant receives an activation e-mail with an URL in it. This URL contains the tenant ID.

SAP Cloud Identity Services administration console entry screen looks (depending on authorizations) like this

The SAP BTP subaccount is represented in SAP Cloud Identity Services as Application.

Choose Applications & Resources (1) and go to Applications (2). Click Create (3) on the left hand panel and enter a Display Name (4) to represent your SAP BTP subaccount. Create (5) the application.

1. The newly created application will be shown, choose SAML 2.0 Configuration and then the option Load from File.

   

2. Browse for the SAML metadata XML file of your SAP BTP subaccount that you downloaded before and upload it. All the needed properties will be automatically fetched from the XML file and saved in the SAML 2.0 configuration of the application.

   

Now you have to configure which attribute is used to identify users during SAML 2.0 authentication. SAP S/4HANA Cloud expects the Subject Name Identifier to be set to Login Name or Email. Choose a subject name identifier that is known and provided in both SAP BTP and on S/4HANA Public Cloud Side. Refer to Configure the Subject Name Identifier Sent to the Application for more information.

1. Still being in your application’s Trust settings select Subject Name Identifier.

   

2. Under Primary Attribute use Identity Directory as Source, choose Login Name or Email as Value and save your changes.

   

As most common use case the SAP Cloud Identity Services - Identity Authentication does not act as Identity Provider itself but as proxy for an already existing corporate identity provider. This has to be set now.

Still being in your application’s Trust settings scroll down and open Conditional Authentication.

Under Default Authenticating Identity Provider select your corporate identity provider as Default Identity Provider and click Save.

To set the SAP Cloud Identity Services tenant as trusted identity provider in the SAP BTP subaccount next, you need to get its SAML metadata first.

1. Choose Applications & Resources

2. Switch to Tenant Settings

3. Go to Single Sign-On section

4. Open SAML 2.0 Configuration

5. Click the Download Metadata file button

   

6. In the pop-up that opens, use Default certificate and press the Download button.

   

Alternatively you can open the metadata XML by entering your tenant’s web address for it which follows pattern https://<YOUR_TENANTS_ID>.accounts.ondemand.com/saml2/metadata and saving that XML to a file.

Switch back to your SAP BTP cockpit trust configuration.

Choose Add SAML Trust to add a trusted identity provider.

Upload the metadata XML file of your SAP Cloud Identity Services tenant in the Metadata field, give a Name, as for example the tenant id. Save your changes via Add SAML Trust.