SAP Cloud IdP

[#1]

Hi,

I have subscribed a trial account and I have access to SAP BTP cockpit. I am trying to find out how to configure as such I could use SAP IdP for the authentication using OAuth2.0.

I guess I have to register an application and get the client ID and other metadata. Where could I do that? My goal is to protect our app written in NodeJS and React with SAP IdP.

I read some documentation that I need to access SAP Identity Authentication service and SAP Cloud Identity service.

Not sure if I am in the right direction, but I have check out this tutorial: https://blogs.sap.com/2021/04/15/sap-business-technology-platform-security-hands-on-video-tutorials-.../

I have few findings when I am trying to follow the tutorial:

- I can't find SAP Cloud Identity service in the Service Marketplace

- Under "Trust Configuration", when click on "Establish Trust", I am prompted with this error:

"Unable to fetch available IAS tenants. 400

[400] \{"error":"23dc5ed4-47e6-4308-a1fa-2e2f8f00f51e is not a valid tenant for OIDC configuration: customer or cost center ID not set."}"

Your help is greatly appreciated. Thank you.

[gregorw]

As soon as you have the BTP Free Tier the integration with the custom IdP is quite easy as it's just one click in the Security -> Trust section of your subaccount. For a first end-to-end example I suggest to run trough Build an Application End-to-End Using CAP, Node.js and VS Code.

[Willem_Pardaens]

Trial accounts do not provide a dedicated SAP BTP Identity Authentication Service tenant. For this, you will have to subscribe to a non-trial account (e.g. a PayGo account) which contains a wide set of services you can use free of charge (Free Tier). This will include an IAS tenant.

Applications deployed on BTP are secured using IAS, but rely normally on normal/human logins (username/password, certificate, ...) and not use OAuth. In case your application is more of a technical module that exposes APIs for other applications to consume (here OAuth would be useful), you could look at the API Management capability of SAP Integration Suite as well.

[80faeb97trial]

Hi Willem,

Thank you for answering.

Let's say I will subscribe the non-trial account. Do you know if there is a documentation for me to integrate the SAP Cloud IdP to my app with OAuth2?

Theoretically, I will need to register an application to get the client ID, token & authorization endpoint URL, scopes and redirect URL. Do you know where could I do that or if there is a guide on this topic?

[Willem_Pardaens]

Hi Suwarno, the feature you're looking for is the XSUAA services which is an OAuth2 authentication service, containing the token endpoint, client id, etc. The Help documentation can be found here: https://help.sap.com/docs/BTP/65de2977205c403bbc107264b8eccf4b/4902b6e66cbd42648b5d9eaddc6a363d.html and for a hands-on example you can check the link below from Gregor's answer.