This is a community for learning, sharing, and getting help with the security services and features in SAP Business Technology Platform (SAP BTP) and their functional capabilities. Share your stories, connect with experts, and stay up to date on the latest developments.
Check out our new video tutorial series about SAP BTP extension generators. In this tutorial, we zoom in on the security aspects of authentication and authorization for business applications.
Watch the hands-on tutorials
As a global account administrator [Feature Set B], you can now see all users of your global accounts in the cockpit, related identity provider information, and manage the users.
Check out the details
In the SAP Road Map Explorer, you can discover planned innovations you need to secure your applications. These services help you to be compliant with internal and external security standards.
Discover innovations
In this new end-to-end video tutorial, we explore in some detail how we can use XSUAA service instances in the SAP BTP, Cloud Foundry environment for authentication and authorization.
Watch the hands-on tutorial
The SAP Authorization and Trust Management Service (XSUAA) of SAP BTP lets you manage user authorizations. The service allows to confine access rights for resources to eligible business users or system users (system-to-system communication). OAuth 2.0 is the protocol used for authorization.
Guide for User Authentication and Authorization in SAP BTPSAP Authorization and Trust Management Service in SAP Discovery CenterDocumentation: SAP Authorization and Trust Management Service in the Cloud Foundry EnvironmentImplement Instance-Based Access ControlCreating Role Collections in SAP BTPSecure a Node.js Application and Make it Available to Other SubaccountsTroubleshooting the SAP Authorization and Trust Management Service (XSUAA)
The SAP Cloud Application Programming Model (CAP) offers automatic authorization enforcement in the CAP-supported runtimes Node.js and Java. No manual coding of permission checks are required because it is automatically enforced during runtime. Developers can still implement individual permission checks.
Overview VideoSAP Cloud Application Programming Model (CAP)Cookbook: Authorization and Access Control
SAP Credential Store service provides a secure repository for passwords and keys for applications that are running on SAP BTP. It enables applications to retrieve credentials and use them for authentication to external services, or to perform cryptographic operations and transport layer security (TLS) communication.
SAP Credential Store in SAP Discovery CenterSAPinsider: Introducing SAP Credential StoreDocumentation: SAP Credential Store
SAP Custom Domain service allows you to make your SAP BTP applications accessible via an individual domain, which is different from the default one (hana.ondemand.com). It also provides a self-service for managing the related certificates and trust. You can also integrate your own PKI solutions, so it is not limited to a specific trust center. Furthermore, you have full control over the private key and certificate lifecycle.
SAP Custom Domain Service in SAP Discovery CenterDocumentation: SAP Custom Domain ServiceGuided Answers: SAP Custom Domain Service
SAP BTP connectivity provides two services, the SAP Connectivity service and the SAP Destination service. The SAP Connectivity service contains a connectivity proxy, which is used to access on-premise resources. The SAP Destination service can be used to retrieve and store the technical information about the target resource.
Documentation: Connectivity in the Cloud Foundry Environment
The Cloud Connector provides a secure tunnel between SAP BTP applications and on-premise systems to access relevant data. Existing on-premise data can be reused without exposing the entire internal landscape. The Cloud Connector itself will be installed on-premise, so you have full control over what happens in your on-premise SAP systems. Furthermore, the connection will be established from on-premise to SAP BTP. This offers the advantage that you do not have to open an additional incoming port. The Cloud Connector also offers principal propagation. It manages the authentication process of an identity between systems.
Documentation: Cloud Connector