Back to Details

sap-btp-cloud-identity-services

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

SAP Cloud Identity Services

SAP Cloud Identity Services

SAP Cloud Identity Services are a group of services on SAP BTP that manage identity and access across cloud and on-premise systems. They provide single sign-on, user provisioning, and policy-based authorization.
The services comprise:
  • Identity Authentication (IAS) — cloud-based authentication, SSO (OIDC/SAML 2.0), corporate IdP federation, conditional authentication, and user store management. Acts as the identity provider for SAP BTP applications.
  • Identity Provisioning (IPS) — identity lifecycle management as a service. Synchronizes users and groups between source and target systems (SAP and non-SAP) with full and delta read modes, real-time provisioning, and transformation support.
  • Identity Directory — the central user store. Provides SCIM 2.0 REST API, custom schemas, and generates the Global User ID distributed by IPS to SAP cloud applications.
  • Authorization Management (AMS) — policy-based authorization for BTP applications. Developers define policies in Data Control Language (DCL); administrators refine and assign them via the administration console.
SAP Cloud Identity Services是SAP BTP上的一组服务，用于管理云和本地系统间的身份与访问权限。它们提供单点登录（SSO）、用户配置和基于策略的授权功能。
该组服务包括：
  • Identity Authentication（IAS） — 基于云的身份认证、SSO（OIDC/SAML 2.0）、企业IdP联邦、条件式身份认证及用户存储管理。作为SAP BTP应用的身份提供商。
  • Identity Provisioning（IPS） — 身份生命周期管理即服务。在源系统与目标系统（SAP和非SAP）之间同步用户和组，支持全量与增量读取模式、实时配置及转换功能。
  • Identity Directory — 中央用户存储。提供SCIM 2.0 REST API、自定义模式，并生成由IPS分发至SAP云应用的全局用户ID（Global User ID）。
  • Authorization Management（AMS） — 面向BTP应用的基于策略的授权。开发者使用数据控制语言（DCL）定义策略；管理员通过管理控制台优化并分配这些策略。

Related Skills

相关技能

  • sap-btp-connectivity — destination service and connection authentication mechanics (OAuth client credentials, principal propagation through Cloud Connector)
  • sap-cap-capire — CAP application-level auth usage (role templates, @requires annotations, cds deploy with xs-security.json)
  • sap-btp-best-practices — high-level security governance and production deployment patterns
  • sap-btp-cloud-platform — BTP account setup, subaccount configuration, service instance creation
  • sap-btp-connectivity — 目标服务与连接认证机制（OAuth客户端凭证、通过Cloud Connector的主体传播）
  • sap-cap-capire — CAP应用级认证用法（角色模板、@requires注解、使用xs-security.json进行cds部署）
  • sap-btp-best-practices — 高级安全治理与生产部署模式
  • sap-btp-cloud-platform — BTP账户设置、子账户配置、服务实例创建

When to Use This Skill

何时使用该技能

  • Registering an OIDC or SAML 2.0 application in IAS
  • Configuring corporate identity provider federation (IdP proxy)
  • Establishing trust between a BTP subaccount and an IAS tenant
  • Setting up Identity Provisioning source/target systems and jobs
  • Writing or refining AMS authorization policies (DCL)
  • Migrating from XSUAA to IAS-based authentication
  • Troubleshooting token validation, audience, or issuer mismatch errors
  • Configuring conditional authentication (risk-based, MFA)
  • Integrating IAS with the SAP BTP Identity service (automatic OIDC app creation)
  • 在IAS中注册OIDC或SAML 2.0应用
  • 配置企业身份提供商联邦（IdP代理）
  • 建立BTP子账户与IAS租户间的信任关系
  • 设置Identity Provisioning的源/目标系统及任务
  • 编写或优化AMS授权策略（DCL）
  • 从XSUAA迁移到基于IAS的身份认证
  • 排查令牌验证、受众或颁发者不匹配错误
  • 配置条件式身份认证（基于风险、多因素认证MFA）
  • 将IAS与SAP BTP Identity服务集成（自动创建OIDC应用）

Quick Reference

快速参考

ServicePurposeKey Objects
IASAuthentication & SSOApplications (OIDC/SAML), IdPs, conditional auth, user store
IPSUser/group provisioningSource systems, target systems, proxy systems, transformations, jobs
Identity DirectoryUser persistenceUsers, groups, custom schemas, Global User ID
AMSPolicy-based authorizationAuthorization policies, DCL rules, policy templates, restrictions
服务用途核心对象
IAS身份认证与SSO应用（OIDC/SAML）、IdP、条件式认证、用户存储
IPS用户/组配置源系统、目标系统、代理系统、转换规则、任务
Identity Directory用户持久化存储用户、组、自定义模式、全局用户ID
AMS基于策略的授权授权策略、DCL规则、策略模板、限制条件

Identity Authentication (IAS)

Identity Authentication（IAS）

IAS is the entry point for authentication in SAP BTP applications. It supports OIDC and SAML 2.0 protocols, acts as an identity provider or a proxy to corporate IdPs, and provides conditional authentication based on user attributes, email domain, user group, or IP range.
IAS是SAP BTP应用身份认证的入口点。它支持OIDC和SAML 2.0协议，可作为身份提供商或企业IdP的代理，并能基于用户属性、邮箱域名、用户组或IP范围提供条件式身份认证。

Application Registration

应用注册

Register applications in the IAS admin console under Applications and Resources > Applications. Each application defines:
  • Application Type — OIDC or SAML 2.0
  • Trust Configuration — SP metadata upload (SAML) or redirect URIs (OIDC)
  • Authentication — method, conditional rules, IdP selection
  • User Attributes — which attributes are sent in tokens/assertions
When using the SAP BTP Identity service (
xsuaa
replacement), the service instance automatically creates an OIDC application in IAS. No manual registration is needed.
在IAS管理控制台的Applications and Resources > Applications下注册应用。每个应用需定义：
  • 应用类型 — OIDC或SAML 2.0
  • 信任配置 — SP元数据上传（SAML）或重定向URI（OIDC）
  • 身份认证 — 认证方式、条件规则、IdP选择
  • 用户属性 — 哪些属性会被包含在令牌/断言中
当使用SAP BTP Identity服务（
xsuaa
的替代方案）时，服务实例会自动在IAS中创建一个OIDC应用，无需手动注册。

Corporate IdP Federation

企业IdP联邦

IAS can act as a proxy: end users authenticate at a corporate IdP (Azure AD, Okta, etc.), and IAS bridges the token for SAP applications. Configure under Applications and Resources > Corporate Identity Providers.
For details, see 
references/identity-authentication.md
.
IAS可作为代理：终端用户在企业IdP（如Azure AD、Okta等）完成身份认证，IAS为SAP应用转换令牌。配置路径为Applications and Resources > Corporate Identity Providers。
详细内容请参阅
references/identity-authentication.md
。

Identity Provisioning (IPS)

Identity Provisioning（IPS）

IPS synchronizes users and groups between systems. It supports source, target, and proxy system types with configurable transformations and scheduling.
IPS用于在系统间同步用户和组。它支持源系统、目标系统和代理系统类型，可配置转换规则和调度任务。

Key Concepts

核心概念

  • Source systems — read users/groups from (e.g., SAP SuccessFactors, Azure AD, SAP S/4HANA Cloud)
  • Target systems — write users/groups to (e.g., IAS tenant, SAP BTP XSUAA, SAP Analytics Cloud)
  • Proxy systems — hybrid scenarios where IPS reads from one system and writes through another
  • Transformations — JSON-based attribute mappings between source and target schemas
  • Jobs — scheduled or on-demand provisioning runs (full or delta read)
  • Real-time provisioning — immediate entity propagation from source to target
For details, see 
references/identity-provisioning.md
.
  • 源系统 — 读取用户/组的系统（如SAP SuccessFactors、Azure AD、SAP S/4HANA Cloud）
  • 目标系统 — 写入用户/组的系统（如IAS租户、SAP BTP XSUAA、SAP Analytics Cloud）
  • 代理系统 — 混合场景，IPS从一个系统读取并通过另一个系统写入
  • 转换规则 — 基于JSON的源与目标模式间属性映射
  • 任务 — 定时或按需执行的配置任务（全量或增量读取）
  • 实时配置 — 实体从源系统到目标系统的即时传播
详细内容请参阅
references/identity-provisioning.md
。

Authorization Management (AMS)

Authorization Management（AMS）

AMS enables policy-based, instance-level authorization for BTP applications. Developers define authorization policies in Data Control Language (DCL) — an SQL-like language — and deploy them with the application. Administrators refine policies in the IAS admin console.
AMS为BTP应用提供基于策略的实例级授权。开发者使用数据控制语言（DCL）（类SQL语言）定义授权策略，并随应用一起部署。管理员在IAS管理控制台中优化这些策略。

Policy Lifecycle

策略生命周期

  1. Developer defines policies in DCL and deploys with the application
  2. Base policies appear in the IAS admin console under Authorization Policies
  3. Administrator creates custom policies (copies of base) with refined restrictions
  4. Administrator assigns policies to users via groups
  1. 开发者在DCL中定义策略并随应用部署
  2. 基础策略出现在IAS管理控制台的Authorization Policies下
  3. 管理员创建自定义策略（复制基础策略）并添加优化后的限制条件
  4. 管理员通过组将策略分配给用户

DCL Example

DCL示例

sql
DEFINE POLICY SalesOrderAccess
  AS (SELECT FROM SalesOrder
      WHERE buyer = CONTEXT('userIdentityLogonName')
      OR region = CONTEXT('userAttributes.region'));
For details, see 
references/authorization-management.md
.
sql
DEFINE POLICY SalesOrderAccess
  AS (SELECT FROM SalesOrder
      WHERE buyer = CONTEXT('userIdentityLogonName')
      OR region = CONTEXT('userAttributes.region'));
详细内容请参阅
references/authorization-management.md
。

XSUAA to IAS Migration

XSUAA到IAS迁移

SAP is migrating BTP authentication from XSUAA (SAP Authorization and Trust Management Service) to Cloud Identity Services. The recommended posture:
  • New BTP applications: Use the Identity service (BTP service) + IAS. The Identity service automates OIDC application creation in IAS.
  • Existing XSUAA applications: Coexistence is supported. Migration is incremental — SAP recommends migrating authentication to IAS while keeping XSUAA for backward compatibility.
  • Authorization: SAP is replacing XSUAA scope-based authorization with AMS policy-based authorization for new applications. Existing role-collection patterns remain supported.
For the full migration guide, see 
references/xsuaa-to-ias-migration.md
.
SAP正将BTP身份认证从XSUAA（SAP授权与信任管理服务）迁移至云身份服务。推荐方案：
  • 新BTP应用：使用Identity服务（BTP服务）+ IAS。Identity服务会自动在IAS中创建OIDC应用。
  • 现有XSUAA应用：支持共存。迁移是渐进式的——SAP建议将身份认证迁移至IAS，同时保留XSUAA以实现向后兼容。
  • 授权：对于新应用，SAP正用AMS基于策略的授权替代XSUAA基于范围的授权。现有角色集合模式仍受支持。
完整迁移指南请参阅
references/xsuaa-to-ias-migration.md
。

Trust Configuration

信任配置

Trust between BTP subaccounts and IAS is established automatically when using the Identity service. For manual configurations:
  • SAML 2.0: Upload SP metadata XML to the IAS application trust configuration
  • OIDC: Configure redirect URIs, post-logout URIs, and client authentication
使用Identity服务时，BTP子账户与IAS间的信任会自动建立。如需手动配置：
  • SAML 2.0：将SP元数据XML上传至IAS应用的信任配置
  • OIDC：配置重定向URI、注销后URI及客户端认证

BTP Subaccount Trust

BTP子账户信任

In the BTP cockpit, under Security > Trust Configuration, the IAS tenant appears after establishing the service binding. The Identity service creates the trust automatically.
For details, see 
references/troubleshooting.md
and 
references/app-integration-patterns.md
.
在BTP控制台的Security > Trust Configuration下，建立服务绑定后会显示IAS租户。Identity服务会自动创建该信任关系。
详细内容请参阅
references/troubleshooting.md
和
references/app-integration-patterns.md
。

Common Errors and Solutions

常见错误与解决方案

ErrorCauseSolution
Invalid redirect URI
Redirect URI in IAS app doesn't match the approuter callback URLAdd the exact URI (including protocol and trailing slash) in IAS app > Trust > Redirect URIs
Token audience mismatch
Token 
aud
claim doesn't include the expected client ID		Verify the application's client ID matches the one in IAS; check the Identity service binding
Trust not established
BTP subaccount has no trust to the IAS tenantRe-bind the Identity service instance or manually add IAS as trust configuration in BTP cockpit
Missing role collections
User has no roles assigned in BTPAssign role collections in BTP cockpit > Security > Role Collections, or configure AMS policies
401 on service-to-service call
Client credentials invalid or missingRegenerate client secret/certificate; verify binding credentials
SAML assertion expired
Clock drift between IdP and IASSynchronize system clocks; check IAS tenant SAML settings
Provisioning job failed
Source/target system connection issueCheck system properties, certificates, and connectivity in IPS admin console
Issuer mismatch in token
IAS tenant URL changed or wrong tenantVerify the 
iss
claim matches the IAS tenant URL configured in the BTP trust
错误原因解决方案
Invalid redirect URI
IAS应用中的重定向URI与approuter回调URL不匹配在IAS应用 > 信任 > 重定向URI中添加完全一致的URI（包括协议和末尾斜杠）
Token audience mismatch
令牌的
aud
声明未包含预期的客户端ID		验证应用的客户端ID与IAS中的一致；检查Identity服务绑定配置
Trust not established
BTP子账户与IAS租户间无信任关系重新绑定Identity服务实例，或在BTP控制台中手动添加IAS作为信任配置
Missing role collections
用户在BTP中未被分配角色在BTP控制台 > Security > Role Collections中分配角色集合，或配置AMS策略
401 on service-to-service call
客户端凭证无效或缺失重新生成客户端密钥/证书；验证绑定凭证
SAML assertion expired
IdP与IAS间存在时钟偏差同步系统时钟；检查IAS租户的SAML设置
Provisioning job failed
源/目标系统连接问题在IPS管理控制台中检查系统属性、证书及连接性
Issuer mismatch in token
IAS租户URL变更或使用了错误的租户验证
iss
声明与BTP信任配置中的IAS租户URL一致

Bundled Resources

配套资源

  1. references/identity-authentication.md
    — IAS app registration, OIDC/SAML configuration, corporate IdP federation, conditional authentication, user store
  2. references/identity-provisioning.md
    — IPS source/target/proxy systems, jobs, transformations, real-time provisioning, troubleshooting
  3. references/authorization-management.md
    — AMS policy language (DCL), policy lifecycle, CAP/BTP integration, instance-based authorization
  4. references/xsuaa-to-ias-migration.md
    — XSUAA vs IAS decision guide, coexistence, migration steps, role-collection mapping
  5. references/app-integration-patterns.md
    — Approuter + IAS, CAP + IAS/AMS, SAPUI5 frontends, mTLS/certificate auth for service-to-service
  6. references/troubleshooting.md
    — Trust errors, token validation failures, audience/issuer mismatches, SAML vs OIDC pitfalls
  1. references/identity-authentication.md
    — IAS应用注册、OIDC/SAML配置、企业IdP联邦、条件式身份认证、用户存储
  2. references/identity-provisioning.md
    — IPS源/目标/代理系统、任务、转换规则、实时配置、故障排查
  3. references/authorization-management.md
    — AMS策略语言（DCL）、策略生命周期、CAP/BTP集成、基于实例的授权
  4. references/xsuaa-to-ias-migration.md
    — XSUAA与IAS决策指南、共存方案、迁移步骤、角色集合映射
  5. references/app-integration-patterns.md
    — Approuter + IAS、CAP + IAS/AMS、SAPUI5前端、服务间调用的mTLS/证书认证
  6. references/troubleshooting.md
    — 信任错误、令牌验证失败、受众/颁发者不匹配、SAML与OIDC陷阱

Documentation Links

文档链接