Set Up Trust Between Identity Authentication and SAP Business Technology Platform

Enter the SAP Business Technology Platform subaccount as an administrator and expand the Security area to open Trust Management by clicking the Trust section.

To enable secure (Security Assertion Markup Language = SAML 2.0) communication the SAP Business Technology Platform Subaccount has to be set up as Service Provider.

Being in the trust management, click Edit to change the default Local Service Provider.

Change and add following information to your local provider:

Click Generate Key Pair

Save your changes.

To set up the trust from Identity Authentication to the Subaccount soon you need the subaccount’s metadata.
Download the metadata by clicking Get Metadata.

Open the SAP Cloud Identity Services - Identity Authentication Administration Console with its URL which follows the pattern:

https://<YOUR_TENANTS_ID>.accounts.ondemand.com/admin

Tenant ID is an automatically generated ID by the system. The first administrator created for the tenant receives an activation e-mail with a URL in it. This URL contains the tenant ID.

SAP Cloud Identity Services - Identity Authentication Administration Console entry screen looks (depending on authorizations) like that

The subaccount is represented in SAP Identity Authentication Service as Application.
Choose Applications & Resources and go to Applications. Click + Add on the left hand panel to enter the name of your SAP Business Technology Platform subaccount. Save your changes.

Click on the newly created application on the left side and then on Trust. Choose SAML 2.0 Configuration.

Upload the metadata XML file of your SAP Business Technology Platform subaccount. By this service provider metadata upload, the needed properties are gotten from the XML file. Save the configuration settings.

Now you have to configure which attribute is used to identify users during SAML2.0 secure communication. By default this is User ID, but as S/4HANA Cloud by default works with Login Name it shall be switched to that.

Procedure

Still being in your application’s Trust settings, select Subject Name Identifier.

Under Basic Configuration choose Login Name from the dropdown list for the attribute and save your changes.

As in most common use case the SAP Cloud Identity Services - Identity Authentication does not act as Identity Provider itself but as proxy for a probably already existing corporate identity provider this has to be set now.

In your application’s Trust settings switch to Conditional Authentication and select it.

Select your corporate Identity Provider as Default Identity Provider and click Save.

To set the Identity Authentication tenant as trusted identity provider in the SAP Business Technology Platform subaccount next, you need to get its metadata first.

Open the metadata XML by entering your tenant’s web address for it which follows this pattern:

https://<YOUR_TENANTS_ID>.accounts.ondemand.com/saml2/metadata

Save that XML to a file.

Switch back to your SAP Business Technology Platform cockpit and go to your trust settings.

Choose Application Identity Provider to add a trusted identity provider.

Upload metadata XML file of your identity authentication tenant in the Metadata File field. Save your changes.