Establish Trust Configuration between SAP S/4HANA On-premise and SAP BTP

Log in to the SAP S/4HANA system and run the transaction OA2C_SAML20, to get the SAML metadata.

Copy the text into a `.xml’ file into your local system.

Log on to your BTP Subaccount and navigate to the Trust Configuration option in the left side menu and click New Trust Configuration.

In the New Trust Configuration window that opens, upload the SAML2.Metadata.xml that you downloaded in the previous step (Reference: Step 1.1), and enter the name of your choice. Click on Parse and Save.

Verify the trust configuration by clicking on the recently created trust configuration in the above step (Reference: Step 2.2).

Important: Verify that the SAP backend system’s host name is correctly specified in the trust configuration. Double-check the selected Origin Key for accuracy and ensure that the protocol is set to SAML.

Click on Show Details and ensure that the Subject and Issuer provided are correct.

Navigate back to the SAP BTP Cockpit home screen and go to the Security > Users tab. Click Create.

In the Create User dialog, enter the Username, select the newly created Identity Provider, add the email address of the user, and click Create.

IMPORTANT: The e-mail address of the user must be identical to the one used in the SAP S/4HANA system. The email address can be identified using the Maintain Business User or Manage Workforce option. It’s important to note that the email IDs are identical. For example, if your SAP system user email ID is **demo.user@myexample.com** then the SAP BTP Cockpit user email ID is the as same your SAP system user email ID, and it should also be maintained as : **demo.user@myexample.com**.

Select the newly created user from the list and click on Assign Role Collection.

Assign the user role collection of the SAP Document Management Service, Integration Option (For example, SDM_roles or the role collection that you created) which is defined in the subaccount. For more information, see the 3rd step in this tutorial Create a Service Instance and then a Service Key of SAP Document Management Service, Integration Option.

In the same subaccount, navigate to the Trust Configuration and click SAML Metadata. A metadata file gets downloaded to your local system.

Go to the file in your explorer and right-click on the downloaded file in your local system from the previous step. Open it with any editor (like Notepad, Notepad++, Code, Sublime Text, etc.) scroll down to the bottom of the file to get the token endpoint and copy the URL that is located at the string:

  <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:URI" Location="https://example.com"index="1"/>