secondsky/sap-btp-cloud-identity-services
|
npx skills add https://github.com/secondsky/sap-skills --skill sap-btp-cloud-identity-servicesSAP Cloud Identity Services are a group of services on SAP BTP that manage identity and access across cloud and on-premise systems. They provide single sign-on, user provisioning, and policy-based authorization.
The services comprise:
| Service | Purpose | Key Objects |
|---------|---------|-------------|
| IAS | Authentication & SSO | Applications (OIDC/SAML), IdPs, conditional auth, user store |
| IPS | User/group provisioning | Source systems, target systems, proxy systems, transformations, jobs |
| Identity Directory | User persistence | Users, groups, custom schemas, Global User ID |
| AMS | Policy-based authorization | Authorization policies, DCL rules, policy templates, restrictions |
IAS is the entry point for authentication in SAP BTP applications. It supports OIDC and SAML 2.0 protocols, acts as an identity provider or a proxy to corporate IdPs, and provides conditional authentication based on user attributes, email domain, user group, or IP range.
Register applications in the IAS admin console under Applications and Resources > Applications. Each application defines:
When using the SAP BTP Identity service (xsuaa replacement), the service instance automatically creates an OIDC application in IAS. No manual registration is needed.
IAS can act as a proxy: end users authenticate at a corporate IdP (Azure AD, Okta, etc.), and IAS bridges the token for SAP applications. Configure under Applications and Resources > Corporate Identity Providers.
For details, see references/identity-authentication.md.
IPS synchronizes users and groups between systems. It supports source, target, and proxy system types with configurable transformations and scheduling.
For details, see references/identity-provisioning.md.
AMS enables policy-based, instance-level authorization for BTP applications. Developers define authorization policies in Data Control Language (DCL) — an SQL-like language — and deploy them with the application. Administrators refine policies in the IAS admin console.
DEFINE POLICY SalesOrderAccess
AS (SELECT FROM SalesOrder
WHERE buyer = CONTEXT('userIdentityLogonName')
OR region = CONTEXT('userAttributes.region'));
For details, see references/authorization-management.md.
SAP is migrating BTP authentication from XSUAA (SAP Authorization and Trust Management Service) to Cloud Identity Services. The recommended posture:
For the full migration guide, see references/xsuaa-to-ias-migration.md.
Trust between BTP subaccounts and IAS is established automatically when using the Identity service. For manual configurations:
In the BTP cockpit, under Security > Trust Configuration, the IAS tenant appears after establishing the service binding. The Identity service creates the trust automatically.
For details, see references/troubleshooting.md and references/app-integration-patterns.md.
| Error | Cause | Solution |
|-------|-------|----------|
| Invalid redirect URI | Redirect URI in IAS app doesn't match the approuter callback URL | Add the exact URI (including protocol and trailing slash) in IAS app > Trust > Redirect URIs |
| Token audience mismatch | Token aud claim doesn't include the expected client ID | Verify the application's client ID matches the one in IAS; check the Identity service binding |
| Trust not established | BTP subaccount has no trust to the IAS tenant | Re-bind the Identity service instance or manually add IAS as trust configuration in BTP cockpit |
| Missing role collections | User has no roles assigned in BTP | Assign role collections in BTP cockpit > Security > Role Collections, or configure AMS policies |
| 401 on service-to-service call | Client credentials invalid or missing | Regenerate client secret/certificate; verify binding credentials |
| SAML assertion expired | Clock drift between IdP and IAS | Synchronize system clocks; check IAS tenant SAML settings |
| Provisioning job failed | Source/target system connection issue | Check system properties, certificates, and connectivity in IPS admin console |
| Issuer mismatch in token | IAS tenant URL changed or wrong tenant | Verify the iss claim matches the IAS tenant URL configured in the BTP trust |
references/identity-authentication.md — IAS app registration, OIDC/SAML configuration, corporate IdP federation, conditional authentication, user storereferences/identity-provisioning.md — IPS source/target/proxy systems, jobs, transformations, real-time provisioning, troubleshootingreferences/authorization-management.md — AMS policy language (DCL), policy lifecycle, CAP/BTP integration, instance-based authorizationreferences/xsuaa-to-ias-migration.md — XSUAA vs IAS decision guide, coexistence, migration steps, role-collection mappingreferences/app-integration-patterns.md — Approuter + IAS, CAP + IAS/AMS, SAPUI5 frontends, mTLS/certificate auth for service-to-servicereferences/troubleshooting.md — Trust errors, token validation failures, audience/issuer mismatches, SAML vs OIDC pitfallsTake secondsky/sap-btp-cloud-identity-services from the repository into ~/.claude/skills for personal
use, or into .claude/skills inside a project.
The agent identifies a skill by the name field in its header. Two skills with the
same name cannot sit side by side — one of them will be ignored.