BTP Security Part 1: Identity, Trust and Platform Access
Understand the BTP security model: platform users (who administer accounts) vs business users (who use apps), identity providers and trust, the authorization chain from scopes to roles to role collections, and the services involved (SAP Cloud Identity Services, XSUAA).
What this complete series covers
Learn BTP Security in a clear, practical sequence — from the basic idea to real project use, troubleshooting, and interview-ready understanding.
- Who it is for
- Best for SAP consultants, developers, and learners who want a practical understanding of BTP Security.
- Prerequisites
- A basic understanding of SAP BTP helps. Hands-on steps may require a BTP subaccount and access to the relevant Integration Suite or BTP service.
- Final outcome
- By the end, you should be able to explain BTP Security clearly, follow the main end-to-end flow, apply it in a project scenario, and troubleshoot the most common issues.
- Part 1: BTP Security Part 1: Identity, Trust and Platform Access
Introduces why identity and access control matter on SAP BTP, and explains the core building blocks: Identity Authentication Service, trust configuration, users, roles, role collections, and scopes.
- Part 2: BTP Security Part 2: Trust, OAuth Clients and Role Collections Across Subaccounts
Explains how to configure trust between a subaccount and an identity provider, set up OAuth clients for service-to-service and user-to-application flows, and manage role collection
- Part 3: BTP Security Part 3: App-to-App Security with OAuth2
Learn how BTP applications authenticate to each other and to backend systems using OAuth2 client credentials flow and X.509 certificate-based mutual TLS, including how to configure
System and release assumptions: SAP BTP services evolve regularly. Capability names, screens, and setup steps can differ by region, entitlement, and tenant version; the core design principles remain the same.
Explanation
📌 KEY POINTS
✅ Platform users administer global accounts/subaccounts; business users use applications.
✅ Subaccounts trust an identity provider (typically SAP Cloud Identity Services – Identity Authentication, federated to the corporate IdP).
✅ Authorization chain: scopes (in the app) → role templates → roles → role collections → assigned to users or IdP groups.
✅ XSUAA issues OAuth tokens with scopes for apps secured by it.
⚠️ Assigning role collections to individual users instead of groups doesn't scale and leaves orphaned access.
━━━━━━━━━━━━━━━━━━━━
▶ WHAT THIS SERIES COVERS
Part 1: Identity, trust and access
Part 2: Trust, OAuth clients and role collections across subaccounts
Part 3: App-to-app security with OAuth2
━━━━━━━━━━━━━━━━━━━━
▶ 1. USER TYPES
- Platform vs business users.
━━━━━━━━━━━━━━━━━━━━
▶ 2. TRUST
- Subaccount ↔ identity provider.
━━━━━━━━━━━━━━━━━━━━
▶ 3. AUTHORIZATION CHAIN
- Scopes, roles, role collections.
━━━━━━━━━━━━━━━━━━━━
▶ 4. TOKENS
- XSUAA/IAS issue JWTs; apps check scopes.
━━━━━━━━━━━━━━━━━━━━
▶ 5. GOVERNANCE
- Group-based assignment; reviews.
━━━━━━━━━━━━━━━━━━━━
▶ STEP BY STEP
- Review trust configuration of a subaccount.
- Inspect a role collection and its roles.
- Map it to an IdP group and test login.
✅ CHECKPOINT: a user gets access only via group membership.
Code example
===== AUTHORIZATION CHAIN =====xs-security.json scope $XSAPPNAME.Display → role template Viewer → role → role collection "Orders_Viewer" → IdP group "APP_ORDERS_VIEW" ===== CLI =====btp list security/role-collection --subaccount <id>btp assign security/role-collection Orders_Viewer --to-group APP_ORDERS_VIEW --of-idp <origin>Real project scenario
A mid-size company assigned role collections to 300 users individually; leavers kept access for months. Switching to IdP group mapping tied access to HR-driven directory changes.
Common mistakes
- Individual assignments.
- Default IdP left active.
- Broad role collections.
- Mixing platform and business access.
- No reviews.
Best practices
- Group mapping.
- Corporate IdP via IAS.
- Fine-grained collections.
- Separate admin roles.
- Periodic access reviews.
Interview angle
Questions: "Platform vs business users?", "Explain scopes, roles and role collections", "How does trust work?"
Strong answer: user types, trust, authorization chain, tokens, governance.
Practice this lesson
Quick check
1. In SAP BTP's authorization model, what is the correct relationship among role templates, roles, and role collections?
2. What is the correct order of the BTP authorization chain from app to user?
3. What is the primary function of the Identity Provisioning service (IPS) within the SAP BTP security landscape?
Interview questions
1. A company assigns BTP role collections to hundreds of users individually and leavers keep access. Explain the BTP security model and your fix.
Answer it in your own words first, then compare.
2. What are the core concepts of BTP Security for Integration and Application Architecture, and how would you explain them clearly in an SAP interview?
Answer it in your own words first, then compare.
Reference-verified: the steps are checked against official SAP documentation and tutorials, and object and field names in the sample code are checked for consistency. The code has not been compiled or run on an SAP system by ERPClimb. Syntax marked release-dependent varies by SAP release, so check it in your own system.