BTP & Integrationintermediate

BTP Identity Authentication Part 2: Trust and Corporate IdP Federation

Key takeaway

Connect everything: establish OIDC trust between BTP subaccounts and IAS, add the corporate IdP to IAS (SAML or OIDC), configure subject name identifiers and attributes, send groups, set up Identity Provisioning, and test federation end to end.

Explanation

📌 KEY POINTS
✅ BTP subaccount trust to IAS uses OIDC (establish trust in the cockpit).
✅ The corporate IdP is added in IAS as a corporate identity provider (SAML 2.0 or OIDC).
✅ Subject name identifier (e.g. email or user ID) must be consistent across systems.
✅ Groups/attributes sent in assertions drive role collection mapping.
⚠️ A changed subject identifier creates "new" users — existing role assignments no longer apply.

━━━━━━━━━━━━━━━━━━━━
▶ WHERE WE ARE
Part 1 explained IAS. Now federation.\n\n━━━━━━━━━━━━━━━━━━━━\n▶ 1. BTP ↔ IAS TRUST\n• OIDC; application created in IAS.

━━━━━━━━━━━━━━━━━━━━
▶ 2. CORPORATE IDP

Metadata exchange; SAML/OIDC.

━━━━━━━━━━━━━━━━━━━━
▶ 3. IDENTIFIERS & ATTRIBUTES

Subject name ID; email; groups.

━━━━━━━━━━━━━━━━━━━━
▶ 4. PROVISIONING

IPS jobs for users and groups.

━━━━━━━━━━━━━━━━━━━━
▶ 5. TESTING

Test users; token inspection.

━━━━━━━━━━━━━━━━━━━━
▶ STEP BY STEP

Establish trust from subaccount to IAS.
Add corporate IdP to IAS.
Configure attributes and test login.

✅ CHECKPOINT: users log in with corporate credentials and get group-based roles.

Code example

ABAP Code

===== SETUP ORDER =====BTP cockpit → Trust Configuration → Establish Trust (IAS tenant, OIDC)IAS → Corporate Identity Providers → add Entra ID (SAML metadata) → assign to applicationIAS application → attributes: email, groups | subject name identifier: emailIdentity Provisioning → source Entra ID → target IAS (users, groups) ===== TEST =====Login with test user → inspect token (groups present?) → role collection mapping works?

Real project scenario

During a production cutover, users could log in but saw no apps. The groups attribute was not configured in the IAS application. Adding it restored role mappings immediately.

Common mistakes

Changing subject IDs.
Missing groups.
No test users.
Manual user creation.
Skipping metadata refresh.

Best practices

Stable identifier.
Send groups.
Test users.
Provisioning.
Monitor certificate/metadata expiry.

Interview angle

Questions: "How do you federate a corporate IdP?", "What is the subject name identifier?", "Why might users have no access after login?"
Strong answer: trust setup, corporate IdP, identifiers/attributes, provisioning, testing.

Practice this lesson

Quick check

1. Candidates are often asked to trace the full authentication redirect flow from a user hitting a BTP application URL through to an authenticated session, and to explain where in that flow an attribute mapping problem would surface versus whe. In the Identity Authentication context, which answer shows the strongest practical judgment?

2. After cutover, users can log in but see no apps. What is the likely cause?

3. Which protocol is used for trust between a BTP subaccount and Identity Authentication in current setups?

Interview questions

1. Set up trust and corporate IdP federation for new BTP subaccounts.

Answer it in your own words first, then compare.

2. How would you apply Identity Authentication in a real SAP project? Walk through the design or implementation approach.