## 6.1.1.8.1.1.2.3.2  SAP Cloud Identity Services with Corporate Identity Provider
You want to insert your SAP Cloud Identity Services tenant in the user authentication flow between your SAP BTP subaccount and your corporate identity provider. So far, you've migrated the trust configuration from your subaccount to use SAP Cloud Identity Services. Now, you configure SAP Cloud Identity Services to delegate user authentication to the corporate identity provider.
We already asked you to configure trust between your SAP Cloud Identity Services tenant and your corporate identity provider is this step: Prepare for Migration from SAML Trust to OpenID Connect [page 2291].
How you configure the connection depends on whether you're using identity federation or not. Identity federation is a configuration of SAP Cloud Identity Services. If you haven't connected SAP Cloud Identity Services to the corporate identity provider yet, use the disabled approach. If your SAP Cloud Identity Services tenant already trusts your corporate provider, then choose the approach that fits to the existing trust configuration.
For more information about identity federation, see Configure Identity Federation in the documentation of SAP Cloud Identity Services.
- Identity federation is disabled (default option) See Choose Default Identity Provider for an Application in the documentation of SAP Cloud Identity Services.
- Identity federation is enabled (advanced) See Configure Conditional Authentication for an Applicationin the documentation of SAP Cloud Identity Services.
## Identity Federation Is Disabled
As you were preparing for this migration, you saw what subject and attributes you need for your users.
For more information, see Prepare for Migration from SAML Trust to OpenID Connect [page 2291].
Attributes are passed to SAP BTP just as they're received from the corporate identity provider. Subject and attribute configurations on the SAP Cloud Identity Services application are ignored. The subject must be provided by the corporate identity provider as required. Attributes ideally come from the corporate identity provider with the attribute names used by the subaccount so far.
Compare the attributes you got before the migration to the attributes you get now.
For more information, see Test the Trust Configuration After the Migration [page 2298].
If the assertion attributes don't come from the corporate identity provider as you expected, change the names of the following assertion attributes as listed in the following table.
| From User Attribute   | To User Attribute   |
|-----------------------|---------------------|
| first_name            | given_name          |
| last_name             | family_name         |
| mail                  | email               |
Map the attribute names between what the corporate identity provider provides and what the subaccount expects, according to the protocol of the trust configuration:
- For OIDC: See Enrich Token Claims Coming from Corporate IdP in the documentation of SAP Cloud Identity Services.
- For SAML: Enrich Assertion Attributes Coming from Corporate IdP in the documentation of SAP Cloud Identity Services.
## Identity Federation Is Enabled
As you were preparing for this migration, you saw what subject and attributes you need for your users.
For more information, see Prepare for Migration from SAML Trust to OpenID Connect [page 2291].
Configure your new OIDC-based SAP Cloud Identity Services application to send the same information to your SAP BTP subaccount as before.
- Subject name identifier
See Configure the Subject Name Identifier Sent to the Application in the documentation of SAP Cloud Identity Services.
- Assertion attributes
<!-- image -->
|  Recommendation                                                                         |  Recommendation                                                                         |
|------------------------------------------------------------------------------------------|------------------------------------------------------------------------------------------|
| Change the names of the following assertion attributes as listed in the following table. | Change the names of the following assertion attributes as listed in the following table. |
| From User Attribute                                                                      | To User Attribute                                                                        |
| first_name                                                                               | given_name                                                                               |
| last_name                                                                                | family_name                                                                              |
| mail                                                                                     | email                                                                                    |
See Configuring User Attributes from a Corporate Identity Provider in the documentation of SAP Cloud Identity Services.
Compare the attributes you got before the migration to the attributes you get now.
For more information, see Test the Trust Configuration After the Migration [page 2298].