## 4.1.3.6.5 Register the Multitenant Application to the SAP SaaS Provisioning Service
To make a multitenant application available for subscription to SaaS consumer tenants, you (the application provider) must register the application in the Cloud Foundry environment via the SaaS Provisioning Service (technical name: saas-registry ).
## Context
The SaaS Provisioning Service allows application providers to register multitenant applications and services in the Cloud Foundry environment in SAP BTP. This activity is a one-time procedure per multitenant application.
## Procedure
1. Create a service instance of the SaaS Provisioning Service with a configuration JSON file in the Cloud Foundry space where the multitenant application is deployed.
```
 Tip You can create the SaaS Provisioning Service instance directly in the SAP BTP cockpit.
```
For general instructions, see Creating Service Instances.
- a. The configuration JSON file must follow the following format and set these properties (note that instead of xsappname you can use appId ):
```
{ "xsappname" : "<xsappname>", "appUrls": { "getDependencies" : "<getDependenciesUrl>", "onSubscription" : "<onSubscriptionUrl>/{tenantId}" }, "appPlans": [ { "name": "...", "description": "..." "allowedTargetPlans": "..." },{ ... } ], "displayName" : "<displayName>", "description" : "<description>", "category" : "<category>", "onSubscriptionAsync": true/false, "callbackTimeoutMillis": <int> "allowContextUpdates": true/false, }
```
Specify the following parameters:
Parameters xsappname
Description
The xsappname configured in the security descriptor file used to create the xsuaa instance (see Develop the Multitenant Application [page 391]).
## Parameters
getDependencies onSubscription
## Description
(Optional) Implement a callback API that is executed by the SaaS Provisioning Service to retrieve your application's dependencies.
##  Note
Implement only if your application has dependencies.
## API Structure
- Request:
- GET
- URL: Define the endpoint to which SaaS Provisioning Service executes the request. For example: https://&lt;app url&gt;/ callback/v1.0/dependencies
- Response:
- HTTP Status Code: 200 (Ok)
- Header: content-type: application/json
- Response Body: Specify the xsappname of each of your dependencies.
```
{ "xsappname": "..."     # The xsappname of the reusable service instance that the application consumes. Find it in the following environment variable of your application: <VCAP_SERVICES.<service>.credentials.xsappn ame > }, ....
```
##  Note
The JSON response of the callback must be encoded as either UTF8, UTF16, or UTF32, otherwise an error is returned.
Any URL that the application exposes via PUT and DELETE subscription. It must end with /{tenantId} . The tenant for the subscription is passed to this callback as a path parameter. You must keep {tenantId} as a parameter in the URL so that it's replaced at real time with the tenant calling the subscription. This callback URL is called when a subscription between a multitenant application and a consumer tenant is created ( PUT ) and when the subscription is removed ( DELETE ).
| Parameters            | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
|-----------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| appPlans              | (Optional) Specify the plan for your application. Nameit and provide a short description. With the help of plans, you can try out your application in differ- ent modes or variations. For example, an app for staging or development purposes. Note that the plans are only visible in the subaccounts that belong to the provider global account. With allowedTargetPlans , you can specifiy a list of plans to which the existing subscription can switch. This includes plans for upgrades, down- grades, and other types of transitions. |
| displayName           | (Optional) The display name of the application when viewed in the cockpit. For example, in the application's tile. If left empty, takes the application's technical name.                                                                                                                                                                                                                                                                                                                                                                     |
| description           | (Optional) The description of the application when viewed in the cockpit. For example, in the application's tile. If left empty, takes the application's display name.                                                                                                                                                                                                                                                                                                                                                                        |
| category              | (Optional) The category to which the application is grouped in the Subscriptions page in the cockpit. If left empty, gets assigned to the default category.                                                                                                                                                                                                                                                                                                                                                                                   |
| onSubscriptionAsync   | Whether the subscription callback is asynchronous. If set to true, callbackTimeoutMillis is mandatory.                                                                                                                                                                                                                                                                                                                                                                                                                                        |
| callbackTimeoutMillis | The number of milliseconds the SaaS Provisioning Service waits for the ap- plication's subscription asynchronous callback to execute, before it changes the subscription status to FAILED .                                                                                                                                                                                                                                                                                                                                                   |
| allowContextUpdates   | Whether to send updates about the changes in contextual data for the serv- ice instance.                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
| allowContextUpdates   | For example, when a subaccount with which the instance is associated is moved to a different global account.                                                                                                                                                                                                                                                                                                                                                                                                                                  |
| allowContextUpdates   | Defaut value is false.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        |
##  Sample Code Configuration JSON file (example: config.json):
```
{ "xsappname":"saas-app", "appUrls": { "getDependencies" : "https://saasapp.cfapps.eu10.hana.ondemand.com/callback/v1.0/dependencies", "onSubscription" : "https://saasapp.cfapps.eu10.hana.ondemand.com/callback/v1.0/tenants/{tenantId}" }, "displayName" : "Hello World", "description" : "My multitenant biz app", "category" : "Test" }
```
- b. Execute the following cf CLI command to create the service instance with the JSON configuration file:
```
cf create-service saas-registry application <SAAS_REGISTRY_SERVICE_INSTANCE> -c <JSON_CONFIG_FILE>
```
Specify the following parameters:
| Parameters                      | Description                                                                                               |
|---------------------------------|-----------------------------------------------------------------------------------------------------------|
| SAAS_REGISTRY_SERVICE_I NSTANCE | The new name for your service instance. Use only alphanumeric characters, hyphens, and underscores.       |
| JSON_CONFIG_FILE                | The file name of the service-specific configuration parameters, in a valid JSON object (described above). |
##  Sample Code
cf create-service saas-registry application saas-registry-application -c config.json
2. To ensure that the application trusts the JWT issued for another identity zone ( sap-provisioning ), add the environment variable: SAP\_JWT\_TRUST\_ACL
```
SAP_JWT_TRUST_ACL:'[{"clientid":"*","identityzone":"sap-provisioning"}]'
```
##  Note
The client libraries (java-security, spring-xsuaa, container security api for node.js &gt;= 3.0.6, approuter &gt;= 8.x, and sap\_xssec for Python &gt;= 2.1.0) have been updated. When using these libraries, setting the parameter SAP\_JWT\_TRUST\_ACL has become obsolete.
Instead, the xsuaa service adds audiences to the issued JSON Web Token audience field ( aud ). Client libraries provide an audience validator to check whether the token is issued for your service or application. Technically, this information is implicitly derived from the audience field ( aud ) or from the scopes.
Therefore, this update comes with a change regarding scopes. For a business application A that wants to call an application B, it's now mandatory that application B grants at least one scope to the calling business application A. Furthermore, business application A has to accept these granted scopes or authorities as part of the application security descriptor. You can grant scopes with the xs-security.json file.
For more information, see Application Security Descriptor Configuration Syntax [page 576].
3. Bind the SaaS Provisioning Service instance that you created to the multitenant application that you deployed in your Cloud Foundry space using the following cf CLI command:
```
cf bind-service <APP_NAME> <SAAS_REGISTRY_SERVICE_INSTANCE>
```
Specify the following parameters:
| Parameters                      | Description                                                                     |
|---------------------------------|---------------------------------------------------------------------------------|
| APP_NAME                        | The ID of your deployed multitenant application.                                |
| SAAS_REGISTRY_SERVICE_IN STANCE | The name of the SaaS Provisioning Service instance you created in step 1 above. |
##  Sample Code
cf bind-service saas-app saas-registry-application
##  Tip
You can bind your application to the SaaS Provisioning Service instance directly in the SAP BTP cockpit.
For general instructions, see Binding Service Instances to Applications [page 257].
4. To ensure that the environment variables in the application take effect, execute the following cf CLI command:
```
cf restage <APP_NAME>
```
Specify the following parameter:
<!-- image -->
| Parameters          | Description                                      |
|---------------------|--------------------------------------------------|
| APP_NAME            | The ID of your deployed multitenant application. |
|  Sample Code       |                                                  |
| cf restage saas-app |                                                  |
## Next Steps
1. In your global account, create a subaccount for each consumer tenant.
2. Subscribe your consumer tenants to the multitenant applications using the cockpit.
3. Test your multitenant application from consumer tenants to ensure availability, subscription lifecycle, and optional application configurations.
4. Supply your customers or users of the multitenant application with their consumer-specific URL to access the application.
For more information, see Providing Multitenant Applications to Consumers in the Cloud Foundry Environment [page 405].