## 6.1.1.8.1.1.3.2  Register SAP BTP Subaccount in the SAML 2.0 Identity Provider
An SAML service provider interacts with an SAML 2.0 identity provider to authenticate users signing in by means of a single sign-on (SSO) mechanism. In this scenario, the SAP Authorization and Trust Management service (XSUAA) acts as a service provider representing a single subaccount. To establish trust between an identity provider and a subaccount, you must register your subaccount by providing the SAML metadata to the identity provider. The identity provider is SAP Cloud Identity Services.
## Context
Administrators must configure trust on both sides, in the service provider and in the identity provider. This description covers the side of the identity provider (SAP Cloud Identity Services). The trust configuration on the side of the SAP Cloud Identity Services must contain the following items:
- Metadata for web-based authentication or the relevant configuration information The metadata contains the configuration information, including the signing certificate and the required URLs. Create the metadata file of your subaccount using the Download SAML Metadata button in Security Trust Configuration of your subaccount.
- Use e-mail as the unique name ID attribute, and map the user attribute Groups to the assertion attribute Groups (case-sensitive). This assertion attribute is required for the assignment of roles.
We illustrate the process of configuring trust in the service provider by describing how administrators use the administration console of SAP Cloud Identity Services to register the subaccount.
To establish trust from a tenant of SAP Cloud Identity Services to a subaccount, assign a metadata file and define attribute details. The SAML 2.0 assertion includes these attributes. With the SAP Authorization
and Trust Management service as SAML 2.0 service provider, they're used for automatic assignment of SAP Authorization and Trust Management service authorizations based on information maintained in the identity provider.
## Procedure
1. Open the administration console of SAP Cloud Identity Services.
https://&lt;sap\_cloud\_identity\_services\_tenant&gt;.accounts.ondemand.com/admin
2. Choose Applications &amp; Resources Applications in the menu or the Applications tile.
3. To add a new SAML service provider, choose Create .
4. Enter the required data and choose + Create .
- Enter a name for the application that clearly identifies it as your new service provider. Users see this name in the logon screen when the authentication is requested by the SAP Authorization and Trust Management service. Seeing the name, they know which application they currently access after authentication.
- Choose SAML 2.0 as the protocol type.
5. Choose Trust SAML 2.0 Configuration .
6. Under Define from Metadata , upload the relevant metadata XML file and choose Save .
##  Note
Use the saml-&lt;subdomain&gt;-sp.xml metadata file of your subaccount. You can create the file using the Download SAML Metadata button in Security Trust Configuration of your subaccount.
If the contents of the metadata XML file are valid, the parsing process extracts the information required to populate the remaining fields of the SAML configuration. It provides the name, the URLs of the assertion consumer service and single logout endpoints, and the signing certificate.
7. Choose Default Name ID Format and select E-Mail as a unique attribute. Save your changes.
8. Choose Attributes , use Add to add an attribute named Groups with a source Identity Provider and the value Groups (case-sensitive). Save your changes.
##  Note
Be aware that the X.509 certificates exposed in the SAML 2.0 metadata have specific validities. This applies to both SAML service providers and SAML identity providers. Authentication may fail with an error once the X.509 certificates expire.
Ensure that the SAML 2.0 metadata is updated before the X.509 certificate expiry dates.
Sign the certificate with a new signing key. For more information, see Rotate Signing Keys of SAML Token [page 2390].