orkungedik/SAP-basis-dataset huggingface dataset:
## 6.1.1.8.5.7  Rotate Signing Keys of Access Tokens
Components of SAP BTP use the digital signature of the access tokens to verify the validity of access tokens. Periodically rotate the signing keys of access tokens, either automatically or manually (see Security Recommendations for SAP Authorization and Trust Management Service [page 3241]).
## Automatic Signing Key Rotation
We recommend that you use the automatic signing key rotation for access tokens. Before you activate it, make sure that your services and applications can handle automatic rotation of signing keys.
<!-- image -->
##  Restriction
Automatic signing key rotation isn't possible with SAP HANA Cloud with principal propagation and Cloud connector
If the automatic signing key rotation is enabled, SAP BTP rotates the signing key periodically. The first signing key rotation is initiated immediately, and the new key becomes active 48 hours after the enablement. Use the SAP BTP cockpit or the SAP BTP command line interface (btp CLI).
- Enable the automatic signing key rotation in the SAP BTP cockpit:
Choose your subaccount and go to the Signing Keys tab in Security Settings . Choose Enable .
- Enable the automatic signing key rotation using the following command of the SAP BTP command line interface (btp CLI):
btp update security/settings --rotate-signing-key-automatically TRUE (Boolean)
##  Recommendation
We recommend to enable automatic rotation first in a non-productive environment and test all applications and services once the first new key becomes active. This occurs within 48 hours.
If issues arise, you can disable the automatic signing key rotation.
##  Note
You may also initiate the signing key rotation manually, for example, if needed for testing. Note that the rotation is completed within 48 hours. Use the following command of the SAP BTP command line interface (btp CLI):
btp rotate security/token-key
## Manual Rotation of Signing Keys
You can also manually rotate the signing keys. You can create a new signing key and enable it after a grace period. The latter is required so that signing key caches (for example, in libraries) can retrieve the new keys. Keep in mind that only two signing keys are allowed at the same time.
- To rotate the signing keys directly, use the following command of the SAP BTP command line interface (btp CLI). The signing key is rotated after 48 hours.
btp rotate security/token-key --key ID
For more information on how to manually manage the rotation using the SAP BTP cockpit or the SAP BTP command line interface (CLI), see the related links.
## Related Information
Manually Rotate Signing Keys of Access Tokens with the SAP BTP CLI [page 2386]
Manually Rotate Signing Keys of Access Tokens with the Security Setting API [page 2388]
## 6.1.1.8.6 Configure Trusted Domains for Multi-Environment Subaccounts
By default, applications of the subaccount, including login pages of the SAP Authorization and Trust Management service (XSUAA), can't be framed by other applications in different domains for security reasons.
## Prerequisites
•
##  Recommendation
Review the security implications of using inline frames (IFrames) with the SAP Authorization and Trust Management service.
For more information, see Implications of Using IFrames [page 3234].
- Check that your application supports the trusted domains of multi-environment subaccounts. The documentation of your application indicates whether you need to make this configuration or not. The login pages of the SAP Authorization and Trust Management service (XSUAA) supports this feature.
## Context
To prevent clickjacking or overlay attacks, web browsers follow a same origin policy. The same origin policy means you can only embedded content in your web page if the content shares the same protocol, host, and port as your web page. If the origins don't match, you must maintain a list of origins that allows for exceptions to the same origin policy. The same origin policy also applies to cookies. Cookies enable single sign-on scenarios. If the cookies have a different origin, the browser rejects them like any other content.
##  Recommendation
Instead of configuring lists of trusted domains, ensure that your application runs under the same domain as the framing application.
For more information about the SAP Custom Domain service, see the documentation of the SAP Custom Domain Service.
If your custom identity provider runs under a different domain as the framing application, you must configure the identity provider to trust the domain of the framing application, too.
## Procedure
1. Go to your subaccount (see Navigate in the Cockpit [page 2207]) and choose Security Settings .
2. Choose the Trusted Domains tab.
3. Choose Add .
4. Enter the host name for the trusted domain.
For example: https://store.example.com
Wildcards are allowed for the subdomain.
For example: https://*.example.com
##  Note
All the trusted domains together, including their space separators, can't exceed 2048 characters.
5. Save your entries.
## Next Steps
Ensure that other components framed by the host application also trust the framing domain. Typical components include the application router and the identity provider.
## Related Information
Application Router [page 439]
Configure Trust Domains (in SAP Cloud Identity Services - Identity Authentication Documentation)
## 6.1.1.8.7 Configure Token Policy for SAP Authorization and Trust Management Service
Set the token policy in the SAP BTP cockpit for SAP Authorization and Trust Management service by configuring the validity of the OpenID Connect (OIDC) tokens the service issues.
## Prerequisites
##  Recommendation
Review the security implications of token policies for SAP Authorization and Trust Management service.
For more information, see Setting Token Policy [page 3237].
## Context
On request, SAP Authorization and Trust Management service issues access and refresh tokens.
With a valid access token, you can access a protected resource. Once an access token expires, you can get new access tokens with a refresh token. Once the refresh token expires, you must reauthenticate and request new access and refresh tokens.
##  Recommendation
Relaxing the token policy means that users reauthenticate less. However, increasing the token validity also means that if a malicious user manages to steal a token, that malicious user has access until the token expires. Keep token validity as short as possible, but not less than 30 minutes.
To change the token validity, access the security settings. The change applies to all service instances in the subaccount that haven't set a specific value in the application security descriptor ( xs-security.json ).
## Procedure
1. Open the SAP BTP cockpit.
2. Go to your global account and subaccount (see Navigate in the Cockpit [page 2207]).
3. Choose Security Settings .
4. Choose the Token Validity tab.
You see the setting of the current access token validity and of the current refresh token validity.
5. Use the slider to set the validity for each token. The tooltip shows the selected value in seconds.
##  Example
- Set the access token validity to 1800 seconds
- Set the refresh token validity to 43200 seconds.
6. To save the value, choose Set Token Validity .
##  Note
It is also possible to change the token validity in the Security Settings API.
For more information, see Security Settings API on SAP Business Accelerator Hub .
## Related Information
Application Security Descriptor Configuration Syntax [page 576]
## 6.1.2  Account Administration Using Joule in the Cockpit
Learn about the administrative tasks that SAP's generative AI copilot, Joule, can assist you with SAP BTP cockpit.
##  Note
A Global Account Administrator must enable Joule in the Global Account settings by accepting the legal Terms and Conditions for Generative AI. Only then will the Joule icon appear in the cockpit tool header. Check out Enable Joule in the Cockpit to learn more.
Joule makes it easy to quickly access information about your accounts and users in the cockpit.
- Ask Joule to perform an administrative action for you from a set of pre-defined capabilities.
- Ask Joule a question about SAP BTP services or the cockpit. Joule references SAP BTP documentation and provides a summary of what it finds, as well as links to relevant help content.
Want to see Joule in action? Check out this short demo video for a brief overview of how to work with Joule.
New features and capabilities for Joule in the SAP BTP Cockpit are announced on the What's New for SAP Business Technology Platform page on SAP Help Portal (filtered for Joule ). For more information about what's in store for Joule, see the SAP Road Map Explorer .
## Enable Joule in the Cockpit [page 2397]
Enable Joule in the SAP BTP Cockpit to access Generative AI capabilities.
## Access Joule in the Cockpit [page 2397]
Launch Joule directly from the SAP BTP cockpit.
## Supported Administrative Tasks with Joule in the Cockpit [page 2398]
Learn about the administrative tasks that Joule can perform for you in the SAP BTP cockpit.
## Best Practices for Joule in the Cockpit [page 2399]
Let Joule help you find answers to questions about managing your accounts in SAP BTP cockpit.
## Troubleshooting Joule in the Cockpit [page 2400]
When you work with Joule, you could have questions about the things you see in the chat conversation. A list of common questions and answers are provided here.
## Related Information
What is Joule? Using Joule
## 6.1.2.1 Enable Joule in the Cockpit
Enable Joule in the SAP BTP Cockpit to access Generative AI capabilities.
## Prerequisites
- You have the Administrator role for the global account for which you'd like to enable Joule in the BTP cockpit.
- Joule is available for your global account (P-/S-users). Make sure you are accessing the cockpit from the SAP default identity provider.
## Procedure
1. Open the global account for which you'd like to enable Joule in the BTP cockpit.
2. Navigate to the global account settings by selecting  (Global Account Settings) .
3. In the global settings, select Joule .
4. Accept the Terms and Conditions for Generative AI and toggle the button Enable Joule .
5. Save your changes.
## Results
After a global account administrator has enabled Joule for the global account, the Joule diamond icon  will become visible in the cockpit tool header for all global account users.
## Related Information
Access Joule in the Cockpit Supported Browsers
## 6.1.2.2 Access Joule in the Cockpit
Launch Joule directly from the SAP BTP cockpit.
Joule is accessed directly from the cockpit when you click the diamond icon  in the cockpit toolbar. When the chat window opens, you can ask Joule to perform one of the supported capabilities or you can ask Joule a question about SAP BTP.
<!-- image -->
<!-- image -->
## Authentication
Joule in the BTP cockpit only supports SAP-managed IAS tenants (P-/S-users) for authentication at this time. Ensure that you are accessing the cockpit using the SAP default identity provider.
## Authorization
Because you're already logged into the SAP BTP cockpit, Joule recognizes you and can perform administrative actions on your behalf. It's important to know that Joule is bound to your cockpit authorization. In other words, Joule can only accomplish tasks for you that you're also authorized to perform.
## Related Information
Supported Browsers
Supported Administrative Tasks with Joule in the Cockpit [page 2398]
Best Practices for Joule in the Cockpit [page 2399]
Using Joule
## 6.1.2.3 Supported Administrative Tasks with Joule in the Cockpit
Learn about the administrative tasks that Joule can perform for you in the SAP BTP cockpit.
You can ask Joule to assist you with administrative scenarios related to accounts and users. If Joule recognizes the task as a supported capability, it walks you through the steps to complete the task.
##  Note
Joule doesn't support administrative actions in the Neo environment.
You can ask Joule what it can do for you, either by typing the question directly or selecting the quick start button.
Joule can help with user management :
- Add a new user to a subaccount
- Get details for global account or subaccount users
- View users and their permissions
- List role collections for your global account or subaccount
Joule can provide you with information about your global accounts or subaccounts :
- List your global accounts or subaccounts and see details
- See available regions
Joule in the BTP cockpit can also assist you with administrative tasks related to Cloud Foundry :
- View available Cloud Foundry environments
- List Cloud Foundry instances, spaces, or applications
- See the Cloud Foundry org or space users
- Add a user to a Cloud Foundry org or space
Joule can also navigate you to select pages within the cockpit:
- Go to the location in the cockpit where various information is displayed
- Navigate to trust configuration for a global account or a subaccount
- Go to the subaccount users page in order to export subaccount users
- Navigate to Cloud Foundry spaces
- Take you to Applications, Events, Service Instances, Service Marketplace, Security Groups, or Routes in a Cloud Foundry space
- Go to a HANA Cloud instance in a subaccount
## Related Information
Best Practices for Joule in the Cockpit [page 2399] Troubleshooting Joule in the Cockpit
## 6.1.2.4 Best Practices for Joule in the Cockpit
Let Joule help you find answers to questions about managing your accounts in SAP BTP cockpit.
Joule is your AI copilot in the SAP BTP Cockpit. You can leverage Joule's generative AI capabilities to help you retrieve information about your accounts and their users. Joule can also answer questions about the cockpit and SAP BTP. Just type a question in the Joule chat using natural language and let Joule scan the product documentation on the SAP Help Portal for answers. Joule summarizes the relevant SAP Help Portal information. This summary is then displayed along with the top help results. If you select a link result, you're taken directly to the topic on the SAP Help Portal.
##  Note
Joule is an addition to in-app help content, guided tours, embedded learning content, and customerspecific enablement content in SAP Companion.
New to Joule? Here are some tips to help you get started:
- To see what Joule can do for you , just ask! For example, you can type, What can you do for me?
- You can start a new the conversation at any time by selecting the New Conversation button in the Joule menu.
- You can hide the Joule chat window by selecting the X and pick up right where you left off by selecting the Joule icon in the cockpit tool header.
- Conversations expire after 8 hours . When this happens, Joule will notify you and give you the option to start a new conversation.
- Joule responds best to single requests . For example, if you want to see the users in your global account and also in a specific subaccount, send these requests as two separate queries.
- You may find that selecting a suggested action or option will provide better results than typing.
- Providing additional context may also help Joule provide a better answer. For example, if you want to see users of a specific subaccount, Joule may need more context and ask for the subaccount ID or name.
- Want to give feedback about your experience with Joule in the BTP cockpit? Simply type or select the quick start button give feedback .
## Related Information
Supported Administrative Tasks with Joule in the Cockpit [page 2398] Troubleshooting Joule in the Cockpit
## 6.1.2.5 Troubleshooting Joule in the Cockpit
When you work with Joule, you could have questions about the things you see in the chat conversation. A list of common questions and answers are provided here.
## I don't see my subaccount in the subaccount list
- Check to make sure any newly created subaccounts were successfully created. If the create action failed, you'll see a red tag on the subaccount that says Creation Failed .
## I'm unable to add users to a subaccount
- Make sure you are asking Joule to add one new user at a time to the subaccount.
## I'm seeing an error message
- Try restarting the conversation with Joule by selecting the New Conversation button in the Joule menu.
- Rephrasing your query may help Joule better understand what you want it to do.
## Joule has stopped responding
- If Joule does not respond to your prompt, try asking again or asking "are you still there?"
- Try restarting the conversation with Joule by selecting the New Conversation button in the Joule menu.
## I'm getting an Identity Provider error message
- If you're seeing an error message about the Identity Provider configuration, try enabling third-party cookies in your browser.
## Get Support
If you need more help, see Getting Support. Please use ticket component BC-CP-CPT-AI when contacting support. It may be helpful to include screen shots of your interactions with Joule in the cockpit.
## 6.1.3  Account Administration Using the SAP BTP Command Line Interface (btp CLI)
Use the SAP BTP command line interface (btp CLI) for all account administration tasks, such as creating or updating subaccounts, authorization management, and working with service brokers and platforms. It is an alternative to the SAP BTP cockpit for users who like to work in a terminal or want to automate operations using scripts.
The btp CLI offers convenient features for interactive use as well as for scripting: For the interactive user, there's login via SSO, command autocompletion, as well as several interactive commands with prompts. But all commands can also be run with parameters, and the command output can be set to json format, so the btp CLI is perfect for scripting.
If you want to use the btp CLI for scripting, we recommend to use the --format json option or to persistently set the output format to json with btp set config --format json . See Change the Output Format to JSON [page 2429] and Change Configuration Settings [page 2428].
## Documentation
In this documentation, you learn how to download, install, update, and use the btp CLI. Additionally, see the following:
- btp CLI Command Reference: The command reference contains descriptions of all commands with their parameters, as well as examples, tips, and links to further conceptual documentation.
- Get Started with the SAP BTP Command Line Interface (btp CLI) : This tutorial walks you through downloading and installing the btp CLI client, understanding the syntax, and running your first commands.
- Setting Up a Global Account via the Command Line [page 165]: This chapter lists the commands of the btp CLI and the cf CLI that you need to create a subaccount and enable Cloud Foundry.
- What's New for SAP BTP Command Line Interface: Release notes for the btp CLI.
When working with the btp CLI in your terminal, you can access the help by executing btp help or by appending --help to a command.
## How the btp CLI Works
<!-- image -->
You download the btp CLI client to your local desktop and access it through the shell of your operating system. The client then accesses all required platform services through its backend, the CLI server, where the command definitions are stored. The CLI server delegates authentication and authorization to the authorization server, and forwards trust to the platform services, which then take care of authorization at the execution of each command.
## Related Information
btp CLI Command Reference
## 6.1.3.1 Download and Start Using the btp CLI Client
To use the SAP BTP command line interface (btp CLI), you need to download the client first.
## Context
Each client version is supported for at least one year. Most of the updates to the btp CLI don't require a new client installation, but are made available through the btp CLI server so that you can use them in your installed version of the client. Using the latest version of the client ensures that you don't miss out on any new features or security updates. If you already have the client installed, you can see which version you have by simply entering btp .
To stay informed about features, client releases, as well as client deprecations and discontinuations, check out the What's New for SAP Business Technology Platform page on SAP Help Portal (filtered for SAP BTP Command Line Interface ).
The client is available for 64-bit versions of the following operating systems:
- Microsoft Windows (amd64)
- Apple macOS (amd64 and arm64)
- Linux (amd64 and arm64)
There are various ways of downloading the client for each operating system, as explained below.
## Related Information
How to Work with the btp CLI [page 2412]
```
Command Syntax of the btp CLI [page 2408] Set a Target for Subsequent Commands with btp target [page 2425] btp CLI Command Reference
```
## 6.1.3.1.2 Get the btp CLI Client for Apple macOS (amd64 and arm64)
## Procedure
1. To get the btp CLI client, you can either run the installation script or download the client manually.
- Option 1: Installation Script
When you run the installation script in your Apple macOS terminal, you will be guided through the installation process:
```
curl https://cli.btp.cloud.sap/btpcli-install.sh | zsh
```
To uninstall the btp CLI:
curl https://cli.btp.cloud.sap/btpcli-uninstall.sh | zsh
- Option 2: Homebrew Package Manager
You can use Homebrew open source package management software to download the latest version of the btp CLI. Homebrew downloads the client from SAP Development Tools. In your terminal, run:
brew install --cask btp
- Option 3: Manually install the latest Apple macOS (amd64 and arm64) version
1. Download the latest Apple macOS client (amd64 or arm64) from SAP Development Tools.
2. Extract the client from tar.gz archive. Open the tar.gz file by double-clicking it.
3. Copy the client executable from the unpacked folder to a directory of your choice. We recommend the following, because it ensures that you can call btp system-wide, i.e., that it is in your PATH: /usr/local/bin
4. Optional: If you have a proxy server configured in your environment, you must specify its address and port as environment variable HTTPS\_PROXY or https\_proxy to access SAP BTP. For example, HTTPS\_PROXY=https://my-https-proxy:1234 . The specified proxy server is then used for HTTPS requests, unless overridden by the NO\_PROXY or no\_proxy, environment variables, which define a comma-separated list of hosts to be excluded from proxying.
2. In your terminal, run btp . Note that you need read and write permissions in the target folder to run this executable.
3. Log into your global account with btp login and enter the required information. You must confirm the btp CLI server ( https://cli.btp.cloud.sap/ ) and, if you have more than one, select your global account. For details, see Log in.
4. Once you're logged in, familiarize yourself with the btp CLI, for example with How to Work with the btp CLI, Command Syntax of the btp CLI, or simply by trying out a few commands, such as the following:
btp list accounts/subaccount btp list security/user
btp get security/user "name@example.com"
btp get accounts/global-account"
##  Tip
Use the command autocompletion feature in the btp CLI to save keystrokes when entering command actions, group-object combinations, and their parameters in the command line. For more information, see Enable Command Autocompletion [page 2423].
5. If you're going to work in a subaccount of this global account, consider setting the target to this subaccount using btp target and select the subaccount. See Set a Target for Subsequent Commands with btp target.
6. To view the current context, target, and version, use btp .
## 6.1.3.1.3 Get the btp CLI Client for Linux (amd64 and arm64)
## Procedure
1. To get the btp CLI client, you can either run the installation script or download the client manually.
- Option 1: Installation Script When you run the installation script in your Linux terminal, you will be guided through the installation process:
```
curl https://cli.btp.cloud.sap/btpcli-install.sh | bash
```
To uninstall the btp CLI:
```
curl https://cli.btp.cloud.sap/btpcli-uninstall.sh | bash
```
- Option 2: Homebrew Package Manager
You can use Homebrew open source package management software to download the latest version of the btp CLI. Homebrew downloads the client from SAP Development Tools. In your terminal, run:
```
brew install --cask btp
```
- Option 3: Manually install the latest Linux (amd64 and arm64) version
1. Download the latest Linux client (amd64 or arm64) from SAP Development Tools.
2. Extract the client from tar.gz archive. Use the terminal to open the tar.gz file with tar -xzf btp-cli-linux-amd64latest.tar.gz
3. Copy the client executable from the unpacked folder to a directory of your choice. We recommend the following, because it ensures that you can call btp system-wide, i.e., that it is in your PATH: /usr/local/bin
4. Optional: If you have a proxy server configured in your environment, you must specify its address and port as environment variable HTTPS\_PROXY or https\_proxy
- to access SAP BTP. For example, HTTPS\_PROXY=https://my-https-proxy:1234 . The specified proxy server is then used for HTTPS requests, unless overridden by the NO\_PROXY
or no\_proxy, environment variables, which define a comma-separated list of hosts to be excluded from proxying.
2. In your terminal, run btp . Note that you need read and write permissions in the target folder to run this executable.
3. Log into your global account with btp login and enter the required information. You must confirm the btp CLI server ( https://cli.btp.cloud.sap/ ) and, if you have more than one, select your global account. For details, see Log in.
4. Once you're logged in, familiarize yourself with the btp CLI, for example with How to Work with the btp CLI, Command Syntax of the btp CLI, or simply by trying out a few commands, such as the following:
```
btp list accounts/subaccount btp list security/user btp get security/user "name@example.com" btp get accounts/global-account"
```
##  Tip
Use the command autocompletion feature in the btp CLI to save keystrokes when entering command actions, group-object combinations, and their parameters in the command line. For more information, see Enable Command Autocompletion [page 2423].
5. If you're going to work in a subaccount of this global account, consider setting the target to this subaccount using btp target and select the subaccount. See Set a Target for Subsequent Commands with btp target.
6. To view the current context, target, and version, use btp .
## 6.1.3.2 Get Updates
Updating the btp CLI client is essentially replacing the old executable file with a newer version.
## Context
Each btp CLI client version is supported for at least a year after its release, but we recommend to regularly update the client. This way, you won't miss any new features or security updates. The What's New for SAP Business Technology Platform page on SAP Help Portal announces new features and informs you if you need a client update to use them. If your client version is deprecated, an update hint is displayed in the client as well.
To find out the version of the CLI client you are using, run btp --info or simply btp .
## Procedure
1. Get the latest version either by re-running the installation script or downloading the client manually.
2. Extract the client file (for example: btp.exe ) and replace the old file with this new one.
3. Work with the btp CLI as usual and enjoy the new features.
## Related Information
Log in [page 2416] Commands in the btp CLI [page 2433]
## 6.1.3.4.1 Get Help
There is extensive help in the btp CLI about every command. You can get help with the help action or the --help option.
There are several ways to call help in the btp CLI, and there is help on all levels, from a basic entry page thats explains the syntax to very detailed command-specific help that explains the usage of a command and its parameters in detail.
The easiest way to get help is probably the help action (for basic help, use btp help , as shown in the examples below. But you can also place --help at the end or beginning of a command call, for example, btp list help , btp --help list , and btp list --help are interchangeable.
Here's the help syntax:
- btp help
- btp help &lt;ACTION&gt;
- btp help &lt;GROUP&gt;
- btp help &lt;GROUP&gt;/&lt;OBJECT&gt;
| Example Help Calls (progressing in level of detail)   | What to Expect                                                                                                                                         |
|-------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------|
| btp help                                              | Explains the syntax and shows plenty of examples.                                                                                                      |
| btp help all                                          | Displays an overview of all available commands, ordered ac- cording to their group/object combinations.                                                |
| btp help list                                         | Displays list commands with short summaries.                                                                                                           |
| btp help accounts                                     | Displays all objects in accounts group, and all available ac- tions per group/object combination.                                                      |
| btp help accounts/subaccount                          | Displays all available commands for this group/object com- bination.                                                                                   |
| btp help list accounts/subaccount                     | Displays command-specific help, such as usage, a list of all parameters with descriptions, helpful tips, examples, and links to further documentation. |
## Related Information
Command Syntax of the btp CLI [page 2408]
## 6.1.3.4.2 View Version and Current Context
To find out the current context you're working in, run the command btp --info or simply btp .
## Procedure
Use btp --info or just btp .
The client displays its own version, usage information, the CLI server URL and version, the current user, the location of the configuration file, as well as the global account, directory, or subaccount you're targeting in their account hierarchy.
## Related Information
Set a Target for Subsequent Commands with btp target [page 2425]
## 6.1.3.4.3.1  Log in with Single Sign-On
Use the single sign-on parameter ( btp login --sso ) to log in to your identity provider through a browser instead of passing username and password on the command line.
## Prerequisites
Login through a browser is only available if you use the default server URL that is proposed by the CLI during login ( https://cli.btp.cloud.sap/ ). This is the case unless your operator has provided you specifically with a different server URL.
## Context
If you have a custom identity provider configured in your global account, use btp login --sso --idp &lt;TENANT&gt; . See Log in with a Custom Identity Provider [page 2421].
##  Tip
If you like logging in through single sign-on in a browser, you can configure this as the default behavior of btp login to save a few keystrokes at login. Use btp set config --login.sso browser . See Change Configuration Settings [page 2428] .
## Procedure
1. Enter the following and press ENTER to be prompted for the server URL and the subdomain of your global account:
```
btp login --sso
```
Alternatively, you can pass the server URL and the subdomain of your global account as parameters:
```
btp login --sso --url https://cli.btp.cloud.sap/ --subdomain <my-subdomain>
```
To suppress the automatic browser-opening, you can run the command as follows:
```
btp login --sso manual
```
2. Authenticate directly at your identity provider through your browser.
If you already have an active session, the identity provider immediately transfers a token to the client, which completes your login. Otherwise, you need to enter your credentials.
## Results
You've successfully logged in. You can return to the command line to work in your global account or - at first login - to select the global account for login.
## Related Information
Log in [page 2416]
Log in with a Custom Identity Provider [page 2421]
## 6.1.3.4.3.2  Log in with a Custom Identity Provider
## Context
If trust is configured between your global account and a custom identity provider, you need to use the --idp parameter to log in through this identity provider. As value, you provide its tenant ID. To retrieve the required value, you can use btp list security/trust and check the Tenant column. Or you can use the Global Account view of the cockpit under Security → Trust Configuration → Custom Platform Identity Providers and use the value from the BTP CLI column.
##  Note
To work with users from a custom identity provider, you need to specify the --of-idp parameter by providing the origin key of the custom identity provider. This is applicable to the following commands: btp list security/user , btp get security/user , btp delete security/user , btp assign security/role-collection , btp unassign security/role-collection , and you find this origin key in the cockpit under Security .
To learn how to configure trust to a custom identity provider, see Establish Trust and Federation of Custom Identity Providers for Platform Users [page 2316] or the command help of btp create security/trust.
<!-- image -->
##  Restriction
Keep in mind that each user is allowed a maximum of 10 parallel sessions per identity provider. This number takes into account all tools, including the cockpit and CLIs.
For more information, see Restrictions When Using Custom Identity Providers for Platform Users [page 2321].
## Procedure
1. To make use of single sign-on, log in with:
2. To provide user and password on the command line, log in with:
```
btp login --sso --idp <TENANT>
```
```
btp login --idp <TENANT>
```
You will be promped for all required login information.
## Related Information
Establish Trust and Federation of Custom Identity Providers for Platform Users [page 2316] Trust and Federation with Identity Providers [page 2280] Log in [page 2416]
## 6.1.3.4.4 Log out
Logging out of the configured server removes all user-specific data from the configuration file.
## Context
Once you're finished using the btp CLI and you want to ensure that your locally stored credentials are immediately deleted, you can run the logout command. If you choose not to log out, your credentials will expire 24 hours after you last command execution, but the next time you log in, the btp CLI will propose your current subdomain and user so you won't have to type it in again.
## Procedure
To log out, use btp logout .
This terminates your active logout session and ensures that all user-specific data is removed. The next time you log in, you will have to type in the subdomain of the global account and your user.
## Related Information
Log in [page 2416]
## 6.1.3.4.7 Change Configuration Settings
Change the configuration settings to customize the behavior of the btp CLI.
## Context
There are a few configuration settings that you can set to customize how the btp CLI works.
These settings are saved to the configuration file, which governs how the btp CLI works. You can have more than one configuration file for working in different accounts at the same time by logging in with the --config PATH option and then also providing it with each command call. See Specify the Location of the Configuration File [page 2431].
To find out where the configuration file is stored, use btp --info . Use the following commands to manage your configuration settings:
## Procedure
1. To change a setting, run:
```
btp [OPTIONS] set config [--format FORMAT] [--verbose BOOL] [-target.hierarchy BOOL]
```
```
--format FORMAT The output format of commands. Valid values: text (de-
```
fault), json
| --verbose BOOL          | If set to true, command output includes tracing informa- tion for support. Valid values: false (default), true                                                                                                                |
|-------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| --target.hierarchy BOOL | If set to true, btp target displays the full hierarchy of all global accounts. Valid values: false (default), true See Set a Target for Subsequent Commands with btp tar- get [page 2425].                                    |
| --login.sso MODE        | Single sign-on mode of btp login . Valid values: none (default), browser, manual. For example, if you want btp login to always open a browser for login at your iden- tity provider, use btp set config --login.sso browser . |
2. To list the current settings, run:
3. To reset individual or all settings back to their default values, run:
```
btp [OPTIONS] list config
```
```
btp [OPTIONS] reset config [--format] [--verbose] [--target.hierarchy] [--all]
```
## Related Information
Specify the Location of the Configuration File [page 2431]
## 6.1.3.4.10  Provide Feedback about the btp CLI
With btp feedback , you can open a feedback survey in a web browser in which you can share your opinion about the btp CLI with the development team.
## Context
A short survey will open in your web browser, in which you're asked how satisfied you are with the btp CLI, and where you can share additional comments. This feedback is carefully analyzed by the development team and a valuable source of input for further improving the btp CLI.
You can also fill it out now: Take our survey about the btp CLI
Thanks a lot for your participation. Your feedback is greatly appreciated.
## Procedure
Open the feedback survey with the following command:
btp feedback
## 6.1.3.5 Commands in the btp CLI
Find a full reference of all btp CLI commands and their parameters here: btp CLI Command Reference.
Working with Global Accounts, Directories, and Subaccounts Using the btp CLI [page 2434]
Use the SAP BTP command line interface (btp CLI) to manage operations with global accounts, directories, and subaccounts.
## Setting Entitlements Using the btp CLI [page 2438]
Use the SAP BTP command line interface (btp CLI) to set entitlements to define the functionality or permissions available for users of global accounts, directories, and subaccounts.
## Working with Environments Using the btp CLI [page 2439]
Use the SAP BTP command line interface (btp CLI) to manage runtime environment instances in a subaccount. For example, enable the Cloud Foundry environment by creating a Cloud Foundry org (environment instance).
## Working with Multitenant Applications Using the btp CLI [page 2440]
Use the SAP BTP command line interface (btp CLI) to manage the multitenant applications to which a subaccount is entitled to subscribe.
## Working with External Resource Providers Using the btp CLI [page 2441]
Use the SAP BTP command line interface (btp CLI) to get details, or to create or delete resource provider instances in a global account.
Managing Trust from SAP BTP to an SAP Cloud Identity Services Tenant [page 2442]
SAP BTP supports identity federation. Its concept is to reuse the user bases of identity providers. To use a custom identity provider, your global account or subaccount in SAP BTP must have a trust relationship to the identity provider you want to use.
## Managing Users and Their Authorizations Using the btp CLI [page 2445]
User authorizations are managed by assigning role collections to users (for example, Subaccount Administrator). Use the SAP BTP command-line interface (btp CLI) to manage roles and role collections, and to assign role collections to users.
## Managing Signing Keys for Access Tokens [page 2447]
Use the SAP BTP command line interface (btp CLI) to manage signing keys for access tokens in the subaccount.
## Managing Security Settings [page 2448]
Use the SAP BTP command line interface (btp CLI) to display and update the security settings for the subaccount.
## Managing API Credentials for Calling REST APIs of SAP Authorization and Trust Management Service [page 2449]
Use the SAP BTP command line interface (btp CLI) to manage API credentials, which enable you to access the REST APIs of the SAP Authorization and Trust Management service.
## Working with Resources of the SAP Service Manager Using the btp CLI [page 2450]
Use the SAP BTP command line interface to perform various operations related to your platforms, attached service brokers, service instances, and service bindings.
## 6.1.3.5.2 Setting Entitlements Using the btp CLI
Use the SAP BTP command line interface (btp CLI) to set entitlements to define the functionality or permissions available for users of global accounts, directories, and subaccounts.
##  Tip
By default, all commands are executed in the global account you're logged into. To change this to a directory or subaccount, use btp target . See Set a Target for Subsequent Commands with btp target [page 2425].
| Task                                                                                                  | Run the command...               | Command help                    |
|-------------------------------------------------------------------------------------------------------|----------------------------------|---------------------------------|
| Get all the entitlements and quota as- signments for a global account, directo- ries, and subaccounts | btp list accounts/ entitlement   | btp list accounts/entitlement   |
| Assign or update an entitlement to a subaccount or a directory                                        | btp assign accounts/ entitlement | btp assign accounts/entitlement |
Parent topic:
Commands in the btp CLI [page 2433]
## Related Information
Working with Global Accounts, Directories, and Subaccounts Using the btp CLI [page 2434]
Working with Environments Using the btp CLI [page 2439]
Working with Multitenant Applications Using the btp CLI [page 2440]
Working with External Resource Providers Using the btp CLI [page 2441]
Managing Trust from SAP BTP to an SAP Cloud Identity Services Tenant [page 2442]
Managing Users and Their Authorizations Using the btp CLI [page 2445]
Managing Signing Keys for Access Tokens [page 2447]
Managing Security Settings [page 2448]
Managing API Credentials for Calling REST APIs of SAP Authorization and Trust Management Service [page 2449]
Working with Resources of the SAP Service Manager Using the btp CLI [page 2450]
btp CLI Command Reference
Entitlements and Quotas [page 117]
## 6.1.3.5.5 Working with External Resource Providers Using the btp CLI
Use the SAP BTP command line interface (btp CLI) to get details, or to create or delete resource provider instances in a global account.
##  Note
The use of this functionality is subject to the availability of the supported non-SAP cloud vendors in your country or region.
Creating a resource provider instance allows your global account to connect to your provider account on a non-SAP cloud vendor. Through this channel, you can then consume remote service resources that you already own and which are supported by SAP BTP.
| Task                                                     | Run the command...                     | Command help                          |
|----------------------------------------------------------|----------------------------------------|---------------------------------------|
| List all resource provider instances in a global account | btp list accounts/ resource-provider   | btp list accounts/resource-provider   |
| Get details about a resource provider instance           | btp get accounts/resource- provider    | btp get accounts/resource-provider    |
| Create a resource provider instance                      | btp create accounts/ resource-provider | btp create accounts/resource-provider |
| Task                                | Run the command...                     | Command help                          |
|-------------------------------------|----------------------------------------|---------------------------------------|
| Update a resource provider instance | btp update accounts/ resource-provider | btp update accounts/resource-provider |
| Delete a resource provider instance | btp delete accounts/ resource-provider | btp delete accounts/resource-provider |
For more information, see Managing Resource Providers [page 2213].
Parent topic:
Commands in the btp CLI [page 2433]
## Related Information
Working with Global Accounts, Directories, and Subaccounts Using the btp CLI [page 2434]
Setting Entitlements Using the btp CLI [page 2438]
Working with Environments Using the btp CLI [page 2439]
Working with Multitenant Applications Using the btp CLI [page 2440]
Managing Trust from SAP BTP to an SAP Cloud Identity Services Tenant [page 2442]
Managing Users and Their Authorizations Using the btp CLI [page 2445]
Managing Signing Keys for Access Tokens [page 2447]
Managing Security Settings [page 2448]
Managing API Credentials for Calling REST APIs of SAP Authorization and Trust Management Service [page 2449]
Working with Resources of the SAP Service Manager Using the btp CLI [page 2450]
btp CLI Command Reference
## 6.1.3.5.8 Managing Signing Keys for Access Tokens
Use the SAP BTP command line interface (btp CLI) to manage signing keys for access tokens in the subaccount.
You can create and manage signing keys for access tokens.
<!-- image -->
The newly created key only becomes active once you enable it. The number of keys is restricted to 2 per subaccount.
When a signing key is enabled, all newly requested tokens are signed with this key and the existing signing key is disabled. It's also possible to list all signing keys, no matter whether they're enabled or disabled. You can also delete a disabled signing key.
For more information, see Rotate Signing Keys of Access Tokens .
| Task                                                                                          | Run the command ...           | Command help                     |
|-----------------------------------------------------------------------------------------------|-------------------------------|----------------------------------|
| Create a new signing key for ac- cess tokens                                                  | btp create security/token-key | btp create se- curity/token- key |
| Enable an existing key as signing key for access tokens                                       | btp enable security/token-key | btp enable se- curity/token- key |
| Delete a disabled signing key for access tokens                                               | btp delete security/token-key | btp delete se- curity/token- key |
| List the existing signing keys for access tokens and indicates which key is currently enabled | btp list security/token-key   | btp list secur- ity/token-key    |
Parent topic:
Commands in the btp CLI [page 2433]
## Related Information
Working with Global Accounts, Directories, and Subaccounts Using the btp CLI [page 2434]
Setting Entitlements Using the btp CLI [page 2438]
Working with Environments Using the btp CLI [page 2439]
Working with Multitenant Applications Using the btp CLI [page 2440]
Working with External Resource Providers Using the btp CLI [page 2441]
Managing Trust from SAP BTP to an SAP Cloud Identity Services Tenant [page 2442]
Managing Users and Their Authorizations Using the btp CLI [page 2445]
Managing Security Settings [page 2448]
Managing API Credentials for Calling REST APIs of SAP Authorization and Trust Management Service [page 2449]
Working with Resources of the SAP Service Manager Using the btp CLI [page 2450]