## 6.1.1.8.1.1.1  Establish Trust and Federation Between SAP Authorization and Trust Management Service and SAP Cloud Identity Services
Use your SAP Cloud Identity Services tenant as an identity provider or a proxy to your own identity provider hosting your business users. This method avoids the upload and download of SAML meta data by using OpenID Connect (OIDC) to establish trust.
## Prerequisites
- You have subaccount administrator permissions.
- You have a tenant of SAP Cloud Identity Services.
For more information, see Get Your Tenant in the documentation for SAP Cloud Identity Services.
- The SAP Cloud Identity Services tenant is associated with the customer IDs of the relevant global account of SAP BTP.
- For more information, see Reuse SAP Cloud Identity Services Tenants for Different Customer IDs in the documentation for SAP Cloud Identity Services.
## Context
##  Note
The content in this section is not relevant for China (Shanghai) and Government Cloud (US) regions.
Consider the following restrictions and tips before you start.
##  Restriction
- You can only establish trust with a single tenant of SAP Cloud Identity Services per subaccount using this method.
- Your SAP Cloud Identity Services tenant can be changed only when no SAP Cloud Identity Servicesbased subscriptions (for example, SAP Build Work Zone using authentication with SAP Cloud Identity Services, SAP Build Apps, or SAP Integration Suite, advanced event mesh) exist.
- If you have an SAML trust configuration for a certain tenant already, you can't add an OIDC trust configuration to the same tenant in addition. Instead, migrate the SAML trust configuration to OIDC (see Migration from SAML Trust to OpenID Connect Trust with SAP Cloud Identity Services [page 2288]).
Consider the upper limits for trust configurations in the subaccount. See Limits for the Subaccount [page 3249].
##  Tip
- We recommend that you use SAP Cloud Identity Services as identity provider and connect a potential corporate identity provider there. If you don't have a tenant yet, check Getting a Tenant.
For more information, see Corporate Identity Providers and Configure Conditional Authentication for an Application in What Is Identity Authentication and SAP Cloud Identity Services
- We provide APIs so you can perform this procedure programmatically. For more information, see the Identity Provider Management API on SAP Business Accelerator Hub .
## Procedure
1. In the SAP BTP cockpit, go to your subaccount (see Navigate in the Cockpit [page 2207]) and choose Security Trust Configuration .
2. Choose Establish Trust .
The Configure Tenant wizard opens.
3. Choose the SAP Cloud Identity Services tenant and choose Next .
The identity providers listed are the SAP Cloud Identity Services tenants associated with your customer ID.
For more information, see the preceding prerequisites.
4. Choose the domain configured with the SAP Cloud Identity Services tenant and continue with Next .
5. You can change the name and the description of the tenant, display and change the origin key.
The origin key can have 36 characters at maximum. Only use the following characters for the origin key of the trust configuration.
aA -zZ , 0 -9 , -(hyphen), \_ (underscore)
6. Provide a link text for user logon (see Using Multiple Identity Providers from the Same Subaccount [page 2311]). Continue with Next .
7. Review your configuration and confirm using Finish .
## Results
You've configured trust in your tenant of the SAP Cloud Identity Services, which is your identity provider. SAP Cloud Identity Services creates an application with the prefix SAP BTP subaccount and the display name of your subaccount in the administration console for SAP Cloud Identity Services. Some attributes of the application are managed by SAP, such as the application type, and are read-only.
<!-- image -->
##  Example
If your subaccount is named My Subaccount , the resulting application in SAP Cloud Identity Services would be SAP BTP subaccount My Subaccount .
Older applications start with XSUAA\_ .
##  Tip
To troubleshoot problems with tokens from SAP Cloud Identity Services, see Logging OpenID Connect Tokens in the documentation for SAP Cloud Identity Services.
<!-- image -->
##  Restriction
If the OIDC issuer is changed in the trust configuration, the trust breaks. To update the trust configuration on the SAP BTP side, open the details of the trust configuration and choose Refresh . This button refreshes the trust configuration to reflect changes in the SAP Cloud Identity Services tenant, for example the issuer value.
## Next Steps
If you don't need the default identity provider anymore, set it to inactive or hide the logon link.
## Related Information
Default Identity Provider [page 2335]