## 7.1 SAP Authorization and Trust Management Service
The global account and subaccounts get their users from identity providers. Administrators make sure that users can only access their dedicated subaccount by making sure that there is a dedicated trust relationship
only between the identity providers and the respective subaccounts. Developers configure and deploy application-based security artifacts containing authorizations, and administrators assign these authorizations using the SAP BTP cockpit.
##  Note
Before you start, make yourself familiar with the sections about authentication and authorization of the SAP BTP Planning and Lifecycle-Management Guide. See the Setting Up Your Security and Compliance Model section.
<!-- image -->
- #unique\_390/unique\_390\_Connect\_42\_subsection-im1 [page 3182]
- #unique\_390/unique\_390\_Connect\_42\_subsection-im2 [page 3182]
- #unique\_390/unique\_390\_Connect\_42\_subsection-im3 [page 3183]
- #unique\_390/unique\_390\_Connect\_42\_subsection-im4 [page 3184]
- #unique\_390/unique\_390\_Connect\_42\_subsection-im5 [page 3185]
- #unique\_390/unique\_390\_Connect\_42\_subsection-im6 [page 3186]
- #unique\_390/unique\_390\_Connect\_42\_subsection-im7 [page 3187]
Hold your pointer over a box for a description. Select a box to display more information.
## Overview of the SAP Authorization and Trust Management Service
Get a high-level overview of the concepts that underpin the SAP Authorization and Trust Management service for SAP BTP in the Cloud Foundry environment.
For more information, see What Is the SAP Authorization and Trust Management Service? [page 3187].
## Tutorials for the SAP Authorization and Trust Management Service
Follow the tutorials below to get familiar with the SAP Authorization and Trust Management service in the Cloud Foundry environment of SAP BTP.
| Tutorials for the SAP Authorization and Trust Management service in the Cloud Foundry environment                                                                                                                                                                           | Language / Framework   | Link           |
|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------------|----------------|
| Learn how to secure a basic single-ten- ant Node.js application. Start with a Node.js application that uses the ex- press framework and SAPUI5 to display a list of products and add the security components step by step.                                                  | Node.js                | SAP Developers |
| Learn how to secure a basic java appli- cation. This tutorial starts with a Hello World Java application built with SAP Cloud SDK.                                                                                                                                          | Java, SAP Cloud SDK    | SAP Developers |
| Learn how to build a cloud-native Node.js application that features se- cured service-to-service communica- tion. The application shows you two dif- ferent ways of securing service-to-serv- ice-communication (by propagating a business user or using a technical user). | Node.js                | GitHub         |
| Learn how to secure microservices in SAP BTP using spring-xsuaa and Spring security. Furthermore, learn how to test the secured application using the java-security-test utilities.                                                                                         | Spring (Boot)          | GitHub         |
| Learn how to add multitenancy to a node.js application and make it avail- able for other subaccounts using the SaaS Provisioning service and the XSUAA.                                                                                                                     | Node.js                | SAP Developers |
| Tutorials for the SAP Authorization and Trust Management service in the Cloud Foundry environment                                                                                                        | Language / Framework     | Link                                                                                       |
|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------|--------------------------------------------------------------------------------------------|
| Learn how to secure microservices in SAP BTP. This sample provides J2EE Configuration using web.xml and uses the SAP Java Buildpack.                                                                     | J2EE, SAP Java Buildpack | GitHub (SAP Java Buildpack version >=1.26.1) GitHub (SAP Java Buildpack version <= 1.26.0) |
| Learn how to use the java-security library to perform JWT Validation as part of your Java application. Further- more, learn how to test the secured application using the java-security- test utilities. | Java                     | GitHub                                                                                     |
| Learn how to validate OAuth tokens us- ing a Python library. Use this library to add authentication in your Python ap- plication.  Note                                                                 | Python                   | GitHub                                                                                     |
| Learn in this reference application how the service fits into a complete archi- tecture of microservices that interact with each other propagating user infor- mation.                                   | Java                     | GitHub                                                                                     |
## Principal Propagation
Exchange user ID information between systems or environments in SAP BTP.
## In This Section
- Principal Propagation from the Multi-Cloud Foundation to the Neo Environment [page 3264]
- Principal Propagation from the Neo Environment to the Multi-Cloud Foundation [page 3257]
## Other Principal Propagation Scenarios
- On-Premise User Store
- Principal Propagation to OAuth-Protected Applications
- Connectivity in the Cloud Foundry Environment: Principal Propagation
- Connectivity in the Neo Environment: Principal Propagation
## Trust and Federation
When setting up accounts you need to assign users. While we provide you with your first users from the default identity provider to get you started, your organization has identity providers that you want to integrate.
SAP BTP supports identity federation, a concept of linking and reusing digital identities of a user base across loosely coupled systems. Identity federation frees applications on SAP BTP as well as the platform itself from the need to obtain and store the credentials of users and to authenticate them. Instead, the user base is reused from identity providers, which support the administration of digital user identities, authentication, and authorizations in a centralized and decoupled manner. To enable communication between SAP BTP and identity providers, you must cross-configure the communication endpoints of the involved systems, establishing a trust relationship between them.
##  Recommendation
We strongly recommend that you use a custom tenant of SAP Cloud Identity Services. Using SAP Cloud Identity Services eases integration with other SAP solutions. When setting up accounts you need to assign users. We provide you with your first users from the default identity provider. By using SAP Cloud Identity Services as a proxy to your corporate identity provider and hosting your users there, you gain a number of advantages:
- Integrate the management of these users with your broader identity management strategy, hosted on your own identity providers. You control your own user lifecycle and single sign-on strategies throughout the entire landscape.
- Enforce your own password and authentication policies, such as stronger passwords or multifactor authentication.
For platform users, the use of SAP Cloud Identity Services is mandatory. If you don't have a tenant yet, check Getting a Tenant.
To connect your corporate identity provider to SAP Cloud Identity Services, see Corporate Identity Providers and Configure Conditional Authentication for an Application in What Is Identity Authentication and SAP Cloud Identity Services
Identity Provider and XSUAA in SAP BTP Architecture
<!-- image -->
SAP Cloud Identity Services is a multitenancy-enabled identity provider for all SAP cloud applications and optionally on-premise applications. The service provides capabilities for authentication, single sign-on, authorizations, identity lifecycle management, and on-premise integration as well as self-services like selfregistration or password reset.
SAP has its own SAP Cloud Identity Services tenant, SAP ID service. SAP ID service is the default identity provider of SAP BTP and where you register to get initial access to SAP BTP. Trust to SAP ID service is preconfigured by default.
We recommend that you request your own SAP Cloud Identity Services tenant (see Getting a Tenant). To establish trust with your identity provider, proceed as follows.
For business users:
- Establish Trust and Federation Between SAP Authorization and Trust Management Service and SAP Cloud Identity Services [page 2282]
- Manually Establish Trust and Federation Between SAP Authorization and Trust Management Service and SAP Cloud Identity Services [page 2302]
- Establish Trust and Federation with UAA Using Any SAML Identity Provider [page 2306]
For platform users:
- Establish Trust and Federation of Custom Identity Providers for Platform Users [page 2316]
For default identity provider:
- Default Identity Provider
##  Note
How you assign users to their authorizations depends on the type of trust configuration. If you're using the default trust configuration via SAP ID service, you can assign users directly to role collections. For more information, see Default Identity Provider [page 2335].
However, if you're using a custom trust configuration as described in this topic, you can assign individual users or groups to role collections. Assigning users to their authorizations is part of application administration, which is described here. For more information, see Mapping Role Collections [page 2358].
## Administration: Managing Authentication and Authorization
Application developers create and deploy application-based authorization artifacts for business users. Administrators use this model to manage roles, build role collections, and assign these collections to users or user groups. In this way, they control the users' permissions.
Setting Up Authorization Artifacts (Account Administrators)
| Task                                                                                    | Links                                           |
|-----------------------------------------------------------------------------------------|-------------------------------------------------|
| Assign the role collection to the users provided by an identity provider                | Working with Role Collections [page 2351]       |
| (If you do use a custom identity provider) Assign the role collec- tions to user groups | Map Role Collections to User Groups [page 2358] |
| Task                                                                            | Links                                                              |
|---------------------------------------------------------------------------------|--------------------------------------------------------------------|
| Assign the role collections to users and user groups, manage attribute mappings | Mapping Role Collections [page 2358]                               |
| Create a role collection and assign roles to it                                 | Define a Role Collection [page 2352]                               |
| Use an existing role or create a new one using role templates                   | Add Roles to Role Collections on the Application Level [page 2370] |
## Troubleshooting
This section provides information on troubleshooting-related activities for the SAP Authorization and Trust Management service in the Cloud Foundry environment.
##  Tip
We also recommend that you regularly check the SAP Notes and Knowledge Base for component BC-CPCF-SEC-IAM in the SAP Support Portal . These contain information about program corrections and provide additional information.
To help you troubleshoot your issue, we also recommend increasing the log verbosity of your application and application router. We provide a script to help you. If for some reason you can't use this script, increase the log verbosity manually, see related link.
To troubleshoot problems with tokens from SAP Cloud Identity Services, see Logging OpenID Connect Tokens in the documentation for SAP Cloud Identity Services.
Our troubleshooting information can be found in Troubleshooting for the SAP Authorization and Trust
Management service in the Cloud Foundry environment . Check the individual troubleshooting topics for your error message. If you can't find your problem, create an incident in the component BC-CP-CF-SEC-IAM . For more information, see the related link.
- The Security Tab Is Missing in the Subaccount
- Access Is Denied or Forbidden
- Identity Provider Could Not Process Authentication Request
- Logon Screen Shows "SAP HANA XS Advanced"
- Requested Route Does Not Exist
- Subdomain Does Not Map to a Valid Identity Zone
- No Client with Requested ID
- Login Issues
- Cannot Add Role Templates to Predefined Role Collections
- 502 Error: Call to /oauth/token Was Not Successful
- Unexpected AuthnResponse : Existing authentication - &lt;User&gt;
- AuthnRequest expired - ID: &lt;RequestId&gt; Destination: &lt;IdPDestination&gt;
- InResponseToField of Response doesn't correspond to the sent message
- Response issue time is either too old or with date in the future. Sync IdP to match skew &lt;skew&gt;
- Trust establishment issues
- Token retrieval fails with status code 401
- Cockpit displays HTTP status 500 error on logon with custom IdP user
- IAS application reference isn't created in your IAS tenant
- User base doesn't appear in existing Neo subaccounts
- User from corporate IdP can't log on to Neo subaccount
- 409 error code on deleting a custom identity provider
- Share Authorization and Trust Management service instances
- Invalid "redirect\_uri"
## Adding Authentication and Authorization
Developers create authorization information for business users in their environment and deploy this information in an application. They make this available to administrators, who complete the authorization setup and assign the authorizations to business users.
Developers store authorization information as design-time role templates in the xs-security.json security descriptor file. Using the cockpit, administrators of the environment assign the authorizations to business users.
The following sections contain the process of adding authentication and authorization checks for protecting your applications, links to a number of associated tutorials, extended tasks for creating authorization artifacts, as well as reference information, including the syntax required to set the properties and values defined in the application security descriptor file.
- Protecting Your Application [page 533]
- Tutorials for the SAP Authorization and Trust Management Service [page 558]
- Application Security Descriptor Configuration Syntax [page 576]