## 4.2.11.1.1  Identity Federation
Identity federation is the process of sharing identity information between two parties by delegating the authentication responsibility to a trusted external party through the use of a common token.
In the ABAP environment, the authentication of business users is based on OAuth 2.0 authorization code flow, using either the SAML 2.0 or OpenID Connect protocol and JSON web token (JWT) as a common access token.
<!-- image -->
The business application (OAuth 2.0 client) is on one hand represented by the Web Access for ABAP as the gateway component or a standalone approuter application deployed to the SAP BTP, Cloud Foundry environment. See Subscribing to the Web Access for ABAP and Application Router.
On the other hand, an ABAP environment system is serving the business application resources (OAuth 2.0 resource server). See Creating an ABAP System.
The SAP Authorization and Trust Management service in the SAP BTP, Cloud Foundry environment is providing endpoints to retrieve and exchange the authorization code for an access token (OAuth 2.0 authorization/ authentication server). See SAP Authorization and Trust Management Service.
The Identity Authentication service is configured as an identity provider in the SAP BTP subaccount where the ABAP environment system has been created. The same subaccount is created as an application in the Identity Authentication service. See Configuring Applications.
This configuration establishes a mutual trust relationship between SAP Authorization and Trust Management service (XSUAA) and the Identity Authentication service as identity provider. See Trust and Federation with Identity Providers.
The ABAP environment system in turn trusts SAP Authorization and Trust Management service.
The business user is federated based on its e-mail address or user name, depending on the configuration of the login\_attribute during system provisioning (See Creating ABAP System) and the subject name identifier in the Identity Authentication application (see Configure the Subject Name Identifier Sent to the Application).
If a resource in the ABAP environment system is requested to be accessed by a business user, the steps to acquire the required access token are as follows:
<!-- image -->
1. The business user accesses the ABAP environment system through the Web Access for ABAP or a standalone approuter application. If no access token is available, the OAuth 2.0 authorization code flow is triggered.
2. A request to the authorization server endpoint in the SAP Authorization and Trust Management service (XSUAA) checks if the business user is already logged on. If the business user is not logged on, the business user is redirected to the Identity Authentication service as the identity provider used for logon.
3. After logging on, the response of the Identity Authentication service, including the e-mail address of the business user as the subject name identifier, is redirected to the authorization server endpoint of SAP Authorization and Trust Management service (XSUAA) to retrieve the authorization code. The authorization code is necessary to retrieve the access token in the following steps. Finally, the authorization code is redirected again to the Web Access.
4. Based on the authorization code, a JSON web token (JWT) is retrieved from the access token endpoint in SAP Authorization and Trust Management service (XSUAA). This OAuth access token includes the e-mail address or login name of the business user that serves as a subject name identifier.
5. To consume resources, such as business services in the ABAP environment system, the JSON web token is forwarded as part of such requests and mapped internally to the business user.
##  Note
Authentication of users other than communication users does not require identity federation as these technical users are authenticated locally in the ABAP environment system.