## 8. Create a Destination
Create a destination using the Destinations editor in the SAP BTP cockpit. For more information, see Using the Destination Editor in the Cockpit. Provide the following data:
| Field   | Input                                                                                        |
|---------|----------------------------------------------------------------------------------------------|
| Name    | Enter the name of the destination, for example my-oauth-saml-bearer-assertion- destination . |
| Type    | HTTP                                                                                         |
Input
Input
| URL                              | Enter https://<hostname of the own communication system> , for example, https:// 1a354373-d200-46f6-9d5c- daab9a65d9b6.abap.eu10.hana.ondemand.co m .                                                          |
|----------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Proxy Type                       | Internet                                                                                                                                                                                                       |
| Authentication                   | OAuth2SAMLBearerAssertion                                                                                                                                                                                      |
| Key Store Location               | If you don't use the standard signing certificate, then se- lect the name of the corresponding key store, for example my-signing-keystore.p12 .                                                                |
| Key Store Password               | Enter the password for the keystore.                                                                                                                                                                           |
| Audience                         | Enter the SAML2 Audience from the own commu- nication system, for example, https://1a354373- d200-46f6-9d5c-daab9a65d9b6.abap- web.eu10.hana.ondemand.com .                                                    |
| AuthnContextClassRef             | urn:oasis:names:tc:SAML:2.0:ac:classes: PreviousSession                                                                                                                                                        |
| Use mTLS for token retrieval     | Activate if the OAuth client shall be authenticated at the token endpoint using client certificate.                                                                                                            |
| Client Key                       | Enter the user name of the communication user (= OAuth Client ID), for example, MY_OAUTH_CLIENT .                                                                                                              |
| Token Service Key Store Location | If the OAuth client shall be authenticated at the to- ken endpoint using client certificate, then select the name of the corresponding key store, for example my- keystore.p12 .                               |
| Token Service Key Store Password | If the OAuth client shall be authenticated at the token endpoint using client certificate, then enter the password for the key store.                                                                          |
| Token Service URL Type           | Choose Dedicated .                                                                                                                                                                                             |
| Token Service URL                | Enter the OAuth 2.0 confidential client token service URL from the own communication system, for example, https://1a354373-d200-46f6-9d5c- daab9a65d9b6.abap.eu10.hana.ondemand.co m/sap/bc/sec/oauth2/token . |
| Token Service User               | If the OAuth client shall be authenticated at the token end- point using client ID and secret, then enter the name of communication user, for example, MY_OAUTH_CLIENT .                                       |
| Token Service Password           | If the OAuth client shall be authenticated at the token end- point using client ID and secret, then enter the password of the communication user.                                                              |
| Field        | Input                                                                                                                                                                                                                                                             |
|--------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| nameIdFormat | Enter urn:oasis:names:tc:SAML:1.1:nameid- format:emailAddress if the e-mail is propagated or urn:oasis:names:tc:SAML:1.1:nameid- format:unspecified if the user name is propagated. See User Propagation via SAML 2.0 Bearer Assertion Flow for more information. |
## Related Information
Maintain Communication Users [page 2708] Communication Systems [page 2714] Communication Arrangements [page 2711]