## 6.1.1.8.1.1.2.4  Test the Trust Configuration After the Migration
Check that your users can still access their applications and have all the attributes they require. Use these steps to validate your new configuration.
## Prerequisites
You saved the list of attributes you get before the migration.
For more information, see Prepare for Migration from SAML Trust to OpenID Connect [page 2291].
## Procedure
1. Check what attributes your user has now.
https://&lt;subaccount\_subdomain&gt;.authentication.&lt;region&gt;.hana.ondemand.com/config? action=who&amp;details=true&amp;trustMigrationOnly=true
For example https://my-subdomain.authentication.eu10.hana.ondemand.com/config? action=who&amp;details=true&amp;trustMigrationOnly=true
2. Compare with the results you had before the migration.
In the following example, the user has a few special attributes in addition to the standard ones:
- Custom attribute cost\_center
- Group assignment my-group
- Authorization assignment over the group to the role collection for reading audit logs
## Before (SAML)
```
userName P000011 origin my-origin-key zoneId 9fcd13d0-77d7-4cfa-86b0a41b02e662a6 User Attributes { user_uuid=[7ebf5c32-cacd-4ad2a208-6bcb3e764f6f], email=[maria.fontes@example.com], cost_center=[my-cost-center], Groups=[my-group], family_name=[Fontes], given_name=[Maria] } email maria.fontes@example.com userId 128af760-ad57-4213b063-2dd381a4d92e externalId P000011 given_name Maria family_name Fontes verified true authorities [ openid, user_attributes, auditlog-management! b8.ReadAuditLogs, uaa.user ]
```
##  Note
In the new OIDC application, uppercase or lower case G in the groups attribute name doesn't matter.
3. If there are any remaining differences, adjust the configuration of the SAP Cloud Identity Services tenant or applications or of the corporate identity provider until you get the same attributes.
For more information, see Configuration of SAP Cloud Identity Services After Migration from SAML to OIDC [page 2295].
Use the OIDC token logging in SAP Cloud Identity Services to help troubleshoot any problems.
For more information, see Logging OpenID Connect Tokens in the documentation of SAP Cloud Identity Services.
If you can't get the configuration to work, restore the SAML trust configuration.
For more information, see Restore SAML Trust Configuration [page 2300].
## After (OIDC)
```
userName P000011 origin my-origin-key zoneId 9fcd13d0-77d7-4cfa-86b0a41b02e662a6 User Attributes { given_name=[Maria], user_uuid=[7ebf5c32-cacd-4ad2a208-6bcb3e764f6f], cost_center=[my-cost-center], groups=[my-group], family_name=[Fontes], email=[maria.fontes@example.com] } email maria.fontes@example.com userId 128af760-ad57-4213b063-2dd381a4d92e externalId P000011 given_name Maria family_name Fontes verified true authorities [ openid, user_attributes, auditlog-management! b8.ReadAuditLogs, uaa.user ]
```
## Next Steps
Once everything is working as you expected and are certain you don't need it anymore, delete your old SAML trust configuration with the origin oidc-migration-backup .
##  Caution
If you delete the old SAML trust configuration too early, you can't use the restore feature anymore.
## Related Information
Restore SAML Trust Configuration [page 2300]