## 6.1.1.8.1.1.3.1  Establish Trust with an SAML 2.0 Identity Provider in a Subaccount
You want to use an SAML 2.0 identity provider, for example, SAP Cloud Identity Services. The identity provider authenticates business users for SAP BTP.
## Prerequisites
- You have subaccount administrator permissions.
- You have downloaded the SAML 2.0 metadata file from the SAP Cloud Identity Services tenant using the URL https://&lt;sap\_cloud\_identity\_services\_tenant&gt;.accounts.ondemand.com/saml2/ metadata .
<!-- image -->
##  Example
https://my-ias-tenant.accounts.ondemand.com/saml2/metadata
For more information, see Tenant SAML 2.0 Configuration in the SAP Cloud Identity Services.
## Context
The following procedure describes how to establish trust with an SAP Cloud Identity Services tenant.
<!-- image -->
##  Restriction
You've already created a trust configuration with a custom identity provider for applications. In this case, you can't add a trust configuration with the same SAP Cloud Identity Services tenant using another protocol.
<!-- image -->
##  Example
If there's already a trust configuration with OpenID Connect, you can't create one using the SAML protocol.
<!-- image -->
##  Restriction
Consider the upper limits for trust configurations in the subaccount. See Limits for the Subaccount [page 3249].
<!-- image -->
##  Restriction
We recommend a single trust configuration per subaccount with SAP Cloud Identity Services using the OpenID Connect (OIDC) protocol. If this isn't sufficient, you may use a trust configuration with SAML 2.0.
Nevertheless, we recommend migrating existing SAML 2.0 trusts according to the documentation Migration from SAML Trust to OpenID Connect Trust with SAP Cloud Identity Services [page 2288].
## Procedure
1. In the SAP BTP cockpit, go to your subaccount (see Navigate in the Cockpit [page 2207]) and choose Security Trust Configuration .
2. Choose New SAML Trust Configuration .
3. Enter a name and a description that make it clear to which identity provider that the trust configuration refers.
##  Note
Make sure that the users who are supposed to log on to this identity provider understand the name of the trust configuration.
4. Download the relevant metadata (see prerequisites) and save it in an XML file.
5. Choose the Upload button to insert the SAML 2.0 metadata.
6. To validate the metadata, choose Parse . The system fills the Subject and Issuer fields with the relevant data from the SAP Cloud Identity Services - your SAML 2.0 identity provider. You see the fields when you choose Show Details .
The name of the new trust configuration now shows the value
&lt;sap\_cloud\_identity\_services\_tenant&gt;.accounts.ondemand.com . It represents the custom identity provider SAP Cloud Identity Services.
This action also fills the fields for the single sign-on URLs and the single logout URLs.
7. Provide a link text for user logon (see Using Multiple Identity Providers from the Same Subaccount [page 2311]).
8. Save your changes.
9. To get the SAML metadata of your subaccount, choose Download SAML Metadata . You download an XML file with the SAML metadata of your subaccount. Its name is saml-&lt;subdomain&gt;sp.xml . Use this file to import the SAML metadata into your identity provider.
## Next Steps
Register your SAP BTP subaccount in the SAML 2.0 Identity Provider