orkungedik/SAP-basis-dataset huggingface dataset:
## 1. Setting Up Your Account Model
<!-- image -->
- Download and Install the Cloud Foundry Command Line Interface [page 2533]
- Log On to the Cloud Foundry Environment Using the Cloud Foundry Command Line Interface [page 2534]
- Create Spaces [page 2520]
- Global Accounts [page 111]
- Create a Subaccount [page 2249]
- Create Orgs [page 2514]
1. After you've received your logon data by email, create subaccounts in your global account. This allows you to further break down your account model and structure it according to your business needs. See Create a Subaccount [page 2249].
2. If you haven't done so already, now is a good time to download and install the Cloud Foundry Command Line Interface (cf CLI). This tool allows you to administer and configure your environment, enable services, and deploy applications. See Download and Install the Cloud Foundry Command Line Interface [page 2533].
But don't worry, you can also perform all the necessary task using the SAP BTP cockpit, which you don't need to install.
3. If you'd like to use the cf CLI, log on to your environment. See Log On to the Cloud Foundry Environment Using the Cloud Foundry Command Line Interface [page 2534].
4. Create a Cloud Foundry organization in each of your subaccounts. See Create Orgs [page 2514]
5. Create spaces. See Create Spaces [page 2520].
## 2. Configuring Your Environment
<!-- image -->
- User and Member Management [page 121]
- Navigate to Orgs and Spaces [page 2512]
- Add Org Members [page 2516]
- Add Space Members [page 2523]
- Configure Entitlements and Quotas for Subaccounts [page 2269]
- Create Space Quotas [page 2528]
- Assign Space Quotas to Spaces [page 2530]
- Managing Entitlements and Quotas Using the Cockpit [page 2261]
1. You can either use the cockpit or the cf CLI to configure your environment. If you'd like to use the cockpit, it's important you understand how you can navigate to your accounts and spaces. See Navigate to Orgs and Spaces [page 2512].
2. It's time to think about member management. You can add members at different levels. For example, you can add members at an org level. See Add Org Members [page 2516]. For more information about roles, see User and Member Management [page 121].
3. You can also add members at a space level. See Add Space Members [page 2523].
4. Before you can start using resources such as services or application runtimes, you need to manage your entitlements and add quotas to your subaccounts. See Configure Entitlements and Quotas for Subaccounts [page 2269]. To learn more about entitlements and quotas, see Managing Entitlements and Quotas Using the Cockpit [page 2261]. Note that if you want to try out services for free, you need to select free tier service plans if available. For a list of free services, check the SAP Discovery Center .
5. You can also assign quotas to different spaces within a subaccount. To do so, first create a space quota plan. See Create Space Quotas [page 2528] or Create Space Quota Plans Using the Cloud Foundry Command Line Interface [page 2575].
6. Then assign the quota plan to your space. See Assign Space Quotas to Spaces [page 2530] or Assign Quota Plans to Spaces Using the Cloud Foundry Command Line Interface [page 2576].
## 3. Developing and Deploying Applications
<!-- image -->
- Creating Service Instances [page 254]
- Binding Service Instances to Applications [page 257]
- Creating Service Keys [page 259]
- Using Services in the Cloud Foundry Environment [page 252]
- Deploy Business Applications in the Cloud Foundry Environment [page 742]
- Development [page 235]
- Creating User-Provided Service Instances [page 256]
1. Develop your application. Check out the Developer Guide for tutorials and more information. See Development [page 235].
2. Deploy your application. See Deploy Business Applications in the Cloud Foundry Environment [page 742].
3. Integrate your application with a service. To do so, first create a service instance. See Creating Service Instances [page 254]
4. Bind the service instance to your application. See Binding Service Instances to Applications [page 257].
5. Alternatively, you can also create and use service keys. See Creating Service Keys [page 259]. For more information on using services and creating service keys, see About Services [page 253].
6. You can also create instances of user-provided services. See Creating User-Provided Service Instances [page 256].
## 3.3 Getting Started in the ABAP Environment
Get onboarded in the SAP BTP ABAP environment. Follow the workflows for trial or customer accounts.
Getting Started with a Customer Account in the ABAP Environment [page 169]
After you have purchased a customer account, learn how to get started in the ABAP environment.
Getting Started with Custom Code Analysis in the ABAP Environment [page 226]
Learn how to get started with Custom Code Analysis in the SAP BTP ABAP environment.
## 3.3.1  Getting Started with a Customer Account in the ABAP Environment
After you have purchased a customer account, learn how to get started in the ABAP environment.
##  Note
This documentation informs you about the first steps as an administrator in the ABAP environment. For more information about getting started as a developer, see Getting Started as a Developer in the ABAP Environment [page 221].
## 1. Logging on to SAP BTP
1. After you have purchased your customer account, you will receive an e-mail with a link to the home page of SAP BTP and the logon data as administrator for the global account.
2. Log on to SAP BTP. You are now in the SAP BTP cockpit.
3. Navigate to your global account.
## 2. Automated Initial Setup Using a Booster (Optional)
<!-- image -->
- Using a Booster to Automate the Setup of the ABAP Environment (Optional) [page 176]
- https:/ /help.sap.com/viewer/65de2977205c403bbc107264b8eccf4b/Cloud/en-US/ fb1b56148f834749a2bf51127421610b.html [https:/ /help.sap.com/viewer/ 65de2977205c403bbc107264b8eccf4b/Cloud/en-US/fb1b56148f834749a2bf51127421610b.html]
To set up a development system quickly, you can use the booster Prepare an Account for ABAP Development . The interactive booster guides you through the process of setting up your subaccounts, configuring entitlements, assigning members, and so on. For more information, see Using a Booster to Automate the Setup of the ABAP Environment (Optional) [page 176].
Using a booster is optional. If you don't use the booster, you must perform more steps manually.
## 4. What's Next
After the initial setup of the ABAP environment, your developers can now develop applications using ABAP Development Tools. You can tell your developers to get started (see Getting Started as a Developer in the ABAP Environment [page 221]).
As next steps, you can optionally set up additional tools for your developers or ensure the integration with other systems:
- If your developers need a UI development tool, set up SAP Business Application Studio (see Setup of UI Development in SAP Business Application Studio (Optional) [page 198]).
- As a default identity service in the ABAP environment, you get SAP ID. You might want to set up a custom identity service (see Setup of a Custom Identity Service [page 206]).
- As an alternative to SAP Business Application Studio, you can also set up SAP Web IDE (see Setup of UI Development in SAP Web IDE (Optional) [page 212]).
Setup of Ul Development in SAP Business Application Studio
Setup of Ul Development in SAP Web IDE
- Setup of UI Development in SAP Business Application Studio (Optional) [page 198]
- Setup of a Custom Identity Service [page 206]
- Setup of UI Development in SAP Web IDE (Optional) [page 212]
## Related Information
Learning Journey
Discovery Center
SAP Community
SAP Road Map Explorer
Video Tutorials
## Setup of a Custom Identity Provider
## 3.3.1.2 ABAP Environment: Initial Settings
With the initial settings, you as an administrator and your ABAP developers can get started in the ABAP environment.
After the initial settings are done, the ABAP environment is ready for your ABAP developers so they can implement business services using ABAP Development Tools (ADT).
## 3.3.1.2.1 Creating a Cloud Foundry Subaccount for the ABAP Environment
Create a Cloud Foundry subaccount for the ABAP environment in your global account using the cockpit.
## Context
##  Note
If you have run the booster Prepare an Account for ABAP Development , you can skip these steps.
For the ABAP environment, you need a Cloud Foundry subaccount as a technical environment. If you want to reuse an existing Cloud Foundry subaccount, make sure that it uses the providers and regions that are available for provisioning an ABAP environment. For more information about the providers and regions for ABAP environment, see Regions.
## Procedure
1. From your global account, choose New Subaccount .
2. Specify a display name, for example, ABAP .
3. Optional: Enter a description.
4. Leave the Neo Environment checkbox deselected.
5. Choose the desired infrastructure provider and region for your subaccount.
You can find the available providers and regions for the ABAP environment in Regions.
6. Enter a subdomain for your subaccount. The subdomain will become part of the URL for accessing applications that you subscribe to from this subaccount.
##  Note
You can choose any string of your choice. However, note that the subdomain can contain only letters, digits and hyphens (not allowed in the beginning or at the end), and must be unique across all subaccounts in the same region. Uppercase and lowercase letters can be used, however that alone does not qualify as a means to differentiate subdomains (for example, SUBDOMAIN and subdomain are considered to be the same).
7. If your subaccount is to be used for production purposes, select the Used for production option.
8. Choose Create .
## 3.3.1.2.2 Creating a Cloud Foundry Organization and Space
Create a Cloud Foundry organization and Cloud Foundry space that will correspond to the instance of the ABAP environment.
## Context
##  Note
If you have already created an organization and space for the ABAP environment, you can skip these steps. If you have run the booster Prepare an Account for ABAP Development , you can also skip these steps.
For more information about creating Cloud Foundry spaces, see Create Spaces.
## Procedure
1. Log on to the SAP BTP cockpit in the global account for the Cloud Foundry environment as administrator.
2. Choose the tile of the Cloud Foundry subaccount.
3. Check whether Cloud Foundry is enabled: If it's enabled, the Cloud Foundry organization name appears as organization on the screen area Cloud Foundry .
4. If Cloud Foundry is not enabled yet, proceed as follows:
- a. Choose Enable Cloud Foundry .
- b. On the Create Cloud Foundry Organization dialog, enter a name for the Cloud Foundry organization and choose Create .
- c. Choose the free or standard plan for the Cloud Foundry runtime according to your needs.
5. On the Cloud Foundry screen area, choose the link for spaces.
6. If the Cloud Foundry space in the Cloud Foundry organization does not exist yet, proceed as follows:
- a. Choose New Space .
- b. On the New Space dialog, enter a name for the new Cloud Foundry space, for example, dev , and leave the checkboxes for space manager and space developer checked.
- c. Choose Create .
## 3.3.1.2.3 Increasing the Quota for the ABAP Environment
Before you can create a service instance for the ABAP environment, you must assign some of the available quota to the subaccount for the ABAP environment.
## Context
##  Note
If you have run the booster Prepare an Account for ABAP Development , you can skip this step.
If you are working in an enterprise account, you need to add quotas to the services that you purchased in your subaccount before they can appear in the service marketplace. For more information, see Configure Entitlements and Quotas for Subaccounts.
## Procedure
1. Log on to the SAP BTP cockpit as administrator.
2. Go to your global account.
3. From the navigation area, choose Entitlements Entity Assignments .
4. Enter the subaccount for the ABAP environment and choose Go .
5. Choose Configure Entitlements .
6. Choose Add Service Plans .
In the following popup, the available entitlements for this subaccount are shown.
7. For the ABAP environment entitlement, select the plans abap\_compute\_unit , standard , and hana\_compute\_unit .
With the selection of the standard service plan, you can size the ABAP runtime and the SAP HANA memory independently from each other. To be able to do your sizing, you must also select the quota plans abap\_compute\_unit and hana\_compute\_unit .
8. Choose Add 3 Service Plans .
9. On the following screen, increase the quotas in the abap\_compute\_unit service plan at least by 1 and in the hana\_compute\_unit service plan at least by 2.
The minimum configuration of 1 ABAP compute unit and 2 HANA compute units is sufficient in many cases to create one service instance for the ABAP environment. If you need more resources, choose higher quotas. Keep in mind that increasing the SAP HANA Cloud storage using the parameter size\_of\_persistence\_disk consumes 0.002 HANA compute units for each GB that exceeds the minimal size of the persistence disk.
10. Choose Save .
## Results
After you have assigned an entitlement for the three plans with respective quotas to your subaccount, you can create an ABAP system. This is the point where you can then decide how many blocks of ABAP compute units and HANA compute units you want to assign to your new system. See Creating an ABAP System [page 183].
## Related Information
ABAP Compute Units [page 3114]
## 3.3.1.2.4 Increasing the Quota for the Cloud Foundry Runtime (Optional)
Check if your subaccount has a quota for the Cloud Foundry runtime and increase it, if needed.
## Context
##  Note
If you have run the booster Prepare an Account for ABAP Development , you can skip this step.
A quota for the Cloud Foundry runtime is optional. It's only needed for the ABAP environment if your developers want to deploy their own apps in Cloud Foundry.
## Procedure
1. Log on to the SAP BTP cockpit as Cloud Foundry administrator.
2. Go to your global account.
3. From the navigation area, choose Entitlements Entity Assignments .
4. If there is no entry for the Cloud Foundry runtime, choose Configure Entitlements and Add Service Plans .
5. In the following popup, proceed as follows:
- a. Choose Cloud Foundry Runtime .
- b. Under Available Service Plans , select the checkbox MEMORY .
- c. Choose Add 1 Service Plan .
6. Choose + to add at least 1 to the subaccount.
7. Choose Save .
## 3.3.1.2.5 Selecting a Service Plan for the Web Access for ABAP
Before you can subscribe to the Web Access for the ABAP environment, you must select the relevant service plan.
## Context
##  Note
If you have run the booster Prepare an Account for ABAP Development , you can skip this step.
If you are working in an enterprise account, you need to add quotas to the services that you purchased in your subaccount before they can appear in the service marketplace.
## Procedure
1. Log on to the SAP BTP cockpit as administrator.
2. Go to your global account.
3. From the navigation area, choose Entitlements Entity Assignments .
4. Enter the subaccount for the ABAP environment and choose Go .
5. Choose Configure Entitlements .
6. Choose Add Service Plans .
In the following popup, the available entitlements for this subaccount are shown.
7. For the Web Access for ABAP entitlement, select the plan default (Application) .
8. Choose Add 1 Service Plan .
9. Choose Save .
## 11. Choose Create .
The ABAP environment instance is being set up, which might take a while. Wait for an email that is sent when the setup is completed and the system up and running. The email is sent to the email address that you specified as admin email in the previous steps.
## 3.3.1.2.7 Subscribing to the Web Access for ABAP
You need to subscribe to the Web access for ABAP SaaS application to get direct browser access to your instances in the ABAP environment, including access to the administration launchpad for ABAP.
## Context
##  Note
If you have run the booster Prepare an Account for ABAP Development , you can skip this step.
This subscription is required to access the SAP Fiori launchpad for the administrator and to access developed SAP Fiori applications. Subscription is required only once per subaccount (for all systems to be created in all spaces of this subaccount). After subscribing to the application, you have access to the administration launchpad, where you can configure application roles and assign those roles to your users.
## Procedure
1. Log on to the SAP BTP cockpit in the Cloud Foundry subaccount of the global account for Cloud Foundry as administrator.
2. In the navigation area, choose Services Service Marketplace .
3. Choose the SaaS application tile Web access for ABAP .
4. If the application is not shown as active, choose Create and wait for the subscription to be provisioned.
## 3.3.1.2.8 Creation of Additional Administrator Users (Optional)
After you have set up the ABAP environment for administration, add more administrator users for the ABAP environment.
After you have completed the administrative setup, only your user is available as administrator in the ABAP environment. You will probably want to create more administration users for your ABAP environment. Creating more administration users also helps you verify that your administrative setup is correct and complete.
## Related Information
Adding a User as Org Manager for the Cloud Foundry Organization [page 191] Adding a User as Space Manager for the Cloud Foundry Space [page 192]
Logging on to the Administration Launchpad of the ABAP Environment [page 192] Creating an Employee Record for a New Administrator [page 193] Assigning the ABAP Environment Administrator Role to the New Administrator User [page 194]
## 3.3.1.2.8.1  Adding a User as Org Manager for the Cloud Foundry Organization
After you have created a Cloud Foundry organization for the ABAP environment, you can add more users as organization managers.
## Context
##  Note
If you have run the booster Prepare an Account for ABAP Development and entered additional administrators, you can skip these steps.
## Procedure
1. Log on to the SAP BTP cockpit as administration user for Cloud Foundry.
2. Go to your subaccount for the ABAP environment.
3. From the navigation area, choose Org Members .
4. Choose Add Members .
5. Enter the user's e-mail address in the E-mails field.
6. Select the checkbox for org manager.
7. Choose OK .
## 3.3.1.2.8.2  Adding a User as Space Manager for the Cloud Foundry Space
After you have created a Cloud Foundry space for the ABAP environment, you can add more users as space managers.
## Context
##  Note
If you have run the booster Prepare an Account for ABAP Development and entered users as additional administrators, you can skip these steps.
## Procedure
1. Log on to the SAP BTP cockpit as administration user for Cloud Foundry.
2. Go to your subaccount for the ABAP environment.
3. Choose Spaces .
4. Choose the Cloud Foundry space in the Cloud Foundry org.
5. In the navigation area, choose Members .
6. Choose Add Members .
7. Enter the user's e-mail address in the E-mails field.
8. Select the checkbox for space manager.
9. Choose OK .
## 3.3.1.2.8.3  Logging on to the Administration Launchpad of the ABAP Environment
To add another user as administrator for the ABAP instance, log on to the administration launchpad of the ABAP environment.
## Prerequisites
You are the administrator who has created the ABAP system (see Creating an ABAP System [page 183]).
## Procedure
1. In the SAP BTP cockpit, go to the Cloud Foundry subaccount for the ABAP environment as administrator.
2. Choose the space in the Cloud Foundry subaccount.
3. In the navigation area, choose Services Service Instance .
4. Choose the service instance for the ABAP environment.
5. Choose View Dashboard . The logon window for the administration launchpad of the ABAP environment opens.
6. If you are using the custom Identity Authentication service for SAP BTP, you don't need to enter your user and password, but choose the available link of the custom Identity Authentication service and log on.
7. If you need to enter your user and password, remember to log on with the right user that was defined before (see Creating an ABAP System [page 183]).
## Results
The administration launchpad opens. You can now proceed with creating an employee record for the administrator.
## 3.3.1.2.8.4  Creating an Employee Record for a New Administrator
To be able to create a new administration user, you first need to create an employee record for the new administrator.
## Prerequisites
You have logged on to the administration launchpad of the ABAP environment as administrator user (see Logging on to the Administration Launchpad of the ABAP Environment [page 192]).
## Procedure
1. From the SAP Fiori launchpad, open the Maintain Employees app.
2. Choose Create .
3. Enter the data for the new administrator, including employee ID, name, and e-mail address.
The entered e-mail is important because it is the default approach to authorization and represents the mapping between the user in the identity provider and in the ABAP environment.
4. Choose Create .
## Results
You can now create a business user and assign administration roles to the business user.
## 3.3.1.2.8.5  Assigning the ABAP Environment Administrator Role to the New Administrator User
Add the new administration user as administrator to the ABAP instance.
## Prerequisites
You have logged on to the administration launchpad of the ABAP environment as administrator (see Logging on to the Administration Launchpad of the ABAP Environment [page 192]). You have created an employee record for another, new administrator.
## Procedure
1. On the SAP Fiori launchpad, choose the Maintain Business Users tile.
2. Choose New .
3. In the following dialog, choose the employee record of the new administrator from the list.
4. Confirm the system message that you want to create a new user.
5. Add the time zone to the business user data.
6. On the Assigned Business Roles tab, choose Add .
7. Select the checkbox for the predefined administrator business role SAP\_BR\_ADMINISTRATOR .
8. Select the checkbox for other administrator roles that are available for your organization and choose OK .
9. Choose OK .
10. Choose Save .
## 3.3.1.2.9 Creation of Developer Users
After you have set up the ABAP environment for development, create developer users for the ABAP environment.
Creating developer users also helps you verify that your development setup is correct and complete.
## 3.3.1.2.9.1  Creating New Space Members and Assigning Space Developer Roles to Them
For your developers, create new members in the space for the ABAP environment and assign developer roles to them.
## Context
##  Note
If you have run the booster Prepare an Account for ABAP Development , you can skip this step.
## Procedure
1. Log on to the SAP BTP cockpit as Cloud Foundry administrator.
2. Choose the tile for the Cloud Foundry subaccount.
3. In the navigation area, choose Spaces .
4. Choose the space for the ABAP environment.
5. In the navigation area, choose Members .
All members currently assigned to the space are shown in a list.
6. Choose Add Members .
7. Enter e-mail addresses of your developer users.
8. You can use commas, spaces, semicolons, or line breaks to separate members.
9. Select the space developer role for the users and save your changes.
## 3.3.1.2.9.2  Creating an Employee Record for a New Developer
Create an employee record for a new developer user for the ABAP environment.
## Procedure
1. Log on to the administration launchpad of the ABAP environment as administrator (see Logging on to the Administration Launchpad of the ABAP Environment [page 192]).
2. Choose the Maintain Employees tile.
3. Choose Create .
4. Enter the data for the new developer, including employee ID, name, and e-mail address.
The entered e-mail is important because it represents the mapping between the user in the identity provider and in the ABAP environment.
5. Choose Save .
## 3.3.1.2.9.3  Assigning the ABAP Developer User to the ABAP Developer Role
Add the developer user as business user to the ABAP instance.
## Prerequisites
You have created an employee record for the new developer user (see Creating an Employee Record for a New Developer [page 195]).
You have created an ABAP developer role based on the business role template SAP\_BR\_DEVELOPER , which provides developers with unrestricted read and write access in the ABAP environment. Alternatively, you have created a business role based on a development-related business catalog (see Business Catalogs for Development Tasks [page 2648]).
## Procedure
1. Log on to the administration launchpad of the ABAP environment as administrator (see Logging on to the Administration Launchpad of the ABAP Environment [page 192]).
2. On the SAP Fiori launchpad, choose the Maintain Business Users tile.
3. Choose New .
4. In the following dialog, choose the employee record of the new developer user from the list.
5. Confirm the system message that you want to create a new user.
6. On the Assigned Business Roles tab, choose Add .
7. Select the checkbox for the ABAP developer role that you have created before (see Prerequisites ).
8. Choose OK and save your entries.
## 3.3.1.2.10  Creating a Service Key (Optional)
In the SAP BTP cockpit, you can create a service key for the ABAP system. You can later use this service key, for example, to log on to the ABAP system from ABAP development tools for Eclipse for test purposes.
## Context
You can use service keys to generate credentials to communicate directly with a service instance. After you have configured the service keys for your service, local clients, apps in other spaces, or entities outside your deployment can access your service with these keys. Using a service key is one option how you can access the service instance of the ABAP environment, for example, as administrator for test purposes. Note, however, that there's also another option for users of ABAP development tools for Eclipse: instead of using an existing service key, developers and other users with a user and password for the ABAP system can also use the project creation wizard in ABAP development tools for Eclipse to log on to the ABAP service instance and use the service key that is automatically provided by the service instance. You can also create service keys for other use cases, such as: Creating an Inbound Communication Arrangement with Service Key Type Basic and Configuring the Timeout of the @sap/approuter Component.
##  Note
The process for connecting to an ABAP service instance URL when creating a new ABAP Cloud project in ABAP development tools for Eclipse has changed. For more information, see ABAP Service Instance URL [page 1772].
## Procedure
1. As Cloud Foundry administration user, log on to the SAP BTP cockpit.
2. Go to your Cloud Foundry subaccount for the ABAP environment.
3. In the navigation area, choose Spaces .
4. Choose the tile for the ABAP environment space.
5. From the navigation area, choose Services Instances and Subscriptions .
6. Choose the service instance of the ABAP system.
7. In the Service Keys section of the details area, choose Create .
8. Enter a name for the service key, for example, ABAP Development .
9. Choose Save .
10. Copy the created service key for later reuse.
## 3.3.1.3 Setup of UI Development in SAP Business Application Studio (Optional)
If developers want to use SAP Business Application Studio to create and deploy SAP Fiori application UIs, you need to perform some administrative activities to set it up.
In the Cloud Foundry environment, SAP Business Application Studio is a service that provides a modular development environment, including the development of SAP Fiori applications. As an alternative to SAP Business Application Studio, you can also use SAP Web IDE. We recommend that you use SAP Business Application Studio.
##  Note
The process for connecting to an ABAP service instance URL when creating a new ABAP Cloud project in ABAP development tools for Eclipse has changed. For more information, see ABAP Service Instance URL [page 1772].
## Prerequisites
For setting up SAP Business Application Studio, you need the following:
- You are a member of the global account.
- You are an organization manager in your Cloud Foundry subaccount (see also Adding a User as Org Manager for the Cloud Foundry Organization [page 191]).
- You have created an ABAP service instance (see also Creating an ABAP System [page 183]).
- You are a security administrator. If you have created a subaccount for the ABAP environment in the Cloud Foundry environment, your user automatically has the security administration role.
## Setting Up SAP Business Application Studio
##  Note
If you have run the booster Prepare an Account for ABAP Development , you can skip the first two steps.
## Do
<!-- image -->
- Subscribing to SAP Business Application Studio [page 200]
- Assigning Permissions for SAP Business Application Studio [page 200]
- Creating a Service Key for the ABAP System [page 201]
- Creating a Destination to the ABAP System for SAP Business Application Studio [page 202]
1. To enable the creation and deployment of SAP Fiori application UIs, subscribe to SAP Business Application Studio in the same subaccount in which you've created your ABAP service instance (see Subscribing to SAP Business Application Studio [page 200]).
2. To allow developers to develop applications using SAP Business Application Studio, assign developers to the Business\_Application\_Studio\_Developer role collection (see Assigning Permissions for SAP Business Application Studio [page 200]).
3. Create a service key for your ABAP system, which you will need to set up a service destination (see Creating a Service Key for the ABAP System [page 201]).
4. To connect your ABAP system with SAP Business Application Studio, set up a destination in the same subaccount in which you have subscribed to SAP Business Application Studio (see Creating a Destination to the ABAP System for SAP Business Application Studio [page 202]).
## 3.3.1.3.1 Subscribing to SAP Business Application Studio
If developers want to use SAP Business Application Studio as development environment for UIs, you need to subscribe to SAP Business Application Studio in your subaccount.
## Context
##  Note
If you have run the booster Prepare an Account for ABAP Development , you can skip this step.
For more information about SAP Business Application Studio and how to subscribe to it, see also Subscribe to SAP Business Application Studio.
## Procedure
1. Log on to the SAP BTP cockpit as Cloud Foundry administrator.
2. Choose the tile of the global account of the Cloud Foundry environment.
3. From the global account, navigate to the same subaccount where the ABAP instance is present.
4. From the navigation area, choose Services Service Marketplace .
5. Search for Studio .
The SAP Business Application Studio tile is displayed.
6. Choose the application name.
7. Choose Create .
## 3.3.1.3.2 Assigning Permissions for SAP Business Application Studio
Use the available role collection Business\_Application\_Studio\_Developer to assign the relevant permissions to your developers to work in SAP Business Application Studio.
## Context
Developers using SAP Business Application Studio must be assigned to developer roles based on the Business\_Application\_Studio\_Developer role template. When you subscribe to SAP Business Application Studio, a role collection containing the relevant developer permissions is automatically created. You must assign the role collection to your developers.
##  Note
In the following steps, you can assign a role collection to an individual user. If you have run the booster Prepare an Account for ABAP Development , you can skip this step.
As an alternative, if you are using a custom identity service and identity provider groups, you can also assign the role collection to the identity provider group for your developers. For more information, see Setup of a Custom Identity Service [page 206] and Mapping a Role Collection to the Identity Provider Group for Developers [page 211].
## Procedure
1. In the SAP BTP cockpit, navigate to your subaccount for the ABAP environment.
2. From the navigation area, choose Security Role Collections .
3. Choose the role collection Business\_Application\_Studio\_Developer .
4. Go to the Users section and choose Edit .
5. Enter the user ID of the user that you want to assign to the role collection.
6. Save your changes.
## 3.3.1.3.3 Creating a Service Key for the ABAP System
Create a service key for the ABAP system, which will later be needed to configure a destination from SAP Business Application Studio to the ABAP system.
##  Note
The process for connecting to an ABAP service instance URL when creating a new ABAP Cloud project in ABAP development tools for Eclipse has changed. For more information, see ABAP Service Instance URL [page 1772].
You can use service keys to generate credentials to communicate directly with a service instance. After you have configured the service keys for your service, local clients, apps in other spaces, or entities outside your deployment can access your service with these keys. For more information about service keys, see Creating Service Keys.
1. As Cloud Foundry administration user, log on to the SAP BTP cockpit.
2. Go to your Cloud Foundry subaccount for the ABAP environment.
3. In the navigation area, choose Spaces .
4. Choose the tile for the ABAP environment space.
5. From the navigation area, choose Services Instances .
6. Choose the service instance for the ABAP system.
7. In the Service Keys section of the details area, choose Create .
8. Enter a service key name, for example, ABAP Destination , and save.
9. From the service key, copy the following for later reuse:
- The URL of the ABAP system from the url element
- The client ID from the clientid element in the uaa section
- The content of the clientsecret element in the uaa section
- The URL from the url element in the uaa section
## Related Information
SAP BTP Cockpit
## 3.3.1.3.5.1  Creating a Communication System for SAP Business Application Studio
Create a communication system to set up communication between your ABAP environment system and SAP Business Application Studio.
## Procedure
1. In the SAP BTP cockpit, download your subaccount-specific trust certificate by navigating to Connectivity Destinations Download Trust .
2. In the SAP Fiori launchpad of your ABAP environment system, create a communication system by using the Communication Systems app. See How to Create Communication Systems.
3. Navigate to section General SAML Bearer Assertion Provider and switch the toggle button to ON .
4. Upload the Signing Certificate first and then enter the following data:
##  Note
The signing certificate is the trust certificate that you have downloaded from your destination.
| Field                | User Input                                                                                                                        |
|----------------------|-----------------------------------------------------------------------------------------------------------------------------------|
| User ID Mapping Mode | UserName                                                                                                                          |
| SAML Bearer Issuer   | From the Signing Certificate Subject , copy the common name (the string after CN= ) and paste it in the SAML Bearer Issuer field. |
## 3.3.1.4 Setup of a Custom Identity Service
For your business users in the ABAP environment, you set up a custom identity service.
## Custom Identity Service for the ABAP Environment
For platform users such as the administrator, the default identity provider is SAP ID Service, which is set up by default. For the business users in the ABAP environment, you must set up a custom identity service. For example, the users of your deployed application or users of subscribed apps or services, such as SAP Business Application Studio, are business users. For more information about platform and business users in the ABAP environment, see User Types.
In this documentation, a custom trust configuration is described using SAP Cloud Identity Services - Identity Authentication. The Identity Authentication service is a cloud solution for identity lifecycle management for SAP BTP applications. You can set up SAP BTP as a service provider, and Identity Authentication service as an identity provider.
## Identity Authentication Service as Proxy
If you have your own custom identity providers at your company, you can use SAP Cloud Identity Services Identity Authentication as a proxy. For more information about setting up the Identity Authentication service as a proxy, see Establish Trust and Federation Between UAA and Identity Authentication and Configure Trust with Corporate Identity Provider.
## More Information
This documentation describes the basic trust concepts and helps you to get started with a simple landscape. To learn more about trust setup with custom identity providers, check the following, more detailed documentation:
- For more information about trust in SAP BTP, see Trust and Federation with Identity Providers.
- For more information about the Identity Authentication service, see Overview and Initial Setup.
## 3.3.1.4.1 Establishing Trust of Type OpenID Connect
If you want to use a custom identity provider, you must set up trust between the subaccount and the SAP Cloud Identity Services - Identity Authentication service.
## Context
##  Note
If you have run the booster Prepare an Account for ABAP Development , you can skip this step.
If you have custom identity provider, you can use a function in SAP BTP cockpit to set up trust between your subaccount and the Identity Authentication service for SAP BTP automatically. The trust configuration is of type OpenID Connect .
For more information, see Establish Trust and Federation Between SAP Authorization and Trust Management Service and Identity Authentication.
## Procedure
1. In the SAP BTP cockpit, go to the subaccount for your ABAP system.
2. From the navigation area, choose Security Trust Configuration .
3. Choose Establish Trust .
4. In the following popup, select a identity provider from the dropdown list.
Only identity providers that are associated with your customer ID are shown.
5. Choose Establish Trust .
Trust of type OpenID Connect between your subaccount and the identity provider is generated.
6. Log on to the Identity Authentication service.
7. From the navigation area, choose Applications &amp; Resources Applications .
8. Search for the application that has been created as part of the trust setup.
The name of the application has the format SAP BTP subaccount &lt;Subaccount Name&gt; , but you can change it if needed.
##  Note
Older application names have the format XSUAA\_ &lt;Subaccount Name&gt; .
9. Verify that the subject name identifier matches the login\_attribute chosen during ABAP system provisioning.
| ABAP login_attribute   | SAP Cloud Identity Services Subject Name Identifier   |
|------------------------|-------------------------------------------------------|
| email                  | email                                                 |
| user_name              | login name                                            |
## 3.3.1.4.2 Creating Identity Provider Users and Groups
Learn how you create identity provider users and groups in the Identity Authentication service.
## Context and Use Cases
This configuration is needed for easier developer authentication using Identity Authentication service. With the creation of identity provider groups, you can also more easily map role collections to entire user groups instead of single users, or map identity provider groups to groups in the Neo environment, for example.
This documentation illustrates the basic concepts and helps you to get started with users and groups in a simple landscape for the ABAP environment.
## Prerequisites
You have already created developer users in the ABAP environment (see Creation of Developer Users [page 194]).
## 3.3.1.4.2.1  Creating an Identity Provider Group for Developers
In the administration console of the Identity Authentication service, you can create an identity provider group for the developers.
## Context
An identity provider group for developers is useful, for example, if you want to assign a role collection to all developers in one step, such as the Application\_Studio role collection for SAP Business Application Studio.
You also use identity provider groups for developers if you want to assign all developers to a corresponding group in the Neo environment, which is necessary if your developers want to use SAP Web IDE as UI development tool.
For more information about creating user groups in the Identity Authentication service, see Create a New User Group.
## Procedure
1. Log on to the tenant's administration console for the Identity Authentication service at https:/ / &lt;tenant ID&gt; .accounts.ondemand.com/admin as administration user.
2. In the navigation area, choose Users &amp; Authorizations User Groups .
3. If no user group for developers exists, choose + Add .
4. Enter a name, for example, Developers .
5. Enter a display name and a description.
6. Choose Save .
7. Note down the group name for later reference.
## 3.3.1.4.2.2  Creating Identity Provider Users for Developers
In the administration console of the Identity Authentication service, you can create identity provider users for the developers working in the ABAP environment.
## Context
You create identity provider users if you work with your own custom identity provider, such as the Identity Authentication service for SAP BTP. You can use the identity provider users, for example, for developers who develop UIs and services using SAP Web IDE or SAP Business Application Studio.
For more information about creating users in the Identity Authentication service, see Create a New User.
## Procedure
1. Log on to the tenant's administration console for the Identity Authentication service at https:/ / &lt;tenant ID&gt; .accounts.ondemand.com/admin as administration user.
2. In the navigation area, choose Users &amp; Authorizations User Management .
3. Choose + Add User .
4. Enter the name, e-mail address and login name of the developer.
5. Leave the account type set to Employee .
6. Make sure that the account activation is set to Send activation e-mail .
7. Choose Save .
## 3.3.1.4.2.3  Assigning the Identity Provider User Group to the Identity Provider Users for Developers
Assign the identity provider user group for developers to the identity provider users that you have created for the developers.
## Prerequisites
You have already created identity provider users. You have also already created identity provider user groups, for example, for SAP Web IDE, for SAP Business Application Studio, or for both.
## Context
You now assign these identity provider user groups to the identity provider users for the developers.
For more information about assigning user groups, see Assign Groups to a User.
## Procedure
1. Log on to the tenant's administration console for the Identity Authentication service at https:/ / &lt;tenant ID&gt; .accounts.ondemand.com/admin as administration user.
2. In the navigation area, choose Users &amp; Authorizations User Management .
3. Choose the identity provider user that you have created for the developer.
4. Choose the User Group tab.
5. Choose Assign Groups .
6. Choose the identity provider group for developers that you have created (for example, Developers for SAP Web IDE, or BAS\_DEVELOPERS for SAP Business Application Studio).
7. Choose Save .
## 3.3.1.4.2.4  Mapping a Role Collection to the Identity Provider Group for Developers
For developers to be able to work with SAP Business Application Studio, you can use a predefined role collection and assign it to the identity provider group that you created for the developers.
## Prerequisites
##  Note
If you have run the booster Prepare an Account for ABAP Development , you can skip this step.
You have subscribed to SAP Business Application Studio (see Subscribing to SAP Business Application Studio [page 200]).
## Context
##  Note
These steps are only relevant if developers want to use SAP Business Application Studio as development environment for UIs.
Developers who want to load, develop, and deploy applications in SAP Application Studio must be assigned to developer roles based on the Business\_Application\_Studio\_Developer role template. There's no need to create these roles for SAP Business Application Studio. When you subscribe to SAP Business Application Studio, role collections together with these business role templates are created automatically.
This procedure briefly describes how to assign the role collections to the developer user group in your custom identity provider. For more information about managing authorizations, see Manage Authorizations.
## Procedure
1. Log on to the SAP BTP cockpit as Cloud Foundry administrator.
2. Choose the tile of the global account of the Cloud Foundry environment.
3. In the SAP BTP cockpit, navigate to your subaccount for the ABAP environment.
4. From the navigation area, choose Security Role Collections .
5. Choose the Business\_Application\_Studio\_Developer role collection.
6. Go to the User Groups section and choose Edit .
7. Select the identity provider where the user group is stored.
8. Enter the name of the user group that you created before, for example, Developers .
## 3.3.1.5 Setup of UI Development in SAP Web IDE (Optional)
If your developers want to use SAP Web IDE as a development tool for creating UIs, you as an administrator need to perform some additional settings.
If your developers want to use SAP Web IDE, which is part of the Neo environment, they need to work in the Cloud Foundry and the Neo environments. To enable an easier authentication of the developers in the Cloud Foundry and Neo environments, set up SAP BTP as a service provider, and Identity Authentication service as an identity provider. For the integration, you must set the trust on both sides and map the identity provider group for developers to its corresponding Neo group.
##  Recommendation
We recommend that you use SAP Business Application Studio as a UI development environment instead of SAP Web IDE.
## 3.3.1.5.1 Neo Environment: Trust Setup
To enable an easier authentication of the developers in the Cloud Foundry and Neo environments, set up SAP BTP as a service provider, and Identity Authentication service as an identity provider.
Before you follow the steps outlined here for setting up trust between the Neo application and the Identity Authentication service, make sure that you have already set up the Identity Authentication service as custom identity provider for the Cloud Foundry account. For more information, see Setup of a Custom Identity Service [page 206].
## 3.3.1.5.1.1  Exporting SAML Identity Provider Metadata
Export the SAML metadata of the identity provider for the SAML trust setup on the service provider side.
## Context
You need this step only if the SAML metadata file for the Identity Authentication service tenant has not been downloaded already. For more information about tenant SAML 2.0 configuration, see Tenant SAML 2.0 Configuration.
## Procedure
1. Log on to the tenant's administration console for the Identity Authentication service at https:/ / &lt;Your custom Identity Authentication service tenant&gt; .accounts.ondemand.com/admin as administration user.
2. In the navigation area, choose Applications &amp; Resources Tenant Settings .
3. Choose SAML 2.0 Configuration .
4. Choose Download Metadata File (or download it directly from https:/ / &lt;Your custom Identity Authentication service tenant&gt; .accounts.ondemand.com/saml2/metadata).
5. Specify a file name and save it locally to your hard drive.
##  Note
Specify a file name that you can easily recognize later, for example, metadataIDP&lt;tentantid&gt;.xml , because you need to download and upload multiple SAML metadata files later.