Introduction
In this blog, I describe how to set up SAP's custom identity provider (IdP) to configure basic inbound authentication for sender systems to call an integration flow endpoints or for API clients to access the OData API.
When setting up trust relationships in SAP BTP cockpit, in most cases SAP ID service is used as default identity provider. However, you've the option to define a custom IdP as your default IdP.
This procedure only works for SAP Identity Authentication Service.
Note: Basic auth for integration flow endpoints or cloud integration API only works if your IDP supports Open ID Connect and is registered as Open ID Connect in the Trust configuration.
Caution: This authentication option can’t be used when operating Cloud Integration on Alibaba Cloud.
Prerequisite
- You already have a Cloud Integration tenant provisioned in a cloud foundry subaccount, or you have enabled Cloud Integration capability for SAP Integration Suite.
- You have subaccount administrator permissions, or you are a security administrator.
- You have access to a SAP Cloud Identity Services - Identity Authentication tenant that is used as an identity provider hosting your business users.
- You have established trust between Cloud Integration tenant and SAP Cloud Identity Services - Identity Authentication tenant following https://blogs.sap.com/2021/06/24/how-to-set-up-a-custom-identity-provider/ .
Description
Create a service instance for XS user authentication and authorization service (XSUAA) under the apiaccess plan:
- From your subaccount, choose Instances & Subscription from the left pane and click Create. Specify the parameters as per below screenshot.
- Specify your existing space and enter a meaningful name for your instance. Click Next.
- Enter below json file (Copy-paste might show error due to character encoding hence recommended to write the json file manually) and click Next to review. {
"roles": ["xs_idp.read","xs_idp.write"]
} - Click Create to create a service instance for XS user authentication and authorization service (XSUAA) under the apiaccess plan.
- Select the service instance and choose Create Service Key.
Enter a name for the service key.
Choose Create.
Use a REST client (for example, Postman) and request an access token by providing details from the service key:
URL
https://<url from service key>/oauth/token?grant_type=client_credentials
Authorization
Basic Auth
User
clientid
Password
clientsecret
Use the access token value from the response body of previous call for all subsequent calls in the following sections.
Create a custom OpenID connect (OIDC) IDP for your XSUAA tenant:
- To establish a trust relationship between XSUAA and an IAS tenant, first list all IAS tenants available for your XSUAA tenant by calling the below URL using a REST client:
Operation
GET
URL
Value from apiurl of service key suffixed with /sap/rest/identity-providers/ias
Example: https://api.authentication.sap.hana.ondemand.com/sap/rest/identity-providers/ias
Authorization
Bearer Token
Token
Value from previous step
- As a result, you get your IAS in json format:
{
"displayName":"<name of your IAS>",
"host":"<IAS host>"
} - Choose IAS tenant hosts from returned list and use it as body of a POST request to configure IAS as Open ID Connect:
Operation
POST
URL
Value from apiurl of service key suffixed with /sap/rest/identity-providers/
Example: https://api.authentication.sap.hana.ondemand.com/sap/rest/identity-providers/
Authorization
Bearer Token
Token
Value from previous step
Header
Content-Type with value as application/json
Body
{
"type":"oidc1.0",
"config":{
"iasTenant":{
"host":"<IAS host value from GET request>"
}
}
}
- The response of the previous POST request shall be 201 created. With this trust is established between XSUAA of the subaccount and IAS IdP as Open ID connect (OIDC).
- Above request can additionally be verified via account cockpit. From your subaccount, choose Trust Configuration from the left pane. Your IAS tenant is now configured as list of trusted IdPs:
Configure SAP Custom IAS as default IdP:
- To configure custom IAS as one of IdP for your subaccount, perform a PATCH request using a REST client:
Operation
PATCH
URL
Value from apiurl of service key suffixed with /sap/rest/authorization/v2/securitySettings
Example: https://api.authentication.sap.hana.ondemand.com/sap/rest/authorization/v2/securitySettings
Authorization
Bearer Token
Token
Value from previous step
Header
Content-Type with value as application/json
Body
{
"defaultIdp": "sap.custom"
}
- The response of previous PATCH request you get 200 OK HTTP code and a response body with the following content:
"defaultIdp": "sap.custom".
- Now SAP's custom IDP (IAS) is active.
Once you have successfully accomplished the above steps, you can now use your new IDP users and assign Cloud Integration roles or role collections to users registered on the IAS tenant. While assigning Cloud Integration roles, choose Custom IAS Tenant from the drop down list for the Identity Provider. Also, the concept of role mappings assignment can be used as normal.
Switching back to SAP ID Service:
- If you like to switch back to SAP default identity provider (SAP ID service), re-perform PATCH request using a REST client using below information:
Operation
PATCH
URL
Value from apiurl of service key suffixed with /sap/rest/authorization/v2/securitySettings
Example: https://api.authentication.sap.hana.ondemand.com/sap/rest/authorization/v2/securitySettings
Authorization
Bearer Token
Token
Value from previous step
Header
Content-Type with value as application/json
Body
{
"defaultIdp": "sap.default"
}
- The response of PATCH request you get 200 OK HTTP code and a response body with the following content:
"defaultIdp": "sap.default".
- Now SAP ID service is active again.
- SAP Managed Tags:
9 Comments
