sap capire without IAS / Cloud

[matteoprinetti]

Hi, im wondering if there is some example of using the Custom Auth Approach in Capire without using IAS / XSUAA ? Scenario:

a) we have a sap capire instance running on Azure cloud provider - hostname cap.mydomain.com

b) our ABAP Gateway has SAML activated (bound to our IDP "Corporate") - hostname sap.mydomain.com

Can we access the gateway using custom auth in Capire to do the login / callback handshake ? Or should we just wrap the complete Capire instance with saml so that the SAML toke will automatically passed to the gateway ?

Is there any example on how to approach this ?

[gregorw]

First of all you should check with your legal department if the license shipped with the CAP NPM Packages (I guess you're using CAP Node.JS) does allow you such a usecase. Also you should ask yourself if you want to run CAP in an environment that SAP will not provide you any support for.

[matteoprinetti]

Hi Gregor, thanks for your answer. I will redirect the company to SAP for the license question, from a quick reading I dont find anything that binds Capire to a BTP Service in order to be used in production but - not a specialist.

The idea behind is apparently to skip the users costs in going thru the IAS for authenticating the user (we are talking over 10000 users) and running the app in CF - which may as well not be in the "permitted uses" as defined by SAP.

So I will ask them to clarify with SAP.

[gregorw]

Based on SAP Cloud Identity Services - Identity Authentication - Pricing I would think that authenticating to a CAP Application on BTP is a "SAP Cloud to SAP Cloud Log-ons" which is free: "This service plan is included in the overall SAP Business Technology Platform contract.".

Don't think that SAP will provide you any advice to that question. If any ERP or S/4HANA backend data is used then you should clarify the licensing to access that with the SAP Account Executive.