You have logged into the SAP BTP cockpit from the landing page for your subaccount.
-
In the cockpit, navigate to your subaccount.
-
Choose Connectivity > Destinations in the navigation panel.
-
Create an HTTP destination.
To enable principal propagation, create an OAuth2SAMLBearerAssertion HTTP destination and configure its settings as follows:
-
Configure the basic settings:
Parameter
Value
Name
Enter a meaningful name.
Type
HTTP
Description
(Optional) Enter a meaningful description.
URL
https://<my_SAP_Cloud_for_Customer_system_name>.crm.ondemand.com/sap/c4c/odata/v1/c4codataapi**
Proxy Type
Internet
Authentication
OAuth2SAMLBearerAssertion
Audience
Go to the SAP Cloud for Customer administration view, then navigate to Configure Single Sign-On under General Settings and copy the value from the Local Service Provider field.
Client Key
Client ID
Paste the entry you have copied from the Client ID field when configuring the OAuth client. For more information, see Configure the OAuth Client for OData Access.
Token Service URL
https://<my_SAP_Cloud_for_Customer_system_name>.crm.ondemand.com/sap/bc/sec/oauth2/token**
Token Service User
Client ID
Paste the entry you have copied from the Client ID field when configuring the OAuth client. For more information, see Configure the OAuth Client for OData Access.
Token Service Password
Client secret
Paste the entry you have copied from the Client Secret field when configuring the OAuth client. For more information, see Configure the OAuth Client for OData Access.
-
Configure the required additional property. To do so, in the Additional Properties panel, choose New Property, and enter the following property:
You map the application users with the respective users in SAP Cloud for Customer using their email. Thanks to this mapping, you don't necessarily need to have a common identity provider between SAP BTP and SAP Cloud for Customer.
Parameter
Value
authnContextClassRef
urn:none
nameIdFormat
urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
scope
Scope ID entries separated by space.
Paste the entry you have copied from the Client ID field when configuring the OAuth client. For more information, see Configure the OAuth Client for OData Access.
Example: UIWC:CC_HOME
userIdSource
email
-
Select the Use default JDK truststore checkbox.
-
-
Save your entries.
Related Information
Consuming the Destination Service (Cloud Foundry Environment)