SAP Cloud Identity Services offered as Trial Versi...

MSo · ‎04-13-2023

Introduction

SAP offers different Trial and so-called Free Tier instances for the Business Technology Platform (BTP) with which one can try out BTP with certain limits and time constraints. The SAP Cloud Identity Services (SCI) were so far only offered for BTP Free Tier accounts, however SCI was recently also made available as part of BTP trial accounts.

Service Offering and Limitations

The trial versions of SCI offer almost the full functional scope, just limited to a maximum of 50 users and connectivity plan not being available. Thus, corporate user store scenario or user provisioning from/to on-premise environments will not be possible with trial tenants. But aside from that trial users – and admins – can try out the SAP Cloud Identity Services free of charge.

One can request one SCI tenant per BTP global (trial) account. The SCI tenant can then be used in all subaccounts as application identity provider. The tenant cannot be used as a platform identity provider.

SCI tenant lifetime is bound to the BTP trial account (90 days – see Trial Lifecycle for details); if the BTP trial account is terminated, the corresponding SCI tenant will also be retired.

Landscape: SCI trial tenants are only offered in US East region. Thus, independent from the BTP trial landscape – currently offered in the US and Singapore – SCI tenants will always be deployed in US East region.

Service Request

Here’s how you can request your own SAP Cloud Identity Services trial tenant:

Go to your SAP BTP Trial account -
in case you don’t have one yet, please have a look at the following tutorial.

Navigate to a subaccount -> Service Marketplace -> the Cloud Identity Services default plan should be auto-entitled:

Create a new instance for Cloud Identity Services default plan:

Verify that SCI tenant creation was successful:

You will receive an account activation email for your admin user in the newly created SCI tenant

and with that user you can access the admin console of your SCI tenant:

Going back to the BTP cockpit:
you may use the new SCI tenant as application identity provider for your BTP subaccount.
Go to your BTP trial subaccount -> Security -> Trust Configuration:

‘Establish Trust’ button will create a trust configuration from the BTP subaccount to SCI based on the OpenID Connect protocol:

It is also an option to establish the trust manually based on the SAML protocol.

In the SCI administration console -> Applications & Resources -> Applications you will see the trust configuration that was established by your BTP trial account:

That’s it!
Applications you deploy in your BTP subaccount can now delegate authentication to the SCI tenant you just created. And in the SCI admin console you may configure the various options for authentication, multi-factor authentication or use SCI just as a proxy for a corporate identity provider that you may have established.