SAP BTP SAML JIT Setup Guide

Item

Details

Prior Confirmation

  • Prior configuration in SAP BTP is required.

  • For the latest setup instructions, please check the manual provided by SAP BTP.

Name ID

Email address

Custom attribute Note: For instructions on how to configure a custom attribute, click here

SP-side Configuration

Configured by the administrator

Request configuration from the SP

Provisioning

Provisioning via API supported (account management possible in TrustLogin)

SAML JIT provisioning supported (account management possible in TrustLogin; user deletion not supported)
Note: For setup instructions when provisioning is not required, see here

None (accounts are created in each system)

Access Method

SP-Initiated SSO

IdP-Initiated SSO

Verified Operation by Device

PC - Browser

PC - Desktop App

iOS - Standard Browser (Safari)

iOS - TrustLogin Mobile App In-App Browser

iOS - Native App

Android - Standard Browser (Chrome)

Android - TrustLogin Mobile App In-App Browser

Android - Native App

TrustLogin Admin Page Configuration

  1. Log in to TrustLogin, open the "Admin Page > App" menu, and click the "Register App" button in the upper right of the screen.
    01.png

  2. Search on the "Register Company App" screen and select "SAP BTP (SAML)".



  3. Download the metadata from the "Download Metadata" button under "Identity Provider Information".
    03.png


Now, switch to configuring the SAP BTP side.
Do not click the "Register" button yet — open the SAP BTP cockpit in a separate window.

SAP BTP Configuration

  1. Log in to the SAP BTP cockpit with an administrator account and click the subaccount you want to configure.
    04.png

  2. Open "Security" > "Trust Configuration" and click "New SAML Trust Configuration".
    05.png

  3. Configure each item, then save your settings by clicking "Save".
    Metadata Upload the "Metadata" obtained from TrustLogin via "Upload"
    Name

    Any name you like (e.g., TrustLogin)

    Status Select "Enabled"
    Create Shadow User During Logon ON

    06jit.png
  4. To make the SAML configuration available for user logon, click the edit icon (pencil mark) for the SAML configuration you created, check the box, and save.
    07.png

    09.png

  5. Download the SP metadata from "Download SAML Metadata".
    10.png

Now return to the TrustLogin Admin Page again.

TrustLogin Admin Page Configuration (Continued)

  1. Upload the metadata obtained from SAP BTP to "Metadata" under "Service Provider Settings".
    11.png

  2. Save by clicking the "Register" button.

TrustLogin User Configuration

① When a User Adds the App via My Page

  1. Click the "Add App" button on "My Page".
  2. On the "Register App" screen, select "SAP BTP (SAML)" and click the "Next" button in the upper right of the screen.
  3. If you want to change the "Display Name", enter it, then click the "Register" button.

②When an Administrator Adds Members

  1. Search for and click the "SAP BTP (SAML)" app in the "Admin Page > App" menu.
  2. Click "Add Member", select the user to add from the member list, and click the "Register" button to add them.

SAP BTP SAML JIT Setup Guide

Item

Details

Prior Confirmation

  • Prior configuration in SAP BTP is required.

  • For the latest setup instructions, please check the manual provided by SAP BTP.

Name ID

Email address

Custom attribute Note: For instructions on how to configure a custom attribute, click here

SP-side Configuration

Configured by the administrator

Request configuration from the SP

Provisioning

Provisioning via API supported (account management possible in TrustLogin)

SAML JIT provisioning supported (account management possible in TrustLogin; user deletion not supported)
Note: For setup instructions when provisioning is not required, see here

None (accounts are created in each system)

Access Method

SP-Initiated SSO

IdP-Initiated SSO

Verified Operation by Device

PC - Browser

PC - Desktop App

iOS - Standard Browser (Safari)

iOS - TrustLogin Mobile App In-App Browser

iOS - Native App

Android - Standard Browser (Chrome)

Android - TrustLogin Mobile App In-App Browser

Android - Native App

TrustLogin Admin Page Configuration

  1. Log in to TrustLogin, open the "Admin Page > App" menu, and click the "Register App" button in the upper right of the screen.
    01.png

  2. Search on the "Register Company App" screen and select "SAP BTP (SAML)".



  3. Download the metadata from the "Download Metadata" button under "Identity Provider Information".
    03.png


Now, switch to configuring the SAP BTP side.
Do not click the "Register" button yet — open the SAP BTP cockpit in a separate window.

SAP BTP Configuration

  1. Log in to the SAP BTP cockpit with an administrator account and click the subaccount you want to configure.
    04.png

  2. Open "Security" > "Trust Configuration" and click "New SAML Trust Configuration".
    05.png

  3. Configure each item, then save your settings by clicking "Save".
    Metadata Upload the "Metadata" obtained from TrustLogin via "Upload"
    Name

    Any name you like (e.g., TrustLogin)

    Status Select "Enabled"
    Create Shadow User During Logon ON

    06jit.png
  4. To make the SAML configuration available for user logon, click the edit icon (pencil mark) for the SAML configuration you created, check the box, and save.
    07.png

    09.png

  5. Download the SP metadata from "Download SAML Metadata".
    10.png

Now return to the TrustLogin Admin Page again.

TrustLogin Admin Page Configuration (Continued)

  1. Upload the metadata obtained from SAP BTP to "Metadata" under "Service Provider Settings".
    11.png

  2. Save by clicking the "Register" button.

TrustLogin User Configuration

① When a User Adds the App via My Page

  1. Click the "Add App" button on "My Page".
  2. On the "Register App" screen, select "SAP BTP (SAML)" and click the "Next" button in the upper right of the screen.
  3. If you want to change the "Display Name", enter it, then click the "Register" button.

②When an Administrator Adds Members

  1. Search for and click the "SAP BTP (SAML)" app in the "Admin Page > App" menu.
  2. Click "Add Member", select the user to add from the member list, and click the "Register" button to add them.