Use SAML assertions (tokens) to access OAuth-protected destinations. This method, frequently used in B2B scenarios, requires you to correctly configure SSO to share SAML security tokens. In this way, applications do not need to deal with some of the complexities of OAuth and can reuse existing identity providers for user data. Achieve reuse by configuring these properties:
  • Audience – the intended assertion audience, which is verified by the destination's OAuth server.
  • Client Key – the key that identifies the user to the destination's OAuth server.
  • Token Service URL – the URL of the security token server. You can read about this server in Security Token Service for SAP Single Sign-On and SAP Identity Management.
  • Token Service User and Token Service Password – a valid set of user credentials for the token service. Use a technical user ID, which authenticates the request.
  • System User – the mobile user who requests an access token. Leave this field blank to use the credentials of the mobile service authorized app user.
  • Security Domain Qualifier – the security domain of the user requesting the token.
  • Company Identifier – for B2B scenarios, the organization identifier of the user requesting the token.
  • SAML Assertion Issuer – the issuer of the SAML assertion.
  • Authentication Class – the value of the AuthnContextClassRef tag, which is part of the generated OAuth2 SAML Bearer Assertion authentication. See the SAML 2.0Information published on non-SAP site specification.
  • Name ID Format – the value of the NameIdFormat tag, which is part of the generated OAuth2 SAML Bearer Assertion authentication. See the SAML 2.0Information published on non-SAP site specification.
  • Define User as Name ID – if the value of the NameId tag is undefined, the generated SAML2 assertion uses the currently logged-in user.