Skip to content

Commit 3ec0750

Browse files
ditaccms-botditaccms-bot
committed
Update from SAP DITA CMS (squashed):
commit 9ce367f766f23cdb38c7e4fe28d37678d751419c Author: REDACTED Date: Tue Aug 5 21:48:13 2025 +0000 Update from SAP DITA CMS 2025-08-05 21:48:13 Project: dita-all/jjq1673438782153 Project map: c2f780f61c744155b0bd42b6f38fb70c.ditamap Output: loiob2927cc326be495da9f4fea0b6bda2b3 Language: en-US Builddable map: c590d25af285407ba12a69179a940c19.ditamap commit 9a80a910891cefd4917816e7433c4e904531de8c Author: REDACTED Date: Tue Aug 5 21:26:11 2025 +0000 Update from SAP DITA CMS 2025-08-05 21:26:11 Project: dita-all/jjq1673438782153 Project map: c2f780f61c744155b0bd42b6f38fb70c.ditamap Output: loiob2927cc326be495da9f4fea0b6bda2b3 Language: en-US Builddable map: c590d25af285407ba12a69179a940c19.ditamap commit 906c62842a7665f96a85f8c2cf4048b486ca86b4 Author: REDACTED Date: Tue Aug 5 13:55:48 2025 +0000 Update from SAP DITA CMS 2025-08-05 13:55:48 Project: dita-all/jjq1673438782153 Project map: c2f780f61c744155b0bd42b6f38fb70c.ditamap ################################################## [Remaining squash message was removed before commit...]
1 parent 04bdbc8 commit 3ec0750

18 files changed

+370
-20
lines changed

‎docs/1-connectivity-documentation/calling-the-destination-service-rest-api-via-ias-token-ce25f2b.md‎

Lines changed: 302 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,302 @@
1+
<!-- loioce25f2be9c3640ca832d73e31e7917fc -->
2+
3+
# Calling the Destination Service REST API via IAS Token
4+
5+
Find a step-by-step procedure to use an IAS token for calling available Destination service REST API endpoints.
6+
7+
8+
9+
## Prerequisites
10+
11+
To call the Destination service REST API using an IAS token, you must have the following set up:
12+
13+
- [Configured Trust](https://help.sap.com/docs/btp/sap-business-technology-platform/establish-trust-and-federation-between-uaa-and-identity-authentication?version=Cloud) between *SAP Authorization and Trust Management service* and *SAP Cloud Identity Services*
14+
- A Destination service instance inside your subaccount
15+
- An Identity service instance inside your subaccount
16+
17+
18+
19+
<a name="loioce25f2be9c3640ca832d73e31e7917fc__instance"/>
20+
21+
## Set Up a Destination Service Instance for your Subaccount
22+
23+
To create a Destination service instance inside your subaccount, follow this documentation about creating service instances through the BTP cockpit or from the CF CLI: [Creating Service Instances](https://help.sap.com/docs/btp/sap-business-technology-platform/creating-service-instances?version=Cloud).
24+
25+
> ### Note:
26+
> When creating a Destination service instance, you can refer to the following *yaml* segment for the basic information of the instance.
27+
28+
29+
<table>
30+
<tr>
31+
<th valign="top">
32+
33+
Basic Information for the Destination Service instance
34+
35+
</th>
36+
</tr>
37+
<tr>
38+
<td valign="top">
39+
40+
- Plan: *lite*
41+
42+
\# Currently, the Destination service offers only this plan.
43+
44+
- Runtime Environment: *Cloud Foundry*
45+
46+
\# You will need to have enabled Cloud Foundry for your subaccount.
47+
48+
- Space: *<space\_name\>*
49+
50+
\# Choose the space in which the Destination service instance will reside in.
51+
52+
- Instance Name: *<instance\_name\>*
53+
54+
\# Enter whatever name you want here for the instance.
55+
56+
57+
58+
59+
</td>
60+
</tr>
61+
</table>
62+
63+
64+
65+
## Retrieving the Destination Service REST API Endpoint
66+
67+
The Destination service REST API endpoint can be retrieved from the credentials contained in a service key of the Destination Service instance. If you don't have any service keys in your Destination service instance, follow this BTP documentation about creating a service key for an instance from the BTP cockpit or through the CF CLI: [Creating Service Keys](https://help.sap.com/docs/btp/sap-business-technology-platform/creating-service-keys?version=Cloud).
68+
69+
Once you have a service key for your Destination service instance, you need to open it and extract the following information:
70+
71+
72+
<table>
73+
<tr>
74+
<th valign="top">
75+
76+
Information to Extract from the Service Key
77+
78+
</th>
79+
</tr>
80+
<tr>
81+
<td valign="top">
82+
83+
- uri: *"<value\_to\_extract\>"*
84+
85+
\# The URL of the Destination service
86+
87+
88+
89+
90+
</td>
91+
</tr>
92+
</table>
93+
94+
95+
96+
## Set up a Cloud Identity Service Instance for your Subaccount
97+
98+
To create a Cloud Identity service instance inside your subaccount, follow this documentation about creating service instances through the BTP cockpit or from the CF CLI: [Creating Service Instances](https://help.sap.com/docs/btp/sap-business-technology-platform/creating-service-instances?version=Cloud).
99+
100+
> ### Note:
101+
> When creating a Cloud Identity service instance, you must provide the following basic information as well as the parameters in the *config.json* input file.
102+
103+
104+
<table>
105+
<tr>
106+
<th valign="top">
107+
108+
Basic Information for the Cloud Identity Service
109+
110+
</th>
111+
</tr>
112+
<tr>
113+
<td valign="top">
114+
115+
- Plan: *application*
116+
117+
\# Currently, the Cloud Identity service offers only this plan.
118+
119+
- Runtime Environment: *Cloud Foundry*
120+
121+
\# You must have enabled Cloud Foundry for your subaccount.
122+
123+
- Space: *<space\_name\>*
124+
125+
\# Choose the space in which the Cloud Identity service instance will reside in.
126+
127+
- Instance Name: *<instance\_name\>*
128+
129+
\# Enter any name for the instance.
130+
131+
132+
133+
134+
</td>
135+
</tr>
136+
</table>
137+
138+
**config.json \(Example\)**
139+
140+
> ### Sample Code:
141+
> ```
142+
> {
143+
> "consumed-services":
144+
> [
145+
> {
146+
> "service-instance-name": "<destination-service-instance-name>"
147+
> }
148+
> ]
149+
> }
150+
> ```
151+
152+
where:
153+
154+
*<destination-service-instance-name\>* is the value of `instance_name` from step [Set Up a Destination Service Instance for your Subaccount](calling-the-destination-service-rest-api-via-ias-token-ce25f2b.md#loioce25f2be9c3640ca832d73e31e7917fc__instance).
155+
156+
157+
158+
## Getting the Credentials to Call the Destination Service REST API
159+
160+
To access the Destination service REST API, you need an access token. To generate such, you must get the credentials contained in a service key of the Cloud Identity service instance. If you don't have any service keys in your Cloud Identity service instance, follow this BTP documentation about creating a service key for an instance from the BTP cockpit or through the CF CLI: [Creating Service Keys](https://help.sap.com/docs/btp/sap-business-technology-platform/creating-service-keys?version=Cloud).
161+
162+
> ### Note:
163+
> The IAS access token is issued through mTLS, so when you are creating the service key in your Cloud Identity service, you must provide the following *config.json*:
164+
>
165+
> **X.509 Credential Type \(Example\)**
166+
>
167+
> > ### Sample Code:
168+
> > ```
169+
> > {
170+
> > "credential-type": "X509_GENERATED"
171+
> > }
172+
> > ```
173+
174+
Once you have a service key for your Cloud Identity service instance, you need to open it and extract the following information:
175+
176+
177+
<table>
178+
<tr>
179+
<th valign="top">
180+
181+
Information to Extract from the Service Key
182+
183+
</th>
184+
</tr>
185+
<tr>
186+
<td valign="top">
187+
188+
- clientid: *"<value\_to\_extract\>"*
189+
190+
\# The client id which will be used for the authentication in the next step
191+
192+
- certificate: *"<value\_to\_extract\>"*
193+
194+
\# The certificate which will be used for the authentication in the next step
195+
196+
- key: *"<value\_to\_extract\>"*
197+
198+
\# The key which will be used for the authentication in the next step
199+
200+
- url: *"<value\_to\_extract\>"*
201+
202+
\# The authentication endpoint from where an access token for the Cloud Identity service will be acquired
203+
204+
205+
206+
207+
</td>
208+
</tr>
209+
</table>
210+
211+
212+
213+
<a name="loioce25f2be9c3640ca832d73e31e7917fc__acquire"/>
214+
215+
## Acquire an Access Token from IAS to Access the Destination Service REST API
216+
217+
In this step, we will acquire an access token from IAS which we can then use to successfully authenticate towards the Destination service REST API. For this step, you must use the values you extracted for `clientid`, `certificate`, `key`, and `url` from the previous step.
218+
219+
Here is an example call using curl:
220+
221+
**CURL Command to Acquire an Access Token for the Destination service**
222+
223+
> ### Sample Code:
224+
> ```
225+
> curl -X POST \
226+
> "<url>/oauth2/token" \
227+
> -H "Content-Type: application/x-www-form-urlencoded" \
228+
> -d "grant_type=client_credentials" --data-urlencode "client_id=<client_id>" --cert <certificate> --key <key>
229+
> ```
230+
231+
where:
232+
233+
- <url\> is the value of `url` from the previous step
234+
- <client\_id\> is the value of `clientid` from the previous step
235+
- <certificate\> is the value of `certificate` from the previous step
236+
- <key\> is the value of the `key` from the previous step
237+
238+
The token which you will be using for the next step is provided under the `access_token` key in the response JSON. Make sure you save it because we will need it in the next step.
239+
240+
241+
242+
<a name="loioce25f2be9c3640ca832d73e31e7917fc__section_i1p_qt5_bgc"/>
243+
244+
## Call the Destination Service REST API
245+
246+
Now that you have an access token for the Destination service, you can finally call one of the Destination service REST API endpoints. To see the full list of available endpoints in the Destination service REST API and their responses, see [Destination Service REST API reference](https://api.sap.com/api/SAP_CP_CF_Connectivity_Destination/resource/Find_a_Destination).
247+
248+
> ### Caution:
249+
> Currently, authentication to the Destination service via IAS token is working only for [destinations](https://api.sap.com/api/SAP_CP_CF_Connectivity_Destination/resource/Destinations_on_Subaccount_Level), [destination fragments](https://api.sap.com/api/SAP_CP_CF_Connectivity_Destination/resource/Destination_Fragments_on_Subaccount_Level), and [certificates](https://api.sap.com/api/SAP_CP_CF_Connectivity_Destination/resource/Certificates_on_Subaccount_Level) on *subaccount* level.
250+
251+
Here is an example of the call using curl:
252+
253+
**CURL Command for Calling the Destination Service**
254+
255+
> ### Sample Code:
256+
> ```
257+
> curl -X GET \
258+
> "<uri>/destination-configuration/v1/<endpoint>" \
259+
> -H "Authorization: Bearer <access_token>"
260+
> ```
261+
262+
where:
263+
264+
- <uri\> is the value of `uri` from [Getting the Credentials to Call the Destination Service](calling-the-destination-service-rest-api-via-ias-token-ce25f2b.md#loioce25f2be9c3640ca832d73e31e7917fc__credentials)
265+
- <endpoint\> is the endpoint of the Destination service REST API which you want to call
266+
- <access\_token\> is the access token you saved from [Acquire an Access Token from IAS to Access the Destination Service REST API](calling-the-destination-service-rest-api-via-ias-token-ce25f2b.md#loioce25f2be9c3640ca832d73e31e7917fc__acquire)
267+
268+
For a more concrete example, if you want to make a GET call towards the */subaccountDestinations* endpoint, the call would look like this:
269+
270+
**CURL Command for Calling the Destination Service**
271+
272+
> ### Sample Code:
273+
> ```
274+
> curl -X GET \
275+
> "<uri>/destination-configuration/v1/subaccountDestinations" \
276+
> -H "Authorization: Bearer <access_token>"
277+
> ```
278+
279+
An example response from the Destination service would be:
280+
281+
> ### Sample Code:
282+
> ```
283+
> [
284+
> {
285+
> "Name": "no-authentication-destination",
286+
> "Type": "HTTP",
287+
> "URL": "https://sap.com",
288+
> "Authentication": "NoAuthentication",
289+
> "ProxyType": "Internet"
290+
> },
291+
> {
292+
> "Name": "basic-authentication-destination",
293+
> "Type": "HTTP",
294+
> "URL": "https://sap.com",
295+
> "Authentication": "BasicAuthentication",
296+
> "ProxyType": "Internet",
297+
> "User": "my-user",
298+
> "Password": "my-password"
299+
> }
300+
> ]
301+
> ```
302+

‎docs/1-connectivity-documentation/configure-identity-propagation-for-rfc-33a2f37.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ The following data and setup is used:
3030
3131
- The Cloud Connector system identity's SNC name is `p:CN=SCC, OU=SAP CP Scenarios, O=Trust Community, C=DE`.
3232
- The ABAP system's SNC identity name is`p:CN=SID, O=Trust Community, C=DE`. This value can typically be found in the ABAP system instance profile parameter `snc/identity/as` and hence is provided per application server.
33-
- When using the SAP Cryptographic Library, the ABAP system's SNC identity and the Cloud Connector's system identity should be signed by the same CA for mutual authentication.
33+
- When using the SAP Cryptographic Library, we recommend that you use an ABAP system SNC identity and a Cloud Connector system identity signed by the same CA for mutual authentication.
3434
- The example short-lived certificate has the subject `CN=P1234567`, where `P1234567` is the SAP BTP application user.
3535

3636

‎docs/1-connectivity-documentation/consuming-the-destination-service-7e30625.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -411,3 +411,5 @@ Back to [Tasks](consuming-the-destination-service-7e30625.md#loio7e306250e08340f
411411
412412
[Extending Destinations with Fragments](extending-destinations-with-fragments-f56600a.md "Use the “Find Destination” API to extend your destination with a destination fragment.")
413413
414+
[Using an IAS User Token for Corporate IdP Token Principal Propagation to On-Premise Systems](using-an-ias-user-token-for-corporate-idp-token-principal-propagation-to-on-premise-e50acf1.md "Using an IAS user token for corporate IdP token principal propagation to on-premise systems allows automatic token exchange to the corporate IdP token.")
415+

‎docs/1-connectivity-documentation/create-http-destinations-783fa1c.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ You have logged into the cockpit and opened the *Destinations* editor from your
5353

5454
10. \(Optional\) You can enter additional properties.
5555

56-
1. In the *Additional Properties* panel, choose *New Property*.
56+
1. In the *Additional Properties* panel, choose *Add Property*.
5757

5858
2. Enter a key \(name\) or choose one from the dropdown menu and specify a value for the property. You can add as many properties as you need.
5959

‎docs/1-connectivity-documentation/create-ldap-destinations-2d11ff6.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ You have logged into the cockpit and opened the *Destinations* editor from your
4141

4242
9. \(Optional\) You can enter additional properties.
4343

44-
1. In the *Additional Properties* panel, choose *New Property*.
44+
1. In the *Additional Properties* panel, choose *Add Property*.
4545

4646
2. Enter a key \(name\) or choose one from the dropdown menu and specify a value for the property. You can add as many properties as you need.
4747

‎docs/1-connectivity-documentation/create-mail-destinations-6442cb4.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,14 +40,14 @@ You have logged into the cockpit and opened the *Destinations* editor from your
4040

4141
7. Enter an *additional property* to specify the address of the target mail server.
4242

43-
1. In the *Additional Properties* panel, choose *New Property*.
43+
1. In the *Additional Properties* panel, choose *Add Property*.
4444

4545
2. Depending on the protocol you want to use, enter *mail.imap4.host*, *mail.pop3.host*, or *mail.smtp.host* and specify a value for the property.
4646

4747

4848
8. \(Optional\) You can enter more additional properties.
4949

50-
1. In the *Additional Properties* panel, choose *New Property*.
50+
1. In the *Additional Properties* panel, choose *Add Property*.
5151

5252
2. Enter a key \(name\) or choose one from the dropdown menu and specify a value for the property. You can add as many properties as you need. Each key of an additional property must start with "`mail.`".
5353

‎docs/1-connectivity-documentation/create-rfc-destinations-9b3cc68.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ You have logged into the cockpit and opened the *Destinations* editor from your
6262

6363
12. \(Optional\) You can enter additional properties.
6464

65-
1. In the *Additional Properties* panel, choose *New Property*.
65+
1. In the *Additional Properties* panel, choose *Add Property*.
6666

6767
2. Enter a key \(name\) or choose one from the dropdown menu and specify a value for the property. You can add as many properties as you need.
6868

‎docs/1-connectivity-documentation/create-tcp-destinations-fe8306a.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ You have logged into the cockpit and opened the *Destinations* editor from your
4444

4545
8. \(Optional\) You can enter additional properties.
4646

47-
1. In the *Additional Properties* panel, choose *New Property*.
47+
1. In the *Additional Properties* panel, choose *Add Property*.
4848

4949
2. Enter a key \(name\) or choose one from the dropdown menu and specify a value for the property. You can add as many properties as you need.
5050

‎docs/1-connectivity-documentation/destination-service-rest-api-23ccafb.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,3 +17,5 @@ It shows all available endpoints, the supported operations, parameters, possible
1717

1818
[Referring Resources Using the REST API](referring-resources-using-the-rest-api-78ba73a.md "Select a level for destinations and destination fragments when using the Destination service Consume REST API in a single-tenant or multi-tenant scenario.")
1919

20+
[Calling the Destination Service REST API via IAS Token](calling-the-destination-service-rest-api-via-ias-token-ce25f2b.md "Find a step-by-step procedure to use an IAS token for calling available Destination service REST API endpoints.")
21+

‎docs/1-connectivity-documentation/http-destinations-42a0e6b.md‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,6 @@ Find information about HTTP destinations for Internet and on-premise connections
99
1010

1111

12-
<a name="loio42a0e6b966924f2e902090bdf435e1b2__section_N10024_N10011_N10001"/>
13-
14-
## Destination Levels
15-
16-
The runtime tries to resolve a destination in the order: *Subaccount Level* → *Service Instance Level*.
17-
18-
19-
2012
<a name="loio42a0e6b966924f2e902090bdf435e1b2__section_ojj_f1p_slb"/>
2113

2214
## Destinations for Subscribed Applications

0 commit comments

Comments
 (0)