SAP Cloud Identity Services for BTP applications: Identity Authentication (IAS), Identity Provisioning (IPS), and Authorization Management (AMS).
SkillScore95Maintained
Automatic
◆Security & AppSec pack
Last verified 8/21/2026
What it changes
Passed 21 of 22 test cases with the skill, and 14 of 22 without it.
Without skill64%
With skill95%
Checks it passed that the model alone missed
Includes DCL syntax using DEFINE POLICY and CONTEXT keywords.
Specifies using CONTEXT functions in the DCL policy definition.
Identifies Identity Directory as the central user store providing SCIM 2.0 APIs.
and 7 more in the full report
7 fixed14 passed either way1 still failing0 broke
Pass-rate lift
+32 pp
Tokens
+81%
Agent turns
0%
Response time
-9%
Model gemini-3.6-flashMeasured 8/21/2026v121 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 7
Prompt
After updating our custom domain settings for our identity authentication tenant, backend services are rejecting OAuth JWT tokens with an issuer mismatch error (`iss` claim error). What causes this mismatch and how is it resolved?
What was checked, without and with the skill
Checked
Without skill
With skill
Explains that the iss token claim does not match the configured tenant URL in BTP trust.
Missed
Passed
Recommends updating the trust configuration in BTP to match the updated identity tenant URL.
Missed
Passed
case-17 · gemini-3.6-flash · 8/21/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md151 lines7 files
SAP Cloud Identity Services
SAP Cloud Identity Services are a group of services on SAP BTP that manage identity and access across cloud and on-premise systems. They provide single sign-on, user provisioning, and policy-based authorization.
The services comprise:
Identity Authentication (IAS) — cloud-based authentication, SSO (OIDC/SAML 2.0), corporate IdP federation, conditional authentication, and user store management. Acts as the identity provider for SAP BTP applications.
Identity Provisioning (IPS) — identity lifecycle management as a service. Synchronizes users and groups between source and target systems (SAP and non-SAP) with full and delta read modes, real-time provisioning, and transformation support.
Identity Directory — the central user store. Provides SCIM 2.0 REST API, custom schemas, and generates the Global User ID distributed by IPS to SAP cloud applications.
Authorization Management (AMS) — policy-based authorization for BTP applications. Developers define policies in Data Control Language (DCL); administrators refine and assign them via the administration console.
Related Skills
sap-btp-connectivity — destination service and connection authentication mechanics (OAuth client credentials, principal propagation through Cloud Connector)
sap-cap-capire — CAP application-level auth usage (role templates, @requires annotations, cds deploy with xs-security.json)
sap-btp-best-practices — high-level security governance and production deployment patterns
sap-btp-cloud-platform — BTP account setup, subaccount configuration, service instance creation
When to Use This Skill
Registering an OIDC or SAML 2.0 application in IAS
Develops business applications on SAP Business Technology Platform (BTP) using CAP (Node.js/Java) or ABAP Cloud.
Use when: building cloud applications on SAP BTP, deploying to Cloud Foundry or Kyma runtimes, integrating with SAP HANA Cloud, implementing SAP Fiori UIs, connecting to remote SAP systems, building multitenant SaaS applications, extending SAP S/4HANA or SuccessFactors, setting up CI/CD pipelines, implementing observability, or following SAP development best practices.
Keywords: SA