SAP BTP Platform Technical User for CTMS Integration
Introduction:
In SAP BTP environments integrated with SAP Identity Authentication Service (IAS), technical users are often required for
- Platform automation
- CI/CD integrations
- Destination-based authentication
- Cloud Foundry access
- API consumption
This blog explains the step-by-step process to create and configure a BTP platform technical user authenticated via IAS and used with OAuth2Password authentication in destination configuration.
In this setup:
- IAS acts as Custom Identity Provider
- Technical user is created in IAS
- User is added to BTP subaccounts (Org & Space level)
- OAuth2Password flow is used for authentication
- CTMS Destination is configured using CF login endpoint
Creating a Technical User in IAS tenant:
Login to IAS Admin Console:
- Go to Users
- Click Add User
- Maintain:
- Username (e.g., CTMSADM)
- Dummy Email ID (must be verified)
- Strong password
Add Technical User to BTP Subaccounts
In SAP Business Technology Platform cockpit:
- Go to Global Account
- Navigate to Subaccount
- Choose Custom IAS IDP
- Add user to:
- Org
- Space
- Required Role Collections
Add the IAS tech user in all subaccounts space and org by choosing the custom IDP IAS
After adding the users in all subaccounts
Longin to the below CF url with the technical user
https://login.cf.sa30.hana.ondemand.com/
Before configuring this user in destination make sure you that you able to login the above URL
Mention Origin key of your Custom IDP and login and it will take you to IAS sign in page
Successfully logged in
Now update the CTMS destination authentication to Oauth2Password
Maintain client ID as cf and secret should be empty
Token service url = https://login.cf.sa30.hana.ondemand.com/
Add the additional property origin and value should origin key of your platform user IDP
Now the destination for Deploy service will work as expected with Technical user created in IAS
Why Enable Technical User in IAS?
1) Secure Platform Automation
Allows:
- Background jobs
- API integrations
- Deployment pipelines
- Destination authentication
Without exposing human credentials.
2) Clear Separation of Duties
Separates:
- Human Users
- Service Accounts
This is critical for:
- Audit compliance
- SOX / ISO controls
- Security governance
3) Controlled Access
You can:
- Assign minimal role collections
- Restrict space-level access
- Monitor login activity
4) Centralized Identity Management
Since IAS is the trusted IDP:
- All authentication flows through IAS
- Password policies enforced centrally
- User lifecycle managed in one place
Conclusion:
Enabling a dedicated technical user through SAP Identity Authentication Service for SAP Business Technology Platform integrations ensures a secure and scalable approach for automation scenarios. By separating service accounts from human users, organizations can enforce stronger security controls, simplify identity management, and maintain compliance with enterprise governance standards.
This approach is particularly useful for integration scenarios such as CI/CD pipelines, CTMS transport automation, API-based integrations, and destination authentication within Cloud Foundry environments. By implementing technical users with minimal required privileges and centralized authentication via IAS, administrators can ensure both operational efficiency and improved security posture across their BTP landscape.
#abap