MCP Server with Integration Suite, expose CAP API (SCI) via OAuth2JWTBearer Principal Propagation

[[{“value”:”

Introduction/Scenario

→ Agent (Claude/Github Copilot/any AI Agent)
→ MCP server by Integration Suite (Authenticated via IAS)
→ BTP Destination Service (OAuth2JWTBearer)
→ CAP Service APIs (executed as the authenticated user)

Note: 

1. The MCP server uses SAP Cloud Identity Services (IAS) as its authentication provider instead of the default XSUAA, as the target APIs are also protected by SAP Cloud Identity Services. Directly accessing an IAS-protected resource through an XSUAA-based authentication flow don’t seem feasible.
2. This approach limits to a single client ID allowed to access the MCP server access This restriction exists because the BAIP/BTP destination configuration requires the consumer’s client ID to be specified rather than the provider’s client ID. In this scenario, the consumer is the Integration Suite MCP server, while the provider is the CAP service.
3. OAuth2SAMLBearerAssertion can also be used in this scenario. However, this authentication flow is typically designed for communication between Cloud Foundry applications – SAML Bearer Assertion Flow between Cloud Foundry Applications | SAP Help Portal

Pre-requisite:

• SAP BAIP/BTP with Cloud Foundry Enabled
• SAP Integration Suite with MCP server, Integration Cell runtime capability
• SAP Cloud Identity Services (IAS)
• AI Agent able to communicate with MCP server

1. CAP Services creation and deploy

This demo is using a CAP bookshop sample (without the UI deployment) as the MCP server will only access the CAP API services. 

Note: You may use any AI Model to assist on CAP app generation, ensure you connect to the CAP MCP server for more accurate response.

Navigate to the project folder in terminal and execute the commands below

cds init –nodejs –add sample
cds add ams
cds add hana
npm install
cds build –for ams
cds add mta

Update the MTA file – to include the additional grant type and binding options

resources:
– name: capServiceDemo-ias
type: org.cloudfoundry.managed-service
parameters:
service: identity
service-name: capServiceDemo-ias
service-plan: application
config:
provided-apis:
– name: capServiceDemo-ias-api
description: API exposed by the application
display-name: capServiceDemo
oauth2-configuration:
token-policy:
access-token-format: “jwt”
grant-types:
– client_credentials
– authorization_code
– refresh_token
– urn:ietf:params:oauth:grant-type:jwt-bearer
– urn:ietf:params:oauth:grant-type:saml2-bearer
redirect-uris:
– https://oauth.pstmn.io/v1/callback
credential-types:
– binding-secret
– x509
authorization:
enabled: true
xsuaa-cross-consumption: true

Generate the MTA file and deploy to CF

npm install
mbt build
cf login -a http://<cf api>
cf deploy ./mta_archives/<mta file>

The App should be successfully deployed. Please make use of any AI on assisting any error during deployment.

• Copy down the services API URL

Create a service key to test the CAP API service from Postman

• clientid
• clientsecret
• authorization_endpoint

Test in Postman

Authentication setup

• Auth URL: <from previous step>, example https://<ias host>/oauth2/authorize
• Access Token URL: <from previous step>, example https://<ias host>/oauth2/token
• Client ID: <from previous step – provider client ID>
• Client Secret: <from previous step – provider client secret>
• scope: openid
• callback URL: https://oauth.pstmn.io/v1/callback <this is redirect-uris for the cloud identity service instance included in the MTA file>

Test Catalog service

Test Admin service where you should be getting authorization error if missing policy ‘Admin’ assign to your user ID in Cloud Identity Services

Go to SAP Cloud Identity Services and assign the required policy to your user ID and retry after 1 minutes. A short delay is expected because the authorization changes need time to be synchronized in the background.

2. Setup Consumer and Provider in Cloud Identity Services

Reference: JWT Bearer Flow between Two Applications in SAP Cloud Identity Services (App to App) | SAP Help Portal

For this Demo

– Consumer: Integration Suite – MCP Server
* Create a separate Cloud Identity service instance with different client ID as the consumer
– Provider: CAP Services

Create new instance

• Service: Cloud Identity Services
• Plan: application
• Instance Name: <any name>
• Redirect-uris: <include any AI Agent callback URL>

{
“authorization”: {
“enabled”: true
},
“display-name”: “IntegrationSuiteMCPConsumer”,
“oauth2-configuration”: {
“public-client”: true,
“redirect-uris”: [
“https://oauth.pstmn.io/v1/callback”,
“https://claude.ai/api/mcp/auth_callback”,
“https://claude.com/api/mcp/auth_callback”,
“http://127.0.0.1:*/callback”,
“http://localhost:*/oauth/callback”,
“http://127.0.0.1:33418”,
“https://vscode.dev/redirect”
],
“token-policy”: {
“access-token-format”: “jwt”
}
},
“provided-apis”: [
{
“description”: “IS MCP Server Consumer”,
“name”: “IS MCP Server Consumer”
}
],
“xsuaa-cross-consumption”: true
}

Create a service key and take note of the client id, client secret and url

• clientid
• clientsecret
• url

• Dependency Name: <any name, but important when setting up the destination>
• Application: capServiceDemo
• API Name: capServiceDemo-ias-api

3. Setup BAIP/BTP Destination

4. Create MCP Server in Integration Suite

Goto Integration Suite -> Create new MCP Server

Select the tools and click Add

Note: maximum 30 tools per MCP server – Create an MCP Server from an HTTP Endpoint | SAP Help Portal

The MCP Server will be created as below

Click Edit -> to update the policies

For the Authentication, choosing the SAP IAS for the authenticate.

More information can refer to the blog Secure APIs: External OIDC-Based Authentication fo… – SAP Community

• The Well-known URL: https://<ias tenant>.accounts.ondemand.com/.well-known/openid-configuration
• Audience: Can leave empty unless restrict to certain client ID or target system only
• ClientID Key: standard using ${authn.oidc.jwt.azp}, where you can find out this when studying the JWT via any JWT decoder, for example: SuperTokens JWT Decoder
• User Info Key: standard using ${authn.oidc.jwt.email}, where you can find out this when studying the JWT via any JWT decoder, for example: SuperTokens JWT Decoder

Authorization, default using API.invoke. Ensure create a role collection on this role and assign to the user, or either map it to IAS group and assign group to user in IAS

The connection(except timeout), you will not able to change anything here as the URL is derive from the BTP destination.

Deploy the MCP server.

Perform the same steps for Catalog MCP server

Goto Developer Hub

Create Product

Navigate “Admin Center” -> Content

Select the MCP Servers and click “Create Product”

Enter Name, Short Text and Click Publish

Create Subscription

Create “Subscription for Agent”

Select the created product in previous step

Client ID: <Consumer client ID generated in previous step>

click Save

5. Role Connection Setup in BAIP/BTP to allow user to invoke the MCP server

2 options here for using Cloud Identity Services/IAS as authentication for MCP server

• Create role collection to include the API.Invoke role and assign to user (The example below demonstrates this approach).
• Map the role collection contains API.Invoke to IAS group and assign IAS group to user

6. Test the MCP Server via Postman

Authentication setup

• Auth URL: <from previous step>, example https://<ias tenant>/oauth2/authorize
• Access Token URL: <from previous step>, example https://<ias tenant>/oauth2/token
• Client ID: <Consumer client ID from previous step>
• Client Secret: <Consumer client secret from previous step>
• scope: openid
• callback URL: https://oauth.pstmn.io/v1/callback <this is redirect-uris for the Consumer SAP cloud identity service instance>

Use the tool to create a new Author, can notice the createdBy my user ID, that validate that the principal propagation is working as expected.

Reference:

• SAP Help Portal | SAP Online Help
• Principal Authentication from BTP Webapp to S/4HANA (private cloud/on premise
• Named-User calling S4 Public Cloud API via Cloud I… – SAP Community
• Building MCP Servers with SAP Integration Suite: W… – SAP Community
• MCP Server | SAP Help Portal
• Secure APIs: External OIDC-Based Authentication fo… – SAP Community
• MCP Server with Integration Suite via API Centric … – SAP Community

“}]] 

  Read More Technology Blog Posts by Members articles 

#abap