Principal Propagation

Principal Propagation is a mechanism on SAP Business Technology Platform that allows a user's identity (the "principal") to be forwarded from one application or service to another, preserving the original user context across system boundaries. Developers use it to enable inbound communication via a business user so that downstream systems can apply the correct authorizations for that specific user rather than a generic technical user. It is also applied in tightly coupled development scenarios and can be configured using protocols such as SAML Bearer Assertion or OAuth 2.0 SAML Bearer Assertion Grant to propagate user information between applications or services.

Tutorials that teach this

Docs explaining this concept

Prerequisites

Concept SAML Identity Provider Trust Configuration The provided sources do not contain enough grounded information to define a concept labeled "undefined." Based on the available sources, they collectively describe **SAML trust configuration** on SAP BTP — a mechanism that allows developers to establish federated trust between SAP BTP subaccounts and identity providers (such as [SAP Cloud Identity Services](https://help.sap.com/docs/btp/sap-business-technology-platform/7c6aa87459764b179aeccadccd4f91f3?locale=en-US&state=PRODUCTION&version=Cloud) or SAP SuccessFactors) using the SAML 2.0 protocol. Developers use it to enable single sign-on, map identity provider groups to platform roles, and configure OAuth 2.0 SAML Bearer Assertion grants for secure service-to-service communication. It can also be [restored after replacement](https://help.sap.com/docs/btp/sap-business-technology-platform/21d86cf36ce94da7b2f2db8271e0b539?locale=en-US&state=PRODUCTION&version=Cloud) to recover a previous trust setup in a subaccount.

Concepts that build on this

Concept OAuth2 SAML Bearer Assertion Authentication Setup