/sap-btp-cloud-identity-services

XSUAA to IAS Migration — Complete Reference

Source: SAP Help Portal - Migration of Authentication from XSUAA to IAS, CAP IAS/XSUAA Guide, SAP Community - Cloud Identity Services

Overview

SAP is migrating SAP BTP authentication from XSUAA (SAP Authorization and Trust Management Service) to Cloud Identity Services (IAS). This is a strategic shift that enables new capabilities like Joule (SAP's AI assistant), centralized identity management, and policy-based authorization (AMS).

Current SAP Recommendation

For New Applications

• Use the Identity service of SAP BTP (not XSUAA)
• The Identity service automatically creates OIDC applications in IAS
• Use AMS for authorization (policy-based) instead of XSUAA scopes
• Configure via BTP cockpit: create an identity service instance instead of xsuaa

For Existing XSUAA Applications

• Coexistence is supported — XSUAA and IAS can work side by side
• Migration is incremental — not a big-bang switch
• SAP recommends migrating authentication to IAS while keeping XSUAA for backward compatibility during transition
• Existing xs-security.json role templates remain functional

Source: SAP Community Q1 2026 Release Highlights, adesso blog on SAP IAM strategy

Key Differences

Migration Steps

Phase 1: Establish IAS Tenant

1. Obtain an IAS tenant (bundled with SAP cloud solution or self-service via BTP cockpit)
2. Configure the IAS tenant:
   • Set up corporate IdP federation if needed
   • Configure conditional authentication
   • Set up user store (Identity Directory)

Phase 2: Create Identity Service Instance

Replace the XSUAA service instance with an Identity service instance:

# Old (XSUAA)
cf create-service xsuaa application my-xsuaa -c xs-security.json

# New (Identity service)
cf create-service identity application my-identity -c identity-config.json

The identity-config.json:

{
  "display-name": "My Application",
  "redirect-uris": ["https://myapp.cfapps.eu10.hana.ondemand.com/login/callback"],
  "post-logout-redirect-uris": ["https://myapp.cfapps.eu10.hana.ondemand.com"]
}

Phase 3: Update Application Binding

# Unbind old XSUAA
cf unbind-service myapp my-xsuaa

# Bind new Identity service
cf bind-service myapp my-identity

# Restage
cf restage myapp

Phase 4: Update Application Code

Key changes in application code:

1. Token validation: Update expected issuer and audience from XSUAA to IAS
2. User attribute access: Map from UAA claims to OIDC standard claims
3. Role checking: Transition from XSUAA scopes to role collections or AMS policies
4. Approuter configuration: Update authentication configuration to use the Identity service

Phase 5: Migrate Authorization (if using AMS)

1. Define AMS policies in DCL based on existing @restrict annotations
2. Deploy policies with the application
3. Assign policies to users via IAS admin console
4. Verify authorization behavior matches XSUAA role collections

Phase 6: Validate and Cut Over

1. Test all authentication flows (login, SSO, SLO, token refresh)
2. Verify user attributes are correctly mapped
3. Confirm role/authorization assignments work
4. Monitor for token validation errors
5. Remove XSUAA service instance once stable

Coexistence

During migration, XSUAA and IAS can coexist:

• Applications can accept tokens from both XSUAA and IAS
• Role collections in BTP cockpit can include roles from both services
• Users can authenticate via either path
• Use the IAS trust configuration alongside the existing sap.default trust

Role Collection Mapping

XSUAA role templates map to IAS authorization policies:

Common Migration Issues

SAP BTP Samples

The SAP-samples repository provides a reference implementation for IAS integration in a CAP multitenant SaaS application:

• Central user management using SAP IAS

This sample demonstrates:

• Creating an IAS instance from BTP cockpit
• Configuring trust between BTP subaccount and IAS
• User onboarding via IPS
• Application authentication with IAS