skilld
All skills
secondsky avatar

/sap-btp-connectivity

@620a19a
by Eddiesecondsky/sap-skills456 stars
120

SAP BTP Connectivity skill covering Destination Service, Connectivity Service, Cloud Connector, Connectivity Proxy, and Transparent Proxy for Kubernetes. Use when configuring destinations (HTTP, RFC, LDAP, MAIL, TCP), setting up cloud-to-on-premise connectivity, implementing OAuth and principal propagation, deploying connectivity proxies in Kubernetes/Kyma, troubleshooting connectivity errors (405, 407, 503), or configuring multitenancy.

Ask your Agent

Use this Skill: https://skilld.dev/gh/secondsky/sap-skills/sap-btp-connectivity

This session only. Nothing lands on disk.

referencesauthentication-types.md

≈2.9k tokens on demand. Your agent reads this file only when SKILL.md points to it.

Authentication Types - Complete Reference

Source: https://github.com/SAP-docs/btp-connectivity/tree/main/docs/1-connectivity-documentation

Overview

SAP BTP Destination Service supports 17+ authentication types for HTTP destinations, covering various OAuth flows, certificate-based authentication, and principal propagation.

Authentication Type Summary

Type Use Case User Context
NoAuthentication Public APIs No
BasicAuthentication Simple credentials Technical
ClientCertificateAuthentication X.509 certificates Technical
OAuth2ClientCredentials Service-to-service Technical
OAuth2Password Legacy password flow Technical
OAuth2JWTBearer Token exchange Business User
OAuth2SAMLBearerAssertion Cloud-to-cloud propagation Business User
OAuth2UserTokenExchange User token exchange Business User
OAuth2TokenExchange Generic token exchange Business User
OAuth2TechnicalUserPropagation Technical user via OAuth Technical
OAuth2RefreshToken Refresh token flow Depends
OAuth2AuthorizationCode Interactive authorization Business User
SAMLAssertion SAML without OAuth Business User
PrincipalPropagation Cloud-to-on-premise SSO Business User
ServerCertificateAuthentication Server certificates Technical

NoAuthentication

No authentication required for the target endpoint.

{
  "Name": "public-api",
  "Type": "HTTP",
  "URL": "https://api.public.example.com",
  "ProxyType": "Internet",
  "Authentication": "NoAuthentication"
}

BasicAuthentication

Username and password authentication.

{
  "Name": "basic-auth-destination",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "BasicAuthentication",
  "User": "username",
  "Password": "password"
}

Properties:

Property Required Description
User Yes Username
Password Yes Password

ClientCertificateAuthentication

X.509 client certificate authentication.

{
  "Name": "cert-auth-destination",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "ClientCertificateAuthentication",
  "KeyStoreLocation": "cert.p12",
  "KeyStorePassword": "keystorepassword"
}

Properties:

Property Required Description
KeyStoreLocation Yes Certificate location in Destination Service
KeyStorePassword Yes Keystore password

OAuth2ClientCredentials

OAuth 2.0 client credentials flow for service-to-service communication.

{
  "Name": "oauth-cc-destination",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "OAuth2ClientCredentials",
  "clientId": "my-client-id",
  "clientSecret": "my-client-secret",
  "tokenServiceURL": "https://auth.example.com/oauth/token"
}

Required Properties:

Property Description
clientId OAuth client ID
clientSecret OAuth client secret
tokenServiceURL Token endpoint URL

Optional Properties:

Property Description
tokenServiceURLType Dedicated (default) or Common (multi-tenant)
scope OAuth scopes (space-separated)
tokenServiceUser User for token service basic auth
tokenServicePassword Password for token service basic auth

Token Caching: Automatic caching with auto-renewal before expiration.

OAuth2JWTBearer

Exchanges incoming user JWT for new access token.

{
  "Name": "oauth-jwt-bearer",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "OAuth2JWTBearer",
  "clientId": "my-client-id",
  "clientSecret": "my-client-secret",
  "tokenServiceURL": "https://auth.example.com/oauth/token"
}

Required Properties:

Property Description
clientId OAuth client ID
clientSecret OAuth client secret
tokenServiceURL Token endpoint URL

Requires: User JWT in request context (e.g., from XSUAA).

OAuth2SAMLBearerAssertion

OAuth 2.0 SAML Bearer Assertion flow for user propagation between cloud systems.

{
  "Name": "oauth-saml-bearer",
  "Type": "HTTP",
  "URL": "https://api.successfactors.com",
  "ProxyType": "Internet",
  "Authentication": "OAuth2SAMLBearerAssertion",
  "audience": "www.successfactors.com",
  "clientKey": "my-client-key",
  "tokenServiceURL": "https://api.successfactors.com/oauth/token",
  "KeyStoreLocation": "signing-cert.p12",
  "KeyStorePassword": "password"
}

Required Properties:

Property Description
audience SAML assertion audience
clientKey Client identifier for authorization server
tokenServiceURL Token endpoint URL
KeyStoreLocation Certificate for SAML signing
KeyStorePassword Keystore password

Optional Properties:

Property Description
nameIdFormat SAML NameID format
userIdSource JWT field for user ID extraction
authnContextClassRef Authentication context class
assertionIssuer SAML issuer
assertionRecipient SAML recipient
companyId Company identifier

User ID Resolution Order:

  1. SystemUser property (deprecated)
  2. JWT field via userIdSource or nameIdFormat
  3. Custom user attributes from IdP

OAuth2Password

OAuth 2.0 Resource Owner Password flow.

{
  "Name": "oauth-password",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "OAuth2Password",
  "User": "username",
  "Password": "password",
  "clientId": "my-client-id",
  "clientSecret": "my-client-secret",
  "tokenServiceURL": "https://auth.example.com/oauth/token"
}

Deprecation Warning: This flow is deprecated. Use OAuth2ClientCredentials or OAuth2SAMLBearerAssertion instead.

OAuth2UserTokenExchange

Exchanges user token for new access token.

{
  "Name": "oauth-ute",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "OAuth2UserTokenExchange",
  "clientId": "my-client-id",
  "clientSecret": "my-client-secret",
  "tokenServiceURL": "https://auth.example.com/oauth/token"
}

Requires: User token in request context.

OAuth2TokenExchange

Generic OAuth 2.0 Token Exchange (RFC 8693).

{
  "Name": "oauth-token-exchange",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "OAuth2TokenExchange",
  "clientId": "my-client-id",
  "clientSecret": "my-client-secret",
  "tokenServiceURL": "https://auth.example.com/oauth/token"
}

OAuth2TechnicalUserPropagation

Propagates technical user identity via OAuth.

{
  "Name": "oauth-tech-user",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "OAuth2TechnicalUserPropagation",
  "clientId": "my-client-id",
  "clientSecret": "my-client-secret",
  "tokenServiceURL": "https://auth.example.com/oauth/token"
}

OAuth2RefreshToken

Uses refresh token to obtain access tokens.

{
  "Name": "oauth-refresh",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "OAuth2RefreshToken",
  "clientId": "my-client-id",
  "clientSecret": "my-client-secret",
  "tokenServiceURL": "https://auth.example.com/oauth/token",
  "refreshToken": "stored-refresh-token"
}

OAuth2AuthorizationCode

OAuth 2.0 Authorization Code flow for interactive authorization.

{
  "Name": "oauth-auth-code",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "OAuth2AuthorizationCode",
  "clientId": "my-client-id",
  "clientSecret": "my-client-secret",
  "tokenServiceURL": "https://auth.example.com/oauth/token"
}

SAMLAssertion

SAML assertion authentication without OAuth token exchange.

{
  "Name": "saml-destination",
  "Type": "HTTP",
  "URL": "https://api.example.com",
  "ProxyType": "Internet",
  "Authentication": "SAMLAssertion",
  "audience": "target-audience"
}

PrincipalPropagation

Cloud-to-on-premise user identity propagation via Cloud Connector.

{
  "Name": "onprem-pp-destination",
  "Type": "HTTP",
  "URL": "http://virtual-host:443/api",
  "ProxyType": "OnPremise",
  "Authentication": "PrincipalPropagation"
}

Requirements:

  1. Cloud Connector installed and configured
  2. Subject pattern configured in Cloud Connector
  3. Trust established between Cloud Connector and on-premise system
  4. User JWT in request context

How It Works:

  1. Application sends request with user JWT
  2. Connectivity Service forwards to Cloud Connector
  3. Cloud Connector generates X.509 certificate from user identity
  4. Certificate used for on-premise system authentication

Client Assertion

Alternative to client secret for OAuth flows using SAML or JWT assertions.

SAML Client Assertion

{
  "Authentication": "OAuth2ClientCredentials",
  "clientId": "my-client-id",
  "tokenServiceURL": "https://auth.example.com/oauth/token",
  "clientAssertion.type": "urn:ietf:params:oauth:client-assertion-type:saml2-bearer",
  "clientAssertion.destinationName": "saml-provider-destination"
}

JWT Client Assertion

{
  "Authentication": "OAuth2ClientCredentials",
  "clientId": "my-client-id",
  "tokenServiceURL": "https://auth.example.com/oauth/token",
  "clientAssertion.type": "urn:ietf:params:oauth:client-assertion-type:jwt-bearer",
  "clientAssertion.destinationName": "jwt-provider-destination"
}

X.509 Certificate Authentication with OAuth

Combine OAuth flows with X.509 client certificate for token service.

{
  "Authentication": "OAuth2ClientCredentials",
  "clientId": "my-client-id",
  "tokenServiceURL": "https://auth.example.com/oauth/token",
  "tokenService.KeyStoreLocation": "cert.p12",
  "tokenService.KeyStorePassword": "password"
}

Decision Guide

Service-to-Service (No User Context)

→ OAuth2ClientCredentials

User Propagation (Cloud-to-Cloud)

→ OAuth2SAMLBearerAssertion or OAuth2JWTBearer

User Propagation (Cloud-to-On-Premise)

→ PrincipalPropagation

Simple Credentials

→ BasicAuthentication

Certificate-Based

→ ClientCertificateAuthentication

Public API

→ NoAuthentication

Documentation Links

Last Updated: 2025-11-22

Source: SKILL.md on GitHub

Third-party checks

1 alert16d5 checks · Risk SAFE
  • Gen Agent Trust Hub16d

    This skill provides comprehensive documentation and configuration templates for SAP BTP Connectivity, covering Destination Service, Cloud Connector, and Kubernetes proxy components. It follows security best practices, utilizes official SAP resources, and provides safe templates for connectivity setup.

  • Socket16d

    No alerts

  • Snyk16d

    Risk: LOW · No issues

  • Runlayer6mo

    11/21 files flagged

  • ZeroLeaks5mo

    Score: 93/100 · 2 sections analyzed

Provenance

Signed by skilld at 620a19a. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub 2 weeks ago.

Activeupdated 2 months ago

Capability

Other metadata
metadata
{
  "maintainer": "Eduard Jiglau",
  "maintainer_email": "hello@sap-ai-skills.com",
  "website": "https://sap-ai-skills.com",
  "version": "2.4.1",
  "last_verified": "2025-11-27",
  "keywords": [
    "SAP BTP",
    "Connectivity",
    "Destination Service",
    "Cloud Connector",
    "Connectivity Proxy",
    "Transparent Proxy",
    "Kyma",
    "Kubernetes",
    "OAuth",
    "Principal Propagation",
    "RFC",
    "LDAP",
    "on-premise",
    "hybrid connectivity",
    "service channels",
    "SOCKS5",
    "reverse proxy",
    "tunnel"
  ]
}

README badge

README badge for secondsky/sap-skills/sap-btp-connectivity