zhongwei/gh-secondsky-sap-skills-skills-sap-btp-cias
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Initial commit

Browse Source
This commit is contained in:
Zhongwei Li
2025-11-30 08:54:54 +08:00
commit d5f8dc087c
13 changed files with 3235 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
.claude-plugin/plugin.json Normal file
View File

@@ -0,0 +1,12 @@
{
"name": "sap-btp-cias",
"description": "Cloud Integration Automation Service for guided integration workflows. Covers CIAS subscriptions, destinations, roles, scenario planning, and My Inbox tasks.",
"version": "1.0.0",
"author": {
"name": "Zhongwei Li",
"email": "zhongweili@tubi.tv"
},
"skills": [
"./"
]
}

3
README.md Normal file
View File

@@ -0,0 +1,3 @@
# sap-btp-cias
Cloud Integration Automation Service for guided integration workflows. Covers CIAS subscriptions, destinations, roles, scenario planning, and My Inbox tasks.

281
SKILL.md Normal file
View File

@@ -0,0 +1,281 @@
---
name: sap-btp-cias
description: |
SAP BTP Cloud Integration Automation Service (CIAS) skill for guided integration workflows.
Use when: setting up CIAS subscriptions, configuring destinations, assigning roles (CIASIntegrationAdministrator, CIASIntegrationExpert, CIASIntegrationMonitor), planning integration scenarios, working with My Inbox tasks, monitoring scenario execution, troubleshooting CIAS errors, creating OAuth2 instances, configuring identity providers for CIAS, understanding CIAS security architecture, or integrating SAP products (S/4HANA, SuccessFactors, BTP services, SAP Build, IBP).
license: GPL-3.0
metadata:
version: "1.0.1"
last_verified: "2025-11-27"
sap_product: "Cloud Integration Automation Service"
source_docs: "[https://github.com/SAP-docs/btp-cloud-integration-automation-service"](https://github.com/SAP-docs/btp-cloud-integration-automation-service")
---
# SAP BTP Cloud Integration Automation Service (CIAS)
Cloud Integration Automation Service provides guided workflows to integrate SAP cloud solutions with on-premise and other SAP cloud solutions. It offers both manual task instructions and automated configuration capabilities.
## Quick Reference
### Service Plans
| Plan | Type | Purpose |
|------|------|---------|
| **Standard** | Application | UI access for scenario planning, task monitoring, integration management |
| **OAuth2** | Service | API access for programmatic operations (required for ABAP automation) |
### Role Collections
| Role | Collection | Capabilities |
|------|------------|--------------|
| Integration Administrator | `CIASIntegrationAdministrator` | Full access: Plan for Integration, My Inbox, Monitoring; terminate scenarios |
| Integration Expert | `CIASIntegrationExpert` | My Inbox access; work on assigned tasks |
| Integration Monitor | `CIASIntegrationMonitor` | Read-only access to Scenario Execution Monitoring |
### Supported Regions
**AWS**: EU10 (Frankfurt), EU11 (Frankfurt EU Access), US10 (Virginia), AP10 (Sydney), JP10 (Tokyo), CA10 (Montreal)
**Azure**: EU20 (Netherlands), CN20 (China North 3)
**Alibaba**: CN40 (Shanghai)
## Core Workflows
### 1. Subscribe to CIAS (Standard Plan)
1. Navigate to SAP BTP Cockpit → Global Account → Subaccount
2. Go to **Services** → **Service Marketplace**
3. Filter by "Cloud Integration Automation Service"
4. Click tile → **Create** → Select **Standard** plan
5. Confirm creation
6. Access via **Instances and Subscriptions** → "Go to Application" icon
### 2. Assign Roles to Users
1. Navigate to **Security** → **Role Collections** in subaccount
2. Select role collection (e.g., `CIASIntegrationAdministrator`)
3. Click **Edit** → **Users** tab
4. Add users by email ID or login user ID
5. Save changes
> Multiple users can be assigned per role using comma-separated user IDs.
### 3. Plan Integration Scenario
1. Access CIAS application from Instances and Subscriptions
2. Open **Plan for Integration** tile
3. Browse available solutions in **Solutions** tab
4. Select scenario and scenario option
5. Choose systems for integration (by customer number)
6. Specify:
- Target subaccount for workflow
- SAP BTP Workflow Users (must have subaccount access)
- Transaction name for monitoring
7. Confirm workflow generation
8. Access tasks in **My Inbox** tile
### 4. Work with Tasks (My Inbox)
1. Open **My Inbox** tile (requires Administrator or Expert role)
2. Click **Claim** to lock task for your user
3. Follow instructions in **Task Instructions** tab
4. For automation tasks: Configure parameters → Click **Execute Step**
5. Click **Task Completed** when done
6. Click **Refresh** to display next task
7. Repeat until viewing Execution Summary
### 5. Create Destination for Automation
1. In My Inbox → Confirm System Components task
2. Click **Create Destination** link
3. Configure:
- **Name**: Valid identifier
- **Description**: Purpose description
- **URL**: Target system host URL
- **Authentication**: Method + credentials
- **Type**: HTTP (default)
4. Save configuration
> Always use HTTPS for secure communication.
### 6. Monitor Scenario Execution
1. Open **Scenario Execution Monitoring** tile (requires Administrator or Monitor role)
2. Filter workflows by status: Running, Completed, Canceled
3. View tabs: Task Details, Targets, Roles and Users, Scope, Support Information
4. Use **Terminate Execution** to remove scenarios permanently
5. Access **Logs** tab for automation execution details
## Service Limitations
- Maximum **15 active workflows** per subaccount
- No self-service data deletion (submit ticket to component `BC-INS-CIT-RT`)
- Logs retained for **90 days**
- OAuth2 certificate maximum validity: **1 year**
- Execution scope cannot be changed after confirmation
- Destination cannot be changed if already used in automation task
- Supported browsers: Google Chrome, Microsoft Edge (Chromium), Mozilla Firefox, Apple Safari (macOS)
## Security Architecture
CIAS comprises six core components:
1. **Runtime**: Backbone framework rendering integration tasks
2. **Planning**: UI for planning integration scenarios
3. **Inbox**: UI for end-user task access
4. **Monitoring**: UI for scenario implementation monitoring
5. **Managed System**: System configured during integration
6. **Automation Runtime**: Calls configuration APIs of managed systems
Security features:
- Role-based access via SAP BTP authorization framework
- XSRF protection for backend connectivity calls
- Identity provider integration (SAML assertion Name ID attribute supported)
- Credentials stored in Credential Store service (inaccessible to external parties)
## Common Error Patterns
### Empty Destination Dropdown
**Symptom**: Destination dropdown shows no options during task execution.
**Cause**: No destinations exist matching the tenant's Host Base URL.
**Solution**:
1. Create destination manually following Destination Creation steps
2. Ensure destination URL matches tenant Host Base URL exactly
3. Refresh the dropdown after creation
### Workflow Conflict Lock
**Symptom**: Cannot proceed with task; execution lock activated.
**Cause**: Multiple integration workflows exist with identical system components.
**Solutions**:
- **Proceed**: Continue without resolving (manual resolution later)
- **Terminate**: End selected conflicting instances
- **Terminate Current Instance**: Stop active workflow only
- **Cancel**: Halt operation entirely
### Application Access Denied After IdP Change
**Symptom**: Users cannot access CIAS application after identity provider change.
**Cause**: Users not managed by newly configured identity provider.
**Solution**:
1. Add users to new identity provider
2. Reassign role collections in subaccount Security settings
3. Verify user IDs exist in configured IdP
### Task Marked as Reserved
**Symptom**: Cannot claim task; shows "Reserved" status.
**Cause**: Another assigned user has already claimed the task.
**Solution**: Coordinate with team; only one user can work on claimed task at a time.
## Support Channels
| Issue Type | Component | Action |
|------------|-----------|--------|
| General CIAS support | `BC-INS-CIT-RT` | Create support ticket |
| Manual task instructions | Check Support Information tab | Submit incident to listed component |
| Data deletion request | `BC-INS-CIT-RT` | Include email ID and subaccount name |
| Service availability | Consumer account | Check Service Availability feature |
## OAuth2 API Access
For programmatic access (required for ABAP automation):
1. Navigate to subaccount → **Services** → **Service Marketplace**
2. Select Cloud Integration Automation Service → **Create**
3. Choose **OAuth2** plan
4. Select runtime: "Other" or "Cloud Foundry"
5. Provide instance name → Create
### Create Service Key (for API calls)
**With mTLS (Certificate)**:
```json
{
"xsuaa": {
"credential-type": "x509",
"x509": {
"key-length": 2048,
"validity": 365,
"validity-type": "DAYS"
}
}
}
```
**Without Certificate**: Create with name only.
Use generated client ID and client secret to create OAuth JWT token for API authentication.
## Data Protection
- Email IDs and subaccount names stored in service database
- System/tenant selection data preserved for workflow execution
- Logs do not store user-related personal data
- Audit logs follow SAP BTP Audit Log retention policy
- Sensitive data stored in Credential Store service
## Glossary
| Term | Definition |
|------|------------|
| **Personal Data** | Any information relating to identified/identifiable natural person |
| **Sensitive Personal Data** | Racial/ethnic origin, political opinions, religious beliefs, genetic/biometric data |
| **Residence Period** | Time between business end and end-of-purpose when data remains accessible |
| **Retention Period** | Time from last business activity through data deletion |
| **Blocking** | Restricting access to data whose primary business purpose has ended |
## Task UI Controls Quick Reference
### Automation Task Controls
| Control | Function |
|---------|----------|
| **Refresh** | Update automation statuses |
| **Expand All** | Show all parameter panels |
| **Collapse All** | Hide all parameter panels |
| **Show/Hide Read-Only Parameters** | Toggle read-only visibility |
| **Save Parameters** | Preserve current values |
| **Logs** | View execution records |
| **Information** | Parameter descriptions |
| **Execute Step** | Run automation (async) |
### Error Recovery
After automation failure:
- **Only Failed Automations** - Retry failed steps only
- **All Automations** - Retry entire sequence
## Bundled Resources
### Reference Files
1. `references/setup-guide.md` - Complete subscription, OAuth2, and destination configuration procedures
2. `references/security-guide.md` - Security architecture, identity provider configuration, and role management
3. `references/integration-scenarios.md` - Full list of 100+ supported integration scenarios with codes (1M1, 22K, 4A1, etc.)
4. `references/troubleshooting.md` - Detailed error resolution procedures and common issues
5. `references/maintenance-planner.md` - Maintenance Planner integration guide and workflow invocation
6. `references/task-ui-guide.md` - Complete task UI controls, tabs, behaviors, and automation steps
7. `references/whats-new.md` - Complete release notes from 2021-2025 with feature updates
### Template Files
1. `templates/destination-config.md` - Destination configuration templates by target system type
2. `templates/role-assignment.md` - Role assignment procedures and checklists for different scenarios
## Documentation Sources
**Primary**:
- GitHub: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/tree/main/docs](https://github.com/SAP-docs/btp-cloud-integration-automation-service/tree/main/docs)
- SAP Help Portal: [https://help.sap.com/docs/cloud-integration-automation-service](https://help.sap.com/docs/cloud-integration-automation-service)
**Related**:
- Maintenance Planner: [https://maintenanceplanner.cfapps.eu10.hana.ondemand.com](https://maintenanceplanner.cfapps.eu10.hana.ondemand.com)
- Credential Store: [https://help.sap.com/viewer/601525c6e5604e4192451d5e7328fa3c/Cloud/en-US/02e8f7d1016740b8adf68690f36df142.html](https://help.sap.com/viewer/601525c6e5604e4192451d5e7328fa3c/Cloud/en-US/02e8f7d1016740b8adf68690f36df142.html)
- SAP BTP Destinations: [https://help.sap.com/docs/btp/sap-business-technology-platform/destination](https://help.sap.com/docs/btp/sap-business-technology-platform/destination)

81
plugin.lock.json Normal file
View File

@@ -0,0 +1,81 @@
{
"$schema": "internal://schemas/plugin.lock.v1.json",
"pluginId": "gh:secondsky/sap-skills:skills/sap-btp-cias",
"normalized": {
"repo": null,
"ref": "refs/tags/v20251128.0",
"commit": "873880289f09bef2e04b3c5436756b0ea9973864",
"treeHash": "943ae26924fedd3ab807a49ed077b162ec493efff63c89f9d7875197eacc6296",
"generatedAt": "2025-11-28T10:28:11.762841Z",
"toolVersion": "publish_plugins.py@0.2.0"
},
"origin": {
"remote": "git@github.com:zhongweili/42plugin-data.git",
"branch": "master",
"commit": "aa1497ed0949fd50e99e70d6324a29c5b34f9390",
"repoRoot": "/Users/zhongweili/projects/openmind/42plugin-data"
},
"manifest": {
"name": "sap-btp-cias",
"description": "Cloud Integration Automation Service for guided integration workflows. Covers CIAS subscriptions, destinations, roles, scenario planning, and My Inbox tasks.",
"version": "1.0.0"
},
"content": {
"files": [
{
"path": "README.md",
"sha256": "b57f38326288003f2759166ca0021e30f3003ca9b3a42468456b4184a54120c4"
},
{
"path": "SKILL.md",
"sha256": "15f7c2a75883cb1cadc69ef7d45cd74f6b09cf96e8a46bb6d0a5f0c521a4e0de"
},
{
"path": "references/troubleshooting.md",
"sha256": "bc1add6dac1faa7c5873f56b2c71bdbc5c66661b885f03bcbfb1ec715bba8996"
},
{
"path": "references/security-guide.md",
"sha256": "76afe78cad41b2255d32aacedb284850e98add90ba249ab9ac0833d75b4d4e20"
},
{
"path": "references/task-ui-guide.md",
"sha256": "a428b3e87997aaa2f9f3fbf1396debdadd6ab0c171c4a07341c9a9d8286ebe6b"
},
{
"path": "references/setup-guide.md",
"sha256": "6cb622cb59d07acb521174f29c6b2de9d1259a7820d525840d3408fbc1020fdb"
},
{
"path": "references/whats-new.md",
"sha256": "d8a90b1bf75158acc85583921e7f05c9a6ee2bc6e3fabf174d7c56b9345cdee6"
},
{
"path": "references/maintenance-planner.md",
"sha256": "2f52595b5a12e8896b8600759f2c7d4499c715db962735c977308b299e9ed198"
},
{
"path": "references/integration-scenarios.md",
"sha256": "e0f4b3a1248f94e3d7b081a17ccd421df47d0355ca86358b10fd0d7ba10d5ec5"
},
{
"path": ".claude-plugin/plugin.json",
"sha256": "9bc02c7d1d5b799d3454f4a04f6987ffc6b6e9b8777273c9b2b24f82994c8b9e"
},
{
"path": "templates/role-assignment.md",
"sha256": "ab14c9b53d0e9d5a53433a6375dbfe2a2411387f32277c4c63fb9ff4b2ede31a"
},
{
"path": "templates/destination-config.md",
"sha256": "b1ab4b69be813f4a9d3db64b6d76df2bc9e6bd48abc4519db92e915f51743055"
}
],
"dirSha256": "943ae26924fedd3ab807a49ed077b162ec493efff63c89f9d7875197eacc6296"
},
"security": {
"scannedAt": null,
"scannerVersion": null,
"flags": []
}
}

401
references/integration-scenarios.md Normal file
View File

@@ -0,0 +1,401 @@
# SAP BTP CIAS Integration Scenarios - Complete Reference
Complete list of ALL supported integration scenarios in Cloud Integration Automation Service with scenario codes.
**Source**: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/what-is-cloud-integration-automation-service-35fbf2a.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/what-is-cloud-integration-automation-service-35fbf2a.md)
---
## Table of Contents
1. [SAP BTP Services](#sap-btp-services)
2. [SAP BTP ABAP Environment](#sap-btp-abap-environment)
3. [SAP S/4HANA Cloud](#sap-s4hana-cloud)
4. [SAP S/4HANA On-Premise](#sap-s4hana-on-premise)
5. [SAP SuccessFactors Employee Central with SAP S/4HANA On-Premise](#sap-successfactors-employee-central-with-sap-s4hana-on-premise)
6. [SAP Integrated Business Planning (IBP)](#sap-integrated-business-planning-ibp)
7. [SAP Build Solutions](#sap-build-solutions)
8. [SAP Cloud Connector](#sap-cloud-connector)
---
## SAP BTP Services
| Scenario | Description |
|----------|-------------|
| SAP Business Network Asset Collaboration Setup on BTP | Asset collaboration setup |
| SAP Asset Performance Management | APM configuration |
| SAP Group Reporting Data Collection | Financial data collection |
---
## SAP BTP ABAP Environment
| Scenario | Description |
|----------|-------------|
| Configuring the ABAP Environment to Use the Custom Code Migration App | Custom code migration setup |
| SAP BTP, ABAP Environment, and SAP S/4HANA Cloud: Integration | ABAP-S/4HANA Cloud integration |
> **Note**: ABAP automation scenarios require OAuth2 service plan subscription.
---
## Intelligent Enterprise - Design to Operate - Plan to Fulfill
| Code | Scenario |
|------|----------|
| 5I2 | Subcontracting with SAP Business Network |
---
## Intelligent Enterprise - Lead to Cash - Contact to Lead
| Scenario | Description |
|----------|-------------|
| Onboard Company: Integration Commerce Cloud with S/4 Cloud (S4HC) | Commerce-S/4 onboarding |
| Capture Interaction: Integrate SAP Commerce Cloud with SAP Marketing Cloud | Commerce-Marketing integration |
| SAP Customer Data Cloud Integration with SAP S/4HANA Cloud | CDC-S/4HANA Cloud integration |
---
## Intelligent Enterprise - Lead to Cash - Lead to Opportunity
| Code | Scenario |
|------|----------|
| 1J9 | SAP Marketing Cloud Integration with SAP Cloud for Customer |
---
## Intelligent Enterprise - Lead to Cash - Master Data
| Code | Scenario |
|------|----------|
| MDM MC | MDM Business Partner Integration with Marketing Cloud |
| MDI C4C | MDI Business Partner Integration with SAP Cloud for Customer |
| MDI BP | MDI Business Partner Integration with S/4HANA Cloud |
| - | SAP Master Data Service for Business Partners Integration with SAP Commerce Cloud |
| MDM FSM | MDM Business Partner Integration with Field Service Management |
| - | SAP Customer Data Cloud Integration with SAP Master Data Service for Business Partners |
| - | SAP Configure Price Quote with SAP Master Data Service for Business Partners |
| - | SAP Customer Data Cloud Integration with SAP Commerce Cloud (B2B Scenario) |
| - | SAP Customer Data Cloud Integration with SAP Commerce Cloud (B2C Scenario) |
---
## Intelligent Enterprise - Lead to Cash - Order to Cash
| Code | Scenario |
|------|----------|
| 49X | Service Order Processing with SAP Field Service Management |
| 1UG | Orchestrate Fulfillment Process: Order Management Data Replication to SAP Marketing Cloud |
| SB | Orchestrate Fulfillment Process: Integration Commerce Cloud with Subscription Billing |
| 5IK | Subscription Management with Convergent Invoicing |
| BP SB | Subscription Management with Sales Billing |
| 2TY (2021) | On-Premise: B2B Order Fulfillment with SAP Commerce Cloud |
| 2TY (2022) | On-Premise: B2B Order Fulfillment with SAP Commerce Cloud |
---
## Intelligent Enterprise - Lead to Cash - Opportunity to Quote
| Code | Scenario |
|------|----------|
| 1J9 | SAP Marketing Cloud Integration with SAP Cloud for Customer |
| 1VP | Opportunity-to-Order with SAP Cloud for Customer |
| - | Integration SAP CPQ Quote 2.0 - SAP Cloud for Customer |
---
## Intelligent Enterprise - Lead to Cash - Quote to Order
| Code | Scenario |
|------|----------|
| - | SAP Commerce Cloud Integration with SAP CPQ for Quote 2.0 |
| 4A1 | Automation of Order-to-Invoice with SAP Business Network |
---
## Intelligent Enterprise - Recruit to Retire - Hire to Retire
| Code | Scenario | Year |
|------|----------|------|
| 1NL | Payroll Processing with SAP SuccessFactors Employee Central Payroll | Cloud |
| 3UP | Payroll Processing with SAP ERP HCM Payroll | Cloud |
| - | Workforce Management with SAP Master Data Integration (Inbound) | Cloud |
| 1NL (2020) | On-Premise: Setting up Payroll Processing with SAP SuccessFactors Employee Central Payroll | 2020 |
| 1NL (2021) | On-Premise: Setting up Payroll Processing with SAP SuccessFactors Employee Central Payroll | 2021 |
| - (2020) | On-Premise: Workforce Integration in SAP S/4HANA | 2020 |
| - (2021) | On-Premise: Workforce Integration in SAP S/4HANA | 2021 |
| - (2022) | On-Premise: Workforce Integration in SAP S/4HANA | 2022 |
| JB1 | Core HR with SAP SuccessFactors Employee Central | Cloud |
---
## Intelligent Enterprise - Recruit to Retire - Travel to Reimburse
| Code | Scenario |
|------|----------|
| 1M1 | Travel Expense Processing with SAP Concur Expense Professional |
| 1NL | Payroll Processing with SAP SuccessFactors Employee Central Payroll |
| - | SAP S/4HANA-Concur-Payroll Integration |
---
## Intelligent Enterprise - Recruit to Retire - External Workforce
| Code | Scenario | Year |
|------|----------|------|
| 22K | External Workforce Procurement via SAP Fieldglass | Cloud |
| 22K (2021) | On-Premise: External Workforce Procurement via SAP Fieldglass | 2021 |
| 22K (2022) | On-Premise: External Workforce Procurement via SAP Fieldglass | 2022 |
---
## Intelligent Enterprise - Source to Pay - Contract
| Code | Scenario | Year |
|------|----------|------|
| 4AZ | Contract Management with SAP Ariba Contracts | Cloud |
| 4AZ (2020) | On-Premise: Contract Management with SAP Ariba Contracts | 2020 |
| 4AZ (2021) | On-Premise: Contract Management with SAP Ariba Contracts | 2021 |
| 4B0 | Contract for Central Procurement with SAP Ariba Contracts | Cloud |
| 4B0 (2021) | On-Premise: Contract for Central Procurement with SAP Ariba Contracts | 2021 |
---
## Intelligent Enterprise - Source to Pay - Guided Buying
| Code | Scenario | Year |
|------|----------|------|
| 2NV | Guided Buying Capability with SAP Ariba Buying | Cloud |
| 2NV (2021) | On-Premise: Guided Buying Capability with SAP Ariba Buying | 2021 |
| 3EN | Guided Buying for Central Procurement with SAP Ariba Buying | Cloud |
| 3EN (2021) | On-Premise: Guided Buying for Central Procurement with SAP Ariba Buying | 2021 |
| 4A1 (2020) | On-Premise: Automation of Order-to-Invoice with SAP Business Network | 2020 |
| 4A1 (2021) | On-Premise: Automation of Order-to-Invoice with SAP Business Network | 2021 |
---
## Intelligent Enterprise - Source to Pay - Sourcing
| Code | Scenario | Year |
|------|----------|------|
| 4BL | Sourcing with SAP Ariba Sourcing | Cloud |
| 4BL (2020) | On-Premise: Sourcing with SAP Ariba Sourcing | 2020 |
| 4BL (2021) | On-Premise: Sourcing with SAP Ariba Sourcing | 2021 |
| 4QN | Central Sourcing with Ariba Sourcing | Cloud |
| 4QN (2021) | On-Premise: Central Sourcing with Ariba Sourcing | 2021 |
---
## Intelligent Enterprise - Source to Pay - Supplier Collaboration/Network
| Code | Scenario | Year |
|------|----------|------|
| 5JT | Automation of Central Procurement Quotes with Ariba Network | Cloud |
| 5JT (2021) | On-Premise: Automation of Central Procurement Quotes with Ariba Net | 2021 |
| 42K | Automation of Source-to-Pay with SAP Business Network | Cloud |
| 42K (2020) | On-Premise: Automation of Source-to-Pay with SAP Business Network | 2020 |
| 42K (2021) | On-Premise: Automation of Source-to-Pay with SAP Business Network | 2021 |
| 5I2 | Subcontracting with SAP Business Network | Cloud |
| 4R2 | Services Procurement with SAP Business Network and SAP Fieldglass | Cloud |
---
## Communication Management Migration
| Scenario | Description |
|----------|-------------|
| Migrate Communication Management Entities from 2SL to 3SL | 2-System to 3-System Landscape migration |
| 3SL Migration Precheck of S/4 - CIAS Connection | Pre-migration validation check |
---
## SAP Cloud Connector
| Scenario | Description |
|----------|-------------|
| Configuration of SAP Cloud Connector with Principal Propagation | Secure Cloud Connector setup |
---
## SAP Integrated Business Planning (IBP)
| Scenario | Description | Added |
|----------|-------------|-------|
| Configuring Real-Time Integration (RTI) in SAP IBP | Real-time master/transactional data integration from S/4HANA or ERP to IBP without batch jobs | 2023-11-10 |
---
## SAP Build
| Scenario | Description |
|----------|-------------|
| Provision SAP Build on SAP BTP | SAP Build environment setup |
| Provision SAP Build on SAP BTP with S/4HANA Cloud Private Edition Integration | SAP Build with S/4HANA PE |
---
## SAP Build Work Zone Integration
| Scenario | Description |
|----------|-------------|
| SAP Build Work Zone Standard Edition Integration with SAP S/4HANA | On-premise S/4HANA integration |
| SAP Build Work Zone Standard Edition Integration with SAP S/4HANA Cloud | Cloud S/4HANA integration |
---
## SAP S/4HANA Cloud Private Edition Integration
| Code | Scenario |
|------|----------|
| 7HB | Solution Quotation Management with SAP CPQ |
---
## SAP S/4HANA Cloud Integration (Complete List)
| Code | Scenario |
|------|----------|
| 1M1 | Travel Expense Processing with SAP Concur Expense Professional |
| 1S4 | Automatic Market Rates Management |
| 1NL | Payroll Processing with SAP SuccessFactors Employee Central Payroll |
| 1RY | Credit Agency Integration |
| 1S0 | Customer Payments |
| 1S2 | Digital Payments |
| 1VP | Opportunity-to-Order with SAP Cloud for Customer |
| 1WE | Restricted Party Screening with SAP Watch List Screening |
| 1XV | SAP S/4HANA for Enterprise Contract Management |
| 1YB | Import Connection setup with SAP Analytics Cloud |
| 1Z1 | Digital Payments Sales |
| 1Z6 | External Billing |
| 1ZQ | Logistics with Third-Party Warehouse Management |
| 22K | External Workforce Procurement via SAP Fieldglass |
| 2EJ | Integration of Procurement with External Suppliers |
| 2EL | Integration of Sales with External Buyers |
| 2MB | Integration of Payment Advice with Buyers and Suppliers |
| 2NV | Guided Buying Capability with SAP Ariba Buying |
| 2OH | Continuous Control Monitoring with SAP Process Control |
| 2OQ | Integration to SAP S/4HANA Cloud for Enterprise Contract Assembly |
| - | International Trade Management with SAP GTS |
| 2U2 | Key Risk Indicator Monitoring with SAP Risk Management |
| 3AB | Automated Provisioning via SAP Cloud Identity Access Governance |
| 3EN | Guided Buying for Central Procurement with SAP Ariba Buying |
| 3UP | Payroll Processing with SAP ERP HCM Payroll |
| 3W3 | Third-Party Shop Floor Execution - Process Industry |
| 3W4 | Third-Party Shop Floor Execution - Discrete Industry |
| 49X | Service Order Processing with SAP Field Service Management |
| 42K | Automation of Source-to-Pay with SAP Business Network |
| 4A1 | Automation of Order-to-Invoice with SAP Business Network |
| - | Workforce Management with SAP Master Data Integration (Inbound) |
| 4AI | Setting Up SAP Ariba Buying |
| 4AZ | Contract Management with SAP Ariba Contracts |
| 4B0 | Contract for Central Procurement with Ariba Contracts |
| 4BL | Sourcing with SAP Ariba Sourcing |
| 4N6 | SAP Central Invoice Management |
| 4QN | Central Procurement with SAP Ariba Sourcing |
| 4R2 | Services Procurement with SAP Business Network and SAP Fieldglass |
| 53V | Digital Payments Foundation |
| 53L | ABAP Core Data Services Extraction for SAP Datasphere |
| 57Z | Subscription Management with Sales Billing |
| 5I2 | Subcontracting with SAP Business Network |
| 5IK | Subscription Management with Convergent Invoicing |
| 5JT | Automation of Central Procurement Quotes with Ariba Network |
| 5VX | Real Estate Integration between S/4HANA cloud with C4RE |
| JB1 | Core HR with SAP SuccessFactors Employee Central |
| 65D | MRP Change Request Integration with SAP Business Network |
| 6BV | Solution Order Quotation Management with SAP CPQ |
| 6JO | Resource Management capability in SAP Project and Resource Management |
| 6KO | Integrate SAP S/4HCE with SAP Sales and Service Cloud |
| 6JN | S/4HANA Cloud for Projects, Collaborative Project Management |
| 6V2 | Integration to Icertis for Contract Assembly |
| - | 3SL Migration Precheck of S/4 - CIAS Connection |
---
## SAP S/4HANA On-Premise Integration (Complete List)
| Code | Scenario | Year |
|------|----------|------|
| - | Configuration for Connectivity S/4HANA to SAP Digital Manufacturing Cloud | - |
| - | Asset Intelligence Network integration with S/4HANA On-Premise | - |
| 2EL | On-Premise: Integration of Sales with External Buyers | 2022, 2023 |
| 2EJ | On-Premise: Integration of Procurement with External Suppliers | 2022, 2023 |
| 22K | On-Premise: External Workforce Procurement via SAP Fieldglass | 2022, 2023 |
| 2TY | On-Premise: B2B Order Fulfillment with SAP Commerce Cloud | 2022 |
| 4A1 | On-Premise: Automation of Order-to-Invoice with SAP Business Network | 2022, 2023 |
| 42K | On-Premise: Set Up Automation of Source-to-Pay with SAP Business Network | 2022, 2023 |
| 5I2 | On-Premise: Subcontracting with SAP Business Network | 2022, 2023 |
| 4QN | On-Premise: Central Procurement with SAP Ariba Sourcing | 2022, 2023 |
| 4BL | On-Premise: Sourcing with SAP Ariba Sourcing | 2022, 2023 |
| 4R2 | On-Premise: Services Procurement with SAP Business Network and SAP Fieldglass | 2022, 2023 |
| 4AZ | On-Premise: Contract Management with SAP Ariba Contracts | 2022, 2023 |
| 65D | On-Premise: MRP Change Request Integration with SAP Business Network | 2022, 2023 |
| 4B0 | On-Premise: Contract for Central Procurement with SAP Ariba Contracts | 2022, 2023 |
| 3EN | On-Premise: Guided Buying for Central Procurement with SAP Ariba Buying | 2022, 2023 |
| 5JT | On-Premise: Automation of Central Procurement Quotes with Ariba Net | 2022, 2023 |
| 2NV | On-Premise: Guided Buying Capability with SAP Ariba Buying | 2022, 2023 |
| - | On-Premise: Workforce Integration in SAP S/4HANA | 2022, 2023 |
| - | On-Premise: Workforce Integration in SAP S/4HANA as Producer | 2022, 2023 |
| - | On-Premise: SAP Business Network Asset Collaboration Integration with S/4HANA | - |
---
## SAP SuccessFactors Employee Central with SAP S/4HANA On-Premise
| Scenario | Description |
|----------|-------------|
| Replicating Cost Centers from SAP S/4HANA On-Premise to SAP SuccessFactors Employee Central | Cost center replication |
| Migrating Employee and Organizational Data from SAP S/4HANA On-Premise to SAP SuccessFactors Employee Central | Employee data migration |
| Basic System Setup for Data Replication from SAP SuccessFactors Employee Central to SAP S/4HANA On-Premise | Basic replication setup |
---
## SAP SuccessFactors Employee Central Payroll
| Scenario | Description |
|----------|-------------|
| Configure Pay Statement (Direct) Integration in SFEC and ECP | Pay statement integration |
---
## Two-Tier Accelerator
| Scenario | Description |
|----------|-------------|
| Integration of S/4HANA Cloud Public Edition with S/4HANA On-Premise using BTP | Two-tier ERP deployment |
---
## Business Transformation Center
| Scenario | Description |
|----------|-------------|
| Setup Integration of Business Transformation Center with ECC and S/4HANA On-Premise | BTC integration setup |
---
## Scenario Code Quick Reference
### By Product Area
**Concur**: 1M1
**SuccessFactors**: 1NL, JB1, 3UP
**Fieldglass**: 22K, 4R2
**Ariba**: 2NV, 3EN, 4AI, 4AZ, 4B0, 4BL, 4QN, 5JT
**Business Network**: 4A1, 42K, 5I2, 65D
**Cloud for Customer**: 1VP, 1J9
**Marketing Cloud**: 1J9, 1UG
**Commerce Cloud**: 2TY
**Analytics Cloud**: 1YB
**CPQ**: 6BV, 7HB
**GTS**: International Trade Management
**Process Control**: 2OH
**Risk Management**: 2U2
---
## Documentation Links
- What is CIAS: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/what-is-cloud-integration-automation-service-35fbf2a.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/what-is-cloud-integration-automation-service-35fbf2a.md)
- Using CIAS: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/using-cloud-integration-automation-service-5ccb2ce.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/using-cloud-integration-automation-service-5ccb2ce.md)

207
references/maintenance-planner.md Normal file
View File

@@ -0,0 +1,207 @@
# SAP Maintenance Planner Integration Guide
Using Maintenance Planner with Cloud Integration Automation Service.
**Source**: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/tree/main/docs](https://github.com/SAP-docs/btp-cloud-integration-automation-service/tree/main/docs)
---
## Table of Contents
1. [Overview](#overview)
2. [Prerequisites](#prerequisites)
3. [Access Maintenance Planner](#access-maintenance-planner)
4. [Integration Scenarios](#integration-scenarios)
- System Information Download
- Stack XML Upload
- Project Creation
5. [Workflow Integration](#workflow-integration)
6. [Best Practices](#best-practices)
---
## Overview
Maintenance Planner provides an alternative method for invoking Cloud Integration Automation Service workflows. It allows planning of cloud integration scenarios with system selection based on S-User customer associations.
**Maintenance Planner URL**: [https://maintenanceplanner.cfapps.eu10.hana.ondemand.com](https://maintenanceplanner.cfapps.eu10.hana.ondemand.com)
---
## Prerequisites
### S-User Requirements
- S-User assigned to customer ID for maintenance planner access
- S-User must have appropriate authorizations for system visibility
### SAP BTP Requirements
- SAP BTP subaccount subscribed to Cloud Integration Automation Service
- Subaccount in supported region
- Users with appropriate role collections assigned
---
## Step-by-Step Workflow Invocation
### Step 1: Launch Maintenance Planner
Access the maintenance planner at:
```
[https://maintenanceplanner.cfapps.eu10.hana.ondemand.com](https://maintenanceplanner.cfapps.eu10.hana.ondemand.com)
```
### Step 2: Select Planning Tile
Click the tile labeled **"Plan for Cloud Integration Scenario"**.
### Step 3: Choose Solution
- Select from available solutions in the **Solutions** tab
- Use search function to locate specific cloud integration solutions
- Browse by category if needed
### Step 4: Select Scenario
Choose appropriate scenario from the available options presented.
### Step 5: Choose Scenario Option
Select a specific scenario option from available choices. Each scenario may have multiple configuration options.
### Step 6: Select Systems for Integration
**System Display**:
- Systems and tenants listed according to customer number based on S-User
- Only systems associated with your customer number appear
**If Systems Not Visible**:
- Manual landscape data entry available through Confirm System Components task in My Inbox application
- Search systems by Tenant URL if available
### Step 7: Configure Workflow Invocation
Provide the following four inputs:
| Field | Description |
|-------|-------------|
| **SAP BTP Region** | Data center selection for the workflow |
| **SAP BTP Account Technical Name** | Subaccount where CIAS is subscribed |
| **Workflow Users** | List of users for initial task assignment (must have subaccount access) |
| **Transaction Name** | Reference name for monitoring applications |
**Cross-Landscape Warning**:
- Systems from different landscapes may require confirmation before proceeding
- Review landscape implications before confirming
### Step 8: Generate Workflow
- Confirm all settings
- Workflow generation begins
- Wait for successful generation message
### Step 9: Launch Cloud Integration Automation Service
Upon successful generation:
- Link appears to launch CIAS
- Click link to access generated workflow
- Tasks appear in **My Inbox** tile
---
## System Selection Details
### Customer Number Association
Systems are organized by customer number linked to your global account and S-User credentials.
### Manual Entry Option
If expected systems don't appear:
1. Continue to My Inbox after workflow generation
2. Access **Confirm System Components** task
3. Manually enter system properties
4. Provide Account Name and Host details
### Tenant Data
- Tenant Name and Host from maintenance planner configuration
- Cannot be modified after initial setup
- Verify accuracy before proceeding
---
## Integration with CIAS
### Workflow Access
After maintenance planner workflow generation:
1. Access CIAS from Instances and Subscriptions
2. Open **My Inbox** tile
3. View generated tasks
4. Follow standard task execution process
### Transaction Monitoring
- Transaction name used in Scenario Execution Monitoring
- Filter by transaction name for easy identification
- All monitoring features available for maintenance planner-initiated workflows
---
## Important Notes
### Data Synchronization
Deleting a transaction in maintenance planner does **NOT** automatically delete associated data in Cloud Integration Automation Service.
**Manual deletion required**:
1. Terminate workflow in CIAS if needed
2. Create support ticket to BC-INS-CIT-RT for data deletion
3. Provide subaccount name and transaction details
### Transaction Limits
Maximum 15 running transactions per consumer subaccount applies to maintenance planner-initiated workflows as well.
### User Requirements
- All workflow users must have access to specified SAP BTP subaccount
- Users must have appropriate CIAS role collections assigned
- Identity provider configuration must include specified users
---
## Troubleshooting
### Systems Not Visible
**Cause**: Customer number not associated with S-User
**Solution**:
1. Verify S-User customer associations
2. Contact SAP to update customer number linkages
3. Use manual entry in Confirm System Components task
### Workflow Generation Fails
**Check**:
- SAP BTP subaccount name is valid
- Subaccount is subscribed to CIAS
- Region selection matches subaccount region
- All specified users exist in subaccount
### Cross-Landscape Confirmation Required
**When**: Systems from different landscapes selected
**Action**: Review and confirm cross-landscape integration implications before proceeding
---
## Documentation Links
- Using Maintenance Planner: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/using-maintenance-planner-2ad4326.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/using-maintenance-planner-2ad4326.md)
- Confirm System Components: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/confirm-system-components-1f39555.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/confirm-system-components-1f39555.md)
- Maintenance Planner User Guide: [https://support.sap.com/en/alm/solution-manager/processes/maintenance-planner.html](https://support.sap.com/en/alm/solution-manager/processes/maintenance-planner.html)

278
references/security-guide.md Normal file
View File

@@ -0,0 +1,278 @@
# SAP BTP CIAS Security Guide
Comprehensive security documentation for Cloud Integration Automation Service.
**Source**: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/tree/main/docs](https://github.com/SAP-docs/btp-cloud-integration-automation-service/tree/main/docs)
---
## Table of Contents
1. [Security Architecture Overview](#security-architecture-overview)
- Core Architecture Components
- Security Features
2. [Identity Provider and Identity Management](#identity-provider-and-identity-management)
- Authentication Flow
- Target System Requirements
- SAML Support
- IdP Change Considerations
3. [Roles and Authorizations](#roles-and-authorizations)
- Role-Based Access Control
- Integration Administrator (CIASIntegrationAdministrator)
- Integration Expert (CIASIntegrationExpert)
- Integration Monitor (CIASIntegrationMonitor)
- Role Assignment
4. [Security Restrictions](#security-restrictions)
- Subaccount Prerequisites
- User ID Requirements
- Transaction Limits
- Data Deletion Behavior
5. [Data Protection and Privacy](#data-protection-and-privacy)
- Database Storage
- Log Management
- Data Deletion
6. [Sensitive Data Handling](#sensitive-data-handling)
- Credential Storage
- Security Features
7. [Audit Logging](#audit-logging)
- Overview
- Features
- Data Retention
8. [Destination Security](#destination-security)
- Configuration Data
- Security Requirements
- Authorization
9. [Glossary of Security Terms](#glossary-of-security-terms)
10. [Browser Support](#browser-support)
---
## Security Architecture Overview
Security is vital for Cloud Integration Automation Service as it handles integration setup between SAP products. The service comprises components provisioned into customer subaccounts via the SAP BTP cross-subaccount subscription concept.
### Core Architecture Components
| Component | Description |
|-----------|-------------|
| **CIAS Runtime** | Backbone framework that renders integration tasks |
| **CIAS Planning** | UI application to plan integration scenarios |
| **CIAS Inbox** | UI application to access tasks for end-users |
| **CIAS Monitoring** | UI application for scenario implementation monitoring |
| **Managed System** | System to be configured during integration scenario |
| **CIAS Automation Runtime** | Calls configuration APIs of managed systems |
### Security Features
- Valid user identity required in configured identity provider
- Backend connectivity calls protected against cross-site request forgery (XSRF)
- Role-based access through SAP BTP authorization framework
- Credential Store service for sensitive data (inaccessible to external parties)
---
## Identity Provider and Identity Management
### Authentication Flow
Cloud Integration Automation service depends on an Identity Provider (IdP) for identity management and authentication. The IdP must be configured within the customer subaccount.
**Key Points**:
- All requests authenticated against consumer subaccount identity provider
- Authorization enforced against role assignments in subaccount
- Users must exist in respective identity provider for feature access
- Organizations can replace default SAP Cloud Identity Authentication service with corporate IdP
### Target System Requirements
When using destinations pointing to target systems:
- Users in destinations must be authenticated by IdP configured in target systems
- Users must be authorized by target system IdP
### SAML Support
CIAS supports any SAML assertion Name ID attribute.
### IdP Change Considerations
Changing identity providers after subscription may disable application access unless new users are managed by the updated provider.
---
## Roles and Authorizations
### Role-Based Access Control
CIAS implements role-based access through SAP BTP's standard authorization framework. Users and groups receive assignment to consumer roles from their respective consumer subaccounts.
### Role Definitions
#### Integration Administrator
**Role Collection**: `CIASIntegrationAdministrator`
**Capabilities**:
- Access My Inbox application
- Access Scenario Execution Monitoring
- Access Plan for Integration
- Plan integration scenarios and generate workflows
- Review workflow execution plans (landscape confirmation, role assignments, scope selection)
- Monitor workflow execution
- Terminate scenarios
#### Integration Expert
**Role Collection**: `CIASIntegrationExpert`
**Capabilities**:
- Access My Inbox application
- Work on assigned tasks
#### Integration Monitor
**Role Collection**: `CIASIntegrationMonitor`
**Capabilities**:
- Read-only access to Scenario Execution Monitoring application
### Role Assignment
Navigate to **SAP BTP Cockpit** → **Security** → **Role Collection** within consumer subaccount.
**Process**:
1. Select appropriate role collection
2. Click Edit → Users tab
3. Add users via email ID or login user ID
4. Alternatively use Trust configuration for SAP IDP, custom IDP, or IAS tenant
---
## Security Restrictions
### Subaccount Prerequisites
- SAP BTP subaccount name must be present
- Subaccount must be subscribed to Cloud Integration Automation service
### User ID Requirements
User identifications for workflow invocation must exist in the SAP BTP subaccount specified during planning.
### Transaction Limits
**Maximum 15 running transactions (workflows)** per Cloud Integration Automation service consumer subaccount.
### Data Deletion Behavior
Deleting a transaction in maintenance planner does **not** automatically delete associated data in CIAS. Manual deletion in CIAS required.
---
## Data Protection and Privacy
### Database Storage
Service provider maintains database containing:
- Email IDs linked to subscriptions
- SAP BTP consumer subaccount names
- Selected systems and tenants for integration setups
### Log Management
| Aspect | Policy |
|--------|--------|
| Personal Data in Logs | Logs do not store user-related personal data |
| Log Retention | Logs remain for 90 days, then deleted |
| Audit Logs | Follow SAP BTP Audit Log retention policy |
### Data Deletion
**No self-service option** for deleting email IDs or transactional data.
To delete data:
1. Create support request to component **BC-INS-CIT-RT**
2. Include in ticket:
- Email ID requiring removal
- SAP BTP consumer subaccount name
---
## Sensitive Data Handling
### Credential Storage
CIAS requires sensitive information input to automate certain integration tasks. This data undergoes secure storage within the **Credential Store service** in the Cloud Integration Automation service provider account.
**Security Features**:
- Data inaccessible to external parties
- Secure encryption at rest
- Access limited to automation processes
**Reference**: [https://help.sap.com/viewer/601525c6e5604e4192451d5e7328fa3c/Cloud/en-US/02e8f7d1016740b8adf68690f36df142.html](https://help.sap.com/viewer/601525c6e5604e4192451d5e7328fa3c/Cloud/en-US/02e8f7d1016740b8adf68690f36df142.html)
---
## Audit Logging
### Overview
Cloud Integration Automation service maintains security-related events and user actions through the Audit Log service.
### Features
- View all audit log entries for your subaccount
- Security events documented automatically
- User actions tracked and logged
### Data Retention
Audit log entries follow SAP BTP Audit Log data retention policy for deletion procedures.
---
## Destination Security
### Configuration Data
- Destination configuration data remains exclusively in consumer subaccount
- Service accesses configurations during automation execution for restricted timeframe
### Security Requirements
- **Always use HTTPS** for secure communication
- Delete destinations after workflow completion (recommended)
- Users executing automation must have authorization on target systems
### Authorization
By default, Integration Administrator has authorization to create destinations. Deletion or modification of existing destinations is not permitted through CIAS.
---
## Glossary of Security Terms
| Term | Definition |
|------|------------|
| **Personal Data** | Any information relating to an identified or identifiable natural person including names, identification numbers, location data, and physical/physiological/genetic/mental/economic/cultural/social identity factors |
| **Sensitive Personal Data** | Racial/ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric information, professional secrecy data, criminal/administrative offense records, insurance/financial account information |
| **Blocking** | Restricting access to data for which primary business purpose has ended |
| **Consent** | Records showing whether data subject granted, withdrew, or denied consent for data usage |
| **Residence Period** | Time between business end and end-of-purpose when data remains accessible for subsequent processes |
| **Retention Period** | Time from last business activity through data deletion, subject to applicable laws |
---
## Browser Support
Supported browsers on Windows:
- Mozilla Firefox (ESR and latest)
- Google Chrome (latest)
---
## Documentation Links
- Security Overview: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/security-9e8f7c2.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/security-9e8f7c2.md)
- Security Architecture: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/security-architecture-df15122.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/security-architecture-df15122.md)
- Security Restrictions: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/security-restrictions-3538ec5.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/security-restrictions-3538ec5.md)
- Identity Provider: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/identity-provider-and-identity-management-1508b49.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/identity-provider-and-identity-management-1508b49.md)
- Data Protection: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/data-protection-and-privacy-22abc39.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/data-protection-and-privacy-22abc39.md)
- Audit Logging: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/audit-logging-639f869.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/audit-logging-639f869.md)
- SAP BTP Security Guide: [https://help.sap.com/docs/btp/sap-business-technology-platform/security](https://help.sap.com/docs/btp/sap-business-technology-platform/security)

327
references/setup-guide.md Normal file
View File

@@ -0,0 +1,327 @@
# SAP BTP CIAS Setup Guide
Complete guide for subscribing to and configuring Cloud Integration Automation Service.
**Source**: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/tree/main/docs](https://github.com/SAP-docs/btp-cloud-integration-automation-service/tree/main/docs)
---
## Table of Contents
1. [Prerequisites](#prerequisites)
2. [Subscribe to CIAS - Standard Plan](#subscribe-to-cias---standard-plan)
- Access BTP Cockpit
- Navigate to Service Marketplace
- Create Service Instance
- Access CIAS Application
3. [Subscribe to CIAS - OAuth2 Plan](#subscribe-to-cias---oauth2-plan)
- OAuth2 Plan Purpose
- Create OAuth2 Instance
- Create Service Key
- Service Key Configuration Options
4. [Assign Roles to Users](#assign-roles-to-users)
- Role Collections Overview
- Assign Users to Role Collection
- Multiple User Assignment
5. [Configure Identity Provider](#configure-identity-provider)
- Default Identity Provider
- Custom Identity Provider Setup
- SAML Configuration
6. [Create Destinations](#create-destinations)
- Destination Types
- Create Destination via My Inbox
- Manual Destination Creation
- Destination Configuration Fields
7. [Next Steps](#next-steps)
---
## Prerequisites
### SAP BTP Subaccount Requirements
Your organization must have an SAP BTP subaccount in a supported region with licensed SAP products in scope.
### Supported Cloud Platforms and Regions
**Amazon Web Services (AWS)**:
| Region | Code | Location |
|--------|------|----------|
| Europe (Frankfurt) | EU10 | Germany |
| Europe (Frankfurt) EU Access | EU11 | Germany |
| US East | US10 | Virginia, USA |
| Australia | AP10 | Sydney |
| Japan | JP10 | Tokyo |
| Canada | CA10 | Montreal |
**Microsoft Azure**:
| Region | Code | Location |
|--------|------|----------|
| Europe | EU20 | Netherlands |
| China | CN20 | North 3 |
**Alibaba Cloud**:
| Region | Code | Location |
|--------|------|----------|
| China | CN40 | Shanghai |
---
## Subscription to Standard Plan (Application Access)
### Step-by-Step Process
1. **Login to SAP BTP Cockpit**
- Access your global account in the cockpit
- Navigate to your subaccount
2. **Create Subaccount** (if needed)
- Set up subaccount in one of the supported regions listed above
3. **Access Service Marketplace**
- Navigate to **Services** → **Service Marketplace**
- View all entitled resources
4. **Filter for CIAS**
- Use "All Types" filter
- Select "Cloud Integration Automation Service" from dropdown
- Additional filters available: environments, capabilities, status
5. **View Service Overview**
- Select the service tile
- Review Overview page with application details and available plans
6. **Initiate Creation**
- Click **Create** button
- Alternative: Click three dots on tile to create without viewing overview
7. **Select Standard Plan**
- Choose **Standard** plan (subscription type)
- Confirm creation
### Post-Subscription
- **Active status** indicates successful subscription
- **Go to Application** link activates once subscription is live
- Access via **Instances and Subscriptions** page or application column icon
> **Warning**: Deleting the application via three-dot menu results in complete data loss for that subaccount.
---
## Subscription to OAuth2 Plan (API Access)
Required for programmatic access and ABAP automation scenarios.
### Service Instance Creation
1. **Access Space in SAP BTP Cockpit**
- Navigate to your Cloud Foundry space
2. **Open Service Marketplace**
- Select **Services** → **Service Marketplace**
3. **Locate CIAS**
- Find Cloud Integration Automation tile in Integration section
4. **Create Instance**
- Click **Create**
- Select **OAuth2** plan from popup
- Choose runtime environment: "Other" or "Cloud Foundry"
- Provide instance name
- Create instance
Instance appears on the Instances page. All service instances within the same organization share the same data.
### Service Key Creation
Service keys enable standalone API calls without UI access.
#### Option 1: With mTLS Certificate
Use JSON parameters for certificate-based authentication:
```json
{
"xsuaa": {
"credential-type": "x509",
"x509": {
"key-length": 2048,
"validity": 365,
"validity-type": "DAYS"
}
}
}
```
> Maximum certificate validity is **1 year**.
#### Option 2: Without Certificate
- Provide service key name only
- Create key
### API Authentication
1. Retrieve generated client ID and client secret from service key
2. Create OAuth JWT token using these credentials
3. Use token to connect to Cloud Integration Automation service APIs
---
## Assigning Roles to Users
### Prerequisites
- Subaccount subscribed to CIAS in Cloud Foundry environment
- User has Security Admin access to subaccount
### Available Role Collections
Three role collections are automatically created during subscription:
| Role Collection | Role | Capabilities |
|-----------------|------|--------------|
| CIASIntegrationAdministrator | Integration Administrator | Full access to all tiles; plan scenarios; monitor; terminate |
| CIASIntegrationExpert | Integration Expert | My Inbox access; work on assigned tasks |
| CIASIntegrationMonitor | Integration Monitor | Read-only Scenario Execution Monitoring |
### Assignment Process
1. **Navigate to Role Collections**
- Go to **Security** → **Role Collections** in left menu
2. **Select Role Collection**
- Choose appropriate collection (e.g., CIASIntegrationAdministrator)
3. **Edit Users**
- Click **Edit**
- Go to **Users** tab
- Add users via email ID or login user ID
4. **Alternative: Trust Configuration**
- Add users through SAP IDP, custom IDP, or IAS tenant
- Navigate to **Trust configuration** settings
### Multi-User Assignment
You can assign multiple users per role with comma-separated user IDs.
### Important Considerations
- User access depends on identity provider configured for subaccount
- CIAS supports any SAML assertion Name ID attribute
- Changing identity providers after subscription may disable access unless new users are managed by updated provider
---
## Destination Configuration
### Overview
Automation services use destinations configured in the consumer SAP BTP subaccount. The subaccount administrator manages destination creation with configuration data remaining exclusively in the consumer subaccount.
### Authorization
By default, a **Cloud Integration Automation Service Integration Administrator** has authorization to create destinations in the subscription subaccount.
### Security Requirements
- **Always use HTTPS** for secure communication
- Delete destinations after workflow completion (recommended)
- Users executing automation must have authorization on respective target systems
### Destination Creation Process
1. **Access CIAS Launchpad**
- Open Cloud Integration Automation service application
2. **Navigate to My Inbox**
- Open **My Inbox** tile
3. **Access System Components**
- Expand relevant system under **Confirm System Components**
4. **Create Destination**
- Click **Create Destination** link next to assign destination option
5. **Configure Destination**
- **Name**: Valid identifier for the destination
- **Description**: Details about destination purpose
- **URL**: Target system host URL (use HTTPS)
- **Authentication**: Appropriate method with credentials
- **Type**: HTTP (default)
6. **Save Configuration**
### Editing Destinations
During scenario execution, Integration Administrators can modify or set destinations:
1. Navigate to **Targets** tab in **Scenario Execution Monitoring**
2. Click **Edit Destination** button
3. Select existing destination or create new one
4. Click **Save**
> Destination cannot be changed if already used in an automation task.
---
## Confirm System Components
System components are automatically populated from maintenance planner selections.
### Access Requirements
Only users with Admin role can view and complete this task.
### Confirmation Process
1. Review components listed
2. Assign destinations to system components as needed
3. For missing destinations: Create in SAP BTP subaccount and refresh
### Manual Property Entry
Some scenarios permit manually entering system properties when management system data isn't automatically displayed.
### Workflow Conflict Handling
When multiple integration workflows exist with identical system components, an execution lock activates.
**Resolution Options**:
- **Proceed**: Continue without resolving (manual resolution later)
- **Terminate**: End selected conflicting instances
- **Terminate Current Instance**: Stop the active workflow
- **Cancel**: Halt the operation
---
## Unsubscribe Process
### Who Can Unsubscribe
Only platform Administrators can delete subscriptions.
### Process
1. Navigate to **Instance and Subscription** in SAP BTP Cockpit
2. Locate CIAS subscription
3. Delete subscription
### Consequences
- Removes subscription from consumer subaccount
- Eliminates technical connection
- **Permanently deletes all transactional information**
- Data cannot be recovered once deleted
---
## Documentation Links
- Subscription Overview: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/subscription-to-cloud-integration-automation-service-b3a72d9.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/subscription-to-cloud-integration-automation-service-b3a72d9.md)
- Standard Plan: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/subscription-to-standard-plan-c8ed936.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/subscription-to-standard-plan-c8ed936.md)
- OAuth2 Instance: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/create-instance-in-oauth2-service-plan-6187a7e.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/create-instance-in-oauth2-service-plan-6187a7e.md)
- Role Assignment: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/assigning-roles-to-the-users-9ad530a.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/assigning-roles-to-the-users-9ad530a.md)
- Destinations: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/destinations-496a763.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/destinations-496a763.md)

415
references/task-ui-guide.md Normal file
View File

@@ -0,0 +1,415 @@
# SAP BTP CIAS Task UI Complete Guide
Complete reference for working with tasks in Cloud Integration Automation Service My Inbox and Monitoring applications.
**Source**: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/tree/main/docs](https://github.com/SAP-docs/btp-cloud-integration-automation-service/tree/main/docs)
---
## Table of Contents
1. [Task Types](#task-types)
- Manual Tasks
- Automation Tasks
- Confirmation Tasks
2. [My Inbox Application](#my-inbox-application)
- Task List
- Task Details
- Task Actions
3. [Task Workflow Process](#task-workflow-process)
- Standard Workflow
- Automation Workflow
4. [Scenario Execution Monitoring](#scenario-execution-monitoring)
- Workflow Status
- Task Progress
- Termination Options
---
## Task Types
When hovering over tasks in the Overview tab, you can identify task types:
| Type | Icon/Label | Description |
|------|------------|-------------|
| **Concept Task** | Overview icon | Scenario overview task |
| **Topic** | Header icon | Task grouping header |
| **User Task** | Manual icon | Manual configuration task |
| **User Service Task** | Automation icon | Automated configuration task |
---
## My Inbox Application
### Access Requirements
Users need one of these roles:
- **Integration Administrator** (CIASIntegrationAdministrator)
- **Integration Task Expert** (CIASIntegrationExpert)
### Accessing My Inbox
1. Navigate to SAP BTP Cockpit
2. Select subaccount with CIAS subscription
3. Go to **Instance and Subscriptions**
4. Under Subscriptions, click **Go To Application** icon next to Cloud Integration Automation service
5. Select **My Inbox** tile
---
## Task Instructions Tab
### Manual Tasks
For manual tasks:
1. Review on-screen instructions
2. Execute required actions on target system
3. Click **Task Completed** when finished
### Automation Tasks
For tasks enabled for automation:
1. Configure parameter details in respective fields
2. Use available controls (see below)
3. Click **Execute Step** to process automations
### Available Controls
| Control | Function |
|---------|----------|
| **Refresh** | Updates automation statuses after execution |
| **Expand All** | Expands all parameter panels |
| **Collapse All** | Collapses all parameter panels |
| **Show/Hide Read-Only Parameters** | Toggles visibility of read-only parameters |
| **Save Parameters** | Preserves current parameter values |
| **Logs** | Shows execution records and logs |
| **Information** | Describes each parameter's purpose |
| **Execute Step** | Processes the automation (runs asynchronously) |
### Multi-User Task Handling
When multiple users are assigned to a task:
1. Any assigned user can click **Claim** to lock the task
2. Task becomes marked as **Reserved** for all other assigned users
3. A **padlock icon** displays next to the claiming user
4. Only the claiming user can complete the task
### Error Handling After Failed Automation
After fixing incorrect parameters, users can select:
- **Only Failed Automations** - Retry only failed steps
- **All Automations** - Retry entire automation sequence
---
## Overview Tab
Displays all tasks in execution sequence showing:
- Manual instructions for each task
- Comments associated with tasks
- Current execution position (marked with arrow)
### Controls
| Control | Function |
|---------|----------|
| **Expand All** | Expand all task details |
| **Collapse All** | Collapse all task details |
| **Current Task Instruction** | Jump to current task |
---
## Comments Tab
### Features
- Displays comments for ALL tasks in the scenario
- Comments visible to all assigned users and admins
- Search functionality for finding specific comments
- Refresh capability for latest comments
### Adding Comments
1. Type comment in text field
2. Click submit to post
3. Comment immediately visible to all users
---
## System Access Tab
Provides:
- System access details for selected task
- Direct connection links to target systems
- Authentication information (if configured)
---
## Assigned To Tab
Shows all users assigned to the selected task.
**Limitations**:
- View-only access
- Cannot change assigned users from this tab
- Cannot modify role assignments
### Viewing Role Details
1. Click on role name in Task Instructions
2. View:
- Role description
- Complete list of users assigned to that role
---
## Support Information Tab
Contains:
- Maintenance Planner ID
- Transaction Name
- Creation Date
- Additional support metadata
- Component IDs for support tickets
- Assistance resources for error resolution
---
## Scopes Tab
Enables:
- Assignment of execution scope from available options
- Removal of execution scope if needed
- View of current scope selection
---
## Task Workflow Process
### Standard Workflow
1. Open **My Inbox** tile
2. Review task in left panel
3. Click **Claim** to lock task
4. Read **Task Instructions** tab
5. Complete required actions
6. Click **Task Completed**
7. Click **Refresh** in left pane
8. Next task appears
9. Repeat until Execution Summary displays
### Automation Workflow
1. Claim task
2. Review automation parameters
3. Configure required parameters
4. Optionally: **Save Parameters**
5. Click **Execute Step**
6. Wait for asynchronous execution
7. Click **Refresh** to update status
8. Review **Logs** if needed
9. Click **Task Completed**
10. Proceed to next task
---
## Scenario Execution Monitoring
### Access Requirements
- **Integration Administrator** role, OR
- **Integration Monitoring** role
### Main Features
- Status overview of active workflow instances
- Filter by status: Running, Completed, Canceled
- Terminate execution capability (Admin only)
### Available Tabs
| Tab | Content | Visibility |
|-----|---------|------------|
| **Task Details** | Individual task status, skip reasons | Always |
| **Targets** | Target systems, destinations | Always |
| **Roles and Users** | User assignments per task | Always |
| **Scope** | Execution scope selection | Always |
| **Support Information** | Support resources | Always |
| **Parameters** | Automation parameters | When task selected |
| **Comments** | User comments | Always |
| **Logs** | Execution logs, trial information | When task selected |
### Task Skip Reasons
When task status shows "Not Applicable":
1. Click the status link
2. View explanation for why task was skipped
### Terminate Execution
**Warning**: Removes scenario from CIAS applications **permanently**.
1. Open Scenario Execution Monitoring
2. Select workflow
3. Click **Terminate Execution**
4. Confirm termination
### Logs Tab Details
Provides detailed overview of:
- Execution timeline
- Trial attempts (number of retries)
- Error messages
- Success/failure status per automation component
- Parameter values used
Access by selecting a task and opening the Logs tab.
---
## Disclaimer Task
The first task in any scenario inbox.
### Access
Only users with Admin role can view and complete.
### Tabs Available
| Tab | Content |
|-----|---------|
| **Summary** | SAP terms, conditions, integration recommendations |
| **Assigned To** | Users assigned to task (view-only) |
| **Support Information** | Support details for issues |
### Completion
1. Review Summary tab carefully
2. Document relevant points
3. Click **I Agree** to provide consent and proceed
---
## Confirm System Components Task
### Access
Only users with Admin role can view and complete.
### Main Steps
1. **Review Components**
- Populated from maintenance planner selections
- Click **Confirm Systems** button
2. **Assign Destinations**
- Optional but enables automation
- Without destination: respective automation unavailable
3. **Account Details**
- Specify Account Name and Host
- For SAP BTP Account Cockpit (from maintenance planner)
4. **Manual Entry**
- Some scenarios allow manual system property entry
- Use when management system data not displayed
### Critical Notes
- Tenant Name and Host **cannot be changed** after confirmation
- Missing destinations must be created in SAP BTP subaccount first
### Workflow Conflict Handling
If multiple workflows exist with same system components:
| Option | Action |
|--------|--------|
| **Proceed** | Continue; resolve conflicts manually later |
| **Terminate** | End selected conflicting instances |
| **Terminate Current Instance** | Stop only active workflow |
| **Cancel** | Halt the operation |
---
## Selecting Execution Scope Task
### Access
Only users with Admin role can view and complete.
### Options
| Selection | Result |
|-----------|--------|
| **Don't perform optional tasks** | Execute mandatory tasks only |
| **Perform optional tasks** | Execute ALL tasks including optional |
### Completion
1. Select desired scope option
2. Click **Confirm Scope Selection**
**Warning**: Execution scope **cannot be changed** after confirmation.
---
## Uploading Files in Tasks
### Purpose
Upload certificate files for reuse across systems in landscape.
### Process
1. Navigate to **Task Instructions** tab in My Inbox
2. Click **Browse** button
3. Select SAP S/4HANA Certificate file
4. Upload completes automatically
5. File available for multiple tasks
---
## Execution Summary Screen
### Purpose
Final task confirming scenario completion.
### Completion
1. Review execution summary
2. Click **Complete Execution** to finalize
**Warning**: After clicking Complete Execution, scenario **no longer appears** in Scenario Execution Monitoring.
### PDF Export
**From My Inbox**:
- Use **Export to PDF** button on Execution Summary screen
**From Scenario Execution Monitoring**:
- Use **Export to PDF** button anytime during execution
---
## Role Assignment Task
### Capabilities
- Assign multiple users per role with comma-separated user IDs
- View role descriptions
- View assigned users list
### Access
Only users with Admin role can view and complete.
### Prerequisites
- Users must have access to SAP BTP subaccount
- Users must exist in configured identity provider
---
## Documentation Links
- Working with Tasks: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/working-with-tasks-3da3577.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/working-with-tasks-3da3577.md)
- Task Details: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/task-9ec0684.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/task-9ec0684.md)
- My Inbox: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/my-inbox-7f7860d.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/my-inbox-7f7860d.md)
- Monitoring: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/monitoring-scenario-implementation-f8daffa.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/monitoring-scenario-implementation-f8daffa.md)
- Disclaimer: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/disclaimer-7823b84.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/disclaimer-7823b84.md)
- Confirm System Components: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/confirm-system-components-1f39555.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/confirm-system-components-1f39555.md)
- Execution Scope: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/selecting-execution-scope-444db93.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/selecting-execution-scope-444db93.md)
- Summary: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/summary-71f9a64.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/summary-71f9a64.md)

341
references/troubleshooting.md Normal file
View File

@@ -0,0 +1,341 @@
# SAP BTP CIAS Troubleshooting Guide
Detailed troubleshooting procedures for Cloud Integration Automation Service.
**Source**: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/tree/main/docs](https://github.com/SAP-docs/btp-cloud-integration-automation-service/tree/main/docs)
---
## Table of Contents
1. [Common Issues and Solutions](#common-issues-and-solutions)
2. [Monitoring and Logs](#monitoring-and-logs)
3. [Support Channels](#support-channels)
4. [Accessibility Features](#accessibility-features)
5. [Documentation Links](#documentation-links)
---
## Common Issues and Solutions
### Service Availability Issues
**Symptom**: Cannot access Cloud Integration Automation Service.
**Diagnostic Steps**:
1. Check Service Availability feature in consumer account
2. Verify subaccount subscription status
3. Confirm user has appropriate role collection assigned
**Solution**:
- Verify subscription is active in Instances and Subscriptions
- Check role assignment in Security → Role Collections
- Ensure identity provider is correctly configured
---
### Empty Destination Dropdown
**Symptom**: Destination dropdown shows no options during task execution.
**Cause**: No destinations exist matching the tenant's Host Base URL.
**Diagnostic Steps**:
1. Verify destination exists in subaccount
2. Check destination URL matches tenant Host Base URL exactly
3. Confirm destination type is HTTP/HTTPS
**Solution**:
1. Navigate to **My Inbox** → **Confirm System Components**
2. Click **Create Destination** link
3. Configure destination:
- Name: Valid identifier
- URL: Exact tenant Host Base URL (use HTTPS)
- Authentication: Appropriate method
- Type: HTTP
4. Save and refresh dropdown
---
### Task Marked as Reserved
**Symptom**: Cannot claim task; shows "Reserved" status.
**Cause**: Another assigned user has already claimed the task.
**Explanation**: When multiple users are assigned to a task, the first user to click **Claim** locks it. A padlock icon appears next to the claiming user in monitoring views.
**Solution**:
- Coordinate with team to identify who claimed the task
- Only one user can work on a claimed task at a time
- Wait for current user to complete or release the task
---
### Application Access Denied After IdP Change
**Symptom**: Users cannot access CIAS application after identity provider change.
**Cause**: Users not managed by newly configured identity provider.
**Solution**:
1. Add users to new identity provider
2. Navigate to **Security** → **Role Collections** in subaccount
3. Reassign role collections to users with new IdP credentials
4. Verify user IDs exist in configured IdP
5. Test login with updated credentials
---
### Workflow Conflict Lock
**Symptom**: Cannot proceed with task; execution lock activated.
**Cause**: Multiple integration workflows exist with identical system components.
**Resolution Options**:
| Action | Description |
|--------|-------------|
| **Proceed** | Continue without resolving conflicts (manual resolution later) |
| **Terminate** | End selected conflicting workflow instances |
| **Terminate Current Instance** | Stop only the active workflow |
| **Cancel** | Halt the operation entirely |
**Best Practice**: Review all active workflows in Scenario Execution Monitoring before proceeding.
---
### Automation Task Failure
**Symptom**: Automated task fails during execution.
**Diagnostic Steps**:
1. Access **Logs** tab for failed task
2. Review execution details and error messages
3. Check destination configuration
4. Verify user credentials in destination have required permissions
**Solution**:
1. Click **View Logs** button to review detailed execution log
2. Identify specific error
3. Fix underlying issue (credentials, permissions, network)
4. Re-execute using **Execute Step** button
5. Select failed components only for selective retry
---
### Destination Cannot Be Changed
**Symptom**: Edit Destination option unavailable or fails.
**Cause**: Destination is already used in an automation task.
**Explanation**: Once a destination is used in automation, it becomes locked to prevent inconsistency.
**Solution**:
- Create new destination with updated configuration
- Use new destination for subsequent tasks
- Complete current workflow before destination modifications
---
### Task Instructions Missing or Incorrect
**Symptom**: Task instructions don't appear or contain demo content.
**Explanation**: Task Instructions tab may contain demonstration content that varies from actual instructions.
**Solution**:
1. Check **Support Information** tab for scenario-specific guidance
2. Submit incident to component listed in Support Information tab
3. For general issues, create ticket to **BC-INS-CIT-RT**
---
### Systems Not Visible in Selection
**Symptom**: Expected systems don't appear in system selection during planning.
**Cause**: Systems not associated with customer number linked to global account.
**Solution**:
1. Verify S-User customer number associations
2. Use manual landscape data entry through **Confirm System Components** task
3. Search systems by Tenant URL if available
4. Contact SAP support if systems should be visible
---
### Maximum Workflow Limit Reached
**Symptom**: Cannot create new workflow; limit error displayed.
**Cause**: 15 active workflows already exist in subaccount.
**Solution**:
1. Open **Scenario Execution Monitoring**
2. Filter for **Running** workflows
3. Identify completed or unnecessary workflows
4. **Terminate** workflows no longer needed
5. Or wait for active workflows to complete
> **Note**: Maximum 15 running transactions per CIAS consumer subaccount.
---
### Data Deletion Required
**Symptom**: Need to delete transactional data or user email IDs.
**Cause**: No self-service deletion option available.
**Solution**:
1. Create support request to component **BC-INS-CIT-RT**
2. Include in ticket:
- Email ID requiring removal
- SAP BTP consumer subaccount name
3. Wait for support confirmation
> **Note**: Deleting transaction in maintenance planner does NOT automatically delete CIAS data.
---
## Monitoring and Logs
### Accessing Scenario Execution Monitoring
**Prerequisites**: Integration Administrator or Integration Monitor role
**Steps**:
1. Open **Scenario Execution Monitoring** tile
2. Filter workflows by status:
- **Running**: Active workflows
- **Completed**: Finished workflows
- **Canceled**: Terminated workflows
### Available Monitoring Tabs
| Tab | Content |
|-----|---------|
| **Task Details** | Individual task status and details |
| **Targets** | Target system and destination information |
| **Roles and Users** | User assignments per task |
| **Scope** | Execution scope (mandatory/optional tasks) |
| **Support Information** | Support resources and component IDs |
| **Parameters** | Automation parameters (when task selected) |
| **Comments** | User comments for all tasks |
| **Logs** | Detailed automation execution logs |
### Viewing Task Skip Reasons
When task status shows "Not Applicable":
1. Click the status link
2. View explanation for why task was skipped
### Logs Tab Details
The Logs tab provides detailed overview of:
- Execution timeline
- Trial attempts
- Error messages
- Success/failure status per automation component
Access by selecting a task in monitoring view.
---
## Support Channels
### General CIAS Support
**Component**: `BC-INS-CIT-RT`
**Use for**:
- Service issues
- Data deletion requests
- General questions
**Required information**:
- Consumer subaccount name
- User email ID (if applicable)
- Detailed issue description
### Manual Task Instruction Support
**Process**:
1. Open task in My Inbox
2. Navigate to **Support Information** tab
3. Note the component ID listed
4. Submit incident to that specific component
### Scenario-Specific Issues
**Process**:
1. Open **Scenario Execution Monitoring**
2. Select affected scenario
3. Navigate to **Support Information** tab
4. Follow guidance or submit incident to listed component
---
## Accessibility Features
CIAS operates on the SAP BTP cockpit platform and inherits its accessibility capabilities.
### Platform Accessibility
CIAS is built on SAP Fiori/SAPUI5 technology, which provides:
| Feature | Support Level |
|---------|---------------|
| **Screen Readers** | Supported (JAWS, NVDA, VoiceOver) |
| **Keyboard Navigation** | Full keyboard operability |
| **High Contrast Themes** | Available via SAP BTP cockpit settings |
| **Focus Indicators** | Visible focus states for interactive elements |
| **ARIA Labels** | Semantic markup for assistive technologies |
### Keyboard Navigation
Common keyboard shortcuts in CIAS applications:
| Action | Shortcut |
|--------|----------|
| Navigate between elements | Tab / Shift+Tab |
| Activate buttons/links | Enter or Space |
| Navigate lists | Arrow keys |
| Close dialogs | Escape |
| Access menus | F6 (navigate regions) |
### Theme Customization
Users can adjust themes via the user info dropdown:
1. Click user avatar/name in header
2. Select **Settings** or **Appearance**
3. Choose from available themes:
- Morning Horizon (Light) - Default
- Evening Horizon (Dark)
- High Contrast Black
- High Contrast White
### Known Limitations
- Complex automation parameter forms may require additional screen reader configuration
- Some monitoring charts may have limited accessibility descriptions
- PDF export functionality may produce documents with varying accessibility compliance
### Accessibility Resources
- SAP BTP Cockpit Accessibility: [https://help.sap.com/docs/btp/sap-business-technology-platform/accessibility-features](https://help.sap.com/docs/btp/sap-business-technology-platform/accessibility-features)
- SAPUI5 Accessibility: [https://sapui5.hana.ondemand.com/sdk/#/topic/03b914b46e624b138a6fb1b7cf2049ae](https://sapui5.hana.ondemand.com/sdk/#/topic/03b914b46e624b138a6fb1b7cf2049ae)
- SAP Accessibility Statement: [https://www.sap.com/about/company/diversity/accessibility.html](https://www.sap.com/about/company/diversity/accessibility.html)
---
## Documentation Links
- Monitoring and Troubleshooting: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/monitoring-and-troubleshooting-18460b7.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/monitoring-and-troubleshooting-18460b7.md)
- Monitoring Scenario Implementation: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/monitoring-scenario-implementation-f8daffa.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/monitoring-scenario-implementation-f8daffa.md)
- Working with Tasks: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/working-with-tasks-3da3577.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/working-with-tasks-3da3577.md)
- Task Details: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/task-9ec0684.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/task-9ec0684.md)
- Confirm System Components: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/confirm-system-components-1f39555.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/confirm-system-components-1f39555.md)

353
references/whats-new.md Normal file
View File

@@ -0,0 +1,353 @@
# SAP BTP CIAS Release Notes - What's New
Complete release notes for Cloud Integration Automation Service from 2021-2025.
**Source**: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/what-s-new-in-cloud-integration-automation-service-ee05dea.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/what-s-new-in-cloud-integration-automation-service-ee05dea.md)
---
## Table of Contents
1. [2025](#2025)
- China (CN20) Data Center
2. [2024](#2024)
- Montreal (CA10) Data Center
3. [2023](#2023)
- New Integration Scenario - RTI for SAP IBP
- Theme Change - Morning Horizon
- UI Enhancement - Help Features
- Tokyo (JP10) Data Center
- Automation Tasks Enhancement - Async Execution
4. [2022](#2022)
- UI Enhancement - Execution Monitoring
- New Data Centers - Frankfurt & Shanghai
- UI Enhancement - Task Logs
- Scenario Tasks - Execution Modes
- UI Enhancement - Tile Ordering
- Scenario Tasks - Progress Bar & UI Text
5. [2021](#2021)
- Scenario Tasks List View
- Subscription Plans Available & Neo Deprecation
- Cloud Foundry Platform Availability
- Scenario Planning in Application
- Destination Creation Feature
---
## 2025
### New Data Center - China (CN20)
| Field | Value |
|-------|-------|
| **Available** | 2024-04-11 |
| **Environment** | Cloud Foundry |
| **Type** | New |
| **Action** | Info only |
**Description**: Service subscription now available in China (CN20) data center.
---
## 2024
### New Data Center - Montreal (CA10)
| Field | Value |
|-------|-------|
| **Available** | 2024-07-30 |
| **Environment** | Cloud Foundry |
| **Type** | New |
| **Action** | Info only |
**Description**: Service subscription now available in Montreal (CA10) data center.
---
## 2023
### New Integration Scenario - RTI for SAP IBP
| Field | Value |
|-------|-------|
| **Available** | 2023-11-10 |
| **Environment** | Cloud Foundry |
| **Type** | New |
| **Action** | Info only |
**Description**: Connectivity Setup of Real-Time Integration (RTI) in SAP Integrating Business Planning (IBP). Enables integration of master and transactional data from SAP S/4HANA or SAP ERP to SAP IBP order-based planning in near real-time **without batch jobs**.
---
### Theme Change - Morning Horizon
| Field | Value |
|-------|-------|
| **Available** | 2023-09-13 |
| **Environment** | Cloud Foundry |
| **Type** | New |
| **Action** | Info only |
**Description**: Default theme changed from **"Quartz Light"** to **"Morning Horizon (Light)"**. Manual theme adjustment available via user info dropdown.
---
### UI Enhancement - Help Features
| Field | Value |
|-------|-------|
| **Available** | 2023-09-13 |
| **Environment** | Cloud Foundry |
| **Type** | New |
| **Action** | Recommended |
**Description**:
- Help icon (?) provides UI element overviews
- Homepage displays "What's New" section
- Homepage displays "Help Documentation" section with links
---
### New Data Center - Tokyo (JP10)
| Field | Value |
|-------|-------|
| **Available** | 2023-05-24 |
| **Environment** | Cloud Foundry |
| **Type** | New |
| **Action** | Info only |
**Description**: Service subscription now available in Tokyo (JP10) data center.
---
### Automation Tasks Enhancement - Async Execution
| Field | Value |
|-------|-------|
| **Available** | 2023-05-24 |
| **Environment** | Cloud Foundry |
| **Type** | New |
| **Action** | Info only |
**Description**:
- **Execute Step** now performs asynchronously
- Collapsible panels allow viewing/hiding automation component parameters in My Inbox
---
## 2022
### UI Enhancement - Execution Monitoring
| Field | Value |
|-------|-------|
| **Available** | 2022-09-08 |
| **Environment** | Cloud Foundry |
| **Type** | New |
| **Action** | Info only |
**Description**:
- Users can view and monitor execution progress for each task automation
- Ability to collapse/expand all parameters
- View/hide read-only parameters
---
### New Data Centers - Frankfurt & Shanghai
| Field | Value |
|-------|-------|
| **Available** | 2022-07-26 |
| **Environment** | Cloud Foundry |
| **Type** | New |
| **Action** | Info only |
**Description**: Service subscription now available in:
- Frankfurt (EU11) data center
- Shanghai (CN40) data center
---
### UI Enhancement - Task Logs
| Field | Value |
|-------|-------|
| **Available** | 2022-04-14 |
| **Environment** | Cloud Foundry |
| **Type** | Changed |
| **Action** | Info only |
**Description**: **View Logs** button allows viewing automated task logs post-execution.
---
### Scenario Tasks - Execution Modes
| Field | Value |
|-------|-------|
| **Available** | 2022-04-14 |
| **Environment** | Cloud Foundry |
| **Type** | Changed |
| **Action** | Info only |
**Description**: For scenarios with fully automated tasks, you can now generate a workflow by selecting:
- **Background Execution** - Allows adding scenario-specific parameters exclusively
- **Step-by-Step Execution** - Traditional sequential execution
Selection made from **Select System** screen during workflow generation.
---
### UI Enhancement - Tile Ordering
| Field | Value |
|-------|-------|
| **Available** | 2022-02-21 |
| **Environment** | Cloud Foundry |
| **Type** | Changed |
| **Action** | Info only |
**Description**: Tile order changed:
1. **Plan for Integration** (first)
2. **My Inbox** (second)
3. **Monitoring** (third)
---
### Scenario Tasks - Progress Bar & UI Text
| Field | Value |
|-------|-------|
| **Available** | 2022-02-21 |
| **Environment** | Cloud Foundry, Neo |
| **Type** | Changed |
| **Action** | Info only |
**Description**:
- Progress bar displays current task position within total scenario tasks
- On-screen text added throughout UI
- Mouseover text added for better context
---
## 2021
### Scenario Tasks List View
| Field | Value |
|-------|-------|
| **Available** | 2021-10-01 |
| **Environment** | Cloud Foundry |
| **Type** | Changed |
| **Action** | Info only |
**Description**: **Scenario Task** tab in scenario planning UI displays list of selected integration scenario tasks.
---
### Subscription Plans Available & Neo Deprecation
| Field | Value |
|-------|-------|
| **Available** | 2021-08-04 |
| **Environment** | Cloud Foundry |
| **Type** | Changed |
| **Action** | Info only |
**Description**:
- Cloud Integration Automation service now provides **Standard** and **OAuth2** plans
- **Neo environment access ends July 2021**
- Cloud Foundry is recommended for new scenario creation
- Backup support available via BC-INS-CIT-RT component incident
---
### Cloud Foundry Platform Availability
| Field | Value |
|-------|-------|
| **Available** | 2021-05-01 |
| **Environment** | Cloud Foundry, Neo |
| **Type** | Changed |
| **Action** | Info only |
**Description**: Service subscription now available for Cloud Foundry subaccounts.
---
### Scenario Planning in Application
| Field | Value |
|-------|-------|
| **Available** | 2021-05-01 |
| **Environment** | Cloud Foundry, Neo |
| **Type** | Changed |
| **Action** | Info only |
**Description**: Scenario integration planning functionality integrated directly within Cloud Integration Automation service application (no longer requires separate access).
---
### Destination Creation Feature
| Field | Value |
|-------|-------|
| **Available** | 2021-05-01 |
| **Environment** | Cloud Foundry, Neo |
| **Type** | Changed |
| **Action** | Info only |
**Description**: Users can now create destinations in SAP Business Technology Platform subaccounts directly from Cloud Integration Automation service inbox.
---
## Timeline Summary
### Data Center Availability
| Date | Region | Code |
|------|--------|------|
| 2021-05-01 | Cloud Foundry support | - |
| 2022-07-26 | Frankfurt EU Access | EU11 |
| 2022-07-26 | Shanghai | CN40 |
| 2023-05-24 | Tokyo | JP10 |
| 2024-07-30 | Montreal | CA10 |
| 2025-04-11 | China | CN20 |
### Major Feature Releases
| Date | Feature |
|------|---------|
| 2021-05-01 | Cloud Foundry support, In-app scenario planning, Destination creation |
| 2021-08-04 | Standard + OAuth2 plans, Neo deprecation |
| 2022-02-21 | Progress bar, UI tile reordering |
| 2022-04-14 | Background/Step-by-Step execution modes, View Logs |
| 2022-09-08 | Execution monitoring enhancements |
| 2023-05-24 | Async Execute Step, Collapsible parameter panels |
| 2023-09-13 | Morning Horizon theme, Help features |
| 2023-11-10 | RTI for SAP IBP scenario |
### Deprecations
| Date | Deprecation |
|------|-------------|
| 2021-07 | Neo environment access ended |
| 2021-08-04 | Neo no longer recommended for new scenarios |
---
## Environment Support
| Environment | Status |
|-------------|--------|
| **Cloud Foundry** | Active - Primary platform |
| **Neo** | Deprecated (July 2021) |
All new features since 2021-08 are Cloud Foundry only.
---
## Documentation Link
- What's New: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/what-s-new-in-cloud-integration-automation-service-ee05dea.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/what-s-new-in-cloud-integration-automation-service-ee05dea.md)

257
templates/destination-config.md Normal file
View File

@@ -0,0 +1,257 @@
# CIAS Destination Configuration Templates
Templates for configuring destinations in Cloud Integration Automation Service.
---
## Basic HTTP Destination
### Configuration
| Property | Value | Notes |
|----------|-------|-------|
| Name | `<SYSTEM_ID>_DEST` | Use meaningful identifier |
| Type | `HTTP` | Default |
| Description | Integration destination for [System Name] | Purpose description |
| URL | `[https://<hostname>:<port>`](https://<hostname>:<port>`) | Always use HTTPS |
| Proxy Type | `Internet` | For cloud systems |
| Authentication | See options below | Based on requirements |
---
## Authentication Options
### Basic Authentication
```
Authentication: BasicAuthentication
User: <technical_user>
Password: <password>
```
**Use when**:
- Simple username/password authentication
- Technical user with limited scope
- Development/testing environments
**Security note**: Store credentials securely; delete destination after workflow completion.
### OAuth2 Client Credentials
```
Authentication: OAuth2ClientCredentials
Client ID: <client_id>
Client Secret: <client_secret>
Token Service URL: [https://<auth_server>/oauth/token](https://<auth_server>/oauth/token)
```
**Use when**:
- Machine-to-machine authentication
- SAP BTP services integration
- API access scenarios
### OAuth2 User Token Exchange
```
Authentication: OAuth2UserTokenExchange
Client ID: <client_id>
Client Secret: <client_secret>
Token Service URL: [https://<auth_server>/oauth/token](https://<auth_server>/oauth/token)
```
**Use when**:
- User context required in target system
- Principal propagation needed
### Client Certificate
```
Authentication: ClientCertificateAuthentication
Key Store Location: <path_to_keystore>
Key Store Password: <keystore_password>
```
**Use when**:
- mTLS required
- High-security environments
- Production systems
---
## Destination Templates by Target System
### SAP S/4HANA Cloud
```
Name: S4HC_<TENANT_ID>
Type: HTTP
URL: [https://<tenant>.s4hana.ondemand.com](https://<tenant>.s4hana.ondemand.com)
Proxy Type: Internet
Authentication: OAuth2SAMLBearerAssertion
Audience: [https://<tenant>.s4hana.ondemand.com](https://<tenant>.s4hana.ondemand.com)
Client Key: <client_key>
Token Service URL: [https://<tenant>.s4hana.ondemand.com/sap/bc/sec/oauth2/token](https://<tenant>.s4hana.ondemand.com/sap/bc/sec/oauth2/token)
Token Service User: <communication_user>
Token Service Password: <password>
```
### SAP S/4HANA On-Premise (via Cloud Connector)
```
Name: S4OP_<SYSTEM_ID>
Type: HTTP
URL: [http://<virtual_host>:<virtual_port>](http://<virtual_host>:<virtual_port>)
Proxy Type: OnPremise
Location ID: <cloud_connector_location_id>
Authentication: BasicAuthentication
User: <system_user>
Password: <password>
```
### SAP SuccessFactors
```
Name: SFSF_<COMPANY_ID>
Type: HTTP
URL: [https://<datacenter>.successfactors.com](https://<datacenter>.successfactors.com)
Proxy Type: Internet
Authentication: OAuth2SAMLBearerAssertion
Audience: www.successfactors.com
Client Key: <api_key>
Token Service URL: [https://<datacenter>.successfactors.com/oauth/token](https://<datacenter>.successfactors.com/oauth/token)
Token Service User: <admin_user>
Token Service Password: <password>
```
### SAP Integration Suite (CPI)
```
Name: CPI_<TENANT_ID>
Type: HTTP
URL: [https://<tenant>.it-cpi<region>.cfapps.<region>.hana.ondemand.com](https://<tenant>.it-cpi<region>.cfapps.<region>.hana.ondemand.com)
Proxy Type: Internet
Authentication: OAuth2ClientCredentials
Client ID: <client_id>
Client Secret: <client_secret>
Token Service URL: [https://<tenant>.authentication.<region>.hana.ondemand.com/oauth/token](https://<tenant>.authentication.<region>.hana.ondemand.com/oauth/token)
```
### SAP BTP ABAP Environment
```
Name: ABAP_ENV_<SYSTEM_ID>
Type: HTTP
URL: [https://<system_id>.abap.<region>.hana.ondemand.com](https://<system_id>.abap.<region>.hana.ondemand.com)
Proxy Type: Internet
Authentication: OAuth2ClientCredentials
Client ID: <client_id>
Client Secret: <client_secret>
Token Service URL: [https://<system_id>.authentication.<region>.hana.ondemand.com/oauth/token](https://<system_id>.authentication.<region>.hana.ondemand.com/oauth/token)
```
### SAP Ariba
```
Name: ARIBA_<REALM_ID>
Type: HTTP
URL: [https://<datacenter>.ariba.com](https://<datacenter>.ariba.com)
Proxy Type: Internet
Authentication: OAuth2ClientCredentials
Client ID: <application_key>
Client Secret: <shared_secret>
Token Service URL: [https://api.ariba.com/v2/oauth/token](https://api.ariba.com/v2/oauth/token)
```
### SAP Concur
```
Name: CONCUR_<ENTITY_ID>
Type: HTTP
URL: [https://<datacenter>.concursolutions.com](https://<datacenter>.concursolutions.com)
Proxy Type: Internet
Authentication: OAuth2ClientCredentials
Client ID: <client_id>
Client Secret: <client_secret>
Token Service URL: [https://<datacenter>.concursolutions.com/oauth2/v0/token](https://<datacenter>.concursolutions.com/oauth2/v0/token)
```
---
## Additional Properties
### Common Additional Properties
| Property | Value | Purpose |
|----------|-------|---------|
| `sap-client` | `<client_number>` | ABAP system client |
| `HTML5.DynamicDestination` | `true` | Dynamic destination resolution |
| `WebIDEEnabled` | `true` | Enable for BAS/WebIDE |
| `WebIDEUsage` | `odata_abap` | OData service usage |
### Example with Additional Properties
```
Name: S4HC_PROD
Type: HTTP
URL: [https://my-tenant.s4hana.ondemand.com](https://my-tenant.s4hana.ondemand.com)
Proxy Type: Internet
Authentication: OAuth2SAMLBearerAssertion
[Authentication details...]
Additional Properties:
sap-client: 100
HTML5.DynamicDestination: true
```
---
## Security Best Practices
### Do
- Always use HTTPS for URLs
- Use technical/service users with minimal required permissions
- Rotate credentials regularly
- Delete destinations after workflow completion
- Document destination purpose in description
### Don't
- Store production credentials in non-production environments
- Share destination credentials across teams
- Use personal user credentials
- Leave unused destinations active
- Skip certificate validation in production
---
## Troubleshooting
### Destination Not Found in Dropdown
1. Verify destination exists in subaccount
2. Check URL matches tenant Host Base URL exactly
3. Confirm destination type is HTTP
4. Refresh dropdown after creation
### Authentication Failures
1. Verify credentials are correct
2. Check token service URL accessibility
3. Confirm user has required authorizations in target system
4. Review audit logs for specific error
### Connection Timeouts
1. Check Cloud Connector status (for on-premise)
2. Verify network connectivity
3. Confirm target system is available
4. Review timeout settings
---
## Documentation Links
- Destinations: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/destinations-496a763.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/destinations-496a763.md)
- Destination Creation: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/destination-creation-b2cd7e9.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/destination-creation-b2cd7e9.md)
- SAP BTP Destinations: [https://help.sap.com/docs/btp/sap-business-technology-platform/destination](https://help.sap.com/docs/btp/sap-business-technology-platform/destination)

279
templates/role-assignment.md Normal file
View File

@@ -0,0 +1,279 @@
# CIAS Role Assignment Templates
Templates and procedures for assigning roles in Cloud Integration Automation Service.
---
## Role Collections Overview
Three role collections are automatically created during CIAS subscription:
| Role Collection | Role | Purpose |
|-----------------|------|---------|
| `CIASIntegrationAdministrator` | Integration Administrator | Full access and administration |
| `CIASIntegrationExpert` | Integration Expert | Task execution |
| `CIASIntegrationMonitor` | Integration Monitor | Read-only monitoring |
---
## Role Assignment Templates
### Template: Integration Administrator Assignment
**Use for**: IT administrators, solution architects, integration leads
**Capabilities granted**:
- Access My Inbox application
- Access Plan for Integration
- Access Scenario Execution Monitoring
- Plan integration scenarios and generate workflows
- Review workflow execution plans
- Monitor workflow execution
- Terminate scenarios
- Create destinations
**Assignment procedure**:
```
1. Navigate to SAP BTP Cockpit > [Subaccount] > Security > Role Collections
2. Select: CIASIntegrationAdministrator
3. Click: Edit
4. Go to: Users tab
5. Add users: [email1@domain.com, email2@domain.com]
6. Click: Save
```
**Typical recipients**:
- Integration architects
- BTP administrators
- Project leads
- System administrators
---
### Template: Integration Expert Assignment
**Use for**: Functional consultants, configuration specialists, implementation team members
**Capabilities granted**:
- Access My Inbox application
- Work on assigned tasks
- Execute manual and automated tasks
- Add comments to tasks
**Assignment procedure**:
```
1. Navigate to SAP BTP Cockpit > [Subaccount] > Security > Role Collections
2. Select: CIASIntegrationExpert
3. Click: Edit
4. Go to: Users tab
5. Add users: [email1@domain.com, email2@domain.com]
6. Click: Save
```
**Typical recipients**:
- Functional consultants
- Configuration specialists
- Implementation team members
- Subject matter experts
---
### Template: Integration Monitor Assignment
**Use for**: Project managers, auditors, stakeholders needing visibility
**Capabilities granted**:
- Read-only access to Scenario Execution Monitoring
- View task status
- View execution progress
**Assignment procedure**:
```
1. Navigate to SAP BTP Cockpit > [Subaccount] > Security > Role Collections
2. Select: CIASIntegrationMonitor
3. Click: Edit
4. Go to: Users tab
5. Add users: [email1@domain.com, email2@domain.com]
6. Click: Save
```
**Typical recipients**:
- Project managers
- Internal auditors
- Quality assurance
- Stakeholders requiring visibility
---
## Multi-User Assignment
### Comma-Separated Assignment
You can assign multiple users per role with comma-separated user IDs:
```
Users: user1@domain.com, user2@domain.com, user3@domain.com
```
### Bulk Assignment via Trust Configuration
For large teams, use Trust Configuration:
1. Navigate to **Security** → **Trust Configuration**
2. Select identity provider (SAP IDP, Custom IDP, or IAS tenant)
3. Map groups to role collections
4. Users in mapped groups automatically receive roles
---
## Identity Provider Integration
### SAP Cloud Identity Services (Default)
```
Trust Configuration:
Identity Provider: SAP Cloud Identity Services
Domain: accounts.sap.com
User Format: <email>@<domain>
Example: john.doe@company.com
```
### Corporate Identity Provider (Custom IDP)
```
Trust Configuration:
Identity Provider: Corporate SAML IDP
Metadata: [Upload IDP metadata XML]
User Format: Per corporate IDP configuration
SAML Attribute: NameID (any supported format)
```
### SAP Identity Authentication Service (IAS)
```
Trust Configuration:
Identity Provider: IAS Tenant
Tenant URL: [https://<tenant>.accounts.ondemand.com](https://<tenant>.accounts.ondemand.com)
User Format: <email> or <user_id>
```
---
## Workflow User Assignment Template
When invoking workflows via Plan for Integration or Maintenance Planner:
### Initial Task Assignment
**Field**: SAP BTP Workflow Users
**Format**: Comma-separated list of user IDs
**Requirements**:
- Users must have access to specified SAP BTP subaccount
- Users must be in configured identity provider
- At least one user required
**Template**:
```
Workflow Users: admin@company.com, lead@company.com, consultant@company.com
```
### Role-Based User Identification
During workflow execution, view role assignments:
1. Open task in My Inbox
2. Click role name in Task Instructions
3. View:
- Role description
- Complete list of assigned users
---
## Task Claiming Behavior
### Multi-User Task Assignment
When multiple users are assigned to a task:
1. Any assigned user can click **Claim** to lock the task
2. Task marked as **Reserved** for all other assigned users
3. Padlock icon appears next to claiming user in monitoring
4. Only claiming user can complete the task
### Best Practices
- Coordinate team assignments to avoid conflicts
- Use Integration Monitor role for stakeholders needing visibility
- Assign Integration Expert to implementation team members
- Reserve Integration Administrator for lead personnel
---
## Role Assignment Checklist
### Before Assignment
- [ ] Verify subaccount is subscribed to CIAS
- [ ] Confirm identity provider is configured
- [ ] Identify users requiring each role level
- [ ] Verify user IDs exist in identity provider
### During Assignment
- [ ] Use correct role collection name
- [ ] Add users via email ID or login user ID
- [ ] Save changes after each modification
- [ ] Verify assignment in Role Collection details
### After Assignment
- [ ] Have users test application access
- [ ] Verify appropriate tiles are visible
- [ ] Confirm task visibility in My Inbox
- [ ] Check Scenario Execution Monitoring access (if applicable)
---
## Troubleshooting Role Issues
### User Cannot Access Application
1. Verify role collection assignment
2. Check identity provider user exists
3. Confirm user is logging in with correct credentials
4. Review trust configuration settings
### User Cannot See Expected Tiles
| Missing Tile | Required Role |
|--------------|---------------|
| My Inbox | Administrator or Expert |
| Plan for Integration | Administrator only |
| Scenario Execution Monitoring | Administrator or Monitor |
### User Cannot Claim Tasks
1. Verify user has Expert or Administrator role
2. Check if another user has already claimed the task
3. Confirm user is assigned to the specific task
### Access Denied After IdP Change
1. Add users to new identity provider
2. Reassign role collections
3. Verify SAML attribute mapping
4. Test login with updated credentials
---
## Documentation Links
- Roles and Authorizations: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/roles-and-authorizations-917f842.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/roles-and-authorizations-917f842.md)
- Role Assignment: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/role-assignment-cd6b96b.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/role-assignment-cd6b96b.md)
- Assigning Roles to Users: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/assigning-roles-to-the-users-9ad530a.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/assigning-roles-to-the-users-9ad530a.md)
- Identity Provider: [https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/identity-provider-and-identity-management-1508b49.md](https://github.com/SAP-docs/btp-cloud-integration-automation-service/blob/main/docs/identity-provider-and-identity-management-1508b49.md)