Unverified50% confidenceSolutionExact time
In principal propagation mode, the user logs in to the MCP client via SAP Cloud Identity Services; the JWT token reaches Integration Suite, Cloud Connector issues a short-lived X.509 certificate for that user, and S/4HANA maps it to the real SAP user via certificate rules.
1
Sources
50%
Confidence
Long-term
Relevance
10/20/2026
First Seen
Sources
SAP Meets MCP: 5 Architecture Patterns for AI Agents Connecting to S/4HANA
youtubeGP Satapathy10/20/2026
Related Entities
Related Claims
UnverifiedFor S/4HANA public cloud, since Cloud Connector cannot be used, principal propagation instead uses an OAuth 2.0 to SAML 2.0 bearer assertion flow, with SAP Cloud Identity Services issuing the SAML assertion directly to S/4HANA.74% similarUnverifiedCloud platforms obtain the public keys (JWKS URI) required for signature verification by accessing the identity provider's .well-known/openid-configuration endpoint, enabling token verification without pre-shared secrets.71% similarUnverified首次调用时需通过 az login 使用 Azure CLI 登录进行身份认证，该命令触发 OAuth 2.0 授权流程并在本地缓存访问令牌66% similarUnverifiedOIDC federated identity is the recommended keyless authentication method between cloud providers such as AWS, GCP, and Azure and GitHub Actions, exchanging short-lived JWT tokens for time-limited cloud resource access credentials63% similarUnverifiedThe OAuth 2.0 / JWT token scheme carries server identity claims via signed tokens, with the agent verifying signature validity upon connection.63% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1075211API
curl https://kongchang.com/api/v1/knowledge/claims/1075211MCP
get_claim(id=1075211)