Skip to main content

Non-SAP Agent Principal Propagation

Last updated on by sapgunnar

This sub-page of the SAP-managed integration model describes principal propagation for non-SAP AI agents: how the acting principal of a third-party agent is carried, validated, and asserted when that agent interacts with SAP solutions through SAP Cloud Identity Services and the SAP Agent Gateway.

It focuses on the scenario where third-party agents call SAP agents, and documents two integration variants — a front channel and a back channel flow. It is the SAP-managed IAM companion to Third-Party A2A Integration & Token Exchange, which details the underlying token exchange and audience handling.

Disclaimer

Some capabilities described here are still in preparation. The architecture reflects the recommended target design; standardization of the underlying flows is ongoing.

End-to-End Architecture Overview​

In this scenario, third-party agents call SAP agents. Access from a third-party agent to an SAP agent is brokered by the SAP Agent Gateway and governed by SAP Cloud Identity Services, with the end user's principal propagated end to end.

Key aspects​

  • Third-party agent to SAP agent access is defined via SAP for Me / formations.
  • Third-party agents access SAP agents via the Agent Gateway.
  • Third-party agents must be represented in SAP Cloud Identity Services.
  • Users must be represented in SAP Cloud Identity Services and authorized to access the SAP agent.
  • Authentication and authorization are based on OAuth 2.0 / OpenID Connect (OIDC).
  • Access makes usage of principal propagation.

Token: Access token for the user, requested by the third-party agent, issued by SAP Cloud Identity Services, with the Agent Gateway as the audience.

image of solution diagram
Copy to clipboard
Solution Diagram Resources
You can download the Solution Diagram as a .drawio file for offline use. Alternatively, you may view and edit the Solution Diagram directly on draw.io.
Please note that any changes made online will need to be saved locally if you wish to keep them.
DownloadEdit

Integration Pattern 1: Front Channel​

The front-channel variant drives user authentication and consent through browser-based OAuth/OIDC redirects at the third-party agent, then exchanges the resulting token for one targeted at the Agent Gateway.

The diagram below shows the end-to-end front-channel flow between the Human User, the Non-SAP Agent, the Non-SAP IdP / OAuth Authorization Server, SAP Cloud Identity Services, SAP's Agent Gateway, and the SAP Agent:

image of solution diagram
Copy to clipboard
Solution Diagram Resources
You can download the Solution Diagram as a .drawio file for offline use. Alternatively, you may view and edit the Solution Diagram directly on draw.io.
Please note that any changes made online will need to be saved locally if you wish to keep them.
DownloadEdit

As shown in the diagram:

  1. The user authenticates at the third-party agent via a browser redirect / authorization request / login against the non-SAP IdP / OAuth authorization server — no constraints (the example assumes OAuth/OIDC).
  2. The third-party agent initiates an authorization code grant with SAP Cloud Identity Services through a browser redirect.
  3. The third-party agent retrieves an access token for the Agent Gateway via token exchange at SAP Cloud Identity Services, which issues the SAP token (user principal, Agent Gateway as audience).

Steps:

  1. User authentication at the third-party agent — no constraints (the example assumes OAuth/OIDC).
  2. The third-party agent must be able to initiate an authorization code grant with SAP Cloud Identity Services.
  3. The third-party agent must be able to retrieve an access token for the Agent Gateway via token exchange.

Single sign-on may be achieved by federating SAP Cloud Identity Services with the third-party identity provider.

Integration Pattern 2: Back Channel​

The back-channel variant avoids an additional browser-based flow: the third-party agent authenticates the user via OAuth/OIDC, obtains a token suitable for token exchange, and exchanges it for an Agent Gateway token server-to-server.

The diagram below shows the end-to-end back-channel flow across the same actors, where the token exchange toward SAP's Agent Gateway happens server-to-server rather than through the browser:

image of solution diagram
Copy to clipboard
Solution Diagram Resources
You can download the Solution Diagram as a .drawio file for offline use. Alternatively, you may view and edit the Solution Diagram directly on draw.io.
Please note that any changes made online will need to be saved locally if you wish to keep them.
DownloadEdit

As shown in the diagram:

  1. The user authenticates at the third-party agent using OAuth/OIDC against the non-SAP IdP / OAuth authorization server (an initial browser redirect / login may still occur to establish the session).
  2. The third-party agent performs a token exchange at the non-SAP IdP / OAuth authorization server to obtain an access token suitable for exchange with SAP Cloud Identity Services.
  3. The third-party agent performs a token exchange with SAP Cloud Identity Services server-to-server, which issues the SAP token (user principal, Agent Gateway as audience) used to call the SAP Agent through the Agent Gateway.

Steps:

  1. User authentication at the third-party agent using OAuth/OIDC.
  2. The third-party agent must be able to retrieve an access token suitable for a token exchange with SAP Cloud Identity Services.
  3. The third-party agent must be able to retrieve an access token for the Agent Gateway via token exchange.

Identity federation between identity providers and user mapping is required.

Example curl​

Token exchange at SAP Cloud Identity Services using the jwt-bearer grant, with the resource parameter identifying the Agent Gateway:

curl -XPOST -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer" \
  -d "assertion=<user-token>" \
  -d "client_id=<3rd-party-agent-app-client-id-from-SAP-Cloud-Identity-Services>" \
  -d "client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer" \
  -d "client_assertion=<jwt-for-client-authentication>" \
  -d "resource=urn:sap:identity:application:provider:name:agent-gateway" \
  -d "token_format=jwt" \
  https://<sap-cloud-identity-domain>/oauth2/token

Additional Considerations​

Most relevant standards​

Custom coding in third-party agents​

  • Token caching.
  • Handling of offline access / refresh tokens.
  • Handling of credentials.

Good to know​

  • Handling of credentials: prefer usage of environment-managed credentials and JWT-based client authentication at SAP Cloud Identity Services over client_id and client_secret.
  • Front channel versus back channel: selection heavily depends on third-party capabilities.
    • Front-channel integration does not introduce constraints on the third-party IdP / OAuth server, but SSO may introduce challenges (especially related to redirects via the browser and missing explicit user mapping).
    • Back-channel integration is typically more resilient (no additional browser-based flow), but requires third-party IdP / OAuth server support.
  • Standardization is ongoing (for example, IETF OAuth WG: ID-JAG — based on RFC 7523 / 8693).

Services and Components​