Before you can start the setup in SAP Integration Suite - Cloud Integration you have to gather some information on your companies SAP Cloud Integration tenant.

Depending you your findings the setup will have to be performed in different ways.

Find your Operations Platform

Identify whether your SAP Integration Suite – Cloud Integration tenant runs on Neo or on SAP Cloud Foundry. To do so please check the URL of your tenant:

• URL of a Neo tenant looks like: https://<tenant Id>-tmn.hci.<landscape>.hana.ondemand.com/
• URL of a Cloud Foundry tenant looks like: https://<tenant Id>.<system id, e.g. it-cpi001>.cfapps.<landscape>.hana.ondemand.com/

Find your ID Provider

Check if your tenant uses the SAP ID service or a custom Identity Provider (IdP). 

• Go to the SAP BTP Cockpit → Access the subaccount used for SAP Cloud Integration → Security → Trust Configuration 
• Check if a custom IdP is used. If there is only the "Default Identity Provider" you are using the SAP ID Service.

Choose your Authentication Method

You can choose between BASIC authentication and OAuth authentication to connect SAP Integration Suite - Cloud Integration to SAP Cloud ALM. 

• OAuth Authentication doesn't require a user, but the initial setup is a bit more complicated
  • If you want to use OAuth authentication, please follow the documentation below under "Prepare and obtain OAuth Credentials"
• BASIC Authentication requires a dedicated user in SAP Integration Suite - Cloud Integration. The password for this user needs to be changed regularly. However the initial setup is less complex
  
  • If you want to use BASIC authentication, please follow the documentation below under "Create Communication User (BASIC Authentication)"

SAP Integration Suite - Cloud Integration on SAP Cloud Foundry

To enable OAuth authentication between SAP Cloud ALM and SAP Integration Suite - Cloud Integration you need to create an instance with a service key for the Process Integration service with the necessary authorizations. 

To be able to create the instance in the space for your SAP Integration Suite Cloud Integration you need "Space Developer" access to this space.

Create Service Instance

1. Go to your SAP BTP Cockpit → Access the subaccount used for SAP Cloud Integration
2. Go to "Instances and Subscriptions"
3. Click the 'Create' button to create a new instance
4. Basic Info
   1. Service: Process Integration (it-rt)
   2. Plan: api
   3. Runtime Environment: Choose Cloud Foundry or Neo
   4. Space: Select the appropriate space (depending on your company)
   5. Instance Name: Enter an instance name
   6. Click 'Next'
5. Parameters
   1. Select the role "MonitoringDataRead" in the 'Roles' drop-down on the Form tab
   2. Click "Create Instance"

Create Service Key

After the instance is created you can create the service key.

1. Select the row of the instance
2. Go to tab "Service Keys"
3. Click 'Create'
4. Enter a name for the service key
5. Click 'Create'

SAP Integration Suite - Cloud Integration in the Neo environment

If you want to use OAuth authentication to connect to SAP Integration Suite - Cloud Integration in the Neo environment, you need to create a client with the correct authorizations:

1. Go to the SAP Business Technology Platform Cockpit
2. Navigate to Applications → Subscriptions
   • Note down the "Provider Subaccount" for the application ending in tmn 
3. Navigate to Security → OAuth
4. Go to tab 'Clients'
   1. Click 'Register New Client'
   2. Choose a name
   3. Set the subscription to the CPI tenant (ends with tmn)
   4. Generate an ID (it is recommended to use the suggested unique ID)
   5. Select Authorization Grant as 'Client Credentials'
   6. Choose a Secret
   7. Click on Save
5. Note down the Client ID and the Client secret for later use in SAP Cloud ALM
6. Go to tab 'Branding' 
   1. Note down the 'Token Endpoint' URL to be used as Token Endpoint URL
7. Navigate to Security → Authorizations
8. As a user enter 'oauth_client_<client_ID>' (the Client ID generated in the previous step)
9. Grant the user the roles: You will find the roles under the correct provider subaccount for the application ending in tmn
   • IntegrationOperationServer.read
   • NodeManager.read
10. Save you changes.

If you plan to use BASIC authentication to connect to SAP Cloud ALM to SAP Integration Suite – Cloud Integration you need to create a communication user in SAP CI.

The user can be a company S-user. Please contact your companies S-User super-admin to request a new S-user for this purpose.

• The user will be maintained in the HTTP endpoint and must be must have a role which contains the following privilege:
  • In the Neo environment:
    • IntegrationOperationServer.read
      
    • NodeManager.read
  • In the Cloud Foundry environment:
    • MonitoringDataRead
• For more information about default role assignments, please refer to SAP Integration Suite – Cloud Integration documentation: https://help.sap.com/viewer/product/CLOUD_INTEGRATION/Cloud/en-US?task=operate_task → Security → Select the link for your platform → Identity and Access Management → Persona → Tasks and Permissions 
• Please note that users in SAP Integration Suite – Cloud Integration running on Cloud Foundry are identified by their email address. This also applies to S-Users. This means:
  • To adjust the authorizations of a user, please search for it by its email address. 
  • When setting up the end-point for a SAP Integration Suite – Cloud Integration tenant running on Cloud Foundry please provide the email address when using basic authentication.