3831066 - Injecting attributes into the authentication flow when using a proxy identity provider with OIDC federation

• When SAP Cloud Identity Services (IAS) is configured as a proxy to a corporate Identity Provider (IdP) using OIDC federation, administrators are unable to forward or map certain claims required by SAP applications downstream. Attempting to configure these claims results in the error: "This claim type is restricted"
• Rather than trying to have the corporate IdP send the claim (which is blocked at the IdP level), the correct approach is to have IAS inject the required claim itself during the authentication flow.
• A common trigger for this issue is configuring the Groups claim with the value sac, which is required for SSO to work with SAP Analytics Cloud and SAP Datasphere.

• This issue is specific to scenarios where IAS acts as a proxy to a corporate Identity Provider (IdP) such as Microsoft Entra ID, and the federation between IAS and the corporate IdP uses the OIDC protocol.
• When using OIDC federation, certain corporate IdPs — including Microsoft Entra ID — do not allow Groups to be configured as a claim name. Attempting to do so in the Entra ID enterprise application results in the error "This claim type is restricted". This is an enforcement by the corporate IdP itself and cannot be worked around by reconfiguring IAS or the downstream application.
• When the corporate IdP federation was SAML-based, this was not an issue because SAML attribute handling in Entra ID does not impose the same restrictions on attribute names.
• This is not configurable on the SAC/DS side, the exact claim name and value are hardcoded requirements.

Rather than forwarding the claim from the corporate IdP (which is blocked), the correct approach is to have IAS inject the required claim itself during the authentication flow. IAS provides a dedicated feature for this called "Enrich Token Claims Coming from Corporate IdP".

This is the recommended pattern whenever:

• A claim is required by the downstream SAP application
• The corporate IdP cannot or should not send it (e.g., due to protocol restrictions, security policies, or naming mismatches)
• IAS is acting as a proxy in the flow

Step-by-Step Configuration

1. In the IAS Administration Console, navigate to Identity Providers → Corporate Identity Providers
2. Select your OIDC corporate IdP (e.g., Microsoft Entra ID)
3. Choose "Enrich Token Claims"
4. Add a new claim entry
5. Save the configuration

IAS will now inject this claim into every token issued during authentications that go through this corporate IdP, regardless of what the corporate IdP sends. Reference:

Enrich Assertion Attributes Coming from Corporate IdP

The behavior depends on Identity Federation mode. Therefore, for this solution to work, you must verify if the "Use Identity Authentication User Store" is enabled or disabled under Identity Federation for the corporate IdP trust:

If you configure enriched claims but do not account for the Identity Federation mode, the claim will be silently ignored — which can appear identical to a misconfiguration in the upstream IdP. Always verify which mode is active before troubleshooting.

• Enrich Token Claims Coming from Corporate IdP | SAP Help Portal
• Enrich Assertion Attributes Coming from Corporate IdP | SAP Help Portal
• Configuring Attributes Based on Flexible Expressions | SAP Help Portal
• KBA 2569847 - Where can you find SAC user assistance (help) to use, configure, and operate it more effectively?
• KBA 2487011 - What information do I need to provide when opening a case for SAP Analytics Cloud?
• KBA 2511489 - Troubleshooting performance issues in SAP Analytics Cloud
• SAP Analytics Cloud Connection Guide
• SAP Analytics Cloud Get More Help and SAP Support
• Need More Help? Contact Support 

Your feedback is important to help us improve our knowledge base.

IAS, OIDC, proxy IdP, corporate IdP, Entra ID, Azure AD, Microsoft Entra, groups claim, restricted claim, claim type restricted, SAC, SAP Analytics Cloud, SAP Datasphere, DWC, token enrichment, attribute injection, claim injection, identity federation, XSUAA, BTP, SSO, single sign-on. , KBA , LOD-ANA-AUT , SAC Authentication / Login , LOD-ANA-ADM , SAC Administration , Problem