3831066 - Injecting attributes into the authentication flow when using a proxy identity provider with OIDC federation

• When SAP Cloud Identity Services (IAS) is configured as a proxy to a corporate Identity Provider (IdP) using OIDC federation, administrators are unable to forward or map certain claims required by SAP applications downstream. Attempting to configure these claims results in the error: "This claim type is restricted"
• Rather than trying to have the corporate IdP send the claim (which is blocked at the IdP level), the correct approach is to have IAS inject the required claim itself during the authentication flow.
• A common trigger for this issue is configuring the Groups claim with the value sac, which is required for SSO to work with SAP Analytics Cloud and SAP Datasphere.

IAS, OIDC, proxy IdP, corporate IdP, Entra ID, Azure AD, Microsoft Entra, groups claim, restricted claim, claim type restricted, SAC, SAP Analytics Cloud, SAP Datasphere, DWC, token enrichment, attribute injection, claim injection, identity federation, XSUAA, BTP, SSO, single sign-on. , KBA , LOD-ANA-AUT , SAC Authentication / Login , LOD-ANA-ADM , SAC Administration , Problem