Credential Management

This section explains how to register and manage credentials required for connecting ReleaseOwl with Integration suite, SAP Cloud Identity Services and SAP Passport.

Credential Management

Credential Management is classified into two primary domains:

1. CPI (Cloud Platform Integration)

The CPI domain manages credentials required for securing integration scenarios and internal SAP communications. It supports both system-level and user-level authentication mechanism.

a. Service Keys

Service Keys are used for system-to-system authentication and are primarily consumed by CPI runtime components. They enable secure, automated communication between ReleaseOwl and SAP Integration Suite without user interaction

Process Integration Runtime – API Access:

A Process Integration Runtime (PIR) instance is required in SAP BTP for ReleaseOwl to securely manage and deploy CPI artifacts across environments. It is used to authenticate and authorize API-based integration endpoints that are exposed or consumed by SAP Cloud Platform Integration (CPI). This setup involves creating PIR instances with two different service plans — api and IFLOW — followed by credential registration in ReleaseOwl for secure system integration.

1. Create a PIR Instance with Plan: API

Purpose: This instance enables programmatic access via APIs for integration, automation, and artifact management tasks.

Steps:

1. Log in to your SAP BTP Cockpit.

2. Navigate to your Global Account > Subaccount.

3. Go to Instances and Subscriptions from the left menu.

1. Click on Create.

2. In the "New Instance or Subscription" wizard:

• Service: SAP Process Integration Runtime

• Plan: api

• Runtime Environment: Cloud Foundry

• Space: Select your development space (e.g., dev)

• Instance Name: Choose a name like CPI_API_Instance

1. Click Next, then Create.

Note: The api plan provides programmatic access to the SAP Process Integration Runtime, allowing you to connect via APIs for integration tasks.

Assign Required Roles

In the Parameters step, assign the following roles to allow artifact management:

Role	Description
MessagePayloadsRead	Read message payloads in the integration runtime.
MonitoringDataRead	View monitoring data for integration flows.
TraceConfigurationEdit	Edit tracing configurations.
TraceConfigurationRead	View current tracing configuration.
WorkspaceArtifactsDeploy	Deploy artifacts from workspace to runtime.
WorkspacePackagesConfigure	Configure packages, parameters, and dependencies.
WorkspacePackagesRead	Read-only access to integration packages.
WorkspacePackagesEdit	Modify and configure integration packages.

Create Service Key (for api plan)

After instance creation:

1. Go to Instances and Subscriptions.

2. Expand your newly created api instance.

3. Click Create Service Key.

4. Enter a name (e.g., cpi-api-key) and leave parameters blank.

5. Click Create.

1. Click View Credentials to retrieve:

• Client ID

• Client Secret

• Token URL

Register SAP CPI (API Access) Credential in ReleaseOwl

Credential registration enables secure communication between ReleaseOwl and SAP CPI environments.

✅ Steps:

1. Log in to the ReleaseOwl Platform.

2. Go to Administration > Credential Manager.

1. Click Register Credential.

2. Fill in the details:

   • Credential Name: Any identifiable name for the credential.

   • Authentication Type: Select OAuth2

   • Client ID: Provide the details from the above created API service key.

   • Client Secret: Provide the details from the above created API service key.

   • Token URL: Provide the details from the above created API service key.

3. Click Save.

The credential will now appear in your list and can be used in pipelines and deployments.

2. Create a PIR Instance with Plan: IFLOW

This is used for managing and testing integration artifacts (iFlows).

✅ Steps:

1. Go to your SAP BTP Cockpit.

2. Select your subaccount that hosts SAP CPI.

3. Go to Services > Service Marketplace.

4. Select SAP Process Integration Runtime → Click Create.

5. Fill in the following:

   • Service: SAP Process Integration Runtime

   • Plan: IFLOW

   • Runtime Environment: Cloud Foundry

   • Space: Provide the appropriate space (e.g., dev)

   • Instance Name: (e.g., CPI_IFLOW_Instance)

1. Click Next and then Create.

Create Service Key (for IFLOW plan)

The IFlow plan service key is required to execute test cases from ReleaseOwl

1. Navigate to Instances and Subscriptions.

2. Locate the IFLOW instance.

3. Click Actions > Create Service Key.

4. Enter a name for the key (e.g., cpi-iflow-key) → Click Create.

1. Click on the service key name to view the key details.

2. You will need these values when setting up ReleaseOwl credentials.

Register SAP CPI Credential (Iflow) in ReleaseOwl

This step allows ReleaseOwl to securely interact with CPI for artifact deployment and management via the IFLOW plan.

Steps:

1. Navigate to Credential Manager from the Administration menu in the ReleaseOwl Platform.

2. Click Register Credential.

3. Set the Credential Type to SAP Cloud Environment.

4. Fill in the following details:

   • Credential Name: Enter a meaningful name (e.g., CPI IFLOW Credential)

   • Authentication Type: Select OAuth2

   • Client ID: Provide the details from the above created IFLOW service key.

   • Client Secret: Provide the details from the above created IFLOW service key.

   • Token URL: Provide the details from the above created IFLOW service key.

5. Click Save.

6. The new credential will now appear in the List of Credentials and can be used in Release Pipelines for IFLOW deployments.

b. Web Authentication

Web Authentication is used for interactive and user-based access to SAP services and applications.

SAP Cloud Identity Services – Identity Authentication (IAS) Instance : Acts as the Identity Provider (IdP) for SAP Integration Suite and is used to authenticate users accessing the platform. It provides browser-based authentication and Single Sign-On (SSO) using the OpenID Connect (OIDC) protocol.

SAP Cloud Identity Service: Create IAS Instance

1. Navigate to Instances & Subscriptions in your SAP BTP subaccount.

2. Click on the Create button.

3. In the Service field, select Cloud Identity Services.

4. In the Plan field, choose Default under Subscriptions, then click Next.

5. Click Create to provision the instance.

Activate Administrator Account

1. An activation email will be sent to the registered email address.

2. Open the email and click Activate Account.

3. Set your password and click on Continue.

Register SAP Cloud Identity Service Credential in Releaseowl

1. Log in to ReleaseOwl.

2. Go to Administration → Credential Manager.

3. Click on Register Credential.

1. Enter the following information:

   • Credential Type: SAP Cloud Identity

   • User Name: Cloud Identity Service Username

   • Password: Cloud Identity Service Password

2. Click Save to complete the credential registration.

2. SAP Passport: It enables secure authentication and establishes trusted communication between SAP internal systems and SAP Integration Suite. It ensures system-to-system trust and protects data exchanged across integrated SAP landscapes.

Steps to Create SAP Passport

1. Go to SAP for Me.

2. Navigate to the SAP Passport page (reference link: SAP Passport).

3. Enter your S-User password when prompted.

4. Click on the Apply for SAP Passport.

1. Give your SAP Passport Password in that box, then click on Apply button your SAP Passport will created.

1. After successful creation, click Download the SAP Passport.

2. The passport will be downloaded in .pfx format to your system.

Register SAP Passport Credential in ReleaseOwl

1. Go to Credential Manager in ReleaseOwl.

2. Click Register Credential.

1. Fill in the following details:

• Credential Type: SAP Passport

• Password: Enter the SAP Passport Password you provided during the apply process

• Certificate: Upload your downloaded SAP Passport (.pfx)

Note: You must keep using the PFX if the server requires client certificate authentication.

1. Save the credential.

2. API Portal & Management

The API Portal & Management layer is responsible for managing credentials associated with external API consumers. It governs API exposure, access control, and security policies for third-party system integrations.

• External API Credentials Used to authenticate external systems consuming APIs, typically via OAuth client credentials, API keys, or access tokens.

Create new instance : API Management, API Portal

1. Go to the SAP BTP Cockpit and log in with your credentials.

2. In the SAP BTP Cockpit, navigate to Instances and Subscriptions.

3. Click on the Create button.

4. Fill in the necessary details as follows:

   • Service: API Management, API Portal

   • Plan: apiportal-apiaccess

   • Runtime Environment: Cloud Foundry

   • Space: Dev

   • Instance Name: Enter a name of your choice

   • Click "Next".

   

• In the JSON format, enter:

{ "role": "APIPortal.Administrator" }

• Click "Next".

• Click "Create".

Create APIPortal-APIAccess Plan Service key

1. After the instance is created, click the three-dot menu (⋮) next to it.

2. Select "Create Service Key".

1. Enter a name for the key (e.g., api-access-key) and click Create.

2. Once created, click on the key to view credentials like clientid, clientsecret, and url — used for API authentication.

Step-by-Step Guide: Registering Credentials in ReleaseOwl

1. From the Administration menu, go to Credential Manager.

2. Click Register Credential.

1. Credential Name: Enter any identifiable name for the credential.

• Credential Type: Select API Management.

• Scope – Select the scope of the credential:

  • Global – Visible to all users.

  • Private – Visible only to the user who created it.

1. Authentication Type: To register your credentials, you can choose one of the following methods:

Option A: Upload Credentials File :

This is the recommended and easiest method.

1. Click Browse.

2. Select and upload the credentials file downloaded from the SAP BTP Cockpit (API Management Service).

3. Once uploaded, the system will automatically extract and populate the required fields.

Option B: Manual Entry

Use this option if you prefer to enter the credentials manually.

1. Select Manual Entry as the authentication type.

2. Provide the required details from the API service key created in SAP BTP Cockpit.