Skip to main content

Identity and Access Service (IAS)

The IAS module provides utilities for working with SAP Identity Authentication Service (IAS) tokens.

Parsing a Token​

Use parse_token to decode an IAS JWT into a typed IASClaims dataclass. It accepts either a raw token string or an Authorization: Bearer <token> header value.

from sap_cloud_sdk.ias import parse_token

claims = parse_token(
    request.headers["Authorization"]
)  # accepts "Bearer <token>" or raw token

print(claims.app_tid)   # tenant ID (multitenant scenarios)
print(claims.scim_id)   # SCIM-based user ID in SAP Cloud Identity Services
print(claims.sub)       # OIDC subject identifier
print(claims.email)     # user email (when email scope was requested)
note

parse_token does not verify the token signature. Validate the token against the IAS JWKS endpoint in your framework or middleware before using the extracted claims for authorization decisions.

Combining with Telemetry​

from sap_cloud_sdk.ias import parse_token
from sap_cloud_sdk.core.telemetry import set_tenant_id, add_span_attribute

claims = parse_token(token)
set_tenant_id(claims.app_tid or "")
add_span_attribute("enduser.id", claims.scim_id or claims.sub or "")

For the complete claims reference and more examples, see the IAS user guide in the cloud-sdk-python repository.