migrate-from-instance-secrets-to-binding-secrets-dcee867.md

Migrate from Instance Secrets to Binding Secrets

To simplify the management of secrets for service instances of the SAP Authorization and Trust Management service, we recommend that you configure service instances to use binding secrets.

Context

By default, service instances of the SAP Authorization and Trust Management service use the instance secret for all bindings of the service instance. In the application security descriptor (xs-security.json), enable binding secrets for service instances. All bindings have their own secret. You can enable both at once for the following plans:

• Application plan

The API access plan only uses binding secrets.

Procedure

1. Modify the application security descriptor (xs-security.json service use the instance) to support both instance secrets and binding secrets.

   Edit the OAuth client configuration of the xs-security.json as follows:

   Sample Code:

   "oauth2-configuration": {
       "credential-types": ["binding-secret","instance-secret"]
   }
   

2. Update the service instance with the new application security descriptor.

3. Unbind and rebind any consuming applications.

   With each new binding, the system creates a new binding secret.

4. Replace any service keys with new service keys.

   At this point, none of the applications consuming your service instance need the instance secret anymore.

5. Modify the application security descriptor (xs-security.json) to disable support for instance secrets.

   Edit the OAuth client configuration of the xs-security.json as follows:

   Sample Code:

   "oauth2-configuration": {
       "credential-types": ["binding-secret"]
   }
   

6. Update the service instance with the new application security descriptor.

Related Information

Update a Service Instance

Creating Service Keys

Service Instance Secrets