Keycloak It is the foundation of the identity and authentication service of SAP Business One. SAP Business One embeds Keycloak as an authentication server that issues access tokens for the service layer.
Role in SAP Business One
The Authentication Server is an embedded Keycloak. It runs on port 40020, uses the sapb1 realm, and uses the default paths from Keycloak for login, token, and logout. The service layer checks the issued tokens against this server for each request. Feature Package 2602 The Service Layer additionally checks the target audience (audience) of the token. For versions prior to Feature Package 2608, SAP lists an Audience Mapper in Keycloak as a workaround.
Connection to external identity providers
External identity providers connect SAP Business One via Identity Brokering from Keycloak. The user logs in with the external provider, for example with Microsoft Entra ID. The token for the service layer is then still provided by the embedded Keycloak server. If the administrator adds an external identity provider in the SLD Once activated, the system automatically generates the appropriate forwarding address.
Information for the operator
Keycloak offers features that SAP does not document for SAP Business One. An example is an endpoint for revoking tokens. Integrators should therefore only use such endpoints from the server's discovery.
Demarcation
Keycloak is not an external identity provider in SAP Business One. Keycloak forms the embedded authentication server to which the administrator connects external providers such as AD FS, Microsoft Entra ID, or SAP IAS.
MARIProject 8.0.000: New design, expanded production and optimised processes
New features in SAP Business One 10.0 FP 2508
Accruals and deferrals in SAP Business One
SAP Business One web client - additional feature or strategic step
Elster 2025 for SAP Business One
