SAP Customer Identity and Access Management (SAP CIAM), formerly Gigya and SAP Customer Data Cloud, is a multi-tenant SaaS customer identity platform on SAP Business Technology Platform. It covers registration and login (password, social, passwordless with FIDO passkeys, phone, email OTP, and magic links), two-factor and risk-based authentication, consent and preference management, and B2B contact and partner management. SAP CIAM can act as an OpenID Connect provider (authorization code, implicit, hybrid, client credentials, device, and token exchange flows) and relying party, and as a SAML identity provider and service provider. Sites are hosted in United States, European Union, Australian, or Chinese data centers, with global site groups for cross-region SSO. Pricing is subscription-based per block of 10,000 monthly active users, with optional enhanced security and consent add-ons.
Features
If you want to compare OpenID Connect features of different providers, please check out the OpenID Connect Providers benchmark.
Looking for SAP CIAM’s (C)IAM features like MFA, SSO, and user management? View SAP CIAM on the (C)IAM Identity Providers benchmark.
Frequently Asked Questions
Does SAP CIAM support the Authorization Code grant type?
SAP CIAM supports Authorization Code grant type. The OIDC provider supports the authorization code flow, along with implicit and hybrid flows using the code, token, and id_token response types. Read more
Does SAP CIAM support the Refresh Token grant type?
SAP CIAM supports Refresh Token grant type. Refresh tokens are issued (for example in the device flow) and can be used to obtain a new access token, ID token, and refresh token; they keep the permissions of the original token. Read more
Does SAP CIAM support the Client Credentials grant type?
SAP CIAM supports Client Credentials grant type. Requests go to the token endpoint with grant_type, client_id, and client_secret; only an access token is returned, without refresh or ID tokens. Read more
Does SAP CIAM support the Implicit grant type?
SAP CIAM supports Implicit grant type. The implicit flow is supported with the id_token and token response types. Read more
Does SAP CIAM support the Token Exchange grant type?
SAP CIAM supports Token Exchange grant type. RFC 8693 token exchange can reduce or extend the permission scopes of an existing token, and supports an actor_token to add an act claim for single-level delegation. Read more
Does SAP CIAM support the Device Authorization Grant grant type?
SAP CIAM supports Device Authorization Grant grant type. The OIDC device flow (RFC 8628) is supported for all relying parties, with configurable code expiry, polling interval, and verification URI. Read more
Does SAP CIAM support the Authorization Endpoint endpoint?
SAP CIAM supports Authorization Endpoint endpoint. The OIDC provider serves its endpoints under https://fidm.<data-center>/oidc/op/v1.0/<API key>/. Read more
Does SAP CIAM support the Token Endpoint endpoint?
SAP CIAM supports Token Endpoint endpoint. The token endpoint is available at https://fidm.<data-center>/oidc/op/v1.0/<API key>/token. Read more
Does SAP CIAM support the UserInfo Endpoint endpoint?
SAP CIAM supports UserInfo Endpoint endpoint. Access tokens can be used at the userinfo endpoint as specified in the OpenID Connect specification. Read more
Does SAP CIAM support the Device Authorization Endpoint endpoint?
SAP CIAM supports Device Authorization Endpoint endpoint. The device_authorization endpoint is listed in the OP metadata. Read more
Does SAP CIAM support the OpenID Connect Discovery Endpoint endpoint?
SAP CIAM supports OpenID Connect Discovery Endpoint endpoint. Metadata is published at the .well-known/openid-configuration URL of the provider, and can also be viewed from the console. Read more
Does SAP CIAM support the client_secret_basic token endpoint authentication method?
SAP CIAM supports client_secret_basic token endpoint authentication method. Confidential clients authenticate to the token endpoint with Basic authorization, as in the token exchange flow. Read more
Does SAP CIAM support the client_secret_post token endpoint authentication method?
SAP CIAM supports client_secret_post token endpoint authentication method. The client credentials example sends client_id and client_secret in the token request body. Read more
Does SAP CIAM support the RP-initiated Logout feature?
SAP CIAM supports RP-initiated Logout feature. The provider exposes an end_session_endpoint that accepts id_token_hint and a trusted post logout redirect URI, letting the user sign out of the RP only or of the OP and all connected RPs. Read more
Compare with other providers
Note: The current data is based on provider documentation/experience and may not be 100% accurate.