The Identity Provider (IdP) is the component responsible for user authentication in SAP BTP. SAP BTP establishes a trust relationship with an IdP, delegating the process of verifying user credentials. By default, this is the SAP ID service, but customers can configure their own corporate IdP (e.g., Azure AD, Okta). When a user tries to access an application, they are redirected to the configured IdP to log in. After successful authentication, the IdP sends a security assertion back to SAP BTP, confirming the user's identity.

B. Role collection: This is used for authorization (what a user can do), which occurs after successful authentication (verifying who a user is).

C. Service binding: This provides credentials for an application to connect to a service instance, not for authenticating end-users.

D. Destination: This defines connection details for an application to call a remote system; it is for system-to-system communication, not user authentication.

1. SAP Help Portal, SAP Business Technology Platform Security. "Trust and Federation." Section: "Application Identity Provider". (Documents that applications in a subaccount are connected to an IdP via a trust configuration).

2. SAP Help Portal, SAP Business Technology Platform. "Working with Platform Users." Section: "User and Member Management". (Explains the role of IdPs like SAP ID service and custom IdPs for platform and business users).