Hi, I am Denys van Kempen, SAP Digital Partner Engineering and the SAP HANA Academy
In this video tutorial, we are going to show you how to configure the Cloud Foundry environement
of the SAP Business Technology Platform to use Microsoft Azure Active Directory, Azure
AD, as identity provider.
This video was recorded in January 2021; for the latest video tutorials on the platform
security topic, please check the playlist.
ok We are connected here to trial environment
of Azure, open the Azure AD service
go to enterprise applications select New application
from the gallery, select SAP and this will list all preconfigured service
providers Out of reach from SAP branding, apparently,
as we can appreciate the original logo’s of the cloud businss solutions Ariba, Concur,
and SuccessFactors together with SAP home brew solutions like
SAP Analytics Cloud, SAP HANA, SAP NetWeaver, Fiori, and,
our focus for today, the SAP Cloud Platform, rebranded recently
as the Business Technology Platform.
These are all service providers.
Could be software-as-a-service, platform-as-a-service, a database, or app server, but instead of
using a dedicated user store for each service we are going to configure the service provider
to use a common, shared identity provider, Azure AD, to support federated single-sign
on.
Select the service provider, maybe make some changes to the name, and click create.
This takes a couple of seconds and then enterprise application,
as it is called in Azure AD, the mapping to a service provider,
will be displayed.
To get started, you would normally add users and groups: whos is allowed to access this
service provider; we will do this in a minute,
followed by the SSO configuration, plus some additonal steps like user account
provisioning, conditional access configuration, self-service
options to change passwords, add multi-factor authentication, and so on.
Topics an AD administrator will be very familiar with, and if not, are properly documented
here on the Azure portal.
Our focus will be on makting the connection between Azure AD as identity provider with
SAP Cloud Platform as service provider.
Select 2.
Set up single sign-on Select SAML
and this will open a configuration screen in five steps.
SAML, security assertion markup language is an XML-based protocol to exchange security
assertions, as they are called,
and this allows two system to exchange security-related information,
authentication and authorization in principe, although in our case,
we will be using Azure AD for authentication only.
For authorization, we will continue to use the roles and role collections from the Cloud
platofrm.
Three parameters are required in the Basic Configuration section but instead of entering
these values manually, what we can do is download the SAML metadata
from the service provider, making things a little bit easier.
Switching to the Business Technology Platform, still showing the old name, soon to be rebranded,
SAP Cloud Platform trial, enter the subaccount, corresponding to the
Cloud Foundry environment, and navigate to the Security section,
Trust Configuration Click the SAML Metadata button,
which will download the file as XML, to the local computer.
Back to the Azure portal Upload metadata file
and this will populate the identifier, reply URL, and logout Url fields.
For some reason the sign on URL is skipped, but we can simply copy/paste the identifer
and append the name of the cloud platform tenant
Save and close
that’s step one Step 2, User Attributes & Claims is already
prepoluated for us but unfortunately not the right way,
so we need to delete the additional claims and change the required claim from userprincipalname
to user.mail - save Then we can add the additional claims
first_name user.given name
last_name user.surname
login_name user.mail
Then we need to add a group claim All groups
Advanced properties Name = Groups
with uppercase G Save
Now, in the left pane, groups is suddenly lowercase
but, when we select it It is a uppercase
and when we return to the single sign-on page it is with uppercase G as well.
So, it fine.
SAML trusts are mutual trust, so now we need to download the metadata from the identity
provider Return to the Cloud Platform cockpit
select New trust configuration and upload the metadata
Give the entry a name; that’s just for the cockpit UI
and a link text for the logon page, we will see how this looks like in a minute
Note that available for user login is selected, and also the option to create shadow users
during login that’s the default
In theory, you could decide to leave this unchecked and manually provision the users
for more control.
Show details shows certificate information and the usual SAML URLs
with Parse, we can check the syntax.
All is well, Ok. so now we have two identity providers,
SAP ID Service, the default provider for the platform,
and Azure AD, the one we just added, and, for now, both are available for user logon
Ok, back to Azure AD The final step: test to see if it is working
Sign in as current user or as someone else, Let’s see how that works
THis should look familiar, we are now connected to subdomain . authentication.
region . hana ondemand .com Here we can select how to sign in, authentication
Login with Azure AD, that’s the text we just entered
or sap.default, without a friendly text field So the login page is working
when we select Azure AD, we are redirected to to Microsoft Sign In,
so that part is working as well username
possword This needs to be an existing Azure AD account,
and this page is customizable, you can add your own logo, theme, etc.
for that corporate look-and-feel and this brings us back to Azure
AD is not entirely satisfied the user has not been granted access to the
application which is correct, that was step 1, the one
we skipped, you may recall, when we created the enterprise application
for this service provider: add users and groups let’s fix it
and try it again, using our gmail account
returns the cloud platform login page username
password and now all is well,
well, we did not assign any group to this user, so one claim was not issued
Groups but that’s ok for now
In the previous videos of this series we deployed an app to explain how security is implemented
in the Cloud Foundry environment with user account and authentication, UAA,
XSUAA, the extension for business applications, so, let’s try that out
Private window, to get the log in dialog sap.default still works, of course,
picks us a client certificate the user link returns some information about
the connected user for users with user scope
and for users with the admin scope we can query the database for session information,
serves no particular purpose, just to show that it works
ok let’s try this again
now select Azure AD as identity provider and we are properly redirected to Microsoft
for sign in and we get Forbidden
which is correct as we did not assign any scope yet
so, authentication works and now we need to address the authorization
this is the same as before, again, we covered this in detail in the previous
videos of this series under Roles we find the business roles Admin
and User for our business application myapp s-e-c
under Role Collections, we can see that the roles were granted to a user in the SAP ID
service user store There is one for Admin
and one for User and when click Edit
and add select the gmail account from the list of shadow users
and Save, we have authorized this AD user for the application
so, when we rinse and repeat we are now properly granted access to the
application, as we have the user scope
but not the admin scope Now of course, in the real world, you probably
would not be working with individual users but with user groups,
and would map the groups in Azure AD, the identity provider, with the groups defined
here in the service provider one more thing,
let’s disable the default IdP for log on return to our app
and now, we no longer get the selection page but are
passed diretly to the identity provider Nice
Ok That’s it
See the description below of this video on our YouTube channel for more information
Don’t forget to subscribe Denys van Kempen, SAP HANA Academy / Digital
partner engineering Thanks for watching