Hi, I am Denys van Kempen, SAP Partner Innovation Lab and the SAP HANA Academy.
In this video tutorial series we are going to cover security topics for SAP Analytics
Cloud and in this video we will show you how you can integrate Analytics Cloud with Microsoft
Azure AD. This video was recorded in November 2021;
for the latest video tutorials on the topic, please check the playlist.
The default identity provider of SAP Analytics Cloud is SAP Cloud Identity,
and, If this has not been customised,
you will see a log on page similar to this one,
and if we zoom in on the URL it probably shows the accounts.ondemand.com
domain followed by saml2, i d p, identity provider, and sso
Now there won’t be much opportunity for single sign-on here, as this Cloud Identity
tenant is dedicated to this Analytics Cloud tenant and typically not configured for any
other purposes. This is, however, something we can change,
under Settings, Administration, Security a custom identity provider (IdP’s) can be
configured, provided they support the SAML protocol,
which most, if not all, IdPs these days do. click the pencil to edit
and then we can select SAML single sign-on On the service provider, SP side, SAP Analytics
Cloud that is, there are four steps. First we need to download the SAML metadata
of Analytics Cloud. Here we can see what this looks like.
SAML = Security Assertion Markup Language, XML that is,
with a number of tags signed by X.509 certificates You need this information to configure the
identity provider, Azure AD in our case. In step 2 we do the reverse, upload the metadata
of the IdP. Then in step 3 we need to configure the mapping.
This can be email, user ID, or a custom SAML mapping
Which in step 4 we need to confirm that this is actually working.
Then there are some optional settings. We can enable the identity provider administration
tool. You might need this to update certificates
and fix IdP connectivity issues. We can add a user profile URL
As as reminder, we can access our Analytics Cloud profile here and then click the link
to change IdP settings. This of course, needs to be updated when we
change our identity provider. A password management URL, for self-service,
and logout configuration. OK
If we then switch to our IdP, our identity provider, Azure Active Directory,
we first need to create, what’s called, an enterprise application, which is haw Azure
AD manages access. There may 100s or 1000s of users in the corporate
directory but they may not all need to access Analytics
Cloud, maybe you only have a certain number of licenses,
so only the users, or preferably the groups, that have been granted access to the enterprise
application entity here in AD, will be able to connect to Analytics Cloud.
Enterprise applications, New application This returns the Azure AD app galery, showing
preconfigured templates, search, or if it is already listed, select
SAP, and then select the entry
SAP Analytics Cloud Give the app a name.
This is for you, as Azure AD administrator, so you know what sytem and application the
entry references, Click create.
Takes a few seconds, maybe a bit more, fast forward, and then we have our enterprise app.
Again, a couple steps to get started. Assign users and groups.
Set up single sign on. Provision user accounts.
Conditional access and self service. Conditional access and the self-service options
are one of the benefits of using an identity provider like Azure AD.
Wit conditional access, for example, you can allow only connections made from the corporate
network, from domain-joined devices, configure multi-factor authentication, and so on.
Let’s start with SSO SAML
Five steps, again, Same idea, upload metadata of the service
provider, download the metadata of Azure AD, the identity provider, and configure the mapping,
the attributes. Three parameters are required.
You can edit these settings manually, but we already downloaded the metadata from Analytics
Cloud, so let’s upload that here. This populates the entity ID and reply URL
but leaves the sign on URL open. What’s needed here is just the hostname
and domainname of your Analytics Cloud tenant. Just copy and paste, and save.
Then we also need to configure Attributes and Claims.
and as required claim, set the source attribute to user.mail.
Next, we need to download the metadata of this Azure AD enterprise app
and then, in Analytics Cloud,
upload the data. Confirm that email is used as mapping attribute,
and enable dynamic user creation for now. The suggested login account here is your current
system owner e-mail address, and this may, or may not work.
If we switch to AD, and perform step 1: adding users and groups
I am using a basic plan for Azure AD here, which restricts me to only select users, not
groups, and we have two users configured, I’ll add them both.
but for the mapping I am going to use an a different user, with a gmail.com email address.
th user principle name, by the way, is also listed here.
This is the entry for user mapping suggested by Azure AD, which you can use, but then you
need to make this a custom mapping. Back to Analytics Cloud.
Enter the login credential and click verify account.
Takes a few seconds then we are presented with the login URL,
which we need to copy, open a new incognito window,
and paste it in, we get the sign in page of the identity provider
enter password and we should be connected to Analytics Cloud
with the message the SAML account verification was successful.
Close the window. and select Check Verification
note the green bar around our login credential: the mapping is working.
We’ll skip the optional configuration for now and click save.
We need to confirm we want to convert to SAML SSO, may take a few minutes apparently, but
only took a few seconds here, and then we are done.
Under System, Administration, Security, we can see the new idp listed.
Should there be any errors, there is a test function in AD, we can test the sign in of
different users, and get some more information about the identifier
user, here email address, token claims, and the signing certificate
Note the email address used will be set as the system owner email.
and should you wish to revert the changes, you can of edit the settings here, on the
Security tab But should you no longer have access to Analtyics
Cloud, you can use the identity provider administration
tool, make sure to have bookmarked the URL
and here you can report incidents, or configure the tenant,
for example to update IdP metdata or, as mentioned, revert back to the default
IdP, SAP Cloud Identity Simple click does the job
and if we then retun to system, administration, security, we can see that we are back where
we started. OK
That’s it for Analytics Cloud SAML SSL configuration. Don’t forget to subscribe.
Denys van Kempen, SAP HANA Academy / Partner Innovation Lab
Thanks for watching.