Hi, I am Denys van Kempen, SAP Partner Innovation Lab and the SAP HANA Academy.
In this video tutorial series we are going to cover security topics for SAP Analytics
Cloud and in this video we will show you how you can integrate Analytics Cloud with SAP
Cloud Identity. This video was recorded in November 2021;
for the latest video tutorials on the topic, please check the playlist.
The default identity provider of SAP Analytics Cloud is SAP Cloud Identity,
and, If this has not been customised, you will see a log on page similar to this one,
and if we zoom in on the URL it probably shows the accounts.ondemand.com
domain followed by saml2, i d p, identity provider, and sso
Now there won’t be much opportunity here for single sign-on, SSO,
as this Cloud Identity tenant is dedicated to our Analytics Cloud tenant and cannot be
used for any other purpose. This is configurable.
If we navigate, as system owner,
Settings, Administration, Security click the pencil to edit
select SAML Single Sign-On Four steps
First we need to download the metadata of Analytics Cloud.
The service provider in SAML terminology. Here we can see what this looks like.
SAML = Security Assertion Markup Language, XML that is,
with a number of tags signed by X.509 certificates In step 2, we are going to do the reverse,
upload the metadata of the identity provider, the I D P.,
SAP Cloud Identity Then in step 3 we need to configure the mapping.
This can be email, user ID,
or a custom SAML mapping And in step 4 we need to confirm that this
is actually working. Then there are some optional settings.
We can enable the identity provider administration tool.
You might need this to update certificates and fix IdP connectivity issues.
We can add a user profile URL As as reminder, we can access our Analytics
Cloud profile here and then click the Edit Profile & Change Password
link to change these settings. This of course, needs to be updated when we
change our identity provider. A password management URL, for self-service,
and logout configuration. OK
Let’s switch to the identity provider, the IdP, SAP Cloud Identity, Identity Authentication
Service. Same SAP Cloud Identity service as the default type but this time fully configurable,
with all the features and functions you would expect from an identity provider
where we can bring together identity authentication and user provisioning of all our business
applications, SAP S/4HANA, SuccessFactors, Concur, Ariba,
plus any extension of integration business app hosted on the SAP Business Technology
Platform all enabled for single sign-on
Under users and authorizations, we can perform user management,
create groups, import users, export user, using CSV files,
and configure target systems for user provision Of course, if you want to continue to use
your current enterprise identity provider, Microsoft Azure AD for example,
that’s perfectly fine. Here in the identity provider section, you
can add your corporate IdP, add social identity provider like Google,
LinkedIn, or Apple, and use SAP Cloud Identity as federation proxy.
The advantage of using SAP Cloud Identity is that the service includes application templates
for SAP solutions, making it very easy to integrate SAP’s cloud-based
and on-premises solutions. OK
Select Analytics Cloud and give the entry a name,
The application home URL is optional at this stage;
but you would need to have this configured when you start to send out invitation messages
to new users but this we can do later on.
Save The protocol defaults to SAML 2.0,
make sure this is selected. To configure the trust, select SAML 2.0 Configuration
and upload the metadata file. This will configure the assertion consumer
service endpoint, the single logout endpoint,
signing certificate, and the other required settings
save Subject name identifier, defaults to user
ID. We need to map this to the user attribute,
in step 3 As e-mail is more commonly used, I will select
this here. Save
Default Name ID format defaults to unspecified. We can leave this as-is. No need to set this
to e-mail. This is not being used in this configuration.
If needed, you can apply a function to convert the subject name identifier to lower or uppercase.
SAML Is case sensitive. So, if your email addresses are not consistently
formatted, you can fix this with a function. Assertion attributes, most of these are optional,
I will remove thm for now required are email, when using e-mail as subject
name identifier, as we just did the assertion attribute is email, not e - mail,
or mail also required is Groups.
Assettion attribute = sac, s a c, lowercase Save
That’s all; to recap, create an entry,
upload the metadata file, specify the subject name identifier to e-mail
and set these two attributes. Lots of other options,
conditional authentication, setting a default identity provider, in case
you have more than one, enable social sign-on,
password policy, branding,
we could add a logo for example, a branding style,
using cascading style sheets CSS. We could spend a whole day here,
but we are not going to do this, keeping things simple for now.
Go to tenant settings, scroll down a bit
and select SAML 2.0 configuration and select download metadata file
then we can return to Analytics Cloud. Step 2, upload the metadata file
Step 3, make sure the user attribute is set to email
enter the login credential you wish to use to validate the settings.
Note that I am using here the same mail address as before as it exists in both the user store
of the default tenant, as system owner,
but also as the administrator, and only account at this stage, of my enterprise SAP Cloud
Identity tenant. These are two entirely different systems,
just happened to be using the same mail address. Verify account
This takes a few seconds, a little more copy the URL
new incognito window paste back in
Cloud identity returns the log on window for our tenant application
enter your SAP Cloud Identity credentials To be clear,
your account in Cloud Identity not the one used for Analtycs Cloud
and then we should get this message Your SAML account verification was successful.
please close this browser windows and continue the setup process.
ok Check Verification
Note the green border confirming all is well. We could add some of the optional settings
but for now let’s keep it simple and save.
We get a little notifcation message Convert
Again, a few seconds and we are prompted to log on again
this time using SAP CLoud Identity and SAML SSO
and if we then return to system administration security,
we can see that SAML SSO is now configured if we scroll down a bit
we can launch the identity provider administration tool,
you may want to bookmark this select the entry
and here we update IdP metadata, for example, a new certificate
or revert to the default IdP in case we have trouble connecting
One final look at the system owner We used the same email account, so everything
looks the same here, no changes OK
That’s it for Analytics Cloud SAML SSO configuration with SAP Cloud Identity acting as identity
provider Don’t forget to subscribe.
Denys van Kempen, SAP HANA Academy / Partner Innovation Lab
Thanks for watching.