Hi, I am Denys van Kempen, SAP Digital Partner Engineering and the SAP HANA Academy.
In this video tutorial, we are going to show you how to configure the Cloud Foundry environment
of the SAP Business Technology Platform to use Microsoft Azure Active Directory (Azure
AD) as identity provider with an SAP Identity Authentication Service tenant in the middle
as federation proxy.
This video was recorded in January 2021; for the latest video tutorials on the platform
security topic, please check the playlist.
For other topics, please visit the SAP HANA Academy channel on YouTube https://www.youtube.com/user/saphanaacademy.
Thankns for watching.
In a previous video tutorial of this series, we showed how we can configure Azure AD as
Identity provider for SAP Cloud Platform, or, to use the most recent name, the Business
Technology Platform, as an alternative to the default SAP ID service that comes with
the platform.
Now, this would work fine in case SAP Cloud Platform is the only touchpoint, the only
service provider, you would be working with.
However, chances are you want to integrate with other service providers as well;
SAP HANA, SuccessFactors, Concur, and so on.
For this scenario, SAP recommends to use SAP Cloud Identity Services - Identity Authentication
as service provider, to act as a hub of some sort.
This also serves scenarios where your business users are stored in multiple corporate identity
providers, not just Azure AD, but also third-party identity providers,
or in case you want to connect with an on-premises user store using the Cloud Connector.
SAP Cloud Identity Services supports certificate-based authentication, social sign-on, 2-factor authentication,
and so on.
Now, we are not going to cover in detail the ins and outs of SAP Cloud Identity Services.
If you want to know more, I suggest you visit the SAP Discover Center,
this will inform you about features and functions, tutorials, references to the documentation,
the SAP Community, etc. see the description of this video below for
how to get there.
So, how do we set this up?
Connect to your Azure AD Directory Create a new enterprise application; this
corresponds to a service provider, select SAP
select SAP Cloud Platform Identity Authentication Give it a name,
or accept the default suggestion provided click create
takes a few seconds and then on the overview page
Select 2. set up single sign on SAML
We will get the basic SAML configuration parameters from a metadata file,
but let’s proceed with number two, User Attributes & Claims.
Here we need to make some modifications, First we are going to change the claim name
to match the user e-mail, and then we are going to rename user givenname,
user surname, and user mail.
Next, click add a group claim All groups
and then under advanced options enter the value Groups with an uppercase G.
Then under 3.
SAML Signing Certificate Download the federation metadata XML file.
The name of the file is the same as the name you gave to this enterprise application, with
an XML extension Then we switch to the service provider, or
rather, in this case, the identity provider proxy
under the Identity Providers menu, corporate identity providers
select add enter a name
My Azure AD (or whatever you want to call this entry)
select SAML 2 configuration Define from metadata
browse and upload the SAML metadata XML file we just
downloaded from Azure AD Save
We need to make a single adjustments under identity provider type,
select Azure AD Save
Then, under Applications & Resources, Tenant settings
SAML 2.0 configuration click the Download metadata file button on
the toolbar This file is called metadata.xml.
Back to Azure AD.
We are still at the enterprise application we just created for identity authentication
Note that two required parameters are still missing.
Select upload metadata file browse to the file,
the file is called metadata, if you did not rename the file
click Add click Save
We can skip the test, we are not done yet, but note that the basic parameter have been
set Now we switch to the SAP Cloud Platform / Business
Technology Platform We are using the trial environement,
no special setup required, Security
Trust configuration New Trust Configuration
Upload the metadata file from SAP Identity Authentication service tenant
this time, we need to add a name this is just a reference, a label, in the
cockpit and a link text,
Save
We no longer need SAP ID service as identity provider for our business users, so let’s
disable Save
Now we also need to download the SAML metadata from this service provider.
return to Identity Authentication Applications & Resources
Applications Add
any name will do Save
SAML 2.0 configuration Upload the metadata file
The format is saml-subaccount-sp, service provider
Save
Default Name ID format this is set to unspecified
change this to E-Mail Save
Select Assertion attributes Click add
scroll down and select Groups
make sure it is Groups with an Uppercase G as assertion attribute
Save
Conditional Authentication Default Identity Provider
change this to the name of the identity provider we created earlier.
As indicated by the text, there are more sophisticated approaches using authentication rules,
here we are just showing a minimal setup.
Back to Azure Now we need to assign a user
Remember that in our scenario Azure AD is where the users reside
I am going to select an external user with a Gmail account
this is a guest user in the AD Directory created just for test purposes
Select and Assign
OK, now we are ready to perform a first test
We need to use a private window to trigger the logon
The URL is tenant . authentication . region eu10 . hana.ondemand.com
Cloud Platform redirects to Identity Authentication Service, which passes the buck to Azure AD
so far, so good Enter the Azure AD logon
password and
no if you are lucky, this all works and if not, you get this SAML error
Response had invalid error code, failed to authenticate the user
As it happens, this is caused by an invalid certificate
How do we fix this?
Well we need to download the Azure AD certificate again and upload it into Identity Authentication
services
Back to Identity Authentication Identity Providers
My Azure AD SAML 2.0 Configuration
Save
Let’s try again New private window
And now it works
OK,
back to cloud platform Note that we enabled the creation of shadow
user This is not required,
If you want you can manually add users, more restrictive, more control
but more work as well; up to your
we can see that with our intial logon, a shadow user is created, and this allows us to grant
privileges, to grant roles
Let’s try this out with our sample app,
we created this app earlier in this video tutorial series
enter username
password
and we are authenticated and our account is forwarded to the target system for processing
The target system here, of course, is the SAP Cloud Platform,
and it checks our authorizations, does not find any,
and returns forbidden.
So, let’s grant our user the privilege to connect.
There are two approaches; I will show both but normally you would implement only one
approach and not mix and match.
Go to role collections
enter the name of your business app, you may recall from our previous video that
we created two roles: user and admin select the user role
edit under users
enter user ID select the identity provider
select the entry and save
Let’s try this out
username
password
very well, the app displays, we have our user privileges
but admin privileges shoud still return forbidden
exactly
We just mapped the shadow user to a role collection.
Brief reminder, we discussed this in a previous video
The scopes and role templates are design time artifact
these are OAuth 2.0 concepts.
industry standard, nothing specific to SAP, Cloud Foundry, or
Azure AD
When we deploy the application, the actual roles are created as runtime objects and managed
by the Cloud Foundry User Account and Authentication service UAA, or to be precises, by the SAP
Cloud Platform implementation, XS-UAA, extended services for UAA.
Then on the identity provider side, we have our user store, with users and groups,
And the usual process is not to assign shadow users to role collections but to map user
groups to role collections
For this,
Go to Trust Configuration, select the identity provider
select Role Collection Mappings new role collection mapping
search for the role
Attribute is Groups with uppercase G
and then we need to return to Azure AD Our enterprise application
Users and groups
Here we have added the two groups, These are regular Azure AD groups, no secret
sauce, you can give them any name you want
but what we are interested in here is the object id
copy that to clipboard
return to the cockpit and paste that in as value
So we are mapping the Azure AD object ID of a group to a runtime role collection managed
by the XSUAA service inside the Cloud Foundry environment of the SAP Cloud Platform
Of course, on the Azure AD side, we added our sample user as member to this
admin group
Note that from this location we can also assign shadow users to role collection
but this is just another approach to what we already did with the user group
that’s not what we want, so let’s cancel
Okay; for Admin group we have a mapping and we have added the AD user as member to the
group
Let’s try this out
Sign in
Password
The app displays, so the user role collection assigned to the shadow user is still active,
as we would expect, as we did not made any changes to this
Do we now also have the Admin scope?
Yes, we do And this we got from the role mapping
Again, we are mixing and matching here, of course
Normally, you would you keep your user and groups in Azure AD and your role collections
with privileges in SAP Cloud Platform.
That’s it See the description below of this video on
our YouTube channel for more information.
Don’t forget to subscribe!
Denys van Kempen, SAP HANA Academy / Digital partner engineering
Thanks for watching!