Single Sign-On (SSO)

SAP Analytics Cloud fully supports the SAML 2.0 web browser-based SSO. SAP Cloud Identity is delivered by default and can act as the identity provider of a single sign-on system with minimal configurations.

The following are some of the advantages you can have with SSO:

  • Users need only a single username/password pair to access multiple services – they don't have to remember multiple pairs.

  • Users are authenticated only once at the identity provider and then they are automatically logged into all services within that "trust-domain".

  • This process is more convenient to users since they do not have to provide their username/password at every service provider.

  • Service providers do not have the overhead of managing user identities, which is more convenient for them.

  • User identities are managed at a central point. This is more secure, less complex, and easily manageable.

What is SAML 2.0?

SAML 2 (Security Assertion Markup Language) is an Oasis standard for exchanging authentication and authorization data between security domains. SAML 2.0 is an XML-based protocol that uses security tokens containing assertions to pass information about a principal (usually an end user) between an identity provider and a web service provider (SAP Analytics Cloud). SAML 2.0 enables web-based authentication and authorization scenarios including single sign-on (SSO).

SAML2 uses a claim attribute to map Identity between the Identity Provider and Service Provider(s). It can be a User ID, email address, or any custom field. The mapping attribute is case sensitive. SAP Analytics Cloud supports only uppercase for User IDs.

The SAML2 process flow is strictly dependent on time. The SAML2 process flow must be executed within a short period of time, as specified by the optional NotBefore and NotOnOrAfter attributes. Please check the server Identity Provider clock and/or the Data Sources server clock.

SAP Analytics Cloud Single Sign-on

SAML 2 federation involves two parties:

  1. An identity provider (IdP): authenticates users and provides Service Providers with an Authentication Assertion if successful. As an Identity Provider, SAP Analytics Cloud provides SAP Cloud Identity by default. You can set your own SAML 2 based identity provider.

  2. A service provider (SP): relies on the Identity Provider to authenticate users. SAP Analytics Cloud and backend data sources (HANA, BW, S4/HANA or Universe) can rely on the same Identity Provider to authenticate.

The process flow:

  1. A user tries to log into SAP Analytics Cloud from a Chrome browser.

  2. SAP Analytics Cloud responds by generating a SAML request.

  3. The browser redirects the user to Identity Provider.

  4. Identity Provider parses the SAML request and verifies if the user is already authenticated.

  5. Identity Provider asks for authentication. If the user is already authenticated on the Identity Provider, this step will be skipped and IDP directly generates a SAML response.

  6. Identity Provider returns the encoded SAML response to the browser.

  7. The browser sends the SAML response to SAP Analytics Cloud for verification.

  8. If the verification is successful, the user will be logged into SAP Analytics Cloud and granted access to all the various resources.

Settings Principles

As seen above, there are two roles; Service Providers and Identity Providers (IP). The important characteristic of a single sign-on system is the predefined trust relation between the Service Providers and the Identity Provider; Service Providers trust the assertions issued by the Identity Providers and the Identity Providers issue assertions based on the results of the authentication and the authorization of principles that access services at the Service Providers.

If you decide to use SAP Cloud Identity, you do not need any settings – it is configured by default. Otherwise, follow this process:

  1. Get SAP Analytics Cloud Service Provider metadata (with certificate).

  2. Configure the Service Provider to the Identity Provider, based on SAP Analytics Cloud Service Provider metadata.

  3. Get Identity Provider metadata.

  4. Upload the Identity Provider metadata into SAP Analytics Cloud.

  5. Indicate the Mapping attribute (User ID, email address, or any customer field).

  6. Test before saving the configuration, and apply the change.

Setting Steps

Step

Description

Owner

Identity Provider settings in SAP Analytics Cloud

Enabling a Custom SAML Identity Provider

Business Intelligence Expert (Admin)

Service Provider settings in Identity Provider

Steps depend on the identity provider used.

Identity Provider Expert

SSO Data Source Settings

Backend Single Sign-On

Data Source IT Expert

Connector settings in SAP Analytics Cloud

  

Business Intelligence Expert

Network Setting

  

Network and Security Expert

Recommended Reading