SAML2 Configuration Examples

SAP HANA Cloud Platform Mobile Services Registration with SAML2 Web POST Profile

{
   "appID":"com.sap.fiori.client",
   "fioriURL":"https://my.host.com/sap/bc/ui5_ui5/ui2/ushell/shells/abap/FioriLaunchpad.html",
   "fioriURLIsSMP":true,
   "auth":[
      {
         "type":"saml2.web.post",
         "config":{
            "saml2.web.post.authchallengeheader.name":"com.sap.cloud.security.login",
            "saml2.web.post.finish.endpoint.uri":"/SAMLAuthLauncher",
            "saml2.web.post.finish.endpoint.redirectparam":"finishEndpointParam"
         }
      }
   ]
}

Using Certificates for SAML Authentication on Android

If you must use certificates for SAML authentication, the Android SAP Fiori client requires some additional configuration.

Open the file ~plugins/kapsel-plugin-fioriclient/www/fioriclient.js. At the onDeviceReady function, add the following coding:

var onDeviceReady = function() {
          var successCallback = function() {console.log("Callback Success") };
          var errorCallback = function() {console.log("Callback Failure") };
          sap.AuthProxy.startIntercepting(successCallback, errorCallback);
          sap.AuthProxy.addHTTPSConversionHost(successCallback, errorCallback, "http://wdflbmt0759.wdf.sap.corp ");
      sap.Logger.info('Cordova container initialized', 'FIORI_CLIENT');

Explanation

The AuthProxy plugin can be configured to intercept all network traffic and to handle sending the requests itself, which enables WebView requests to handle certificates. However, AuthProxy cannot intercept HTTPS requests. The workaround for that is to tell the WebView to load HTTP URLs and have AuthProxy convert those URLs to HTTPS before they are sent over the network. AuthProxy interception is enabled by default for SAP Fiori Client. But even when AuthProxy interception is enabled, AuthProxy normally won’t start intercepting until after Logon registration has finished, because the HTTP -> HTTPS switch can’t be made to always work with logon.

If you want certificate authentication with SAML, you need the WebView requests to use a certificate, which means AuthProxy must be intercepting. But SAML authentication happens before Logon registration when AuthProxy normally hasn’t started intercepting yet. The call startIntercepting makes AuthProxy start intercepting even if Logon registration hasn’t completed yet. The call to addHTTPSConversionHost is for the HTTP -> HTTPS workaround, so that AuthProxy knows to switch requests for that host to HTTPS before sending the requests. Note that both of those calls should only be made on Android.