SAML2 Single Sign-on with Email Address

[former_member240879]

Environment: NW As ABAP 7.52 ; Web-dispatcher ; SAML2 ; ADFS

Currently I am trying to configure SSO for our Fiori application. In our company in ADFS id is different from SAP Logon Id. I already configured SSO by guide (Overview of SSL + SAML 2.0 Configuration) I am able to make single sign on working by maintaining Alias field in the SAP user with ADFS id (samaccountname).

Now Business is requesting for single sign with email address. email address is maintained on both sides in ADFS and also in SAP under user profile.

I have the changed the saml2 configuration for email under identity management like below:

Supported Name id Formats : unspecified - Persistent users

Details of NameID format “Unspecified” tried both option below

option-1.UserId Source – Assertion Subject NameID ; Mapping Mode – Email

option-2.UserId Source – Assertion attribute; Assertion Attribute Name -emailAddress; Mapping Mode – Email

On ADFS maintained claim rule like below :

a.Send LDAP Attributes as Claims rule:

1. From the LDAP Attribute column, select E-Mail Addresses.

2. From the Outgoing Claim Type, select E-Mail Address.

b.Create another new rule by clicking Add Rule, this time selecting Transform an Incoming Claim

1. Select E-mail Address as the Incoming Claim Type.

2. For Outgoing Claim Type, select Name ID.

3. For Outgoing Name ID Format, select Email.

Single sign is not working for email address, I am unable to locate any relevant document, every document talks about name-id - Login id mapping. Very much appreciated for any help.

[former_member240879 · Accepted solution]

1. Maintain Email id in User Profile - SU01

2. In SAML2 - Under Identity Federation

a) Supported NameID formats: Unspecified

b) Details of Name Id

User ID Source - Assertion Subject NameID

User ID Mapping Mode - Email

[former_member692358 · Accepted solution]

What claim rules need to be maintained at ADFS Inbound and outbound. ??

waiting for you reply..

[shivraj_singh2]

Kirpal,

Were you able to find the solution for this scenario?

In SAP, under which field are you maintaining email ID?

Regards,
Shivraj

[former_member240879]

HI,

I am sure you would have solve your issue by now. However, still I would like to write a solution for this issue.

1. Maintain Email id in User Profile - SU01

2. In SAML2 - Under Identity Federation

a) Supported NameID formats: Unspecified

b) Details of Name Id

User ID Source - Assertion Subject NameID

User ID Mapping Mode - Email

[Colt]

Hi Kirpal,

enable SAML tracing on the SP side (ICF-Service SEC_DIAG_TOOL) and use a browser extension such as rcFederation SAML tracer for Chrome. Perform your authentication and make sure AuthnReqest and AuthnResponse are containing the expected values!

Cheers Colt