single sign on for s4 hana cloud and sap cloud mobile service

[jenny_slay]

Hello,

We are developing mobile app (ios and android native) for client demo using SAP Cloud mobile service which is on cloud foundry environment. The backend system is S4 Hana cloud (Starter system) and it use SAP Identity Authentication service(IAS) user authentication. Our requirement is mobile app user should use his/her S4 Hana user id and password to login the newly developed mobile app. Appreciate if you suggest list of setup require to achieve the login process, some document link or blog post also helpful.

Thanks in advance …..

[jenny_slay]

Hi Dirk,

Thanks for replay and document links. I managed to link our cloud foundry subaccount with the SAP Identity Authentication service(IAS) and then enable OAuth in SAP cloud mobile security setting. Now SAP IAS tenant login pad appear when user access native mobile app and they can also use their S4Hana cloud credential to login. However I am still struggling with SSO for "Mobile destination". As you mentioned, App-to-AppSSO can be used as destination SSO mechanism. I have tried App-to-AppSSO but it’s not working, probably I am doing something wrong. As shown in the attached screen shot, I have filled Issuer, Audience and Signing Key. Do I need to do any other setting for App-to-AppSSO ?

As you mentioned, either App-to-AppSSO or OAuth2SAMLBearerAssertion can be used for SSO between S4Hana and cloud mobile service. I was going through the document link document. Can cloud platform “Authorization and trust management” functionality be used to achieve the requirement instead of App-to-AppSSO or OAuth2SAMLBearerAssertion?

Regards, Jenni

[dirk_grosskopf]

Dear Jennifer

The SAP Mobile SDK for Android and iOS are providing build in Authentication dialog to authenticate at your IdP. See https://help.sap.com/doc/f53c64b93e5140918d676b927a3cd65b/Cloud/en-US/docs-en/index.html

We suggest using OAuth authentication in mobile services and the appropriate SSO, see https://help.sap.com/viewer/38dbd9fbb49240f3b4d954e92335e670/Cloud/en-US/9995b0fa9b4e45709eb62ebe407...

Possible options are:

• App-to-AppSSO
• OAuth2SAMLBearerAssertion

Please see https://help.sap.com/viewer/38dbd9fbb49240f3b4d954e92335e670/Cloud/en-US/21a016f86b0d4fdeb3e6fef802d... how to define a mobile destination.

Best Regards

Dirk