Using SAP Analytics Cloud as an Identity Provider

[huseyindereli]

Hi,

I've got users that are defined only at the SAP Cloud Analytics system.

Also, I have an application that is running on SAP Cloud Platform. Both part use the same HANA database on the SCP.

And I want them to be able to login with their SAC users to my custom application.

Is it possible to use SAP Analytics Cloud as an Identity Provider for SAP Cloud Platform ?

If not, what are the best practices for managing authorizations and authentications ?

Thanks,

Huseyin.

[julian_jimenez · Accepted solution]

Hi huseyin.dereli ,

SAP Analytics Cloud (SAC) is not an Identity Provider but a service provider. What SAC is using is SAP Cloud Identity as its SAML IdP. When we connect to HANA in SAPCP, we act as a SAML Service Provider, as indicated in my blog (step 2.3): https://blogs.sap.com/2016/11/27/sap-businessobjects-cloud-live-data-connection-to-sap-hcp-with-sso-...

If you were trying to use SAC as your IdP it shouldn't work as we exchanged the metadata XML only in that specific connection.

If you try to login directly in your application, your users will be redirected to the SAP Cloud Id used by SAC and your application will be rejected as it is not a service provider trusted. You can't exchange XML with it.

A solution can be using your own SAML IdP in both: HANA and SAC. You can use AD FS, an SAP Cloud Identity tenant, etc.

Regards,
Julian

[huseyindereli · Accepted solution]

Hi julian.jimenez ,

Thanks for your answer.

I've concluded the same after doing some research but I wanted to make sure by sharing my question in here.

And your blog posts are pretty much the best resources on this topic. Good work.

[huseyindereli]

Hi Tammy,

I've read these blogs. Both of them are really helpful but also both of them uses different Identity Providers, not SAP Analytics Cloud itself.

Thanks for your quick response.

[TammyPowlas]

Hi Huseyin - would this blog by Julian help? https://blogs.sap.com/2017/07/13/saml-authentication-in-sap-analytics-cloud/ - I am not sure

There's also https://help.sap.com/doc/00f68c2e08b941f081002fd3691d86a7/release/en-US/a30b5127419a4fd0aeef7be91fdf... and https://blogs.sap.com/2017/07/24/sso-setup-for-sap-analytics-cloud-using-okta-as-an-identity-provide...