SSL configuration for FIORI with web dispatcher as thin client

[Former Member]

Hi Gurus,

We have a Web dispatcher configured on thin client. When the FIORI requests comes in from the browser, the web dispatcher directs it either to Gateway or to backend ECC. The communication to Gateways is working properly with SAML configured. The ADFS is the identity provider.

However, when the request is for backend ECC system then it asks for logon information. So far we had trusted connection setup between gateway and backend ECC system. However, our gateway and ECC are both in different domains so SAP adviced us to setup SAML2 for backend as well.

We did the configuration from SAML2 tcode and now when accessing from FIORI we get Relay State Mapping Error. I understand that this happens because ADFS trusts the backend system and not the Web dispatcher which is sending the request. In ideal scenario, we could have initiated SAML2 from Web dispatcher and then shared the metadata file with ADFS. However, since Web dispatcher is a thin client so that is not possible.

I am looking for expert advice regarding how to have ADFS trust the Web Dispatcher system.