2487116 - How to configure SAP Analytics Cloud (SAC) SAML SSO using AD FS (Active Directory Federation Services)

You want to use your AD FS (Active Directory Federation Services) to authenticate users in SAP Analytics Cloud (SAC).

• SAP Analytics Cloud
• Windows Active Directory 2012

Warning: It is strongly recommended to discuss these steps with your network (Active Directory / AD) administrators.

Follow the recommended steps below to help configure Active Directory Federation Services with SAC.

Remember that only an Active Directory expert or a Microsoft Authentication expert is able to answer all your specific questions.
Consulting and configuration is outside the scope of SAP Product Support. See 2706322 - What is Support – What is Consulting: Cloud Solutions.

1. Download XML Service Provider Metadata:

You need to download the Service Provider metadata for your system (tenant URL).

1. Log on to SAP Analytics Cloud using an administrator (admin) account.
2. Go to the menu System > Administration > Security.
3. Click the pencil icon to edit.
4. Select SAML single sign-on (SSO).
5. Click the Download button that appears in menu Step 1: Download Service Provider metadata

2. Importing the information into AD FS:

1. Connect to your AD FS Management tool.
2. Select Trust Relationships > Relying Party Trust > Right click and select Add Relying Party Trust.
   
3. Select "Import data about the relying party from a file".
   
4. After importing the file, you will be asked a couple of questions.
5. Select "I do not want to configure multi-factor authentication settings for this relying party trust at this time".
   

6. Select "Permit all users to access this relying party".
   
   

7. For more information on these settings, read Microsoft's documentation.

3. Add Claim Rules for SAP Analytics Cloud:

You will be prompted to add Claim Rules.

• Transformation from Active Directory attribute to Claims

• Transformation from the logon name in Active Directory (LDAP Attribute: SAMAccountName ) to an intermediary claim.
  In this sample, we manually enter the custom claim type name called: my_intermediate_claim.
  
  
  
  
  • In this case, UPN（userPrincipalName）of your user (MY_USER@example.com or EXAMPLE\MY_UYSER) will be transformed to the Name ID(MY_UYSER) in the SAML assertion, which will be used to map the SAC user attribute.
  • If all users have UPN in upper case in ADFS, you can select the option USER ID when configuring SAML SSO in SAC (Step 3).
  • Othwise, if some users have UPN in lower case or mix case, you must select option Custom SAML User Mapping when configuring SAML SSO in SAC (Step 3).
  • If you want to configuring SAML SSO using Email in SAC (Step 3), please select LDAP attribute E-Mail-Addresses here.
    
    
• Transformation from other attributes to white-listed SAML attributes (manually enter; case-sensitive; used to map SAC user attributes)
  
  NOTE: SAML Attribute email is always recommended.
  See KBA 2789431 - After enabling custom SAML SSO on the SAP Analytics Cloud system, e-mails are overwritten with @unknown.org or @this-default-was-not-configured.invalid domain
  
  
• Transformation from this intermediary Claim to Name ID, which is required by SAP Analytics Cloud.
  
  
  
  
• If this rule is not created (but transform SAMAccountName to Name ID directly in the previous step), the ADFS claim will not contain the required format:<NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">USER_NAME</NameID>
  The logon process will work but you will get an error when you logout.  Please refer to more details in KBA 2601672.
• If you want to configuring SAML SSO using Email in SAC (Step 3), please select Outgoing name ID format to Email.

• Issue SAML Attribute Groups to return static value "SAC", which is required only when SAP Analytics Cloud is running on a non-SAP data center.
  
  
  
  
• Encryption used: in the newly created Relying party trust you need to change the default Secure hash algorithm to SHA-1:
  
  
  NOTE: SHA-256 hash algorithm is only supported on SAP Analytics Cloud systems running non-SAP Datacenter. Refer to KBA 2796605 and 2820521.

4. Importing the Metadata.xml from AD FS:

Your AD administrator knows how to get this file. It can be obtained by going to the URL: https://YourADServer.YourDomain/FederationMetadata/2007-06/FederationMetadata.xml

Back in SAP Analytics Cloud, in the SAML SSO menu where we downloaded the Service Provider Metadata, we can now upload this file: Upload Identity Provider Metadata

In Step 3: Choose a user attribute to map to your identity provider, you need to select USER ID for this example:

When selected, your username should be populated. In this example, you see that it is Your_AD_User. The value entered has to match the logon credentials EXACTLY that are in Active Directory (SAM-Account-Name).

What happens if you want them to match by e-mail or other attributes?

You need to go back to your Claim rules in AD FS and map them accordingly.

5. Validating the account:

Before we can save the configuration we need to validate the configuration.

You will copy the URL from the validate window and open a Chrome browser Incognito tab or open a browser in another machine.

6. Troubleshooting:

• See 2487567 - Troubleshooting SAML assertions when configuring SAML SSO in SAP Analytics Cloud.

7. IdP Initiated SSO:

IdP-initiated SSO is only supported if SAP Analytics Cloud is running on a SAP Data Center (NEO). Additional configuration is required. Please refer to the official users guide per Enable IdP-Initiated Single Sign On (SAP Data Center Only)

• 2590755 - Is IdP-initiated SSO method supported in SAP Analytics Cloud?

• SAP Analytics Cloud administration community topic page
• 2411608 - SAP Analytics Cloud SAML authentication *** Master KBA ***
• 2569847 - Where can you find SAC user assistance (help) to use, configure, and operate it more effectively?
• Have a question? Ask it here and let our amazing SAP community help! Or reply and share your knowledge!
• 2487011 - What information do I need to provide when opening an case for SAP Analytics Cloud?
• Search for SAP Analytics Cloud content using Google or Bing:
• https://www.google.ca/search?q=site%3Ahttps%3A%2F%2Fapps.support.sap.com+SAP+Analytics+Cloud
• https://www.bing.com/search?q=site%3Ahttps%3A%2F%2Fapps.support.sap.com+SAP+Analytics+Cloud
• Note: Add relevant text or warning/error messages to the text search field to filter results.
• SAP Analytics Cloud > Learning > Data Connections
• SAP Analytics Cloud > Learning > Guided Playlists
• SAP Analytics Cloud > Learning > Guided Playlists > Getting Support
• Need More Help? Contact Support or visit the solution finder today!

Your feedback is important to help us improve our knowledge base.

adfs, ad fs, activedirectory, ldap, sso, howto, how to, SAC, Analytics Cloud, saml, saml2, configuration, email userid,e-mail , KBA , logout , ms ad , ad adfs , sso , sac , saml , ad , adfs , ad fs , LOD-ANA-AUT , SAC Authentication / Login , LOD-ANA-BI , Business Intelligence Functionality, Analytic Models , LOD-ANA-PL , Planning , LOD-ANA-BR , SAC Boardroom , LOD-ANA-PR , SAC Predictive , How To