You want to configure your own Identity Provider (IdP) to use it with SAP Analytics Cloud.
- SAP Analytics Cloud
- SAML 2.0 Identity Provider
- Understanding SAML
- Steps to configure SAML SSO
- How to configure SAP Analytics Cloud SAML SSO using AD FS (Active Directory Federation Services)
- How to configure SAP Analytics Cloud SAML SSO using Azure Active Directory
- Typical Mistakes
- Troubleshooting KBA 2487567
Security Assertion Markup Language (SAML) is an open-standard data format for exchanging authentication and authorization data between parties. We can see the three parties involved and a very simplified exchange in the following picture:
To configure your SAML 2.0 Identity Provider (IdP) with SAP Analytics Cloud, you only need to follow the self-service tool in the menu:
System > Administration > Security (tab)
You can follow the complete steps in the documentation of the product, section Enabling SAML Single Sign-On (SSO).
If you want to follow a step-by-step process with Active Directory Federation Services, you can use the KBA 2487116.
- For steps on how to configure SAP Analytics Cloud SAML SSO using AD FS please read the KBA 2487116
- For steps on how to configure SAP Analytics Cloud SAML SSO using Azure Active Directory please read the KBA 2571892
Modifying the SAP Analytics Cloud Metadata. You only need to import the XML file to your SAML Identity Provider.
You may be tempted to manually modify the confusing entries like this:
to your own location. Don't change it.
Incorrect NameID tag returned.
Your Identity Provider doesn't make the transformations as expected and returns something incorrect:
My phone number
The value returned has to match the Attribute to map: User ID, email, etc.
We recommend you to install an SAML Add-on to examine only the SAML assertions. KBA 2487567 contains a step-by-step troubleshooting guide.
- Can I use the current SAP Cloud Identity used by SAP Analytics Cloud in any of the other SAP Cloud Applications?
No. You can purchase your own tenant of SAP Cloud Identity and you can use it to authenticate all your applications.
- Do I need reverse proxy if my SAML IdP is not in the cloud and can only be accessed from my network?
No. As long as your browser can access both sites: SAC and IdP, everything should be working as expected.
- Can I use the same SAML IdP in HANA, S4/HANA and other SAP applications?
Yes, in fact you should. If you have S4/HANA Cloud edition, you can follow these steps to use the same SAP Cloud Identity in SAC: KBA 2518900
- Are there other options to have SSO in SAP Analytics Cloud?
Currently, you can only authenticate in SAP Analytics Cloud using SAML. However, you can have SSO to HANA using Live Direct Connection (CORS) having two different authentication methods: SAML for SAC and other for HANA, as long as your browser supports both.
Please note that SAP Product Support can only help you with our product deffects. If your SAML IdP is not returning a correct assertion, you will need to contact your SAML IdP vendor to troubleshoot transformations and authorisations.
If you are trying to set up SAML to authenticate your current SAP BusinessObjects Cloud to SAP Cloud Platform and you are not interested in created your own Identity Provider,
you can follow this blog: SAP BusinessObjects Cloud: Live Data Connection to SAP HCP With SSO (Simple URLs).
For specific steps configuring reverse proxy with Apache, follow the steps indicated in the KBA 2358559 - Authenticating to SAP BusinessObjects Cloud via SAP Cloud Identity breaks Apache Reverse Proxy.
- Help resources
- Help portal
- SAP Community ( Questions & Answers / Direct Link to Create Question / Blogs )
- SAP community wiki
- Ideaplace forum ( for enhancement requests & new features )
- Video tutorials
- Videos by topic areas: ( Overview, What's New, Models and Connections, Stories, SAP Digital Boardroom, Planning, Predictive, Collaboration, Administration )
- Training events
- Past event recordings
- New user handbook
- How to connect to on-premise data
- Introducing SAP BusinessObjects Cloud: BI and Planning (SAP Press book)
Your feedback is important to help us improve our knowledge base.
Please rate how useful you found this article by using the star rating feature at the beginning of this article.
SAML, SSO, IdP, SAP Cloud for Planning, sc4p, c4p, cforp, cloudforplanning, Hana Cloud for Planning, EPM-ODS, Cloud for Analytics, C4P, Cloud4Analytics, CloudforAnalytics, Cloud 4 Planning, HCP, C4A, BOC, SAPBusinessObjectsCloud, BusinessObjectsCloud, BOBJ, BOBJcloud, BOCloud., BICloud, BO Cloud , KBA , LOD-ANA , SAP Analytics Cloud , LOD-ANA-BI , SAP Analytics Cloud - Business Intelligence (BOC) , LOD-ANA-PL , SAP Analytics Cloud – Planning (BOC) , LOD-ANA-BR , SAP Analytics Cloud - Digital Boardroom , LOD-ANA-PR , SAP Analytics Cloud – Predictive (BOC) , Problem