Skip to content

Commit c5c2406

Browse files
GitHubber17GitHubber17
authored
Merge pull request #87521 from v-nagta/sapfioriv
Product Backlog Item 806934: SaaS App Tutorial: SAP Fiori Update
2 parents c631203 + d4fac02 commit c5c2406

File tree

1 file changed

+88
-132
lines changed

1 file changed

+88
-132
lines changed

‎articles/active-directory/saas-apps/sap-fiori-tutorial.md

Lines changed: 88 additions & 132 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
---
2-
title: 'Tutorial: Azure Active Directory integration with SAP Fiori | Microsoft Docs'
2+
title: 'Tutorial: Azure Active Directory single sign-on (SSO) integration with SAP Fiori | Microsoft Docs'
33
description: Learn how to configure single sign-on between Azure Active Directory and SAP Fiori.
44
services: active-directory
55
documentationCenter: na
66
author: jeevansd
7-
manager: daveba
7+
manager: mtillman
88
ms.reviewer: barbkess
99

1010
ms.assetid: 77ad13bf-e56b-4063-97d0-c82a19da9d56
@@ -14,78 +14,65 @@ ms.workload: identity
1414
ms.tgt_pltfrm: na
1515
ms.devlang: na
1616
ms.topic: tutorial
17-
ms.date: 03/11/2019
17+
ms.date: 09/05/2019
1818
ms.author: jeedes
1919

20+
ms.collection: M365-identity-device-management
2021
---
21-
# Tutorial: Azure Active Directory integration with SAP Fiori
2222

23-
In this tutorial, you learn how to integrate SAP Fiori with Azure Active Directory (Azure AD).
23+
# Tutorial: Azure Active Directory single sign-on (SSO) integration with SAP Fiori
2424

25-
Integrating SAP Fiori with Azure AD gives you the following benefits:
25+
In this tutorial, you'll learn how to integrate SAP Fiori with Azure Active Directory (Azure AD). When you integrate SAP Fiori with Azure AD, you can:
2626

27-
* You can use Azure AD to control who has access to SAP Fiori.
28-
* Users can be automatically signed in to SAP Fiori with their Azure AD accounts (single sign-on).
29-
* You can manage your accounts in one central location, the Azure portal.
27+
* Control in Azure AD who has access to SAP Fiori.
28+
* Enable your users to be automatically signed-in to SAP Fiori with their Azure AD accounts.
29+
* Manage your accounts in one central location - the Azure portal.
3030

31-
For more information about software as a service (SaaS) app integration with Azure AD, see [Single sign-on to applications in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-appssoaccess-whatis).
31+
To learn more about SaaS app integration with Azure AD, see [What is application access and single sign-on with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-appssoaccess-whatis).
3232

3333
## Prerequisites
3434

35-
To configure Azure AD integration with SAP Fiori, you need the following items:
35+
To get started, you need the following items:
3636

37-
* An Azure AD subscription. If you don't have an Azure AD subscription, create a [free account](https://azure.microsoft.com/free/) before you begin.
38-
* An SAP Fiori subscription with single sign-on enabled.
39-
* SAP Fiori 7.20 or later is required.
37+
* An Azure AD subscription. If you don't have a subscription, you can get a [free account](https://azure.microsoft.com/free/).
38+
* SAP Fiori single sign-on (SSO) enabled subscription.
4039

4140
## Scenario description
4241

43-
In this tutorial, you configure and test Azure AD single sign-on in a test environment and integrate SAP Fiori with Azure AD.
42+
In this tutorial, you configure and test Azure AD SSO in a test environment.
4443

45-
SAP Fiori supports the following features:
44+
* SAP Fiori supports **SP** initiated SSO
4645

47-
* **SP-initiated single sign-on**
46+
> [!NOTE]
47+
> For SAP Fiori initiated iFrame Authentication, we recommend using the **IsPassive** parameter in the SAML AuthnRequest for silent authentication. For more details of the **IsPassive** parameter refer to [Azure AD SAML single sign-on](https://docs.microsoft.com/azure/active-directory/develop/single-sign-on-saml-protocol) information
4848
49-
## Add SAP Fiori in the Azure portal
49+
## Adding SAP Fiori from the gallery
5050

51-
To integrate SAP Fiori with Azure AD, you must add SAP Fiori to your list of managed SaaS apps.
51+
To configure the integration of SAP Fiori into Azure AD, you need to add SAP Fiori from the gallery to your list of managed SaaS apps.
5252

53-
1. Sign in to the [Azure portal](https://portal.azure.com).
53+
1. Sign in to the [Azure portal](https://portal.azure.com) using either a work or school account, or a personal Microsoft account.
54+
1. On the left navigation pane, select the **Azure Active Directory** service.
55+
1. Navigate to **Enterprise Applications** and then select **All Applications**.
56+
1. To add new application, select **New application**.
57+
1. In the **Add from the gallery** section, type **SAP Fiori** in the search box.
58+
1. Select **SAP Fiori** from results panel and then add the app. Wait a few seconds while the app is added to your tenant.
5459

55-
1. In the left menu, select **Azure Active Directory**.
60+
## Configure and test Azure AD single sign-on for SAP Fiori
5661

57-
![The Azure Active Directory option](common/select-azuread.png)
62+
Configure and test Azure AD SSO with SAP Fiori using a test user called **B.Simon**. For SSO to work, you need to establish a link relationship between an Azure AD user and the related user in SAP Fiori.
5863

59-
1. Select **Enterprise applications** > **All applications**.
64+
To configure and test Azure AD SSO with SAP Fiori, complete the following building blocks:
6065

61-
![The Enterprise applications pane](common/enterprise-applications.png)
66+
1. **[Configure Azure AD SSO](#configure-azure-ad-sso)** - to enable your users to use this feature.
67+
1. **[Create an Azure AD test user](#create-an-azure-ad-test-user)** - to test Azure AD single sign-on with B.Simon.
68+
1. **[Assign the Azure AD test user](#assign-the-azure-ad-test-user)** - to enable B.Simon to use Azure AD single sign-on.
69+
1. **[Configure SAP Fiori SSO](#configure-sap-fiori-sso)** - to configure the single sign-on settings on application side.
70+
1. **[Create SAP Fiori test user](#create-sap-fiori-test-user)** - to have a counterpart of B.Simon in SAP Fiori that is linked to the Azure AD representation of user.
71+
1. **[Test SSO](#test-sso)** - to verify whether the configuration works.
6272

63-
1. To add an application, select **New application**.
73+
## Configure Azure AD SSO
6474

65-
![The New application option](common/add-new-app.png)
66-
67-
1. In the search box, enter **SAP Fiori**. In the search results, select **SAP Fiori**, and then select **Add**.
68-
69-
![SAP Fiori in the results list](common/search-new-app.png)
70-
71-
## Configure and test Azure AD single sign-on
72-
73-
In this section, you configure and test Azure AD single sign-on with SAP Fiori based on a test user named **Britta Simon**. For single sign-on to work, you must establish a linked relationship between an Azure AD user and the related user in SAP Fiori.
74-
75-
To configure and test Azure AD single sign-on with SAP Fiori, you must complete the following building blocks:
76-
77-
| Task | Description |
78-
| --- | --- |
79-
| **[Configure Azure AD single sign-on](#configure-azure-ad-single-sign-on)** | Enables your users to use this feature. |
80-
| **[Configure SAP Fiori single sign-on](#configure-sap-fiori-single-sign-on)** | Configures the single sign-on settings in the application. |
81-
| **[Create an Azure AD test user](#create-an-azure-ad-test-user)** | Tests Azure AD single sign-on for a user named Britta Simon. |
82-
| **[Assign the Azure AD test user](#assign-the-azure-ad-test-user)** | Enables Britta Simon to use Azure AD single sign-on. |
83-
| **[Create an SAP Fiori test user](#create-an-sap-fiori-test-user)** | Creates a counterpart of Britta Simon in SAP Fiori that is linked to the Azure AD representation of the user. |
84-
| **[Test single sign-on](#test-single-sign-on)** | Verifies that the configuration works. |
85-
86-
### Configure Azure AD single sign-on
87-
88-
In this section, you configure Azure AD single sign-on with SAP Fiori in the Azure portal.
75+
Follow these steps to enable Azure AD SSO in the Azure portal.
8976

9077
1. Open a new web browser window and sign in to your SAP Fiori company site as an administrator.
9178

@@ -146,31 +133,23 @@ In this section, you configure Azure AD single sign-on with SAP Fiori in the Azu
146133

147134
![The Download Metadata link in the SAP SAML 2.0 Metadata dialog box](./media/sapfiori-tutorial/tutorial-sapnetweaver-generatesp.png)
148135

149-
1. In the [Azure portal](https://portal.azure.com/), in the **SAP Fiori** application integration pane, select **Single sign-on**.
150-
151-
![The Single sign-on option](common/select-sso.png)
152-
153-
1. In the **Select a single sign-on method** pane, select **SAML** or **SAML/WS-Fed** mode to enable single sign-on.
154-
155-
![Single sign-on select mode](common/select-saml-option.png)
136+
1. In the [Azure portal](https://portal.azure.com/), on the **SAP Fiori** application integration page, find the **Manage** section and select **single sign-on**.
137+
1. On the **Select a single sign-on method** page, select **SAML**.
138+
1. On the **Set up single sign-on with SAML** page, click the edit/pen icon for **Basic SAML Configuration** to edit the settings.
156139

157-
1. In the **Set up Single Sign-On with SAML** pane, select **Edit** (the pencil icon) to open the **Basic SAML Configuration** pane.
140+
![Edit Basic SAML Configuration](common/edit-urls.png)
158141

159-
![Edit Basic SAML Configuration](common/edit-urls.png)
142+
1. On the **Basic SAML Configuration** section, if you have **Service Provider metadata file**, perform the following steps:
160143

161-
1. In the **Basic SAML Configuration** section, complete the following steps:
144+
a. Click **Upload metadata file**.
162145

163-
1. Select **Upload metadata file**.
146+
![Upload metadata file](common/upload-metadata.png)
164147

165-
![The Upload metadata file option](common/upload-metadata.png)
148+
b. Click on **folder logo** to select the metadata file and click **Upload**.
166149

167-
1. To select the metadata file, select the folder icon, and then select **Upload**.
150+
![choose metadata file](common/browse-upload-metadata.png)
168151

169-
![Select the metadata file and then select the Upload button](common/browse-upload-metadata.png)
170-
171-
1. When the metadata file is successfully uploaded, the **Identifier** and **Reply URL** values are automatically populated in the **Basic SAML Configuration** pane. In the **Sign on URL** box, enter a URL that has the following pattern: https:\//\<your company instance of SAP Fiori\>.
172-
173-
![SAP Fiori domain and URLs single sign-on information](common/sp-identifier-reply.png)
152+
c. When the metadata file is successfully uploaded, the **Identifier** and **Reply URL** values are automatically populated in the **Basic SAML Configuration** pane. In the **Sign on URL** box, enter a URL that has the following pattern: `https:\//\<your company instance of SAP Fiori\>`.
174153

175154
> [!NOTE]
176155
> A few customers report errors related to incorrectly configured **Reply URL** values. If you see this error, you can use the following PowerShell script to set the correct Reply URL for your instance:
@@ -198,21 +177,46 @@ In this section, you configure Azure AD single sign-on with SAP Fiori in the Azu
198177
![The Manage user claims pane](./media/sapfiori-tutorial/nameidattribute.png)
199178

200179
![The Transformation section in the Manage user claims pane](./media/sapfiori-tutorial/nameidattribute1.png)
180+
181+
1. On the **Set up single sign-on with SAML** page, in the **SAML Signing Certificate** section, find **Federation Metadata XML** and select **Download** to download the certificate and save it on your computer.
201182

183+
![The Certificate download link](common/metadataxml.png)
202184

203-
1. In the **Set up Single Sign-On with SAML** pane, in the **SAML Signing Certificate** section, select **Download** next to **Federation Metadata XML**. Select a download option based on your requirements. Save the certificate on your computer.
185+
1. On the **Set up SAP Fiori** section, copy the appropriate URL(s) based on your requirement.
204186

205-
![The Certificate download option](common/metadataxml.png)
187+
![Copy configuration URLs](common/copy-configuration-urls.png)
206188

207-
1. In the **Set up SAP Fiori** section, copy the following URLs based on your requirements:
189+
### Create an Azure AD test user
208190

209-
* Login URL
210-
* Azure AD Identifier
211-
* Logout URL
191+
In this section, you'll create a test user in the Azure portal called B.Simon.
212192

213-
![Copy configuration URLs](common/copy-configuration-urls.png)
193+
1. From the left pane in the Azure portal, select **Azure Active Directory**, select **Users**, and then select **All users**.
194+
1. Select **New user** at the top of the screen.
195+
1. In the **User** properties, follow these steps:
196+
1. In the **Name** field, enter `B.Simon`.
197+
1. In the **User name** field, enter the [email protected]. For example, `[email protected]`.
198+
1. Select the **Show password** check box, and then write down the value that's displayed in the **Password** box.
199+
1. Click **Create**.
200+
201+
### Assign the Azure AD test user
202+
203+
In this section, you'll enable B.Simon to use Azure single sign-on by granting access to SAP Fiori.
204+
205+
1. In the Azure portal, select **Enterprise Applications**, and then select **All applications**.
206+
1. In the applications list, select **SAP Fiori**.
207+
1. In the app's overview page, find the **Manage** section and select **Users and groups**.
214208

215-
### Configure SAP Fiori single sign-on
209+
![The "Users and groups" link](common/users-groups-blade.png)
210+
211+
1. Select **Add user**, then select **Users and groups** in the **Add Assignment** dialog.
212+
213+
![The Add User link](common/add-assign-user.png)
214+
215+
1. In the **Users and groups** dialog, select **B.Simon** from the Users list, then click the **Select** button at the bottom of the screen.
216+
1. If you're expecting any role value in the SAML assertion, in the **Select Role** dialog, select the appropriate role for the user from the list and then click the **Select** button at the bottom of the screen.
217+
1. In the **Add Assignment** dialog, click the **Assign** button.
218+
219+
## Configure SAP Fiori SSO
216220

217221
1. Sign in to the SAP system and go to transaction code **SAML2**. A new browser window opens with the SAML configuration page.
218222

@@ -294,61 +298,11 @@ In this section, you configure Azure AD single sign-on with SAP Fiori in the Azu
294298

295299
![The OK option in SAML 2.0 Configuration dialog box in SAP](./media/sapfiori-tutorial/configuration2.png)
296300

297-
### Create an Azure AD test user
298-
299-
In this section, you create a test user named Britta Simon in the Azure portal.
300-
301-
1. In the Azure portal, select **Azure Active Directory** > **Users** > **All users**.
302-
303-
![The Users and All users options](common/users.png)
304-
305-
1. Select **New user**.
306-
307-
![The New user option](common/new-user.png)
308-
309-
1. In the **User** pane, complete the following steps:
310-
311-
1. In the **Name** box, enter **BrittaSimon**.
312-
313-
1. In the **User name** box, enter **brittasimon\@\<your-company-domain>.\<extension>**. For example, **brittasimon\@contoso.com**.
314-
315-
1. Select the **Show password** check box. Write down the value that's displayed in the **Password** box.
316-
317-
1. Select **Create**.
318-
319-
![The User pane](common/user-properties.png)
320-
321-
### Assign the Azure AD test user
322-
323-
In this section, you grant Britta Simon access to SAP Fiori so she can use Azure single sign-on.
324-
325-
1. In the Azure portal, select **Enterprise applications** > **All applications** > **SAP Fiori**.
326-
327-
![The Enterprise applications pane](common/enterprise-applications.png)
328-
329-
1. In the applications list, select **SAP Fiori**.
330-
331-
![SAP Fiori in the applications list](common/all-applications.png)
332-
333-
1. In the menu, select **Users and groups**.
334-
335-
![The Users and groups option](common/users-groups-blade.png)
336-
337-
1. Select **Add user**. Then, in the **Add assignment** pane, select **Users and groups**.
338-
339-
![The Add assignment pane](common/add-assign-user.png)
340-
341-
1. In the **Users and groups** pane, select **Britta Simon** in the list of users. Choose **Select**.
342-
343-
1. If you are expecting a role value in the SAML assertion, in the **Select role** pane, select the relevant role for the user from the list. Choose **Select**.
344-
345-
1. In the **Add Assignment** pane, select **Assign**.
346-
347-
### Create an SAP Fiori test user
301+
### Create SAP Fiori test user
348302

349303
In this section, you create a user named Britta Simon in SAP Fiori. Work with your in-house SAP team of experts or your organization SAP partner to add the user in the SAP Fiori platform.
350304

351-
### Test single sign-on
305+
## Test SSO
352306

353307
1. After the identity provider Azure AD is activated in SAP Fiori, try to access one of the following URLs to test single sign-on (you shouldn't be prompted for a username and password):
354308

@@ -364,10 +318,12 @@ In this section, you create a user named Britta Simon in SAP Fiori. Work with yo
364318

365319
1. If you are prompted for a username and password, enable trace to help diagnose the issue. Use the following URL for the trace: https:\//\<sapurl\>/sap/bc/webdynpro/sap/sec_diag_tool?sap-client=122&sap-language=EN#.
366320

367-
## Next steps
321+
## Additional resources
322+
323+
- [ List of Tutorials on How to Integrate SaaS Apps with Azure Active Directory ](https://docs.microsoft.com/azure/active-directory/active-directory-saas-tutorial-list)
324+
325+
- [What is application access and single sign-on with Azure Active Directory? ](https://docs.microsoft.com/azure/active-directory/active-directory-appssoaccess-whatis)
368326

369-
To learn more, review these articles:
327+
- [What is conditional access in Azure Active Directory?](https://docs.microsoft.com/azure/active-directory/conditional-access/overview)
370328

371-
- [List of tutorials for integrating SaaS apps with Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-saas-tutorial-list)
372-
- [Single sign-on to applications in Azure Active Directory](https://docs.microsoft.com/azure/active-directory/active-directory-appssoaccess-whatis)
373-
- [What is Conditional Access in Azure Active Directory?](https://docs.microsoft.com/azure/active-directory/conditional-access/overview)
329+
- [Try SAP Fiori with Azure AD](https://aad.portal.azure.com/)

0 commit comments

Comments
 (0)