Appendix - SAML 2.0 SSO setup for SAP S/4HANA cloud with Azure active directory - Automate_Studio_Manager - Automate_Evolve - Latest

Prerequisites

Section 1 : Steps to be carried out on SAP cloud identity services for configuring SAML

1. Log in to the SAP Cloud Identity Authentication Service (IAS) using an account with administrator privileges
2. Go to Identity Providers -> Corporate Identity Providers.
3. Click Create for creation of a new Identity Provider that will be used for SAML authentication with Azure.
4. On Create Identity Provider screen,
   1. Enter Display Name.
   2. Select Microsoft ADFS as the Identity Provider Type
   3. keep the Copy Settings from Identify Provider field (Don’t Copy from default IdP)
   4. click Create.
5. Go to the Single Sign-On tab and select the option Forward all SSO Requests to Corporate IdP.
6. Go to the Trust tab > Name ID Policy section, and set Email as the Name ID Format, then click Save.
7. Navigate to Applications & Resources > Applications,
   1. Open the relevant tenant (for which SAML configuration is in progress),
   2. In the Trust tab, select the option Trust All Corporate Identity Providers at the bottom of the page.
8. Under Configure Requests to Corporate Identity Providers, go to the SAML 2.0 tab.
   1. Select the option Service Provider Authentication Context, and click Save.
9. Next, go to the Conditional Authentication section.
   1. Scroll to the bottom and set the Default Authenticating Identity Provider for the cloud tenant.
   2. Choose the IdP created in step 4, select the checkbox Allow users stored in Identity Authentication Service to log on, and click Save.
10. Before proceeding to Azure configuration, download the SAP Cloud metadata:
    1. Navigate to Applications & Resources > Tenant Settings > Single Sign-On.
    2. Under SAML 2.0 Configuration, click Download Metadata File.
    3. On the Download Metadata File screen, select Default Certificate (to be used for Azure configuration), and click Download.

Section 2: Basic Steps on Azure

1. Create an SAP Cloud Platform type application on Azure.
2. Select SAML based Single Sign-on and Upload metadata file received from SAP and then click Add.

   Under the Basic SAML Configuration section, the mandatory fields are automatically populated.

3. In the Attributes & Claims section, modify the attribute Unique User Identifier to user.mail.

4. Under the SAML Certificates section, locate the Token Signing Certificate.

   The Federation Metadata XML and Certificate are generated here.

5. Download both the Federation Metadata XML and the Certificate. These will be required in the Service Provider SAP Cloud system.

Section 3: Further Steps to be performed on SAP Cloud Identity Services

Once the Metadata file and Certificate are received from the Identity Provider (Azure), upload them to the Corporate Identity Provider created earlier (Section 1, Step 4) to complete the SAML configuration.

1. Return to Corporate Identity Providers, open the Trust tab, and click SAML 2.0 Configuration (which will currently display Not Configured).
2. Browse and upload the Metadata file downloaded from Azure (Section 2, Step 5), then click Save.
   • The SAML-specific values and relevant certificates are automatically populated using the metadata file.
3. Navigate to Applications & Resources > Applications.
   • Select the relevant tenant for which the SAML configuration is in progress.
   • Go to the Trust tab > SAML 2.0 Configuration > Certificates tab.
   • Upload the certificate received from Azure IdP (Section 2, Step 5).

Section 4: Additional Steps to be performed on SAP S/4HANA Public Cloud Tenant for SAML Configuration (Required only for Automate Evolve integration)

1. Log in to the SAP Public Cloud tenant.
2. Search for the Fiori application Maintain SAML2 Configuration (or use transaction code SAML2) and open it.
3. In the application, navigate to the Secondary Signing Certificate section and click Upload Secondary Certificate.
4. In the pop-up window, browse and select the Evolve certificate (the one uploaded on the Evolve connection page) in .crt format, then click Upload Secondary Certificate.

Expected Output: The Secondary Certificate section displays the details of the uploaded certificate.

Section 5: Additional Steps to be performed on SAP Cloud Identity Services for SAML Configuration (Required only for Automate Evolve integration)

1. Log in to SAP Cloud IAS with administrative privileges.
2. Navigate to Identity Providers > Corporate Identity Providers, and select the previously created IdP (Section 1, Step 4).
3. Go to the Trust tab > SAML 2.0 Configuration, then scroll to the Signing Certificates section.
   • You will see the existing certificate (Azure).
   • Browse and upload another Evolve certificate (.crt/.cer format), then click Add.
4. Set the newly added certificate as Default, and click Save.
5. Navigate to Applications & Resources > Applications, and perform the following:
   • Select the relevant tenant for which the SAML configuration is in progress.
   • Go to the Trust tab > SAML 2.0 Configuration > Certificates section.
   • Edit the existing certificate (Azure) using the pencil icon, and upload the Evolve certificate.
6. Click Save, then click Edit again to mark the uploaded certificate as Default, and click Save once more.