Skip to content

Latest commit

 

History

History
187 lines (111 loc) · 8.34 KB

README.md

File metadata and controls

187 lines (111 loc) · 8.34 KB
title description services author manager ms.reviewer ms.service ms.subservice ms.workload ms.topic ms.date ms.author
Tutorial: Secure principal propagation between Azure Active Directory and SAP | Microsoft Docs
Learn how to configure secure principal propagation between Azure Active Directory and SAP
active-directory
Martha Splitthoff, Alexandra Schroeder, Andreas Mock, Martin Raepple
active-directory
saas-app-tutorial
identity
tutorial
08/26/2020
Martha Splitthoff, Alexandra Schroeder, Andreas Mock, Martin Raepple

SAP NetWeaver Configuration

Prerequisites

First you will set up SAP to configure the federation between SAP and Azure AD.

  • Please see a very detailed instruction for configuring SAP to be able to work with the Azure AD: Single Sign On - SAP and Azure AD
  • Below we highlighted the main configuration parts within SAP Netweaver:

Generate Role

  1. Login to the SAP NetWeaver and redirect to the role & rights section by typing the abbreviation for the role maintenance: /nPFCG

SAP LogIn

  1. Navigate to Role Maintenance create a Single Role and name it TEST_ROLE.

Create Single Role

  1. Add a description, Save the newly created role and navigate to Authorizations. There change the authorization data.

Change the Authorization Data

  1. Do not select any of the shown templates. Select Manually in the upper bar to create two authorization objects.

Manually create authorization objects

  1. Create two new authorization objects S_SERVICE and S_SCOPE as the user must be assigned to a role authorized for the scopes OA2_CLIENT and OA2_Scope later on.

Authorization objects

  1. Unfold the folders down to the scopes and change the Authorization values of these four scopes. For testing, development purposes we used the "wild card" using the "*" in the From and To areas. The final overview should look like this:

Authorization object values

  1. Select Generate in the upper bar. The Status of the role should change from Saved to generated.

Generate Users

  1. Redirect to the User Maintenance section by using: /nSU01

User Maintenance

  1. Set up a user Jane Doe (JDoe) which is known by SAP and by the Azure AD. Select Create.

Create User

  1. Configure the users Address information.

[!CAUTION] The e-mail address should be the same in Azure AD. As we are using the mail address to match the users between Azure AD and SAP this is critical.

Configure User Address

  1. Now the role created before is assigned to the user. Navigate to Roles and add a Role Assignment.

Role Assignment

  1. Search for the Single Role named TEST_ROLE and select the role created by you. Confirm the selection by pressing the green checkmark. Save these changes using the disk symbol in the upper bar.

Role Assignment

  1. Navigate to Logon Data and create a new password for the user. Save this password to the notepad. Make sure the User Type is Dialog User. Save all changes.

Role Assignment

  1. Create a new User. Name it Client1.

Client User

  1. Configure this users Logon Data so that User Type is System and create a password for the user. Save the password to the notepad.

Client User

Federation between SAP and Azure Active Directory

In order to be able to connect SAP and Azure AD, there needs to be a federation configured. In this part you will configure SAP to trust Azure AD:

  1. Redirect to the SAML 2.0 Configuration by using: /nSAML2

SAML 2.0 Configuration

  1. Navigate to Trusted Providers in the upper bar. There show the OAuth 2.0 Identity Providers.

OAuth IDP

  1. Upload the metadata file of the SAPNetWeaver application downloaded during the Azure AD configuration and confirm the next steps.

If you have not downloaded the federation metadata document see a brief description here.

SAML Configuration - Part 2

  1. The Provider Name should set to https://sts.windows.net/<AAD_TENANT_ID> automatically. Finish the OAuth 2.0 Identity Provider setup.

Provider Name

  1. Edit the created trusted provider.

Edit Trusted Provider

  1. Under Identity Federation press Add and select E-mail. Confirm with OK.

Add Email as NameID

  1. Press Enable to finalize the Setup of Azure AD as new trusted provider for SAP NetWeaver.

Add Email as NameID

Configure the Scope for OAuth 2.0

  1. Redirect to the Activate and Maintain Services section by using: /n/IWFND/MAINT_SERVICE

Activate and Maintain Services

  1. Look for ZGWSAMPLE_BASIC and GWSAMPLE_BASIC under Technical Servicename. Check the OAuth box for both scopes.

ZGWSAMPLE_BASIC

Configure Client in SAP

  1. Redirect to the OAuth 2.0 Administration by using: /nSOAUTH2

OAuth2.0 Administration

  1. Add a new OAuth Client which represents the Application Client from the SAP side by selecting Create. Now search for CLIENT1 which was previously created. Add a Description and press Next.

Client ID

  1. Check the box Client User ID and Password in the Client Authentication section and move on to the next section.

  2. Check the box Grant Type SAML 2.0 Bearer Assertion in the Resource Owner Authentication section. Add https://sts.windows.net/<AAD_TENANT_ID> as Trustes OAuth 2.0 IdP by searching for it and than confirming. Move on to the next section.

Client ID

  1. Add Scope Assignments by searching for and adding BW_BICS_INA, GWSAMPLE_BASIC and ZGWSAMPLE_BASIC. Finish the new Client creation.

  2. Next check the client settings. Most should be already configured right.

    1. Check the box SAML 2.0 Bearer
    2. Check the box Client User ID and Password
    3. Check the box Grant Type SAML 2.0
    4. Configure the trustworthy Identityprovider: OAuth-2.0-IdP: https://sts.windows.net/<AAD_TENANT_ID>
    5. Make sure that the box Requires Attribute "client_id" is not checked

Configure Client in SAP NetWeaver

Next Steps

Now let's test the scenario and jump into the section for setting up Postman

Additional resources