Managing Users Using SAML Attributes

In this lesson, we'll cover the following topics related to dynamic user management:

1. User creation, including validation.
2. User assignment to roles and teams.

At The Mock Company, you want new users to be created and assigned to the required roles and teams. You enable Dynamic User Creation and then validate that it is working correctly. You work with your SAML IdP administrator to map the SAML attributes to allow for automatic role and team assignment.

This video will take you through the process in setting up dynamic user management in SAP Analytics Cloud.

While it's possible to select Dynamic User Creation while configuring SAP Analytics Cloud to use a custom SAML IdP, it's recommended to leave the option unchecked while configuring your SAML single sign-on.

In the previous lesson, the custom SAML IdP was set up and now that it has been successfully configured and validated, we will enable dynamic user creation.

To access the option, go to System in the vertical menu and select the Security tab at the top of the page, as shown below.

When dynamic user creation is enabled, new users are automatically created in the SAP Analytics Cloud on their first login. The user will be created with the user attributes as described in the last lesson.

In this lesson, we will show you how users can be automatically assigned to teams and roles in SAP Analytics Cloud.

Automatic user deletion is not supported in SAP Analytics Cloud. If a user is manually removed in the custom SAML IdP system, then you must also manually delete the users from the Users list in the SAP Analytics Cloud system.

This process is covered in the lesson on Creating and Maintaining Users in SAP Analytics Cloud.

You can map existing SAML user attributes to SAP Analytics Cloud user profiles. Each time a user logs on to SAP Analytics Cloud, the latest information is read from their SAML assertion and updated in their SAP Analytics Cloud user profile.

You can map SAML user attributes to the following fields in SAP Analytics Cloud:

• First Name
• Last Name
• Display Name
• Email
• Functional Area
• Language
• Custom1, Custom2, and so on.

Mapping SAML attributes to SAP Analytics Cloud user profiles is a three-step process:

Step 1: Your custom SAML IdP is configured by the IdP administrator to return one or more SAML user attributes in the SAML assertions that are issued to authenticated SAML users.

Step 2: Select Map SAML User Properties in the Users list.

Step 3: In the Map SAML Attributes dialog, select a SAML Attribute and the corresponding Target Property using the dropdowns.

Select the New Mapping Definition icon to add additional SAML attributes, if necessary.

For more information on mapping SAML attributes to users, please visit Map SAML Attributes to Users.

When you have enabled a custom SAML IdP in your SAP Analytics Cloud tenant, you can automatically assign users to roles and teams based on their SAML attributes if your custom SAML IdP is configured to return one or more SAML user attributes in the SAML assertion.

In the screenshot below, custom1 is used to expose the user's Department in SAP NetWeaver IdP.

These attributes can be used to specify which roles and teams the user is assigned to in SAP Analytics Cloud.

In the exercise in this lesson, we use the assignment of users to teams to demonstrate the steps for dynamic assignment. However, the process is similar for roles.

To dynamically assign users to roles using SAML attributes, you follow the process below:

1. From the Roles list, select an existing role.
2. Select the Open SAML Role Mapping icon.
3. In the Create SAML Mapping dialog, select a SAML Attribute, a Condition, and enter a Value. Supported conditions are Equal, Does Not Equal, Is Null, Is Not Null.
4. Select New Mapping Definition to add mappings to the role assignment, if required.
5. Under Conditions Logic, select AND or OR.
   • If AND is selected, then the conditions for all attributes must be met for the mapping to be applied.
   • If OR is selected, the conditions for only one of the attributes must be met for the mapping to be applied.

The selected role will be applied to all users who meet the specified conditions when logging onto SAP Analytics Cloud using the SAML authentication.

If the selected role was previously assigned to a user, but the user does not meet the specified conditions, the role will be revoked when the user logs in.

For more information on mapping SAML attributes for roles and teams, please visit:

• Assign Users to Teams Using SAML Attributes
• Mapping Roles Using SAML Attributes

The User and Team Provisioning API can be used to programmatically manage users and teams.

This API allows you to:

• Create, read, update, and delete users and teams.
• Set user profile preferences.
• Assign existing roles to users and teams.

You cannot create new roles using this API.

For more information on using APIs for user and team provisioning, please visit

• Getting Started with SAP Analytics Cloud REST API | SAP Help Portal
• User and Team Provisioning | SAP Help Portal