Name: SAML: Configuring Service Provider in SAP Customer Data Cloud
Uploaded: 2019-2-18
Duration: 305 s
Description: In this video, you'll learn about the Service Provider Configuration required in the SAP Customer Data Cloud and the client application, for an SP Initiated SSO scenario.

Share feedback

<p><u><strong>Planned maintenance of Practice Systems</strong></u></p>

Planned maintenance of Practice Systems

Why create an SAP account?

Enhance your learning experience

SAP Learning

Choose your subscription

Manage your subscription

Live Sessions

Hands-on Practice

Certification

My Learning

Ready to start learning?

<div><div><div><div>In this video, you'll learn about the Service Provider Configuration required in the SAP Customer Data Cloud and the client application, for an SP Initiated SSO scenario. <br></div></div></div></div>

SAML: Configuring Service Provider in SAP Customer Data Cloud

Hi. In this video you will see the service provider configurations required in the SAP Customer Data Cloud and the client application for an SP initiated. SSO scenario. For the sake of the demo, I'll be using the acronyms CDC for customer Data cloud, IDP for Identity Provider, ESP for service provider and SSO for single sign on. Here's a sample flow of SP initiated SSO. First, the SP sends the user to the CDC SSO endpoint with the specially encoded request. If the user is already logged in, CDC directs them to the service Providers assertion consumer, which takes them to the SP hosted resource. Otherwise, the user is redirected to a special proxy page which triggers the login or registration process. Once the user successfully logs in, then they are redirected back to the CDC SSO endpoint. Then the assertion consumer records them on to the SP hosted resource. The SP initiated SSA configuration is a two step process IDP configuration and SP configuration. In this video we will see the SP configuration for IDP configuration. Search the video introduction to SAML and enable DCS, sap.com. Let's look at the console and see how the SAML configuration looks like. Open the SP API settings page, then the SAML login page and configure SP. The SP can have multiple IDPs that it may authenticate against. This page allows you to see all the configure connections. Let's create a new IDP configuration. Name will be the identifier used in any call to initiate a connection. User is the IDPs entity ID. The value in this field will come from the IDP configuration which I have. It opened and another window. We will look into SAML IDP metadata and copy the entity ID. The single sign on service URL is the IDPs SSL URL. Copy the SSL endpoint from the IDP metadata to this field and single sign on service binding field. You can choose redirect or post. It does not make too much difference here as CDC supports both. Similarly, the IDP may support single log out, which is less commonly used but is still supported by the customer. Data cloud. Copy slow endpoint URL from IDP metadata to the single logout service URL field. Another field is name id and its format. SAML has multiple data type formats, which may be acceptable. This screen shows the default value of customer data cloud, which should be enough in most cases. There's also a possibility to map fields from identity provider to the service provider. For this demo, we are mapping first name, last name and email. And there's an X509 certificate which again can be copied from the IDP metadata. You save the settings and you have a new IDP that you can authenticate against. For this ESP. Now that we have configured the ESP site on the Customer data cloud, let's see how the ESP client is. Every provider can have their own method to initiate the process. There are few ways to initiate a connection. One way is to create a custom button in your show screen. Set call. This button will include some key information like the fact that it is a SAML connection, the identity provider name, and other details like a custom button image. Another option is to make a call to social login JavaScript SDK with the identity provider's name, or to redirect the user to account. Social login Rest endpoint. Note that redirecting the user to the Rest endpoint also requires some extra parameters. Refer to the documentation developers dot wkyc.com for more details. For this demo we will make a call to accounts dot social login JavaScript SDK. Let's see SP initiated. So in action. First the user opens the ESP page and clicks on the login link. The link in turn makes a call to accounts dot social login JavaScript SDK and pass the name of the IDP name with SAML prefix. The proxy page of the IDP opens and redirects the user to the IDP login page. The login screen set of the IDP side opens up. The user enters the credentials and submits. If you are a new user, you can register. The user is redirected to the Service provider page. After successful authentication. That completes the service provider configuration required for SP initiated SSO. Thanks for watching.