Skip to main content

SAP Business Technology Platform SAML integration

Multi-Factor Authentication (MFA) is an extra layer of security used when logging into websites or apps. Individuals are authenticated through more than one required security and validation procedure that only they know or have access to.

Security Assertion Markup Language (SAML) is a protocol for authenticating to web applications. SAML allows federated apps and organizations to communicate and trust one another’s users.

Arculix, as a SAML provider, improves the user login experience for SAP Business Technology Platform users with intelligent and convenient MFA.

Prerequisites

  • Configured Arculix instance and user account with administrative privileges for Arculix.

  • Configured Arculix LDAP Agent.

    For more information, see the Arculix LDAP Agent deployment guide.

  • User account with administrative privileges for the SAP Business Technology Platform portal.

SAP Business Technology Platform configuration

In this section, you'll configure SAP Business Technology Platform (SAP BTP) as a service provider (SP).

  1. Download the SAML metadata and certificate for your organization from Arculix.

    Metadata download: https://sso.acceptto.com/<myorganization>/saml/download/metadata

    View metadata: https://sso.acceptto.com/<myorganization>/saml/metadata

    Certificate download: https://sso.acceptto.com/<myorganization>/saml/download/cert

  2. Log in to your SAP BTP Cockpit portal as an administrator.

  3. Click your preferred Subaccount.

    sap_subaccount.png

  4. Navigate to the Security tab and click Trust Configuration. Then, click SAML Metadata to download SAP metadata for the next section.

  5. On the Trust Configuration tab, click New Trust Configuration.

    sap_new_trust.png

  6. On the New Trust Configuration page, set the following configurations. Upload the metadata file that was downloaded earlier from Arculix. Provide a Name for the IdP setup and a name in the Link Text for user Login field that shows up on the user login screen.

    Metadata

    Upload the metadata file that was downloaded earlier from Arculix. Set the name of the application. This is the name to display for push notifications, in the Admin panel, Application portal, and audit logs.

    For example, SAP BTP.

    Name

    Set the name for this IdP integration.

    For example, Arculix IdP.

    Link Text for User Logon

    Set the name to display on the log in page.

    For example, Arculix login.

    sap_upload_meta.png

  7. Click Save.

  8. Go to the Security tab and click Users. Then, select Create for creating users to authenticate via Arculix SSO.

  9. On the New User page, create a new user account.

    User Name

    Enter the user name.

    Identity Provider

    Select the name of Arculix IdP you just created.

    For example, Arculix IdP.

    Email

    Enter the email address.

    sap_new_user.png

  10. Go to the Security tab and click Role Collection. Click the + button on the right corner to create a new role collection.

    sap_role_collections.png

  11. Enter the name for Role Collection and click Create.

  12. Click the created Role Collection and select Edit.

  13. Add Roles and Users or User Group that you want to use an application or instance in Launchpad.

    sap_role_collection_overview.png

  14. Save your changes.

Arculix SAML configuration as an Identity Provider (IdP)

In this section, you'll add an application for SAP Business Technology Platform and set the SAML configuration settings. This will be the Identity Provider (IdP) side of the configuration.

  1. Log in to Arculix with an administrative account and go to Applications.

  2. Click Create New Application.

    Create new application

  3. In the New Application form, on the General tab, set the following configurations:

    Name

    Set the name of the application. This is the name to display for push notifications, in the Admin panel, Application portal, and audit logs.

    For example, SAP BTP.

    Type

    Set to SAML Service Provider.

    Out of Band Methods

    Select the allowed methods end users can choose to approve MFA requests.

    For example, Arculix Mobile app (push notifications), SMS, or Security Key.

    Message for MFA Requests

    Optional. Type a message displayed to end users when sending an MFA request via push notification, SMS, or email.

    arculix_new_app_sap.png

  4. Select the SAML Service Provider Configuration tab, and set the following configurations:

    Issuer or Entity ID 

    Enter the Issuer/EntityID of your SAP business platform instance provided in the SAP BTP metadata.

    Log in URL 

    The URL used to login to your SAP business platform provided in the SAP BTP metadata.

    NameID Format 

    Set to Email Address.

    Name Identifier 

    Set to Email.

    sap_sp_settings.png

  5. Save your changes.

Test your application integration

  1. Go to your SAP BTP Launchpad portal. Click on the Arculix Login link.

    sap_launchpad.png

  2. You will be redirected to the SSO page.

    Application login page with email

  3. After successful authentication, select your preferred MFA method to approve access to the SAP BTP application.

    Select MFA method

  4. You are redirected to the SAP Launchpad portal page via an easy and passwordless authentication method.

    sap_portal.png

Support

If you have questions or need assistance, contact SecureAuth Support.

Sales

Want to learn more about our MFA solutions? Contact our Professional Services for a demo today.

Disclaimer

All product names, trademarks, and registered trademarks are the property of their respective owners.

All company, product, and service names used in this document are for identification purposes only. The use of these names, trademarks, and brands do not constitute an endorsement by the SecureAuth Corporation.

In this section: