Szenario A trust between the SAML 2.0 IdP and SP is created. A user tries to log on to NetWeaver and after successfully logging in at the IdP, the SP is denying access. Problem An error in the BAdI create_user_to_federate is thrown. Exception type CX_SY_REF_IS_INITIAL. Trace Use the diag tool Read more…
Szenario A trust between the SAML 2.0 IdP and SP is created. A user tries to log on to NetWeaver and after successfully logging in at the IdP, the SP is denying access. Problem Using the diag tool to get a trace of the SAML 2.0 logon. The incoming request Read more…
SAP provides a nice trace tool for troubleshooting login errors with SAML 2.0: Sec Diag Tool. It is a WebDynpro ABAP application. Make sure to activate the necessary ICF services first before running the tool. URL: /sap/bc/webdynpro/sap/sec_diag_tool/ In NPL: https://vhcalnplci:44300/sap/bc/webdynpro/sap/sec_diag_tool/ With the tool you can start a SAML2 trace. When Read more…
In the SAML 2.0 SSO logon with automatic user creation scenario, the user is created in the SAP system by a BADI. The user information send by the SAML 2.0 IdP is contained in the SAML response. In my previous blog I have shown how the user profile is configured Read more…
When you try to develop a Fiori app with the SAP Fiori tools for VS Code you get the error “btoa is not defined”. This error is caused by another SAP extension: mobile Development Kit extension for Visual Studio Code. You have to disable the MDK extension to be able Read more…
The user creation scenario is an extension to the “simple” SAML 2.0 SSO scenario. Therefore, a pre-requisite is to have the SAML 2.0 IdP and SP configured to trust each other. A logon from IdP to SP with an existing user must work. In my case, the external Identity Provider Read more…
The ICF configuration is more complex than the standard SAML 2.0 configuration. Instead of just validating the SAML 2.0 response, the response must be validated, and a user created or update. To be able to create / update a user, the response received must be handled by a service user. Read more…
SAP is ending the SAP Cloud Platform Neo (SCP Neo) Trial and for everyone to learn and try out SCP services, the SCP Cloud Foundry (SCP CF) Trial is the only offering left. I wrote down my thoughts on this and why I think that the free trial approach is Read more…
SAP Help In the previous blog I detailed the BADI provided by SAP for creating and updating a user that logs on via SAML 2.0 and what to take care of. In this blog I’ll detail how to implement the BADI. The implementation means that some ABAP coding is needed. Read more…
The BADI you have to extend to be able to create or update a user in the SAP NW system based on the SAML 2.0 information is BADI_SAML20_USER_CREATE_UPDATE. It offers two methods, one for creating a new user, one for updating an existing user. Keep in mind that the SAP Read more…