There are many alternatives available to achieve single sign-on to a NetWeaver (ABAP) system. I’ve already demonstrated these at DSAG AK Development as well as documented almost all of them in my blog. For instance, take a look at SAML 2.0, X.509 based logon or OAuth 2.0. All of the Read more…
The user creation scenario is an extension to the “simple” SAML 2.0 SSO scenario. Therefore, a pre-requisite is to have the SAML 2.0 IdP and SP configured to trust each other. A logon from IdP to SP with an existing user must work. In my case, the external Identity Provider Read more…
To be able to log in to your SAML 2.0 IdP after a SP redirect, the SP must be configured in your IdP. While this sounds obvious, it can be confusing when you have several clients in your IdP and several IdP in your SP. For instance, you must ensure Read more…
Scenario You send a SAML Bearer Assertion to the OAuth token service of SAP Gateway. The Return type is 400 Bad Request. Error message { “error”: “invalid_grant”, “error_description”: “Provided authorization grant is invalid. Exception was Message Assertion is not signed. For more information, consult the kernel traces or the OAuth 2.0 trouble shooting SAP note 1688545” } Root cause The error message contains a description of the root cause for the HTTP 400: “Exception was Message Assertion is not Read more…
SAP Help: Setting Up an OAuth 2.0 Client In this step an OAuth client is added. This is the client that logs on to NW ABAP on behalf of the end user. For this, the OAuth client is using an SAP user to log on. This user was created earlier Read more…
Configure NameID After adding the OAuth IdP its status is set to disabled. It can only be enabled after the NameID format is configured. Tx: SAML2 In the tab trusted providers select OAuth 2.0 Identity Providers to see all OAuth IdPs. Select the IdP you want to activate and click Read more…
After creating an OAuth client user assigning the permissions to call the OAuth protected OData service, it is time to start the actual OAuth client configuration. First, add an OAuth Identity Provider (IdP). The OAuth IdP NetWeaver ABAP accepts is a normal SAML 2.0 IdP. This is because NW ABAP Read more…
Current state is that a trust between Gateway as SP and Keycloak as IdP is established. While the previous step established the trust, the IdP is not enabled in SAP Gateway. Meaning that SAML2.0 logons are not possible. For this to work, the IdP must be enabled. Currently, enabling is Read more…
This is the final step of the task to establish a trust between SAP Gateway and Keycloak. The Keycloak SAML 2.0 IdP Metadata file downloaded in previous step is now imported into SAP Gateway as a IdP. This creates the trust on the SAP Gateway. Import SAML 2.0 IdP Metadata Read more…
As SAML 2.0 depends on trust, it is necessary to establish this trust by exchanging the metadata of the IdP and SP. When the SAML 2.0 client for Gateway (NPL001) was created, the metadata of the Gateway SP was important to Keycloak. In this step, the metadata of the IdP Read more…