Integrate SAP Analytics Cloud with Okta

Enable provisioning for your SAP Analytics Cloud instance to integrate with Okta.

Before you begin

• You have an active SAP Analytics Cloud integration and an Organization Account.
  • If you have a standard or trial subscription, your tenant is provisioned automatically and needs to be activated. See Activate Your Account.
  • If you want to provision the app using the SAP Business Technology Platform cockpit, see Create Your SAP Analytics Cloud Instance in SAP BTP Cockpit.
• You're a system owner with admin privileges that allow you to manage users.
• You've created an OAuth app in SAP Analytics Cloud. See Set Up Third-Party Access with OAuth Clients.
  • When you create the app, set the Purpose to Interactive Usage. This setting controls the authorization code flow for when a user signs in to the app.
  • Use this redirect URI: https://system-admin.okta.com/admin/app/generic/oauth20redirect.
• You have Client ID, Client Secret, Token Domain, and Authorization Domain values for your OAuth client. To find these values, go to System > Administration > App Integration in your SAP Analytics Organization Account.
• You have a tenant domain. To find this, go to System > Administration > Tenant Links in your SAP Analytics Organization Account.
• You know which attribute your SAP Analytics Cloud tenant uses for SAML mapping. To check this, go to System > Administration > Security in your SAP Analytics Organization Account, and check the User Attribute setting in your SAML SSO configuration. This value is User ID, Email, or Custom SAML Mapping. If your tenant uses custom SAML mapping, a SAML User Mapping column appears under Security > Users.

SAML user mapping

Mapping reference

On the app's Sign On tab, set Application username format to the same source attribute that produces your SAML NameID. If the provisioned username and the NameID don't match, users are created in SAP Analytics Cloud but can't sign in.

Add the app integration to Okta

1. In the Admin Console, go to Applications and Resources > Applications.

2. Search for and select the SAP Analytics Cloud app integration.
3. On the General tab, enter the Application label and click Done.
4. Click the Provisioning tab, click Configure API Integration, and select Enable API integration.
5. Enter your Token Domain without the /oauth/token endpoint and the https:// extension. Your token URL uses this format: https://<tenantName>.authentication.<region>.hana.ondemand.com/oauth/token.
6. Enter your Authorization Domain without the /oauth/authorize endpoint and the https:// extension. Your authorization URL uses this format: https://<tenantName>.authentication.<region>.hana.ondemand.com/oauth/authorize.
7. Enter your Tenant Domain without the https:// extension.
8. Enter your Client ID and Client Secret.
9. Optional. Select Import Groups if you want to import user groups into Okta.
10. Click Authenticate with SAP Analytics Cloud.
11. Enter your SAP Analytics Cloud admin credentials.
12. Click Accept.
13. When the authorization process completes, click Save.
14. Select To App under Settings. Click Edit, and then select the provisioning features that you want to enable.
15. Click Save.

Known limitations

• If your tenant's SAML mapping is User ID, SAP Analytics Cloud doesn't allow you to change the userName through the API. Changing a user's Okta username after provisioning doesn't update the username in SAP Analytics Cloud.
• SAP Analytics Cloud matches users by userName. An existing SAP Analytics Cloud user whose userName doesn't match the Okta username isn't matched during provisioning.
• If you switch your tenant to Custom SAML Mapping after users already exist, the SAML User Mapping column is empty for those users. You need to update it manually in SAP Analytics Cloud.