How to Configure Fiori

Launchpad and Web

Dispatcher to Support
SAML2 Using SAP Identity
Provider Step-by-Step
SAP NetWeaver or S4H – Gateway
© 2016 SAP AG. All rights reserved.

SAP, R/3, SAP NetWeaver, Duet, PartnerEdge, ByDesign, SAP

BusinessObjects Explorer, StreamWork, SAP HANA, and other SAP products
and services mentioned herein as well as their respective logos are
trademarks or registered trademarks of SAP AG in Germany and other
countries.

Business Objects and the Business Objects logo, BusinessObjects, Crystal

Ali Chalhoub Reports, Crystal Decisions, Web Intelligence, Xcelsius, and other Business
Objects products and services mentioned herein as well as their respective
logos are trademarks or registered trademarks of Business Objects Software
Ltd. Business Objects is an SAP company.

Sybase and Adaptive Server, iAnywhere, Sybase 365, SQL Anywhere, and
other Sybase products and services mentioned herein as well as their
respective logos are trademarks or registered trademarks of Sybase Inc.
Sybase is an SAP company.
Crossgate, m@gic EDDY, B2B 360°, and B2B 360° Services are registered
trademarks of Crossgate AG in Germany and other countries. Crossgate is an
SAP company.

All other product and service names mentioned are the trademarks of their
respective companies. Data contained in this document serves informational
purposes only. National product specifications may vary.

These materials are subject to change without notice. These materials are
provided by SAP AG and its affiliated companies ("SAP Group") for
informational purposes only, without representation or warranty of any
kind, and SAP Group shall not be liable for errors or omissions with respect
Document History

Document Version Authored By Description Date Created

1.0 Ali Chalhoub First release of this whitepaper July 18, 2018

Document Version Reviewer Description

Kiran Kola Global CoE July 26, 2018

2
How to Setup a Fiori Tile Step-by-Step Using Web IDE
www.sap.com

TABLE OF CONTENTS

Document History ...................................................................................................................................................... 2

ABSTRACT .....................................................................................................................................................5
Chapter 1 - Configuring SAP Service Provider ........................................................................................................... 5
Chapter 2 - Configuring Fiori Launchpad to Support SAML2 ..................................................................................... 5
Chapter 3 - Accessing Fiori Launchpad Using HTTPS with SAML2 ............................................................................. 5
Chapter 4 – Configuring Web Dispatcher with SAML2 .............................................................................................. 5
Chapter 5 – Troubleshooting ..................................................................................................................................... 5
CHAPTER 1 CONFIGURING SAP SERVICE PROVIDER ........................................................................................6
Overview of the Architecture .................................................................................................................................... 6
Configuring Scenario -1- Local Provider..................................................................................................................... 8
Configuring Scenario -1- Identity Provider .............................................................................................................. 12
Downloading Identity Provider Metadata ............................................................................................................... 19
Importing Identity Provider Certificate into Service Provider ................................................................................. 22
CHAPTER 2 CONFIGURING FIORI LAUNCHPAD TO SUPPORT SAML2 ............................................................. 41
Configuring Fiori Launchpad .................................................................................................................................... 41
Configuring IDP to support Login Name .................................................................................................................. 47
Testing SAML Using Fiori launchpad........................................................................................................................ 50
Configuring Single Logout Endpoint ........................................................................................................................ 51
Configuring Fiori Launchpad Designer ..................................................................................................................... 53
CHAPTER 3 .................................................................................................................................................. 54
ACCESSING FIORI LAUNCHPAD USING HTTPS WITH SAML2 ........................................................................... 54
How to access Fiori Launchpad Using SAML2 HTTPS .............................................................................................. 54
Configuring SAML2 to enable accessing Fiori Launchpad using HTTPS ................................................................... 54
CHAPTER 4 CONFIGURING WEB DISPATCHER WITH SAML2 ........................................................................... 58
Enabling Web Dispatcher to support SAML2 Scenario -2........................................................................................ 58
Downloading Service Provider Metadata ................................................................................................................ 59
Uploading Metadata into the Identity Provider ...................................................................................................... 60
Testing Fiori Launchpad using Web Dispatcher and SAML2.................................................................................... 61
CHAPTER 5 TROUBLESHOOTING ................................................................................................................... 63
Error 1 - Signature verification of metadata was not successful ............................................................................. 63
Error 2 – No RelaySate mapping found for RelayState value …. ............................................................................. 64
Error 3 – HTTPS Status 400 – Service Provider SLO endpoint has not received SAML2 message ........................... 64

4
Abstract
Chapter 1 - Configuring SAP Service Provider
1.1. Overview of the Architecture
1.2. Configuring Scenario -1- Service Provider
1.3. Configuring Scenario -1- Identity Provider
1.4. Downloading Identity Provider Metadata
1.5. Importing Identity Provider Certificate into Service Provider

Chapter 2 - Configuring Fiori Launchpad to Support SAML2

2.1. Configuring Fiori Launchpad
2.2. Configuring IDP to support Login Name
2.3. Testing SAML Using Fiori launchpad
2.4. Configuring Single Logout Endpoint
2.5. Configuring Fiori Launchpad Designer

Chapter 3 - Accessing Fiori Launchpad Using HTTPS with SAML2

3.1. How to access Fiori Launchpad Using SAML2 HTTPS
3.2. Configuring SAML2 to enable accessing Fiori Launchpad using HTTPS

Chapter 4 – Configuring Web Dispatcher with SAML2

4.1. Enabling Web Dispatcher to support SAML2 Scenario -2
4.2. Downloading Service Provider Metadata
4.3. Uploading Metadata into the Identity Provider
4.4. Testing Fiori Launchpad using Web Dispatcher and SAML2

Chapter 5 – Troubleshooting
5.1. Error 1 - Signature verification of metadata was not successful
5.2. No RelaySate mapping found for RelayState value ….
5.3. HTTPS Status 400 – Service Provider SLO endpoint has not received SAML2 message

5
 Chapter 1
Configuring SAP Service Provider

Welcome to How to Configure Fiori Launchpad and Web Dispatcher to Support SAML2 Using SAP Cloud Platform
Identity Authentication Provider Step-by-Step. In this e-book you will find all the details are needed to let you
configure a Web Dispatcher with Fiori launchpad on on-premise SAP NetWeaver Gateway system. In this eBook
we will discuss and show the user how to configure:
• SAP Cloud Platform Identity Provider
• Fiori launchpad on on-premise system running NetWeaver 7.50 or higher with Web Dispatcher in the
front

1. To make the process simple, the steps provided in this book are done against a
Note single NetWeaver Gateway system no ERP involved.

2. NetWeaver 7.5 or higher

1. Requirement 3. SAP Web Dispatcher with SSL already configured
4. Fiori launchpad already configured and working with SSL support

Overview of the Architecture

Before we can start our configuration, we need to look at the Architecture that this book will address. This
eBook will cover two scenarios:
1. SAP Cloud Platform Identity Provider with SAP Fiori launchpad running on on-premise NetWeaver
system
2. SAP Cloud Platform Identity Provider with Web Dispatcher and SAP Fiori launchpad running on on-
premise NetWeaver system

6
2. The architecture below covers scenario number 1

Figure 1 SAP Cloud Platform Identity Provider with Fiori launchpad

1. A web client makes a request to SAP Fiori launchpad
2. SAP Fiori launchpad redirects the client to SAP Cloud Platform Identity Provider
3. Client is asked to authenticate with SAP Cloud Platform Identity Provider
4. After the client is authenticated successfully, a SAML XML assertion is generated which contains all
the information needed about the client such as user id, first name, last name and all this sent to
the client
5. The client makes a post request to SAP Fiori launchpad where the XML assertion is validated
NetWeaver level and a session is created and the client is granted access to Fiori launchpad

3. The architecture below covers scenario number 2.

Figure 2 SAP Cloud Platform Identity Provider with SAP Web Dispatcher

7
 1. A web client makes a request to SAP Web Dispatcher
2. SAP Web Dispatcher redirect the client to SAP Cloud Platform Identity Provider
3. Client is asked to authenticate with SAP Cloud Platform Identity Provider
4. After the client is authenticated successfully, a SAML XML assertion is generated which contains all the
information needed about the client such as user id, first name, last name and all this sent to the client
5. The client makes a post request to Web Dispatcher where the XML assertion is validated at the Web
Dispatcher level
6. Finally, a session is created, and the client is granted access to Web Dispatcher and Fiori launchpad

Configuring Scenario -1- Local Provider

In this scenario we will be configuring SAP Fiori launchpad on-premise to with SAP Cloud Platform Identity
Provider without Web Dispatcher.

In this section there is an assumption, that Fiori launchpad is configured in

Note NetWeaver system and Fiori launchpad can be accessed using HTTPS. As
well the user does have access to SAP Cloud Platform Identity Provider.

4. Connecting to SAP Service Provider. In our configuration that would be our NetWeaver Gateway System

1. Login to SAP NetWeaver system

2. Execute tCode saml2
3. Click on Enable SAML 2.0 Support if no SAML has been configured in the system
4. We should see the following screen below

Figure 4 Enabling SAML2 in NetWeaver

5. Select Create SAML 2.0 Local Provider

8
6. Now enter a name that represent the Local Provider Configuration. Recommendation would be
<INSTANCEID>_SAML2

Figure 5 Providing name to the Local Provider Service Provider

7. Click Next
8. On this screen below do not do anything, click Next as well

Figure 6 Miscellaneous

9. Under Identity Provider Discovery: Common Domain Cookie (CDC), make sure selection Mode is set
to Automatic as shown below:

9
 Figure 7 Setting selection Mode

Note Selection Mode Automatic means the user will not need to select the
default authentication provider. It will be selected automatically.

10. Click Finish

11. We should see the following screen below:

Figure 8 Creating Local Provider Configuration

12. Next, we need to download the Metadata of our Local Provider, so it can be imported into the
Identity Provider. Click on Metadata as shown below:

10
 Figure 9 Accessing Metadata information
13. Click on Download Metadata

Figure 10 Downloading Metadata xml information

14. Save the XML file to your local machine because it will be required in the next step when we
configure the Identity Provider

11
Configuring Scenario -1- Identity Provider

5. Connecting to SAP Cloud Platform Identity Provider to configure it if it is not already configured

1. Open your Web browser

2. Enter the URL of the SAP Cloud Platform Identity Provider. For example:
IDP Host: https://xxxx.accountsxxxx.ondemand.com/admin/#
3. Once logged in the screen may look like the one below:

Figure 11 SAP Cloud Platform Identity Authentication Administration Console

This section is not needed if your administrator provided you already with
Note a user id and password to login to the system. You can skip the creation
user section.

12
4. Once logged in, click on Applications under Applications & Resources

Figure 12 Accessing Applications section

13
5. Click on the Add sign to create a new application which is will be the application to handle our
authentication to Fiori launchpad

Figure 13 Adding new application to our Fiori launchpad

14
6. Give it a name and click save, any name for example three characters of the service provider you are
dealing with. But again, that name can be anything you like

Figure 14 Creating application

15
7. After the application is created, the following screen should be displayed

Figure 15 Configuration screen of the application

8. Click on SAML 2.0 Configuration

Figure 16 Accessing SAML2 configuration

16
9. Click on Browse to import the Metadata. Select the Metadata we downloaded from step 13 under
Configurating Scenario -1- Service Provider

10. After the import, the screen should now contain the address of your NetWeaver as shown below. This
information is provided to the Identity Provider by the Metadata that we have imported

Figure 17 Importing Service Provider Metadata

17
11. Scroll down on the screen until you see the Single Logout Endpoint section

Figure 18 Single Logout Endpoint

Note Notice the certificate of the Service Provider is already here. The reason
for this is because it is part of the Metadata that we imported.

18
 12. Click on Save so the configuration is saved

Figure 19 Saving Identity Provider Application configuration

Downloading Identity Provider Metadata

1. Now that the configuration is done, we need to download the Metadata of the Identity Provider so we
can import it into our Service Provider. In our example our service provider is our NetWeaver Gateway
system. Click on Home as shown below:

Figure 20 Accessing Identity Provider Home page

19
2. Scroll down to the Application & Resources section

3. Click on Tenant Settings as shown below

Figure 21 Accessing Tenant settings

4. Click on SAML 2.0 Configuration

Figure 22 Accessing SAML 2.0 configuration

20
5. Click on Download Metadata file. This file as we mentioned, we need to import it into our Service
Provider which is our NetWeaver Gateway system

Figure 23 Downloading Metadata File of Identity Provider

This section shows you how to download and access the Metadata of the
Note Identity Provider. In our configuration, we will not be using the Metadata,
instead we will be configuring the Service Provider manually.

21
Importing Identity Provider Certificate into Service Provider

1. From the Identity Provider Tenant Settings section and scroll down the Signing Certificate section as
shown below:

Figure 24 Signing Certificate section

2. Copy all the content in “Insert as Text” in the box
3. Open Notepad or a text editor and paste the content in it
4. Save the file as sapidp.cer or whatever you like

Figure 25 Creating IDP public certificate

22
5. Copy the name of the Identity Provider basically, the host name of the identity provider under the
Signing Certificate, where the Subject DN: CN= and before the O=, copy the hostname

Figure 26 Identifying the hostname of the Identity Provider

6. Now that the Metadata has been downloaded and the public certificate of the IDP has been created,
but because there is an issue with the NetWeaver Gateway where importing the Metadata of the
Identity Provider does not work, we need todo the configuration manually.

7. Go back to the Service Provider and access your SAML2 configuration screen as shown below by either
using tCode saml2 or access the SAML2 configuration by using the URL. Example:

http(s)://<HOST-NAME>:<PORT>/sap/bc/webdynpro/sap/saml2?sap-client=<CLIENT-ID>

Figure 27 SAML 2 Service Provider configuration screen

23
8. Click on Trusted Provider tab

Figure 28 Accessing Trusted Providers

9. Click on Add to select Manually

Figure 29 Adding the Identity Provider name manually

24
10. Enter the name of the IDP or Identity Provider by pasting the name we copied from the previous step

Figure 30 Entering the name of the IDP manually

11. Screen should look like this

Figure 31 IDP domain name

25
12. Click Next
13. Now provide the Primary Signing Certificate. Basically, it is the public certificate of our IDP that we
created in step 4 where we created the file sapidp.cer or whatever the file it was called by clicking on
browse as shown below

Figure 32 Providing the public certificate of the IDP

14. Select Upload from File

Figure 33 Uploading the public certificate of the IDP

26
15. Make sure under Artifact Profile, Sign and Require Signature, are set to Never

Figure 34 Setting Artifact Profile

16. Click Next
17. Under Single Sign-On Endpoints click on Add. Note: The Sign-On Endpoints is located under the IDP.
Therefore; this step require you to go back to the IDP to copy the HTTP-Redirect

Figure 35 Adding Sign-On Endpoints

27
18. Go back now to the IDP Tenant Settings and copy the full URL of HTTP-Redirect under Single Sign-On
Endpoint as shown below

Figure 36 Copying the HTTP-Redirect

19. Go back to the Service Provider and Paste the HTTP Redirect as shown below:

Figure 37 Adding the HTTP-Redirect in the NetWeaver Gateway System

28
20. Click OK and click again on Add to add the HTTP-POST

Figure 38 Adding HTTP-POST

21. Select from the Binding Dropdown list HTTP POST

Figure 39 Selecting HTTP POST

22. Go back to the Identity Provider ( IDP ) and copy HTTP-POST URL under the Tenant Settings as shown
below:

Figure 40 HTTP-POST URL under the Single Sign-On Endpoint IDP

29
23. Paste the HTTP-POST under the Binding section in the Service Provider

Figure 41 Pasting HTTP-POST URL from the IDP

24. Click OK
25. Click on Next
26. Now we need to configure Single Logout Endpoints, click on Add

Figure 42 Single Logout Endpoints

27. Select HTTP Redirect under Binding as shown below

Figure 43 Adding HTTP Redirect for Single Logout Endpoints

30
28. Go back to your IDP and copy the HTTP-Redirect Under the Single Logout Endpoint section as shown
below:

Figure 44 Copying the URL of HTTP-Redirect under Signle Logout Endpoint

29. Go back to your Service Provider, NetWeaver Gateway system, and paste it as shown below:

Figure 45 Pasting HTTP Redirect URL for Single Logout Endpoints

31
30. Click OK
31. Click on Add again
32. Select HTTP Post under Binding:

Figure 46 Selecting HTTP POST

33. Go back to your Tenant Settings under your IDP and copy the HTTP-POST URL under Single Logout
Endpoint Section as shown below:

Figure 47 Copying HTTP-POST for Single Logout Endpoint

32
34. Go back to your Service Provider and paste the HTTP-POST URL as shown below:

Figure 48 Adding HTT POST URL to the Service Provider

35. Click OK
36. Click on Next
37. We should see now the Artifact Endpoints screen

Figure 49 Artifact Endpoints configuration

38. Click on Add

Figure 50 Adding Assertion URL under Artifact configuration screen

33
39. Bo back to your IDP under the Tenant Settings and copy the Assertion Consumer Service Endpoint as
shown below:

Figure 51 Copying the Assertion Consumer Service Endpoint URL

40. Go back to your Service Provider and paste the URL HTTP-POST as shown below:

Figure 52 Adding Assertion Consumer Service Endpoint URL

34
41. Click OK
42. Click Next
43. Click Finish
44. We should have the following configuration, click on Edit

Figure 53 Trusted Providers configuration screen

35
45. Click on Add under Details of Identity Provider …

Figure 54 Adding details of Identity Provider

Note: If Add is grayed out, click on the Edit button beside the Save button

46. Select Unspecified as shown below and click OK

Figure 55 Setting Supported NameID Formats

36
47. Finally click Save as shown below

Figure 56 Saving Trusted Providers configuration

37
48. Click on Enable to enable the configuration as shown below:

Figure 57 Enabling the configuration

49. Click on OK

Figure 58 Confirming the enablement of our SAML 2.0 configuration

50. Next, we need configure the relay state, click on Local Provider Tab

38
51. Click on Service Provider Settings

Figure 59 Adding Relay State

52. Click on Edit button
53. Scroll down until you see Relay State Mapping. Click on Add as shown below:

Figure 60 Adding Relay State for Fiori launchpad

39
54. Enter a Relay State name and the Fiori launchpad path as shown below:

Figure 61 Providing the Fiori launchpad path to the RelayState

RelaySate: fiori
Path: /sap/bc/ui5_ui5/ui2/ushell/shells/abap/FioriLaunchpad.html

55. Click on OK
56. Next paste the same Fiori launchpad path to the Default Application Path as shown below:

Figure 62 Providing default application path

57. Click on Save

40
 Chapter 2

Configuring Fiori Launchpad to Support SAML2

Configuring Fiori Launchpad

In this section Fiori launchpad needs to be configured to support SAML2. In this section, we will go through all
the steps needed to allow Fiori launchpad to support SAML2 authentication.

1. Login to the FrontEnd NetWeaver Gateway System

2. Execute tCode SICF
3. Under Service Name type USHELL

Figure 63 Accessing SICF

41
4. Press F8 to execute
5. Click on ushell under ui5_ui5/ui2 as shown below

Figure 64 Accessing USHELL Service Logon Data

42
6. Click on Logon Data tab

Figure 65 Accessing Logon Data

43
7. If you Procedure is set to Alternative Logon Procedure and SAML Configuration already set, then you
are done on this section. If not, then follow these steps below:
a. Click on Edit

Figure 66 Clicking on Edit to alter the Logon Data Procedure

44
b. Under Procedure drop down list change it from Standard to Alternative Logon Procedure
c. In the Logon Data section scroll down
d. Change the Logon Procedure List by scrolling all the way until 8 SAML Logon is shown

Figure 67 Changing the order of the Logon Procedure List

45
e. Change 8 to 1

Figure 68 Changing the order by selecting SAML Logon as 1

f. Press Enter
g. We should see the following result

Figure 69 SAML Logon is the second selection

Note Even though we set the order to be 1, Logon Through HTTP Fields is
always 1 and then comes our SAML Logon based on the order we set.

46
 h. Click on Save

Figure 70 Saving the configuration of the USHELL

Configuring IDP to support Login Name

By default, when configuring SAML2 in NetWeaver, it uses Name ID attribute Login Name. Therefore, SAP
Identity Provider needs to be configured to support NameID. To do that, follow the following steps:
1. Go back to your SAP Identity Provider
2. Login
3. Click on Applications & Resources
4. Click on Applications
5. Click on Name ID Attribute as shown below:

Figure 71 Configuring Name ID Attribute

47
6. Select Login Name

Figure 72 Setting Login Name for Name ID Attribute

7. Click Save
8. Next since our NetWeaver uses Login Name ID, but our IDP uses different ID and naming
convention, we need to provide the Login ID of our NetWeaver system to the IDP in order todo the
mapping. To do that, do the following:
a) Click on Users & Authorizations
b) Click on User Management as shown below:

Figure 73 Accessing User Management

c) Click on your user

48
d) Click on Edit as shown below:

Figure 74 Editing IDP user information

e) Scroll down
f) Until you see Login Name
g) Type the Login ID of the NetWeaver Gateway system

Figure 75 Altering User information

h) Click on Save

49
Testing SAML Using Fiori launchpad

To test the configuration, we need to access Fiori launchpad

1. Open web browser, preferably Chrome

2. Enter the URL of your Fiori launchpad
http://<DOMAIN>:8443/sap/bc/ui5_ui5/ui2/ushell/shells/abap/FioriLaunchpad.html

Because we configured our Service Provider by going to the following URL

Note http://<DOMAIN>/sap/bc/webdynpro/sap/saml2?sap-client=<CLIENT-
ID>&sap-language=EN#. WE MUST access Fiori launchpad using http and
not HTTPS. We will see how we can change this later.

3. If everything is configured correctly, the web browser will redirect the request to the IDP as shown
below:

Figure 76 Redirecting to SAP Identity Provider

50
 4. Login with your IDP user ID and password. Fiori launchpad should log you in successfully

Figure 77 Fiori launchpad

Configuring Single Logout Endpoint

Now that we have Fiori Launchpad configured with SAML2 using HTTP. Next step is to configure the Logoff
button in Fiori Launchpad to redirect the request back to the SAML2 login screen.

In order to configure the logout button in Fiori Launchpad to redirect to SAML2 login screen, we need to do the
following:
1. Go back to your Identity Provider and login
2. Expand Applications & Resources
3. Click on Applications
4. Click on SAML 2.0 Configuration
5. Scroll down to the section Single Logout Endpoint

Figure 78 Single Logout Endpoint URL

6. Copy the URL of HTTP-Redirect
7. Once the URL is copied, go to the NetWeaver Front-End
8. Execute tCode /nSICF
51
9. Under service name type logoff
10. Click on Execute or press F8
11. Double click on the node sap/public/bc/icf/logoff
12. Click on Edit icon on the top left
13. Click on the Error Pages
14. Under Logon Errors paste the URL we copied from step 6 as shown below:

Figure 79 Configuring Logoff ICF node

15. Click on Logoff Page tab
16. Make sure under Redirect to URL the value is set to
/sap/bc/ui5_ui5/ui2/ushell/shells/abap/FioriLaunchpad.html or whatever your Fiori Launchpad
relative URL is
Note: If you were asked to enter user ID and password, enter your NetWeaver or S4H user ID and
password

17. Save your configuration

18. Now when clicking on Logoff button in Fiori Launchpad, you are redirected to the login screen of the
Identity Provider

52
Configuring Fiori Launchpad Designer

In this section we will configure Fiori Launchpad Designer to support SAML2.

1. Login to the Front-End NetWeaver Gateway system
2. Execute tCode /nSAML2
3. Click on Local Provider
4. Click on Service Provider Settings
5. Click on Edit button on the top left
6. Under Relay State Mapping click on Add
7. Enter the following configuration:
RelayState: fioridesigner
Path: /sap/bc/ui5_ui5/sap/arsrvc_upb_admn/main.html
8. Click OK
9. Click Save
10. Configuration should look like this screen below:

Figure 80 Configuring Fiori Launchpad Designer Relay State

53
 Chapter 3

Accessing Fiori Launchpad Using HTTPS with SAML2

How to access Fiori Launchpad Using SAML2 HTTPS

If SAML2 is configured to access Fiori Launchpad using HTTP, then continue reading this section to learn how to
configure SAML2 on NetWeaver while accessing Fiori Launchpad using HTTPS. If SAML2 is not configured at all in
the system, then go back chapter 1 to learn how to configure the system using HTTP.

Assumption: An assumption is made in this section that the user has read chapter 1 already and
configured SAML2 to support Fiori Launchpad using HTTP protocol.

Configuring SAML2 to enable accessing Fiori Launchpad using HTTPS

1. Login into your NetWeaver Gateway system

2. Identify what is the secure port NetWeaver is using. This can be identified by:
a. Issue tCode /nSMICM on the Front-End
b. From the menu select Goto or press SHIFT + F1
c. Select Services
d. Under protocol HTTPS find out the port number
3. Now that we have the port number, we need to go to SAML2 configuration page
4. Execute tCode /nSAML2 from the Front-End
5. Once the configuration screen has opened, we need to do the following:
a. In the URL change the protocol from HTTP to HTTPS
b. Change the port to whatever the port of your HTTPS that we recorded from step 2.b
c. Press Enter

54
6. Click on Metadata as shown below

Figure 81 Accessing Metadata for HTTPS SAML2 configuration

7. Click on Download Metadata

Figure 82 Downloading Metadata for SAML2 HTTPS

8. Save it on your local disk
9. Now we need to go back to our Identity Provider
10. Once logged in into your Identity Provider, expand Application & Resources
11. Click on Applications
12. Make sure you are on your application that you already configured for SAML and select
SAML 2.0 Configuration as shown below:

55
 Figure 83 SAML 2.0 Configuration Screen
13. Scroll up until you see Define from Metadata and click on Browse as shown below:

Figure 84 Uploading Service Provider Metadata

14. Provide the Metadata file of the service provider from the previous step
15. Verify that the URL has been updated to the HTTPS URL by scrolling down to the section
Assertion Consumer Service Endpoint, you should see the new URL got updated as shown below:

Figure 85 URL of the Assertion Consumer Service Endpoint

56
16. Save your changes
17. Test your new configuration by accessing Fiori Launchpad using HTTPS
18. The browser should direct you now to your Identity Provider
19. Login with your Identity Provider User ID and password
20. After successful login, Fiori Launchpad home page should be displayed

Figure 86 Fiori Launchpad using SAML2 with HTTPS

57
 Chapter 4
Configuring Web Dispatcher with SAML2

In this section, we are going to learn how we can configure Web Dispatcher to support SAML2 when accessing
Fiori Launchpad using SAML2 authentication method.

In this section we assume you have already configured SAML2 with

HTTP or HTTPS and you have a fully functional working system.
Fiori Launchpad can be accessed by the user and can login using
Assumption SAML2 successfully

Second assumption you have Web Dispatcher configured in your

system and Fiori Launchpad can be accessed using Web Dispatcher

Enabling Web Dispatcher to support SAML2 Scenario -2

Figure 87 Scenario 2 Web Dispatcher with SAML2

Because we are going to use a new hostname such as a Web Dispatcher, we need to download the Metadata of
the Service Provider one more time but this time, we need to access the SAML2 configuration of the service
provider using the Web Dispatcher. But if we try download the Metadata, we are going to get an error 503
Service not available and the reason for that is because the Web Dispatcher does not know anything about the
following path /sap/saml2/sp/metadata, therefore; we need to do some modification to the Web Dispatcher
configuration file.

1. Backup your Web Dispatcher configuration file sapwebdisp.pfl

2. Open sapwebdisp.pfl in your favorite text editor

58
 3. Alter the SRCURL and add /sap/saml2 to it see below an example:

Figure 88 Updating Web Dispatcher configuration

4. Save your changes
5. Restart Web Dispatcher

Downloading Service Provider Metadata

1. Login to your NetWeaver Front-End

2. Execute tCode /nSAML2 from the Front-End
3. Once the configuration screen has opened, we need to do the following:
a. In the URL change the protocol that the Web Dispatcher is using
b. Change the port to whatever the port of your Web Dispatcher
c. Press Enter
d. Login to your NetWeaver system
4. Click on Metadata as shown below

Figure 89 Accessing Metadata for Web Dispatcher SAML2 configuration

59
 5. Click on Download Metadata

Figure 90 Downloading Metadata for SAML2 for the Web Dispatcher

6. Save it on your local disk

Uploading Metadata into the Identity Provider

1. Go back to our Identity Provider

2. Once logged in into your Identity Provider, expand Application & Resources
3. Click on Applications
4. Make sure you are on your application that you already configured for SAML and select
SAML 2.0 Configuration as shown below:

Figure 91 SAML 2.0 Configuration Screen

60
 5. Scroll up until you see Define from Metadata and click on Browse as shown below:

Figure 92 Uploading Service Provider Metadata

6. Provide the Metadata file of the service provider from the previous step
7. Verify that the URL has been updated to the Web Dispatcher URL by scrolling down to the section
Assertion Consumer Service Endpoint, you should see the new URL got updated as shown below:

Figure 93 URL of the Assertion Consumer Service Endpoint

8. Save your changes

Testing Fiori Launchpad using Web Dispatcher and SAML2

1. Test your new configuration by accessing Fiori Launchpad using Web Dispatcher URL
2. The browser should direct you now to your Identity Provider
3. Login with your Identity Provider User ID and password

61
4. After successful login, Fiori Launchpad home page should be displayed

Figure 94 Accessing Fiori Launchpad using Web Dispatcher with SAML2

62
 Chapter 5
Troubleshooting

In this chapter, we will discuss all the issues that the administrator could face during the configuration process.

Error 1 - Signature verification of metadata was not successful

This issue occurred if you downloaded the metadata of the Identity Provider and you tried to upload it into the
service provider, you may see the error below:

Figure 95 Error 1 Signature verification issue

Solution:
Instead of uploading the metadata, select the option upload manually as discussed in the above section,
Importing Identity Provider Certificate into Service Provider, in Chapter 1

63
Error 2 – No RelaySate mapping found for RelayState value ….

Solution:

There are two possibilities for this error. We will start with the first one.
The user is trying to access Fiori Launchpad either by a URL that does not match the URL under the Assertion
Consumer Service Endpoint. To verify, do the following:
1. Login to your SAP Identity Provider
2. Click and expand Applications & Resources
3. Click on Applications
4. Click on SAML 2.0 Configuration
5. Scroll down to Assertion Consumer Service Endpoint
6. If the URL protocol and hostname does not match the URL protocol and hostname of the Fiori
Launchpad, then you need to either update the Assertion Consumer Service Endpoint of change the
Fiori Launchpad URL protocol and hostname to match the Assertion Consumer Service Endpoint

No RelayState has been created

To fix this issue, follow the step 55 under Chapter1 section “Importing Identity Provider Certificate
into Service Provider”

Error 3 – HTTPS Status 400 – Service Provider SLO endpoint has not received SAML2
message

The reason for this error is because the user configured the Logoff Page to redirect to the SAML2 Logout
Endpoint.
Solution:
To fix the issue, refer to Chapter 2 section Configure Single Logout Endpoint

64