Mastering SAP Analytics Cloud

Mastering SAP Analytics Cloud

Copyright © 2019 by Ingo Hilgefort 1



1 Copyright Copyright © 2019 by Ingo Hilgefort All rights reserved. Neither this publication nor any part of it may be copied or reproduced in any form or by any means or translated into another language, without the prior consent of Ingo Hilgefort. Ingo Hilgefort makes no warranties or a representation with respect to the content hereof and specifically disclaims any implied warranties of merchantability or fitness for any particular purpose. Ingo Hilgefort assumes no responsibility for any errors that may appear in this publication. This publication contains references to the products of SAP AG. SAP, R/3, SAP NetWeaver, Duet, PartnerEdge, ByDesign, Clear Enterprise, SAP BusinessObjects Explorer, and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and other countries. Business Objects and the Business Objects logo, BusinessObjects, Crystal Reports, Crystal Decisions, Web Intelligence, Xcelsius, and other Business Objects products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP France in the United States and in other countries. SAP AG is neither the author nor the publisher of this publication and is not responsible for its content. SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty. All of the screenshots and graphics reproduced in this book are subject to copyright © SAP AG, Dietmar-Hopp-Allee 16, 69190 Walldorf, Germany. SAP, the SAP-Logo, mySAP, mySAP.com, mySAP Business Suite, SAP NetWeaver, SAP R/3, SAP R/2, SAP B2B, SAPtronic, SAPscript, SAP BW, SAP CRM, SAP Early Watch, SAP ArchiveLink, SAP GUI, SAP Business Workflow, SAP Business Engineer, SAP Business Navigator, SAP Busi-ness Framework, SAP Business Information Warehouse, SAP inter-enterprise solutions, SAP APO, AcceleratedSAP, InterSAP, SAPoffice, SAPfind, SAPfile, SAPtime, SAPmail, SAPaccess, SAP-EDI, R/3 Retail, Accelerated HR, Accelerated HiTech, Accelerated Consumer Products, ABAP, ABAP/4, ALE/ WEB, Alloy, BAPI, Business Framework, BW Explorer, Duet, Enjoy- SAP, mySAP.com e-business platform, mySAP Enter-prise Portals, RIVA, SAPPHIRE, TeamSAP, Webflow and SAP PRESS are registered or unregistered trademarks of SAP AG, Walldorf, Germany. All other products mentioned in this book are registered or unregistered trademarks of their respective companies.



2 Introduction The integration of SAP systems and SAP BusinessObjects BI tools has constantly improved since the year 2008 when SAP acquired SAP BusinessObjects. Over the years the focus of the overall SAP BusinessObjects BI portfolio has shifted from Crystal Reports and Web Intelli-gence to Xcelsius (now being called SAP Dashboards) and SAP BusinessObjects Explorer, to SAP BusinessObjects Analysis, edition for Mi-crosoft Office, SAP Design Studio, and SAP Lumira – and now to SAP Analytics Cloud. With SAP Analytics Cloud you as customer have the option to consolidate all your analytic needs and requirements into a single cloud-based solution that covers analytics, planning, application building, and predictive scenario and will evolve over time into true cloud-based analytics-platform.

1.1 Target Group The book is written for those who are looking for simple instructions on how to get started with SAP Analytics Cloud and starts with sim-ple steps on how to analyze information contained in a single spreadsheet and continues covering topics on how to connect to live on-premise data sources – such as SAP HANA and SAP BW. In addition, topics such as Story Design, effective data visualization, and sharing of your analytics content will be covered. It is not the goal of this book to make you an expert in SAP Analytics Cloud or to explain every detailed aspect of the product, but instead the focus is to start on a beginner level and get you started as well as get you enough information and instructions, so that you can get to an intermediate level of knowledge.

1.2 Focus Areas Please note, that this book is focusing on SAP Analytics Cloud and in particular on the analytics related workflows. The book is not focus-ing on the planning workflows nor is the book focusing on the application building workflows – as that will be covered in a separate book.

1.3 Technical Prerequisites All steps and examples in this book are based on the most recent version of SAP Analytics Cloud. In case there are specific sample data sets required to follow the steps, those files will be available for download and the location will be mentioned as part of the steps.



3 Structure of the Book Here is an overview of the content of the chapters.

1.4 Chapter 4 — SAP Analytics Could Introduction This chapter will introduce you to SAP Analytics Cloud and the main components of the product. In addition, the chapter will also provide a positioning of SAP Analytics Cloud and outline how the product fits into the overall SAP Analytics portfolio and who the main audience for the product is.

1.5 Chapter 5 — SAP Analytics Could - QuickStart This chapter will provide you with a quick introduction to the main concepts in SAP Analytics Cloud and get you started with some simple scenario and data uploaded to SAP Analytics Cloud so that you can make yourself familiar with the workflows.

1.6 Chapter 6 — Data Connection In this chapter we will learn more about the data connections from SAP Analytics Cloud towards cloud-based data sources as well as on-premise data sources. We will learn how to establish the data connectivity towards those data sources and how we can bring in the data into SAP Analytics Cloud.

1.7 Chapter 7 — Data Preparation In this chapter we will focus on the data preparation capabilities of SAP Analytics Cloud and learn what capabilities are available to us as part of the data wrangling offered in SAP Analytics Cloud.

1.8 Chapter 8 — Data Modelling This chapter will give a detailed overview on the different aspects of data modelling in SAP Analytics Cloud. We will learn about the differ-ent model types, dimensions, measures, hierarchies, and currencies.

1.9 Chapter 9 — Story Design After we loaded data and connected to live data, in this chapter we will focus on the story design and learn more about the different visualization options, such as charts, maps, tables, and input controls.

1.10 Chapter 10 — Advanced Story Design After we uncovered the basic story design workflows in the previous chapter, we will focus on the more advanced techniques now. In this chapter we will learn about features such as calculations, linked analysis, conditional formatting, bookmarking, and data blending.

1.11 Chapter 11 — Smart Capabilities In this chapter we will review the smart capabilities of SAP Analytics Cloud and learn more about functionality like Smart Insight, Search to Insight, Smart Discovery, forecasting, and the ability to integrate R based information.

1.12 Chapter 12 — Sharing & Collaboration This chapter will outline in detail, how you can leverage the collaboration capabilities of SAP Analytics Cloud and share your stories with your users and discuss the analytical content.

1.13 Chapter 13 — Mobile Access and Mobile Design This chapter will outline the details on how you can provide access to your analytical content for mobile devices, as well as details on how you should create analytical content for your mobile users, including the ability to integrate with the Roam BI option.

1.14 Chapter 13 — Digital Boardroom This chapter will focus on the workflow on how you can leverage your analytical content and setup new Digital Boardroom content. In addition, you will learn about the specific capabilities available to you as part of the Digital Boardroom setup.

1.15 Chapter 14 — SAP Analytics Cloud for the Administrator This chapter will focus on the administrative topics, such as users and groups, data level security, object level security, folders and objects, user monitoring, lifecycle management, and so on.

1.16 Chapter 15 — Common Tutorials This chapter will provide step by step guidelines for a set of common scenarios, such as calculating a variance between the current and previous period revenue, or the ability to convert from a USD based data to EUR as part of your story. The focus in this chapter is to use a set of common tasks and provide you with detailed step by step instructions, so that you can follow those steps to put those scenarios into action.

1.17 Chapter 16 — SAP Analytics Cloud and SAP BW In this chapter we will focus on how SAP Analytics Cloud is able to connect to SAP BW and leverage your existing investment from SAP BW and how SAP Analytics Cloud is supporting your existing assets such as BW Queries.

1.18 Chapter 17 — SAP Analytics Cloud and SAP HANA In this chapter we will focus on how SAP Analytics Cloud is able to connect to SAP HANA and leverage your SAP HANA models.



4 SAP Analytics Cloud – An Introduction In this chapter we will introduce SAP Analytics Cloud (SAC) and position SAP Analytics Cloud as part of the overall SAP Analytics portfolio and the SAP Analytics strategy going forward.

1.19 Introduction SAP Analytics Cloud is SAP’s flag-ship product in the overall Analytics portfolio and the move to a single analytics product based in the cloud, cover multiple aspects, such as business intelligence (BI), planning, predictive, and application building.

Figure 4.1: SAP Analytics Cloud Overview

SAP Analytics Cloud combines abilities, such as - Data preparation and data wrangling - Basic data modeling - Data Discovery - BI Story Design - Planning - Application Design - Predictive scenarios

all into a cloud based single platform.

Figure 4.2: SAP Analytics Cloud Platform

All those capabilities are combined into a single offering in form of a true cloud product, available with difference licensing options, de-pending on customers need and requirements. As shown in Figure 4.2, you can see that SAP Analytics Cloud provides the ability to con-nect to cloud data sources as well as on-premise based data sources (we will go into more details in a later chapter). On top of the analyti-cal capabilities, you have three different experiences for the consumer of the content: Digital Boardroom, Analytics Hub, and Mobile.



SAP Digital Boardroom provides the possibility to provides your management with an experience to leverage content from SAP Analytics Cloud in combination with large touch screens and in that way establish a collaboration environment for executive meetings with the ability use live and interactive analytics content. SAP Analytics Hub plays a key role as part of the Hybrid Analytics strategy and provides customers with the option to simply the access to all their analytics-based content and establish a single point of access for their cloud and on-premise based analytics. SAP Analytics Cloud Mobile gives you access to your SAP Analytics Cloud content on your smartphone or tablets and allows your consum-ers to interact with your analytics content with their mobile devices.

SAP Analytics Hub

The focus of this book is SAP Analytics Cloud, therefore SAP Analytics Hub will not be covered in this book.

Especially the concept of Hybrid Analytics plays a key role for customers as part of the transition to a cloud based analytics platform. Figure 4.3 shows, how SAP Analytics Hub plays a key role, by providing you with the ability to provide your consumers with a single point of entry for cloud based analytics as well as your traditional on-premise analytics content.

Figure 4.3: Hybrid Analytics

Analytics Hub is only one element of the overall hybrid analytics approach and we will revisit this topic in a later chapter when we go into more details in how SAP Analytics Cloud also can be integrated with your on-premise BI products and BI content, such as the ability to leverage your existing Universes to establish connectivity and the option to connect to SAP Analytics Cloud models via SAP Analysis for Microsoft Office.



1.20 SAP Analytics Cloud – Main Components After this quick introduction of SAP Analytics Cloud, we will now look into more details into each of the main components of SAP Analytics Cloud.

Figure 4.4: Data Connections

As shown in Figure 4.4, SAP Analytics Cloud can connect to data sources live or to import the data into SAP Analytics Cloud. In case you connect to the data live – for example your on-premise SAP HANA system - then there is no need to replicate the data from the SAP HANA system to SAP Analytics Cloud and all your existing investment, such as the metadata and your existing data level security, can be reused directly in SAP Analytics Cloud. In case you import the data into SAP Analytics Cloud, you can leverage the data preparation capabilities from SAP Analytics Cloud and manipulate – in case needed – the data before it is loaded into a model in SAP Analytics Cloud. After you loaded the data into a model, you can also setup a recurring schedule for refreshing the data.

Figure 4.5: Business Intelligence

As part of the Business Intelligence (BI) and Analytics capabilities (see Figure 4.5), SAP Analytics Cloud provides you with the functionality to connect to data and clean and transform the information, visualize the information in form of charts, tables, and maps as well as the ability to share your stories with consumers and give them the option to collaborate on the analytics content.



Figure 4.6: Planning

SAP Analytics Cloud also provides you with the Planning capabilities (see Figure 4.6), providing you with an environment where your users have the option to analyze the information using the BI capabilities, forecast trends using the predictive capabilities and work on your plans – all in a single tool.

Figure 4.7: Smart Assist

The Smart Assist features in SAP Analytics Cloud (see Figure 4.7) give your users functionalities, such as the ability to search for infor-mation across BI stories (Search to Insight) and to add automatically generated insights to their analytical content, such as charts. Your users also have the option to leverage further insights into their data and recognize for example the key influencers for a selected measure using the Smart Insight functionality.



Figure 4.8: Application Design

With SAP Analytics Cloud Application Design (see Figure 4.8), you also have now the option to go beyond a simplified dashboard and create professionally designed dashboards – like what you might be familiar with from SAP Lumira Designer capabilities. SAP Analytics Cloud Application Designer is targeting your power users, which then create an interactive dashboard or an interactive application and this application can then be rolled out to all your users.

Figure 4.9: SAP Digital Boardroom

SAP Digital Boardroom is the combination of analytical content from SAP Analytics Cloud, touch enabled hardware, and additional capabil-ities provided by SAP Analytics Cloud allowing your users to combine several sets of information into a single consumption experience.



Figure 4.10: SAP Analytics Cloud Mobile

SAP Analytics Cloud also provides you with a mobile application, which allows your consumers to view and interact with the content on the tablets and smartphones. Your analytics content will adapt to the size and layout of the mobile device so that your users will have the best possible experience.

Figure 4.11: SAP Analytics Hub

With SAP Analytics Hub SAP provides a key pillar of the overall hybrid analytics strategy, allowing you to create a cloud based single point of access for all your analytics content and not only integrate your cloud based analytics content from SAP Analytics Cloud, but in addition to leverage your already existing BI assets from your SAP BusinessObjects environment. In addition to the access for your analytics con-tent, SAP Analytics Hub also provides you with the ability to add additional information to your analytics content, such as categories. After reviewing the main components of SAP Analytics Cloud, we will now take a look at how SAP Analytics Cloud fits into the overall SAP Analytics portfolio.



1.21 SAP Analytics Cloud in the overall SAP BI Portfolio In case you have been working with SAP BusinessObjects BI products or SAP Analytics BI clients now for some time, I am sure you are familiar with the overall product portfolio and I won’t spend time on introducing each of the products in the SAP Analytics portfolio in details. When starting with SAP Analytics Cloud it is important to understand, which role SAP Analytics Cloud plays in the overall analytics portfolio.

Figure 4.12: BI Tools Convergence

As of now (beginning of 2019), Figure 4.12 shows how SAP is planning to consolidate the different analytics clients. • SAP Analytics Cloud is the main client for the data discovery area and in case you are using today SAP BusinessObjects Explorer,

SAP Lumira Discovery, or SAP RoamBI, then you should consider a migration to SAP Analytics Cloud as part of your journey to the cloud. In case you are using SAP BusinessObjects Analysis for OLAP today, please take a closer look at the positioning of SAP Ana-lytics Cloud compared to SAP Analysis for Microsoft Office and which scenarios and personas are targeted by each of the prod-ucts.

• SAP Lumira Designer (mentioned as SAP Lumira 2.x on the image) is currently the go-to product for professionally designed dash-boards and applications and in case you are still using products, such as SAP BusinessObjects Dashboards or the SAP BEx Web Application Designer (WAD), you should be considering a migration to SAP Lumira Designer 2.x. SAP Analytics Cloud Application Design will become available soon to customers and will provide comparable functionality to SAP Lumira Designer, but also keep in mind that SAP Analytics Cloud Application Design is just being released as new product and it will take time until feature parity is close to SAP Lumira Designer, so that you then could consider moving also your professionally design dashboards and applica-tions to a cloud-based scenario.

• For the Microsoft Office integration, SAP Analysis for Microsoft Office is the client tool of choice, also combining the capabilities from SAP BEx Analyzer and the EPM Add In from the BPC side. SAP Analysis for Microsoft Office also integrates with SAP Analytics Cloud and we will revisit the topic in more details in a later section as part of the hybrid analytics topic.

• For the classic reporting capabilities, your clients of choice are either Crystal Reports or Web Intelligence.



Figure 4.13: SAP Analytics Cloud and On-Premise BI Clients

As shown in Figure 4.13, you can see that SAP Analytics Cloud is positioned as the primary client for data discovery scenarios, as well as data visualization, data exploration, and simple dashboarding scenarios. In addition, you can see that SAP Analytics Cloud is also being positioned as a self-service analytics platform and we will revisit, how SAP Analytics Cloud is able to cover the self-service scenario in the next section.

1.22 SAP Analytics Cloud – Positioning After we reviewed how SAP Analytics Cloud fits into the overall SAP Analytics portfolio, we will now look at how we can position SAP Analytics Cloud in regards to typical BI capabilities, such as data discovery or Enterprise Reporting and who the main target group for SAP Analytics Cloud would be. As part of this approach we will also introduce a set of typical user types and we will use those user types and map them to the capabilities of SAP Analytics Cloud. It’s very important to understand the different user types and how those user types map to the different products. Before we begin, it should be stated that not every product from the SAP Analytics portfolio has been created for each user type. Each tool delivers a specific reporting and analysis user experience to a defined group of user types and has not been created with every user type in mind. Before we start mapping the BI toolset to the user types, we need to clarify what those user types are, and more importantly, the needs and skills associated with the user types. We must look at this issue from two sides: what the user wants and what the user actually needs for doing his / her day-to-day job. Beyond these two points, you must also consider the skill level of the user. Sometimes the choice of tool can be based solely on product features and functionality, but other times you also have to consider the skills of the person using the tool. To keep it relatively simple we will break down our user types into three categories:

• Information Consumer

• Analyst / Power User

• Decision Maker - Line of Business Management

• Decision Maker - “C” Level Management

You may notice that these user types do not include a role called “Designer” or “Administrator.” The reason is that we want to focus on the consumption of information and how a user can leverage the analytics tools to make informed decisions based on the provided infor-mation. The person creating the reports and analytics may have a different skill set compared to these user types and not each capability will require a dedicated designer. In the figures shown below you can find each of the user types outlined with a set of typical goals and task, some example roles, their typical analytical tasks, and the software they are familiar with.

User Type Designer & Administrator

As you will notice the user types do not list specifically a dedicated Designer or a dedicated Administrator. This does not

mean that those user types do not exist. Those user types are not shown here in details because those user types are not

relevant for the details discussed in this chapter.



Figure 4.14: Information Consumer

As shown in Figure 4.14, the Information Consumer is our most basic user type, focusing on consuming prepared content and using the prepared information for their day-to-day tasks.

Figure 4.15: Decision Maker – Executive

Figure 4.15 shows the details for our Executive user type, who uses the information provided by the analytical environment but also has the requirement to be able to personalize the information and the ability to share findings with his / her team. Personalization could for example mean to change the chart type, or it could mean to preconfigure filter values to a specific region, so that the user doesn’t have to set the filter value each time when opening the analytical content. In addition, you can recognize, that our Executive user type mostly uses a mobile device and doesn’t want to spend too much time on learning how to use the product.



Figure 4.16: Decision Maker – LoB Management

Figure 4.16 shows the details for our user type LoB Management and as you can see the two user types Executive and LoB Management are similar, but the user type LoB Management requires more self-service capabilities and is not just consuming information, but instead also customizing existing content and adding local data to the analytical content.

Figure 4.17: Analyst

Figure 4.17 shows the details for our Analyst user type, which I am sure most of you are also familiar with as Power User. The Analyst is the “go-to” person for customizing or creating analytical content, in addition to the dedicated Designer. The Analyst is familiar with the data structures and data models in the source systems and is familiar with a variety of tools to interact with the data.



Figure 4.18: Content Consumer or Content Producer (Scale 1 to 4)

Figure 4.18 shows a slightly different perspective by outlining, if the user type is more a Content Consumer or a Content Producer (on a scale of 1 to 4), and if the user type requires a prepared Data Model and if the Data Preparation should already be completed for the user. As you can see in Figure 4.18, the user type Executive is a Content Consumer for Dashboards and Data Models and Data Preparation will have to be completed for the user already. Instead the user type Analyst is a Content Consumer as well, but much more a Content Pro-ducer of Dashboards and Analytical Content and does not require a pre-existing model or a pre-existing data preparation workflow as the Analyst can go through those tasks and workflow himself / herself.

Figure 4.19: Content Type by User Type (Scale 1 to 4)

Now looking at Figure 4.19 we can see the importance of specific capabilities for the user type. For example, the Executive is more fo-cused on simple to advanced dashboard style content with some Data Discovery and Advanced Analysis capabilities whereas the Analyst has a much stronger requirement for Data Discovery and Data Exploration but less need for the Advanced Dashboard capabilities. Below you can find more details on what is meant with each of these capabilities.

• Layout Focused Reporting refers to the ability to create more layout driven / formatted style content, where the user already knows the required information upfront and is more focused on creating a layout focused report and interactive capabilities are less important. As part of Layout Focused reporting, the ability to export the layout and potentially print the layout plays a criti-cal role.

• Ad Hoc / Self Service refers to the option for the consumer of the content to personalize the content and to customize the con-tent. Personalization could be as simple as the ability to configure a set of input values for parameters and customization could include the ability to change the chart type, change the layout of a table by changing dimensions or measures, or adding a ref-erence line to a chart. Ad Hoc / Self Service refers to the requirement, that the consumer of the information has enough func-



tionality available to him / her, so that the consumer can customize existing content or potentially create a complete new ana-lytical workflow.

• Simplified Dashboard refers to the capability to leverage typical visualization, such as charts, tables, maps, list boxes, drop down boxes, and provide the consumer a visual experience in form of a simple dashboard with some preconfigured user interaction.

• Data Discovery and Data Exploration are capabilities, which allow the consumer to go beyond a simple visualization and instead the user can leverage functionality, such as the ability to change dimensions or measures from visualizations, define thresholds, define simple and more advanced filter values – and all those capabilities are available to the consumer and do not have to be prebuilt into the content.

• Advanced Analysis refers to the option to leverage functionality such as forecasting, and other predictive scenarios as part of the analytical content as well as the ability to add calculations and also added guided scenarios into the overall analytical content.

• Advanced Dashboard refers to the option to create scenarios which go beyond a simplified dashboard and involve more ad-vanced user interaction with scripting, which is based on triggers and events in the advanced dashboard. Advanced Dashboards are typically created by a dedicated designer.

Please note, that Figure 4.19 shows user type preferences based on consuming and interacting with the type of content. For example, the user type Executive has a strong requirement for Simple & Advanced Dashboards, but this does not mean that the user type Executive will create those dashboards, but instead the user type Executive will consume and interact with the content. The exceptions are two columns Ad Hoc / Self Service and Data Discovery and Exploration, which go beyond just simple consumption and also include the ability to customize content and leverage options such as changing dimensions or measures in a dashboard. For example, the user type LoB Management has a strong requirement for Simple Dashboards and a strong requirement for Ad Hoc / Self Service capabilities, which could result – as an example – in a dashboard which provides the user the ability to change the measures shown in the chart or table, change the dimensions used for the chart and change the chart type. You should not treat those capabilities shown in Figure 4.19 as mutually exclusive, but instead based on their requirements, it might be the combination of those capabilities that is needed to fulfill the requirements.

Figure 4.20: Capabilities & Product

Figure 4.20 now uses those capabilities and ranks (from 1 to 4) the products from the SAP Analytics portfolio along those capabilities to indicate how well suited the product is to provide your users with such capabilities. As you can see, SAP Analytics Cloud is strong in the Simple Dashboarding category and the option to provide Data Discovery as well as Advanced Analysis features to your users. In Advanced Dashboarding, SAP Lumira Designer and the upcoming SAP Analytics Cloud Application Design might be better choices, de-pending on what your exact requirements are. In case you are looking for strong Self Service capabilities, SAP Analytics Cloud does have some basic capabilities, but Lumira Designer and SAP Analytics Cloud Application Design provide more capabilities that can be used to create a self service based scenario for your users. In addition, Web Intelligence and Analysis for Microsoft Office provide stronger Self Service capabilities out of the box. For the category Enterprise Reporting it shouldn’t be a surprise that Crystal Reports and Web Intelligence are the preferred choices.



Figure 4.21: Detailed Capabilities

Now looking at some more detailed capabilities, Figure 4.21 shows the strength of each of the products.

• Highly Formatted Reporting. In this category, it’s important that the tool provides full control over the layout and that you can create a report that is going to look identical in all web clients or when exported to an external format, such as portable document format (PDF). The extreme example for this is creating reports that are identical to legal forms. However, formatted layouts can be very important in other areas as well where it is important to have a well-structured and formatted report, such as a delivery notice, customer invoice, or a balance sheet.

• Parameterized Layout With parameterized layouts, we’re referring to the concept that the layout can be influenced by the consumer of the report simply by changing some parameters. A good example is a report that allows you to see the data grouped, or as a simple list, or as a chart. The user is able to influence the layout of the report by simply setting a value for a parame-ter that selects one of those options. The other example of a parameterized layout is one that has the capability to show different types of data visualization based on user input. For example, showing a weekly, quarterly, or monthly comparison after the user has selected one of the three options. In addition, part of a parameterized layout is its capa-bility to influence the layout based on defined conditions and the data being retrieved. The simplest example of this functionality is the ability to highlight a key figure based on a value and thresholds.

• Self-Service / Free Form Layout

Self-service reporting (sometimes referred to as free form layout-driven reporting) allows the user to create or change content without involving the Information Technology (IT) department to create a new report or make changes to an existing report. The concept of self-service reporting is more of the actual tool functionality than it is the type of re-ports or analytics that can be created. Self-service reporting is focused on offering the consumer a tool that provides him with an easy-to-use environment that puts the user in the “driver’s seat” of the report —enabling him to create or edit the report as needed.



• Hierarchical Capabilities In this category, the tools are compared based on the capability of leveraging an existing hierarchy from SAP NetWeav-er BW or SAP HANA or any other data source and being able to present the hierarchy properly as part of the report. The tool should not only be able to identify the hierarchy, but also create a hierarchical organized report; allow format-ting of the report based on hierarchical information, such as the hierarchy level; and recognize things like a hierarchy variable and hierarchy node variable. In addition, this category also includes the actual hierarchy navigation a consum-er of the report can perform.

• Data Visualization This category focuses on the set of capabilities needed to visualize actual data and to provide interactive capabilities. It is important to recognize that this is not a comparison of all of the different charting options of the tools. Charting is one element of the data visualization capabilities. Other elements include interactive navigation and the ease-of-use of the visualization.

• Guided Navigation The term “guided navigation” is used to describe the capability to provide ad hoc analysis and to limit the scope of change for the user, so that the user is only able to change specific parts of the analysis workflow. In addition, guided navigation refers to the functionality that the designer of the analysis workflow can create a pre-determined workflow for the actual consumer of the information. Think about a sales management analysis, where the user can see his Top 10 customers and the Top 10 opportunities in his pipeline on the initial view of the analysis. In addition, he can see the Top 10 opportunities with the highest risk factor of not getting closed in the current quarter. Instead of having to navi-gate through the data, the sales manager can click on a button and be “guided” to the second page of his analysis, where he sees more details regarding the 10 opportunities that are at risk. You can see that guided navigation helps create a predefined workflow for the consumer that is geared towards anticipating and providing answers to the most commonly asked questions.

• Mobile Reporting Mobile Reporting refers to the opportunity to leverage the content created by the BI tool on a mobile device. Explicitly this category refers to supporting the mobile device as a native application and not by opening the BI content in a browser session on the mobile device.

• Offline Capabilities Offline in this context refers to the capability to create a report that contains the actual data and allows the user still to navigate in the data, even when the connection to the source system has been disconnected. For example, think off a sales representative that reaches the office on a Monday morning and receives the latest reports and is still able to navigate in the data while being on the road without a connection to the source system for the rest of the week.

• Scheduling Capabilities Scheduling capabilities refers to the option to schedule the report or dashboard and to offload the generation of the report or dashboard to a server environment and to a specified timeframe. In addition, scheduling also includes the ability to present the result in different formats and towards different locations.



Figure 4.22: Required Skills

Now last but not least, Figure 4.22 shows the increasing skill level for the Content Consumer as well as the Content Producer along the products. As you can see here the required skills for the Content Consumer are growing the more self-service awareness the tool is offer-ing and the more analytical capabilities are part of the product. The least amount of skills is required for the consumption of your Lumira Designer application as you can create those exactly tailored for your audience. For the Content Producer, the products that offer a self-service focus require less skills compared to those products offering strong analytical and strong dashboarding type of capabilities. In this chapter we reviewed how SAP Analytics Cloud fits into the overall SAP Analytics portfolio and who the main target audience from a content consumer and content producer point of view is. In the next chapter, we will use a simple example, to make yourself familiar with the main workflows and main concepts in SAP Analytics Cloud.



5 SAP Analytics Cloud – QuickStart In the following sections we will learn more about the concepts and key workflows in SAP Analytics Cloud. The goal of this chapter is not to make you an expert in every functionality that is available in SAP Analytics Cloud, but instead to give you a quick end-to-end workflow from loading data to sharing your analytics content with colleagues, so that you can make yourself familiar with the workflows and menu structures.

SAP Analytics Cloud Trial

In case you do not have a SAP Analytics Cloud tenant available to you, please feel free to follow this URL to request a trial

access: https://discover.sapanalytics.cloud/trialrequest-auto-1/.

First Steps for a new System

At the end of this chapter you will also find a few steps with some recommendations on an initial setup for a new SAP Ana-

lytics Cloud system.

1.1 Launching SAP Analytics Cloud Assuming you received either a trial access or you purchased your own system, you can launch SAP Analytics Cloud by simply entering your SAP Analytics Cloud tenant URL into a browser. After you entered your credentials, you will be send to the Home page of SAP Analyt-ics Cloud (see Figure 5.1).

Figure 5.1: Home Screen

As part of your Home screen, there are several key elements. Figure 5.2 shows the menu from the top left corner – sometimes being referred to as the “Hamburger” button based on the selected icon. For this book, we will either refer to it as the Home menu.

https://discover.sapanalytics.cloud/trialrequest-auto-1/



Figure 5.2: Home Menu

Using the Home menu, you can create new stories, models, or dimensions, or you can browse your repository, and you have access – depending on your profile – to the administrative functions of SAP Analytics Cloud.

Figure 5.3: Profile Settings

Figure 5.3 shows the Profile menu, giving you access to the Profile Settings for your user account (see Figure 5.4) and the option to Re-quest Roles for further permissions.

Figure 5.4: Profile Details

Using the Profile Settings, you can configure your preferences for some key settings, such as the Language of the UI, the preferred Data Access Language, and which Date and Time Formatting you prefer for your content.



Figure 5.5: Edit Home Screen

The third menu in the top left of the Home screen (see Figure 5.5), provides you access to the customization of the Home screen, allowing you to choose a color theme, a logo, and you have the option to specify which Screen Tiles you prefer as part of your personal Home screen.

Figure 5.6: Home Screen Menu

On the right-hand side of your Home screen, you can find several menu options (see Figure 5.6):

• (1) Search: Here you gain access to the search options.

• (2) Notifications: You will receive notifications, which could be system alerts or information around content that has been shared or modified.

• (3) Discussions: Here you gain access to the Discussions panel. • (4) Help: Here you can access the online help.

Figure 5.7: Online Help

Especially as part of the online help I would like to point out the option to enable Guided Page Tips (see Figure 5.7), which then will pro-vide you directly in the software with Tips while you are actively using the software.

1.2 SAP Analytics Cloud – Asset Types SAP Analytics Cloud is not just a single product, but instead a analytics platform, providing you with the ability to create a variety of con-tent types and asset types.



Figure 5.8: SAP Analytics Cloud – Create Menu

Figure 5.8 shows the Create menu option from SAP Analytics Cloud, and as you can see, there is a variety of content and asset types you can build.

• Story: A story is basically a simplified dashboard and data visualization, which gives you access to charts, table, maps, filter, cal-culations, input controls, .. and so on.

• RoamBI: Here you can use the RoamBI provided templates and attach your data sources to those templates and deliver the mo-bile content to your users.

• Analytic Application: This is the content type you create when using SAP Analytics Cloud Application Design, allowing you also to integrate scripting and eventing capabilities into your dashboard.

• Digital Boardroom: This is the content type you create, when combining SAP Analytics Cloud content with the dedicated hard-ware for the Digital Boardroom and delivering a digital experience to your management.

• Model: Before you create a Story based on your data sources, you first need to create a data model with dimensions and measures.

• Dimension: Here you can create public dimensions, which you can re-use in multiple data models.

• Currency: Here you can setup a Currency dimension and also configure currency rates and currency translations.

• Point of Interest: Here you can configure a Point of Interest layer for maps, such as all your shops or additional reference points, which you can then re-use in multiple maps.

After we clarified the main asset types available to you in SAP Analytics Cloud, we will now continue and create our first model and our first story.



1.3 Your first SAP Analytics Cloud Story In the following sections, we will use a spreadsheet as data source, load the data into a SAP Analytics Cloud model, and then use the model and create a new SAP Analytics Story.

Sample Data Set

For the following steps, we will use a Microsoft Excel spreadsheet as data source. You can download the spreadsheet from

the following location: https://sapanalyticscloudbook.com/sample-stories and the file name is Master-

ing_SAP_Analytics_Cloud_chapter05_Sales_Analysis.xlsx.

5.1.1 Loading Data

In this section, we will load the data from the spreadsheet, so that we afterwards can do some data manipulation and create our data model. To upload the data, please follow these steps: 1. Logon to your SAP Analytics Cloud tenant. 2. In SAP Analytics Cloud open the Home menu. 3. In SAP Analytics Cloud select the menu Create • Model (see Figure 5.9).

Figure 5.9: Create Story

4. In the next screen select the option Import a file from your computer.

Figure 5.10: Import File

5. Click Select Source File. 6. Navigate to the location where you placed the sample data file. 7. Select the sample data set. 8. Ensure the option Use first row as column headers is enabled. 9. Click Import.

https://sapanalyticscloudbook.com/sample-stories



Figure 5.11: Draft Data

10. After the data import has finished, you are shown the Draft Data list and you can now continue with our data preparation work.

5.1.2 Preparing Data for further analysis

We will now continue with the uploaded data, perform some basic data manipulations, and then generate the model. 1. Now click on your uploaded data set in the Draft Data. In case the small popup screen is not shown anymore, you can click on the

database symbol to open the list of draft data sources. 2. Click on the data we uploaded. 3. Confirm the message about the Data Sample by pressing OK.

Figure 5.12: Data Integration

Figure 5.12 shows the Data Integration screen. You are presented with your uploaded data set and the system is making suggestions in regard to the dimension or measure types and you can perform data preparation workflows at this step. In addition, on the right-hand side, you can configure the data model properties. For our example, we would like to perform two main data preparation steps. First we would like to split the calendar year and calendar month into two separate columns, and in addition we would like to correct some spelling mistakes in the data. 4. Click on the column header from column Date.

Figure 5.13: Context Menu

5. Now open the menu and select the option Create a Transform (see Figure 5.13).



Figure 5.14: Create Transformation

6. Select the option Split (see Figure 5.14).

Figure 5.15: Transformation Details

7. The system will generate a new column next to the original data and you can see the suggestion transformation formula, which you can now configure (see Figure 5.15).

8. Double-click on the term delimiter in the transformation. 9. Enter a “.” as delimiter.

Figure 5.16: Change Preview

10. The system will show the two separated columns as a preview (see Figure 5.16). 11. Press ENTER on the keyboard to perform the transformation. 12. On the top right-hand side click on History (see Figure 5.17).



Figure 5.17: History

13. Each of the transformation steps is being recorded as part of the History. 14. Click on Details again in the top right-hand corner. 15. Click on the column header for column Region. 16. Now navigate to the right-hand side and take a look at the Data Distribution (see Figure 5.18).

Figure 5.18: Data Distribution

17. You will notice that the second entry for Region is misspelled “Michgan” instead of “Michigan”. 18. Navigate back to the column Region. 19. In the column Region, click on the first entry for Michgan. 20. Open the menu for the transformations (see Figure 5.19).



Figure 5.19: Transformations

21. Select the option Replace value with… .

Figure 5.20: Transformation Formula

22. In the toolbar you can now specify the new value (see Figure 5.20). 23. Double-click on the text value in the formula. 24. Enter the text Michigan. 25. Press Enter to perform the transformation. We finished our first set of data preparation steps and will now move on to specify the details for the model and then create the model.

5.1.3 Creating a Data Model

In the previous steps we performed some basic data manipulation steps. Now we will configure the details of our data model. 1. Click on the column header for column Date. 2. Navigate to the right-hand side (see Figure 5.21).

Figure 5.21: Date Dimension

3. Ensure the Type is set to Date. 4. For the Date Format ensure you are selecting the option YYYY. 5. Now click on the column for Date_2, which is the result from us splitting the column. 6. Double-click on the column header so that the text can be changed. 7. Enter Calendar Month as header.



8. Ensure the type is set to Dimension. 9. Now configure the following columns as Dimension:

• Product Category

• Product

• Region • Country

• City 10. Now select the column Customer ID. 11. Make sure the Type is set to Dimension. 12. Click Add Dimension Attributes (see Figure 5.22).

Figure 5.22: Dimension Attributes

13. Select the option Description. 14. Open the list and select the column Customer Name. In this way the Customer ID and Customer Name are linked together and in visualizations, such as a table or a chart, you will be able to switch between the Customer ID, Customer Name, or both for display purposes. 15. Click on the column header for column Units. 16. Ensure the Type is set to Measure (see Figure 5.23).

Figure 5.23: Measure Details

17. Ensure the Number Format is set to the option with a “.” for the decimal point. 18. Now repeat these steps for the columns Unit Cost, Revenue, Labour Cost, Cost of Goods. 19. Select the column header for column Longitude. 20. Ensure the Type is set to Measure. 21. Ensure the Number Format is set to the option with a “.” for the decimal point. 22. Select the column header for column Latitude. 23. Ensure the Type is set to Measure.



24. Ensure the Number Format is set to the option with a “.” for the decimal point. 25. In the toolbar, open the option for the Geo Enrichment (see Figure 5.24).

Figure 5.24: Geo Enrichment

26. Select the option Coordinates (see Figure 5.25).

Figure 5.25: Geo Enrichment by Coordinates

27. Ensure you select dimension City for the Location ID. 28. Select measures Longitude and Latitude for the corresponding options. 29. Click Create. With these steps, we used the Longitude and Latitude information and create a geographic dimension for dimension City. We wil l now be able to use this geographic dimension and create maps as part of our visualizations. We configured all dimensions and measures and are ready to create our model now, but before we do so, we should configure the overall properties for our model. 30. Navigate to the panel on the right-hand side. 31. Click on the cube symbol to ensure that you see the model properties (see Figure 5.26).



Figure 5.26: Model Properties

32. For the Model name enter My_first_Model. 33. Enter the same text for the model description. 34. In the model options ensure that the Enable Planning option is disabled. We will come to that in a later chapter. 35. For the Default Currency, you can now enter a currency for the model that will be used for all measures. In our example we will use

USD. 36. Now click Create Model (bottom right corner). 37. After a short period, you will be asked if you finished with all mapping. Confirm the dialogue by clicking Create.

Figure 5.27: Created Model

38. As final step you will be presented with the created model (see Figure 5.27), with the list of dimensions, the data that was used for the import, and a dimension called Account.

39. Click on the header Account (see Figure 5.28).

Figure 5.28: Account Dimension

40. As you can see, the dimension Account contains all the measures that were part of the data source. 41. Click on the Home menu and select the option Home. After the configuration steps, the model is being created and we can now move to the next steps and use the data and model to create our first story.



5.1.4 Creating a Story

With the model being created, we can now go ahead and create our first story. 1. Open the Home menu and select the menu Create • Story (see Figure 5.29).

Figure 5.29: Create Story

2. Select the option Add a Canvas Page. 3. In the next screen, select the option Chart. 4. As Data source select the previously created data model (see Figure 5.30).

Figure 5.30: Select Datasource

5. Click OK. 6. You are now being presented with an empty chart and on the right hand side you have a Builder Panel (see Figure 5.31) and a For-

matting Panel (see Figure 5.32) and you can switch between those two panels on the right hand side in the header of the panel.



Figure 5.31: Builder Panel

Figure 5.32: Formatting Panel

7. The Builder panel is used to configure the chart and the Formatting panel is used to configure elements such as the font, font size, colors, and so on.

Story Design Details

Please note, that as part of the QuickStart we will not go through each available menu in the Story design as that is being

explained in all the later chapters in this book.

8. Select the empty chart. 9. Navigate to the Builder Panel. 10. Ensure the chart type is set to a Bar / Column chart from the Comparison category (see Figure 5.33).



Figure 5.33: Chart Type

11. Click Add Measure in the Measures area (see Figure 5.34).

Figure 5.34: Selecting Measures

12. Select measure Revenue. 13. Click Add Dimension in the Dimensions area (see Figure 5.35).

Figure 5.35: Adding Dimension

14. Select dimension Product. 15. Now navigate to the top right corner of your chart. 16. Open the menu list by clicking on the “…” in the top right corner (see Figure 5.36).



Figure 5.36: Chart Context Menu

In the context menu on the top right corner you will a large list of additional features, such as the option to add a Reference Line to the chart.

17. Now click on the second icon in the menu for the sorting options (see Figure 5.37).

Figure 5.37: Sorting Meu

18. Select the option Revenue • Highest to Lowest.

19. Now select the menu for Ranking (see Figure 5.38).



Figure 5.38: Ranking

20. Select the option Top 5. 21. Now navigate to the Insert area of the toolbar (see Figure 5.39).

Figure 5.39: Menu Insert

22. Click on the table symbol to create a new table. 23. The new table will be generated next to your existing chart. 24. Ensure the empty table is selected. 25. Click on Add Measures / Dimensions in the Rows area (see Figure 5.40).

Figure 5.40: Add Dimensions

26. Select dimension Customer ID. 27. In the Columns you will recognize that the Account dimension from our model will be used by default. So instead of selecting

measures, we can filter dimension Account to those measures that we would like to see in the table (see Figure 5.41).



Figure 5.41: Filter Account Dimension

28. Click on the Filter icon for dimension Account (see Figure 5.42Figure 5.41).

Figure 5.42: Set Filter Values

29. Ensure that the following measures are selected: Revenue, Unit Cost, Labour Cost, Cost of Goods. 30. Click OK. 31. Now navigate to the dimension Customer ID in the Rows area.

Figure 5.43: Dimension Display Options

32. Click on the “…” option to open the menu (see Figure 5.43). 33. Select the option Display Options. 34. Select the option ID and Description. 35. Now navigate to the Insert menu in the toolbar.



36. Use the “+” sign to open further details (see Figure 5.44).

Figure 5.44: Insert Menu

37. Select the option Geo Map. 38. Ensure the empty map is selected. 39. Navigate to the Builder Panel (see Figure 5.45).

Figure 5.45: Geo Map Details

40. Click on Add Layer (see Figure 5.46).



Figure 5.46: Geo Layer Details

41. Click on the pencil icon next to the entry No Model for the property Data Source. 42. Select the previously created data model. 43. Click OK. 44. Ensure the Layer Type is set to Bubble Layer. 45. Click on Add Location Dimension (see Figure 5.47).

Figure 5.47: Location Dimension

46. You can now choose the previously created Location dimension based on the Longitude and Latitude values. 47. Click on Add Measure for the option Bubble Size. 48. Select measure Revenue. 49. Now double click into the name of the layer, by default it shows as Layer 1. 50. Rename the layer to Revenue by City. 51. Overall your story should look similar to Figure 5.48.



Figure 5.48: SAP Analytics Cloud Story.

At this point, we have a chart showing the Revenue by Product, a table showing the costs by Customer, and a map showing the Revenue by City on a map. The last element we will add is an Input Control, allowing us to filter the information shown to us based on the Product Category. 52. Navigate to the Insert area in the toolbar (see Figure 5.49).

Figure 5.49: Insert Menu

53. Select the option to Insert an Input Control (see Figure 5.50).

Figure 5.50: New Input Control

54. Click on Dimensions to open the list of available dimensions. 55. Select dimension Product Category (see Figure 5.51).



Figure 5.51: Select Values for Input Control

56. You now can select, which values will be available in the Input Control for filtering. 57. Select all values, including the option All Members. 58. Click OK. 59. By default the Input Control is shown as a small rectangle box, which shows the dimension name (see Figure 5.52) – as shown right

next to the map.

Figure 5.52: Input Control

60. All you need to do, is to select the Input Control and then simply resize it by drag and drop navigation (see Figure 5.53).



Figure 5.53: Resized Input Control

61. Navigate to the menu File in the toolbar. 62. Use the menu from the disk symbol and select the option Save (see Figure 5.54).

Figure 5.54: Menu File

63. Select the folder Public. 64. Enter a title and description for your first story. 65. Click OK. 66. In the top right corner of the toolbar click on the View option (see Figure 5.55).

Figure 5.55: View

67. By clicking on View, you are leaving the design mode of the story and you will be shown your story and how the consumer of the story will be shown the content (see Figure 5.56).



Figure 5.56: SAP Analytics Cloud Story

68. You also should be able now to use the Input Control for the Product Category and filter all the created visualizations. In this chapter we did a quick end-to-end workflow, from uploading the data to SAP Analytics Cloud, performing some basic data manipu-lations, creating the data model, and creating some data visualizations based on the created model.



6 SAP Analytics Cloud – Data Connections After we reviewed the target audience for SAP Analytics Cloud and created our first story with data uploaded from a spreadsheet, lets now look at getting real data into our SAP Analytics Cloud system. In the next few sections we will focus on setting up data connections for live data from SAP BW, SAP HANA, and SAP BusinessObjects Universe. In addition, we will then setup data connections for imported data based on SAP BW, and File Server.

6.1 Live Data vs Imported Data SAP Analytics Cloud can connect to a variety of data sources and has the capabilities to connect to cloud data sources, such as Google Sheets or SAP Concur, as well as on-premise data sources, such as SAP BW or Universes from your SAP BusinessObjects BI platform.

Figure 6.1: SAP Analytics Cloud Data Sources

In addition, SAP Analytics Cloud can connect to data source Live as well as the option to import data from the data source into SAP Analyt-ics Cloud. In case of a live data connection, you are establishing a direct connectivity towards the data source without repl icating the data and you are re-using the existing meta-data and the existing data level security from the connected data source. In case you are using the import option, you are connecting to the data source and selecting the elements you would like to use for your analysis and then import the data into an SAP Analytics Cloud model. In case of the imported data, you will then have to establish the data level security in SAP Analytics Cloud, because the user will not connect directly to the original data source anymore.

List of supported connections

For a list of the latest available connections, please refer to the SAP Analytics Cloud Online help and follow this link:

https://help.sap.com/doc/00f68c2e08b941f081002fd3691d86a7/release/en-

US/bdf055159cbb4f36b26c93ccb0c56066.html

https://help.sap.com/doc/00f68c2e08b941f081002fd3691d86a7/release/en-US/bdf055159cbb4f36b26c93ccb0c56066.html

https://help.sap.com/doc/00f68c2e08b941f081002fd3691d86a7/release/en-US/bdf055159cbb4f36b26c93ccb0c56066.html



Live Connection Import Connection

Meta-Data Reuse existing meta-data directly from the data source.

Reuse existing meta-data directly from the data source.

Data Latency Connect Live to the data source in real-time. Upload of data can be setup as recurring job.

Data Location Only meta-data is stored in SAP Analytics Cloud. Keep your corporate data behind the firewall.

Data is replicated into SAP Analytics Cloud.

Data Security Data Level security from the data source can be leveraged.

Data Level security needs to be defined in SAP Analytics Cloud

Limitations Not all capabilities of SAP Analytics Cloud are supported with live data sources.

Upload of data has volume limits.

Table 6.1: Live Connection vs Import Connection

Above you can see some key points of both data connection options, hopefully helping you making the decision on which type of connec-tivity you would like to use in combination with SAP Analytics Cloud. Please note, that before making the decision, look at the list of sup-ported data sources and some of the key limitations, as not each data source supports live and import. In the next set of sections, we will establish connections to SAP BW, SAP HANA, and SAP BusinessObjects Universes and go through the steps to establish live connectivity as well as a data import option. We will first go through the steps using SAP Cloud Platform Authentica-tion Service as an Identity Provider and configure a SAML based authentication. In the second set of steps we will use SAP NetWeaver SSO as Identity Provider. Regarding the direct connectivity from SAP Analytics Cloud towards those data sources, we will setup a CORS based connection as that is the recommended approach by SAP.

What is CORS ?

Cross-Origin Resource Sharing (CORS) is a mechanism that uses additional HTTP headers to tell a browser to let a web appli-

cation running at one origin (domain) have permission to access selected resources from a server at a different origin. A

web application makes a cross-origin HTTP request when it requests a resource that has a different origin (domain, proto-

col, and port) than its own origin.

In the following sections we will outline the steps required to establish live data connections towards SAP BW, SAP HANA, and SAP Busi-nessObjects Universes. In addition to the configuration of SAP Analytics Cloud, we will also include any prerequisites for the backend systems, and we will configure a SAML based authentication as well, so that we can achieve Single-Sign-On (SSO) starting from the brows-er authentication for SAP Analytics Cloud to the actual data source.



Figure 6.2: Scenario Overview

Figure 6.2 Shows our first scenario, which we are going to setup with SAP Analytics Cloud connecting to SAP BW and SAP HANA using a live connection and using SAP Cloud Platform Identity Authentication as a SAML Identity Provider. Here are the details for this scenario: 1. User opens the browser and opens the URL for SAP Analytics Cloud. 2. SAP Analytics Cloud responds to the browser request with a SAML authentication request. 3. Browser sends the SAML authentication request to the Identity Provider (IdP). 4. Identity Provider (IdP) authenticates the user and sends a SAML assertion to the browser 5. Browser sends the SAML assertion to SAP Analytics Cloud for authentication 6. SAP Analytics Cloud responds with page that initiates the loading of the SAP Analytics Cloud application. 7. User opens a story in SAP Analytics Cloud. 8. SAP Analytics Cloud sends story definition and meta-data to the browser. 9. Browser is requesting information from SAP BW and SAP HANA based on story definition. 10. SAP BW and SAP HANA respond to the browser request with a SAML authentication request. 11. Browser sends the SAML authentication request to the Identity Provider (IdP). 12. Identity Provider (IdP) authenticates the user and sends a SAML assertion to the browser. 13. Browser sends the SAML assertion to SAP HANA and SAP BW for authentication Please note, that the steps above just outline the steps for a scenario with SAP BW and SAP HANA but that the steps for a scenario with SAP BusinessObjects Enterprise based Universes would be similar.



Figure 6.3: Scenario with Name ID Configuration

Figure 6.3 shows the scenario with the configuration regarding the Name ID configuration. In our given scenario, SAP Analytics Cloud, SAP BW, SAP HANA, and SAP BusinessObjects Enterprise will act as a SAML Service Provider. SAP Cloud Platform Identity Authentication will act as a SAML Identity Provider, and we will configure SAP Analytics Cloud to use the eMail from the user record, SAP BW will use the Display Name property, SAP HANA will use the Login Name property, and SAP BusinessObjects Enterprise will use the Employee Number for the Name ID property. In our second scenario we will use a similar landscape, but instead of using SAP Cloud Platform Identity Authentication we wi ll use SAP NetWeaver SSO as Identity Provider.

SAML Assertion Attributes

Please note, that in the given scenario the three different SAML Service Provider (SAP HANA, SAP BW, SAP Analytics Cloud)

are using different properties from the User record. In such a scenario, please make sure that all properties required for all

three SAML Service Provider are configured as SAML Assertion Attributes for all three scenarios. For example, even though

the Login Name property is only required for the SAP HANA scenario, make sure it is included in the SAP BW and the SAP

Analytics Cloud configuration as well.



6.2 Scenario 1: SAP Cloud Platform Identity Authentication as SAML Identity Provider

6.2.1 Using SAP Cloud Platform as SAML Identity Provider

In this section we will use SAP Cloud Platform Identity Authentication Service as a SAML based Identity Provider and leverage the SAML Authentication towards SAP Analytics Cloud and SAP HANA.

SAP Cloud Platform Identity Authentication Service

In case you are interested in SAP Cloud Platform Identity Authentication, you can find the item in the SAP Store following

this URL : https://www.sapstore.com/solutions/40132/SAP-Cloud-Platform-Identity-Authentication - unfortunately there is

no trial option available at this point in time.

SAML Attributes

Please note, that the next steps and the definitions of the SAML Attributes and values outlined here are case sensitive.

6.2.1.1 Enabling SAML for SAP Analytics Cloud As first step we need to enable the SAML option for our SAP Analytics Cloud tenant. You can follow the steps outlined below to do so: 1. Logon to your SAP Analytics Cloud tenant. 2. Navigate to the menu Home • System • Administration. 3. Navigate to the tab Security. 4. Click Edit (top right corner).

Figure 6.4: System Administration

5. Select the option SAML Single-Sign-On (SSO). 6. You don’t have to save the changes at this point, as we continue the configuration later.

6.2.1.2 Download SAP Analytics Cloud meta-data As next step we need to download the meta-data from the SAP Analytics Cloud tenant, so that we can import the meta-data into the Identity provider – in this case SAP Cloud Platform Identity Authentication server: 1. Navigate to the screen from the previous steps in SAP Analytics Cloud. 2. Click Download as part of Step 1. 3. Save the file to your local disk. 4. Do not close the session from the SAP Analytic Cloud Administration site.

https://www.sapstore.com/solutions/40132/SAP-Cloud-Platform-Identity-Authentication



6.2.1.3 Create SAP Cloud Platform Identity Provider Application We now have the meta-data from SAP Analytics Cloud and can continue configuring the details in SAP Cloud Platform. In SAP Cloud Plat-form we need to setup the SAML details and we need to create an entry for our SAP Analytics Cloud tenant and provide the meta-data we just downloaded: 1. Open a separate browser window. 2. Logon to the SAP Cloud Platform Identity Authentication Administration page. 3. Logon with your credentials.

Figure 6.5: Identity Authentication Service

4. On the left-hand side navigate to Applications & Resources. 5. Navigate to the area Applications.

Figure 6.6: Applications

6. Click Add (bottom toolbar). 7. Enter SAP Analytics Cloud as application name. 8. Click Save.

Figure 6.7: SAP Analytics Cloud Application Entry

9. Click on Home URL.



10. Here enter your SAP Analytics Cloud tenant URL. 11. Click Save. 12. Click on the Type option and ensure it is set to SAML 2.0. 13. Navigate back to the overview page. 14. Click on SAML 2.0 Configuration.

Figure 6.8: SAML Configuration

15. Click on Browse for the Metadata File. 16. Navigate to the previously saved metadata file from your SAP Analytics Cloud tenant. 17. Select the XML file. 18. After the upload has finished click Save (bottom right). 19. Navigate back to the overview page. 20. Click on the category Name ID Attribute. 21. For our example we will use the option E-Mail. 22. Click Save. 23. Navigate back to the overview page. 24. Click on the category SAML Assertion Attributes.

Figure 6.9: SAML Assertion Attributes

25. Remove all of the default attributes. 26. Use the Add option and add the following entries:

User Attribute Assertion Attribute

First Name givenName

Last Name familyName

E-Mail email

Display Name displayName

Language preferredLanguage

Login Name login_name

Employee Number employee_number

Table 6.2: SAML Attributes

27. Click Save. 28. Navigate back to the overview page.



Figure 6.10: SAML Assertion Attributes

29. Click on the category Default Attributes. 30. Click Add. 31. Enter Groups as Attribute. 32. Enter sac as Value. 33. Click Save. 34. Navigate back to the overview page.

Support Ticket for using SAML Attributes

To ensure mapping SAML attributes to users, and mapping roles using SAML attributes, works with dynamic user creation,

you must submit an SAP Product Support Incident at the following link:

https://launchpad.support.sap.com/#incident/solution

using the component LOD-ANA-BI. In the support ticket, indicate that you want to set up user profiles and role assignment

based on custom SAML attributes, and include your SAP Analytics Cloud tenant URL.

6.2.1.4 Create SAP Cloud Platform Identity Provider User We created the entry for our SAP Analytics Cloud tenant as part of the SAP Cloud Platform and we configured the SAML attributes so far. So as next step we should be able to create a new user in our Identity Provider. 1. Logon to the SAP Cloud Platform Identity Authentication Administration page. 2. Logon with your credentials. 3. On the left-hand side navigate to Users & Authorizations. 4. Click User Management.

Figure 6.11: User Management

5. Click Add User (bottom right).



Figure 6.12: New User

6. Provide the necessary details for the user account. 7. Select an option for the Account Activation. 8. Click Save. 9. In case you chose to use the eMail activation, please ensure you open the eMail and activate the account. 10. After you saved the user details, use a double-click on the user to see the details.

Figure 6.13: User Details

11. Use the pencil icon (top right) to edit the user details and ensure the properties Display Name and Language are filled. 12. Click Save.

6.2.1.5 Upload SAP Cloud Platform metadata to SAP Analytics Cloud Before we can logon to our SAP Analytics Cloud tenant by using the newly created user via the SAML authentication, we also need to provide the meta-data information from SAP Analytics Cloud and provide this information towards to SAP Cloud Platform system. 1. Logon to the SAP Cloud Platform Identity Authentication Administration page. 2. Logon with your credentials. 3. On the left-hand side navigate to Applications & Resources. 4. Navigate to the area Tenant Settings. 5. Click on the category SAML 2.0 Configuration.




6. Click on Download Metadata File. 7. Save the file to your local system 8. Now navigate back to SAP Analytics Cloud and make sure you are still in the Security area for the System Administration. 9. Navigate to Step 2 of the SAML Configuration in SAP Analytics Cloud

Figure 6.15: Meta-Data Upload

10. Click Upload. 11. Navigate to the metadata file from the SAP Cloud Platform Identity Authentication Service. 12. Select the file.



Figure 6.16: Uploaded Meta-Data

13. Navigate to Step 3.

Figure 6.17: User Attribute

14. In our example we set the User Attribute to Email. 15. Enable the option Dynamic User Creation – in that way the users are created automatically in SAP Analytics Cloud. 16. Navigate to Step 4. 17. Enter an eMail account for verification. 18. Click Verify Account. 19. You will receive a message with a Login URL. Ensure you are using the incognito mode of your browser to use this Login URL.



Figure 6.18: Verify Account

20. Open a new browser window (not just a tab). 21. Ensure the browser is using the incognito mode. 22. Paste the URL from the previous message. 23. Login with the configured user credentials. 24. You should see a message, that the verification was successful. 25. Close the separate browser window and navigate back to Step 4 of the configuration. 26. Click Check Verification from the popup window. 27. The eMail account should be highlighted in green.

Figure 6.19: Verified Account

28. Click Save. 29. You will receive a warning message about the conversion to SAML Authentication.

Figure 6.20: Convert to SAML

30. Click Convert. 31. You will be logged out of your SAP Analytics Cloud tenant. 32. Close the browser and try to logon to your SAP Analytics Cloud tenant via the users from SAP Cloud Platform Identity Service. At this point, we configured the SAP Analytics Cloud tenant to leverage a SAML based authentication and we configured our SAP Cloud Platform Identity Authentication Service to act as Identity Provider. But we are missing the role assignments at this point, so the user has no roles assigned yet and we also need to ensure that we configure the SAML attribute mapping.



6.2.1.6 Configure SAML User Attributes Mapping We provided a set of user attributes as part of the SAML integration and we configured our SAML Identity Provider with a list of user attributes, which are being transferred to SAP Analytics Cloud each time a user tries to authenticate. Now we need to map those attrib-utes to the available fields from the user record in SAP Analytics Cloud. 1. Logon to your SAP Analytics Cloud tenant with administrative credentials. 2. Navigate to the menu Home • Security • Users. 3. In the toolbar open the SAML Attributes Mapping dialog.

Figure 6.21: SAML User Properties Mapping

4. Use the “+” sign to add configurations between SAML Attributes and User Attributes as shown below

Figure 6.22: SAML Mappings

5. Click Save.

6.2.1.7 Configure SAP Analytics Cloud Role Mapping In addition to the user authentication, you can also configure role mapping from your Identity Provider to roles in your SAP Analytics Cloud system. In the next steps we are going to create three separate groups in the SAP Cloud Platform Identity Authentication Service, assign those groups to a user in our Identity Provider, and then map those groups from the Identity Provider to roles in SAP Analytics Cloud. 1. Logon to the SAP Cloud Platform Identity Authentication Administration page. 2. Logon with your credentials. 3. On the left-hand side navigate to Users & Authorizations. 4. Click User Groups.



Figure 6.23: User Groups

5. Click Add (bottom toolbar).

Figure 6.24: New Group

6. Enter BIVIEWER as Name. 7. Enter BI Viewer as Display Name. 8. Click Save. 9. Click another two groups: BIADMIN, and BIDESIGN. 10. On the left-hand side navigate to Users & Authorizations. 11. Click User Management. 12. Open the details for the previously created user. 13. Click on User Groups.

Figure 6.25: Assigned Groups

14. Click Assign Group (bottom right).



Figure 6.26: User Groups

15. Select all three groups. 16. Click Save. 17. On the left-hand side navigate to Applications & Resources. 18. Navigate to Applications. 19. Select the application we created for the SAP Analytics Cloud tenant. 20. Click on Assertion Attributes. 21. Click Add. 22. Select the Attribute Groups from the list. 23. Ensure the Assertion Attribute is named groups. 24. Click Save. At this point we created three groups in our Identity Provider and we assigned these three groups to the user account. As next step we need to map the user groups from our Identity Provider to Roles in SAP Analytics Cloud. 1. Logon to your SAP Analytics Cloud tenant. 2. Navigate to the menu Home • Security • Roles.

Figure 6.27: SAP Analytics Cloud Roles

3. We have three roles and would like to map those to the roles in SAP Analytics Cloud as shown below:

• BIADMIN to BI Admin • BIVIEWER to BI Content Viewer

• BIDESIGN to BI Content Creator 4. Select the role BI Admin in the category Business Intelligence. When you click on the tile for the BI Admin role a small checkbox will

be shown to select the role. 5. After you selected the role, select the Open SAML Role Mapping option in the toolbar.



Figure 6.28: SAML Role Mapping

6. For the SAML Attribute enter the attribute groups. 7. As condition select Equals. 8. As Value enter BIADMIN.

Figure 6.29: SAML User Group Mapping

9. Select the role BI Content Creator in the category Business Intelligence. When you click on the tile for the role a small checkbox will be shown to select the role.

10. After you selected the role, select the Open SAML Role Mapping option in the toolbar. 11. For the SAML Attribute enter the attribute groups. 12. As condition select Equals. 13. As Value enter BIDESIGN. 14. Select the role BI Content Viewer in the category Business Intelligence. When you click on the tile for the role a small checkbox will

be shown to select the role. 15. After you selected the role, select the Open SAML Role Mapping option in the toolbar. 16. For the SAML Attribute enter the attribute groups. 17. As condition select Equals. 18. As Value enter BIVIEWER. 19. Logoff from SAP Analytics Cloud and login to the system with the previously created user via the SAML authentication. 20. After you authenticated, select the menu Home • Security • User. 21. Scroll down to the details of the user account. 22. You should now see the three roles that we mapped in the column Roles assigned to the user.

Figure 6.30: Mapped User Roles



6.2.2 Setting up SAP HANA Live Connectivity

The following steps outline how you can establish a live data connection from SAP Analytics Cloud towards your SAP HANA system based on the previously configured SAML Identity Provider. The following are the steps that are required:

• Configure SAP HANA for HTTPS / SSL

• Retrieving SAP HANA HTTPS Ports

• Verifying SAP HANA Information Access (InA) Service

• Configuring SAP HANA user roles

• Configuring browser

• Configure CORS headers for SAP HANA

• Configuring SAP HANA XS Timeout • Establishing trust between SAP HANA and SAML Identity Provider

• Configuring SAP HANA user for SAML

• Deploy customer web content

• Test access to SAP HANA Info Access Service via SAML

6.2.2.1 Configuring SAP HANA for HTTPS / SSL In the following steps we will configure our on-premise SAP HANA system for HTTPS / SSL, which is a pre-requisite for the live data con-nection with SAP Analytics Cloud.

Required Roles

Please ensure that the user you are going to use to configure the next steps for your SAP HANA system has the following

roles assigned:

sap.hana.xs.wdisp.admin::WebDispatcherAdmin

sap.hana.xs.wdisp.admin::WebDispatcherMonitor

sap.hana.xs.admin.roles:RuntimeConfAdministrator

sap.hana.xs.admin.roles:SAMLAdministrator

sap.hana.xs.admin.roles::SAMLViewer

sap.hana.xs.admin.roles::HTTPDestViewer

1. Logon to the SAP HANA Web Dispatcher Administration:

http://<HANA Server Name>:<HANA Server Port>/sap/hana/xs/wdisp/admin. 2. Logon with your SAP HANA credentials that has the necessary roles. 3. On the left-hand side select the entry SSL and Trust Configuration • PSE Management.

Figure 6.31: PSE Management

4. Ensure the SAPSSLS.pse file is selected. 5. Click Recreate PSE.



Figure 6.32: Recreate PSE

6. In the field Distinguished Name enter your server details, for example: CN=hana03.dyndns.org, OU=PG, O=SAP, C=CA

7. Click Create. 8. You will receive a message that the Key Pair has been created. 9. Click Create CA Request.

Figure 6.33: CA Request

10. Select the complete text from the CA Request box. 11. Ensure you copy the text to the clipboard (if needed, to a text file). 12. Now we need to sign the request and the steps depend on your Certificate Authority. 13. Please ensure that Base 64 encoded is used when you download the full certificate chain.

PKCS#7 or X.509

In case your Certificate Authority offers a choice between PKCS#7 and X.509 format, you have to choose PKCS#7 for the XS

Classic server and X.509 for the XS Advanced.

14. After you downloaded the certificate, open the file with a text editor, such as notepad. 15. Select the content of the file and copy the content to the clipboard. 16. Navigate back to the SAP Web Dispatcher Administration page. 17. Paste the copied content to the Import CA Response box. 18. In addition to the content of the signed certificate we also have a wildcard domain certificate from the Certificate Authority and we

copy / paste the content of the second certificate below the first certificate into the Import CA Response box. 19. Click Import. 20. After you imported the certificate(s), please restart the SAP Web Dispatcher service of your SAP HANA system.

Live Connection without Signed Certificate

In case you do not have access to a signed certificate for your SAP HANA system, you could still establish a direct live con-

nectivity from SAP Analytics Cloud to your SAP HANA System. The user will have to open up a separate browser window

and navigate to https://<HANA Server Name>:43<HANA Instance Number> and the user will then have to manually ad-

vance through the certificate warnings until the SAP HANA XS page is shown.



Domain Certificate and Wildcard Certificate

It is highly recommended to use proper domain certificates signed by a Certificate Authority over self-signed certificates. In

our example we are also using a wildcard certificate for the domain.

6.2.2.2 Retrieving the SAP HANA HTTPS Port After you configured your SAP HANA system for HTTPS / SSL, you also need to retrieve the HTTPS ports that are being used. 1. Logon to the SAP HANA Web Dispatcher Administration:

http://<HANA Server Name>:<HANA Server Port>/sap/hana/xs/wdisp/admin. 2. Logon with your SAP HANA credentials that has the necessary roles. 3. On the left-hand side select the entry Core System • Active Services.

Figure 6.34: Active Services

4. Here you can see the Active Services and the assigned ports.

6.2.2.3 Verifying SAP HANA Information Access (InA) Service SAP Analytics Cloud requires the Information Access (InA) to be deployed as part of your SAP HANA system and you can easily verify, if the InA Service has been deployed. 1. Launch the following URL:

https://<HANA Server Name>:43<HANA Instance Number>/sap/bc/ina/service/v2/GetServerInfo. 2. Logon to your SAP HANA system. 3. You should receive a JSON Structure as response, showing the server details from your SAP HANA system

SAP HANA EPM-MDS Component

Starting with SAP HANA 2.0, the SAP HANA EPM-MDS Package is not bundled anymore with SAP HANA, but instead needs

to be imported. Please refer to SAP Note 2456225 and 2444261 for further details.

6.2.2.4 Configuring SAP HANA user roles For SAP HANA users to leverage the live connection in combination with SAP HANA they require the following SAP HANA role: sap.bc.ina.service.v2.userRole::INA_USER . In the following steps you will learn how to assign the role to a user using SAP HANA Studio. 1. Start SAP HANA Studio 2. Logon to your SAP HANA system entry. 3. Navigate to the area Security • Users. 4. Navigate to the user that you would like to change. 5. Open the user details with a double-click. 6. Navigate to the tab Grant Roles.



Figure 6.35: Granted Roles

7. Click on the “+” sign.

Figure 6.36: Select Roles

8. Enter sap.bc.ina.service. 9. Press ENTER on the keyboard. 10. Select the role sap.bc.ina.service.v2.userRole::INA_USER from the list of matching items. 11. Click OK. 12. Use the Deploy option (top right corner) in the screen (or as alternative use F8) to apply the changes. These steps showed how you can add the required role to a single user. You can also setup a dedicated role – for example SAC_HANA_LIVE - for your deployment and add the here listed required role to role SAC_HANA_LIVE and then simply add all users to the SAC_HANA_LIVE role. In addition to the role from the previous steps, the SAP HANA users also require the SELECT privilege for those Analytic and Calculation views, which the users will be connecting to from SAP Analytics Cloud. 1. Start SAP HANA Studio 2. Logon to your SAP HANA system entry. 3. Navigate to the area Security • Users. 4. Navigate to the user that you would like to change. 5. Open the user details with a double-click. 6. Navigate to the tab Object Privileges.



Figure 6.37: Object Privileges

7. Click on the “+” sign. 8. Select the Analytic / Calculation views that the user should be able to use in combination with SAP Analytics Cloud. 9. Press ENTER on the keyboard. 10. Ensure at a minimum the SELECT privilege is granted. 11. Click OK. 12. Use the Deploy option (top right corner) in the screen (or as alternative use F8) to apply the changes.

SAP HANA Object Rights

For SAP HANA version 1.00.112.04 and above, users require both the INA_USER role, and additional object rights. The SAP

HANA administrator must grant users SELECT privileges on all view items in the _SYS_BIC schema that users should have

access to. For more information, see SAP Note 2353833.

SELECT Privilege

At a minimum, users need the SELECT right on each information view’s associated column view. This can be assigned to the

entire _SYS_BIC schema or to individual column views.

6.2.2.5 Configuring SAP HANA CORS Headers As next step we can now configure the CORS Headers for the SAP HANA system. 1. Launch the following URL:

https://<HANA Server Name>:43<HANA Instance Number>/sap/hana/xs/admin. 2. Logon to your SAP HANA system. 3. Click on the arrow right next to the package sap (not clicking on sap). 4. Click on the arrow right next to the package bc (not clicking on bc). 5. Click on the arrow right next to the package ina (not clicking on ina). 6. Click on the arrow right next to the package service (not clicking on service). 7. Click on the v2 package (on the text v2).



Figure 6.38: Configuration Details.

8. Ensure Security & Authentication is selected on the right-hand side. 9. Click Edit (bottom right). 10. Ensure that Basic is enabled for the Authentication Methods.

Figure 6.39: InA Service

11. On the right-hand side click CORS.

Figure 6.40: CORS Configuration

12. Enable the option Enable Cross Origin Resource Sharing. 13. Enable the checkbox next to the entry showing the “*” for the Allowed Origins.



Figure 6.41: CORS Configuration

14. After selecting the element, click on Edit.

Figure 6.42: Allowed Origin

15. Replace the “*” value with the URL for your SAP Analytics Cloud tenant. 16. Click Update. 17. Navigate to the area Allowed Headers. 18. Click Add.

Figure 6.43: Allowed Header

19. Enter accept as the Allowed Header Value. 20. Click Add. 21. Repeat the steps and ensure the following Allowed Header Value(s) are added:

• accept

• authorization

• content-type

• x-csrf-token

• x-request-with

• x-sap-cid • accept-language

22. Navigate to the area Exposed Headers. 23. Click Add. 24. Enter x-csrf-token as Exposed Header Value. 25. Click Add. 26. For the Allowed Methods ensure the following methods are enabled:

• GET

• HEAD

• POST • OPTIONS

27. Click Save (bottom right corner).



28. In the navigation bar on the left-hand side click on “sap”. 29. Click on the arrow right next to the package hana (not clicking on hana). 30. Click on the arrow right next to the package xs (not clicking on xs). 31. Click on formLogin (on the text, not the arrow). 32. On the right-hand side click CORS. 33. Click Edit (bottom right corner). 34. Enable the option Enable Cross Origin Resource Sharing. 35. Enable the checkbox next to the entry showing the “*” for the Allowed Origins. 36. After selecting the element, click on Edit. 37. Replace the “*” value with the URL for your SAP Analytics Cloud tenant. 38. Click Update. 39. Navigate to the area Allowed Headers. 40. Click Add. 41. Enter accept as the Allowed Header Value. 42. Click Add. 43. Repeat the steps and add the following Allowed Header Value(s):

• accept

• authorization

• content-type

• x-csrf-token

• x-request-with • x-sap-cid

• accept-language 44. Navigate to the area Exposed Headers. 45. Click Add. 46. Enter x-csrf-token as Exposed Header Value. 47. Click Add. 48. For the Allowed Methods ensure the following methods are enabled:

• GET

• HEAD • POST

• OPTIONS 49. Click Save (bottom right corner).

HANA Upgrade

Please note, that the steps outlined in this section have to be repeated with each SAP HANA upgrade.

6.2.2.6 Deploying custom content To enable SSO from SAP Analytics Cloud towards SAP HANA using the live connection, you will have to deploy custom web content to your SAP HANA server. This web content is what will appear briefly to users once per session when they first create a live data connection to your SAP HANA system, or when they refresh charts or tables against that live data connection. 1. Launch the following URL:

https://<HANA Server Name>:43<HANA Instance Number>/sap/hana/ide/editor. 2. Logon to your SAP HANA system. 3. Navigate to the package sap.bc.ina.service.



Figure 6.44: Web Based Editor

4. Use a right-click on the v2 package. 5. Select the menu New • Package.

Figure 6.45: New Package

6. Enter cors for Package Name. 7. Click Create. 8. Select the newly create package cors and use a right-click. 9. Select the menu New • File. 10. Enter auth.html as File Name. 11. Click Create. 12. Now use a double-click on the new auth.html file. 13. Add the following code to the file:

<html> <script type="text/javascript"> open(location, '_self').close(); </script> </html>

14. Save the changes. 15. Close the file. 16. Select the newly create package cors and use a right-click. 17. Select the menu New • File. 18. Enter .xsaccess as File Name. 19. Click Create. 20. Now use a double-click on the new .xsaccess file. 21. Remove the default code. 22. Add the following code to the file:

{"cache_control" : "no-cache, no-store"}

23. Save the changes.



24. Select the newly create package cors and use a right-click. 25. Select the menu Activate All. 26. Launch the following URL:

https://<HANA Server Name>:43<HANA Instance Number> /sap/bc/ina/service/v2/cors/auth.html.

The website should load and close automatically.

HANA Upgrade

Please note, that the steps outlined in this section have to be repeated with each SAP HANA upgrade.

6.2.2.7 Configuring SAP HANA XS Timeout As next step in the configuration, we will have to increase the timeout parameters for the SAP HANA system. 1. Start SAP HANA Studio 2. Logon to your SAP HANA system entry. 3. Select your SAP HANA System entry and use a right-click. 4. Select the menu Configuration and Monitoring • Open Administration 5. Navigate to the tab Configuration. 6. Navigate to the entry xsengine.ini. 7. Open the entry and navigate to the entry httpserver. 8. Open the entry and navigate to the property sessiontimeout.

Figure 6.46: SAP HANA Session Timeout

9. Use a double-click on the entry sessiontimeout. 10. Enter 43200 (= 12 hours) as New Value. 11. Click Save.

6.2.2.8 Configuring client-side browser We also need to verify the client-side browser configuration, to ensure cookies are accepted and popups are allowed. 1. Start Google Chrome. 2. Open the Settings for Google Chrome. 3. Click on Advanced to open the Advanced Settings. 4. Navigate to the area Privacy and Security. 5. Navigate to the area Content Settings and open the details. 6. Navigate to Cookies and open the details. 7. Under Allow Cookies click Add. 8. Here you should now add an entry to allow for cookies from your corporate domain or the domain that is used for your SAP HANA

landscape. 9. After adding those entries, navigate back to the Content Settings area. 10. Select the area Pop-ups and redirects. 11. In the Allow section click Add. 12. Enter [*.]sapanalytics.cloud to add popups from your SAP Analytics Cloud tenant.



13. After those changes, close the Settings for the browser.

6.2.3 Establishing Trust between SAP HANA, and SAML Identity Provider (IDP)

At this point we configured SAP Cloud Platform Identity Authentication as Identity Provider, we configured our SAP HANA system for HTTPS, and we configured the CORS headers on our SAP HANA system. As next step we need to exchange the meta-data between our SAP HANA system and our Identity Provider, in this case SAP Cloud Platform Identity Authentication.

6.2.3.1 Downloading Meta-Data from SAP Cloud Platform As first step we will download the meta-data from the SAP Cloud Platform. 1. Logon to the SAP Cloud Platform Identity Authentication Administration page. 2. Logon with your credentials. 3. On the left-hand side navigate to Applications & Resources. 4. Navigate to the area Tenant Settings. 5. Click on the category SAML 2.0 Configuration.

Figure 6.47: Meta-Data File

6. Click on Download Metadata File. 7. Save the file to your local system

6.2.3.2 Downloading Meta-Data from SAP HANA As next step we will download the meta-data from our SAP HANA System. 1. Launch the following URL:

https://<HANA Server>:<HANA Port>/sap/hana/xs/admin 2. Logon with your System credentials. 3. Open the menu in the top left corner.

Figure 6.48: HANA XS Menu

4. Select the menu SAML Service Provider.



Figure 6.49: SAML Service Provider

5. Click Edit (bottom right corner). 6. Ensure the details are filled with the necessary information for fields, such as Organisation Name. 7. Click Save. 8. Click Metadata.

Figure 6.50: Service Provider Metadata

9. Select the complete content from the box. 10. Paste the content into a new file on your local system. 11. Ensure the file is being save with an XML Extension, for example HANA_SAML_METADATA.XML

6.2.3.3 Uploading SAP Cloud Platform Meta-Data to SAP HANA As next step we will upload the meta-data from SAP Cloud Platform to our SAP HANA System. 1. Launch the following URL:

https://<HANA Server>:<HANA Port>/sap/hana/xs/admin 2. Logon with your System credentials. 3. Open the menu in the top left corner.


4. Select the menu SAML Identity Provider.



5. Click “+” at the bottom of the page.

Figure 6.52: Metadata

6. Open the meta-data file from the SAP Cloud Platform, which we saved previously. 7. Select the complete content from the file and paste the content into the empty box for the meta-data. 8. After you pasted the content, click on any of the boxes in the General Data area and the values will be populated.

Figure 6.53: Metadata

9. Click Save (bottom right). 10. The new Identity Provider should now be shown in the list. 11. Open the menu in the top left corner.




12. Select the menu XS Artifact Administration. 13. Click on the arrow right next to the package sap (not clicking on sap). 14. Click on the arrow right next to the package bc (not clicking on bc). 15. Click on the arrow right next to the package ina (not clicking on ina). 16. Click on the arrow right next to the package service (not clicking on service). 17. Click on the v2 package (o the text, not the arrow).

Figure 6.55: Security & Authentication

18. Click Edit (bottom right). 19. Enable the option SAML. 20. Select the previously created Identity Provider from the list. 21. Click Save.

6.2.3.4 Uploading SAP HANA Meta-Data to SAP Cloud Platform As next step we will setup our SAP HANA system as Application in SAP Cloud Platform and upload the meta-data we downloaded previ-ously. 1. Logon to the SAP Cloud Platform Identity Authentication Administration page. 2. Logon with your credentials. 3. On the left-hand side navigate to Applications & Resources. 4. Navigate to the area Applications. 5. Click Add (bottom toolbar). 6. Enter SAP HANA as application name. 7. Click Save. 8. Click on the Type category and ensure it is set to SAML 2.0. 9. Navigate back to the overview page for our new entry for SAP HANA. 10. Click on SAML 2.0 Configuration.



11. Click on Browse for the Metadata File. 12. Navigate to the previously saved metadata file from your SAP HANA system. 13. Select the XML file. 14. After the upload has finished click Save (bottom right). 15. Navigate back to the overview page for our new entry for SAP HANA. 16. Click on the category Name ID Attribute. 17. For our example we will use the option Login Name. 18. Click Save. 19. Navigate back to the overview page for our new entry for SAP HANA. 20. Click on the category Assertion Attributes. 21. Remove all of the default attributes. 22. Use the Add option and add the following entries:




E-Mail email





Table 6.3: SAML Assertion Attributes

23. Click Save. 24. Close the administration console.

6.2.3.5 Configuring SAP HANA User for SAML As last step in this configuration, we now need to configure the SAP HANA users for SAML. 1. Start SAP HANA Studio 2. Logon to your SAP HANA system entry. 3. Navigate to the area Security • Users. 4. Navigate to the user that you would like to use for this workflow. 5. Open the user details with a double-click.



Figure 6.56:

6. Enable the option SAML. 7. Click Configure (below SAML).

Figure 6.57:

8. Click Add. 9. Select the previously created SAML Identity Provider. 10. Click OK. 11. For the External Identity enter the SAML Name ID value which is being passed by the Identity Provider to the SAP HANA system. This

is the user account that is send from your SAML Identity Provider to the SAP HANA system. 12. Click OK. 13. Click Save. 14. Click Deploy or use F8 to deploy the changes.

6.2.3.6 Configuring User Details in SAP Cloud Platform Authentication Service As last step for this configuration, we need to configure the user details in our Identity Provider, which is SAP Cloud Platform Authentica-tion Service. 1. Logon to the SAP Cloud Platform Identity Authentication Administration page. 2. Logon with your credentials. 3. On the left-hand side navigate to Users & Authorizations. 4. Click User Management. 5. Select the User Account that you would like to configure to be able to logon to SAP HANA. 6. Use a double-click on the user to see the details. 7. Use the pencil icon (top right) to edit the user details. 8. Ensure the property Login Name is filled with the credentials for the SAP HANA System.



9. Click Save.



6.2.4 Setting up SAP BW Live Connectivity (SAP NetWeaver lower than 7.52)

In the following sections we will configure the connectivity from SAP Analytics Cloud to SAP BW. The steps are slightly different, depend-ing on the SAP BW release you are currently using.

• In case you are using a SAP NetWeaver release lower than 7.52, than please follow the steps from section 6.2.4 for the SAP BW connectivity with SAP Analytics Cloud.

• In case you are using SAP NetWeaver 7.52 or higher, please follow the steps from section 6.2.5 for the setup.

SAP BW and Native CORS Support

Native CORS support using the Unified connectivity (UCON) is supported from the versions mentioned in SAP Note

2547381. In lower NW versions the ICM Script can be used to set up connectivity as referred in SAP Note 2596285.

SAP Analytics Cloud and SAP BW

Please refer to SAP Note 2541557 on a regular basis, as the note provides important information on required updates for

your SAP BW system based upon new features in SAP Analytics Cloud.

6.2.4.1 Configuring SAP BW for HTTPS / SSL As part of the configuration for the CORS connectivity, we also need to make sure that our SAP BW system is configured with HTTPS / SSL. As first step we need to make sure the SAP Cryptographic Library is deployed.

Documentation for HTTPS / SSL

Please also refer to the documentation for further details:

https://help.sap.com/viewer/e73bba71770e4c0ca5fb2a3c17e8e229/7.5.8/en-

US/4923691cbf5a1902e10000000a42189c.html and also consult the following SAP Notes for further details: 2198198 and

510007.

Configure the profile parameters for the SAP BW system. 1. Logon to your SAP BW System. 2. Start transaction RZ10. 3. Select the instance profile and select the option Extended Maintenance. 4. Select the option Change. 5. Now ensure the following profile parameters are add / configured:

Profile Parameter Value

icm/ssl_config_<xx> CRED=<credential> [, CACHESIZE=<cache size>, LIFETIME=<max. lifetime>, VCLIENT=<SSL client verification>, CIPHERS=<Cipher Suites>]

icm/server_port_<xx> PROT=HTTPS, PORT=<port>,TIMEOUT=<timeout_in_ seconds>

icm/HTTPS/verify_client 0: Do not use certificates

1: Allow certificates (default)

2: Require certificates

Table 6.4: Profile Parameters

6. Save the changes and ensure the changes are being activated. 7. Restart your system. As next step we need to create the SSL Server PSE. 1. After the system has been restarted, login to the system. 2. Start transaction STRUST. 3. Select the entry SSL Server Standard. 4. Use a right-click and select the menu Create (or Replace in case a PSE already exists).

https://help.sap.com/viewer/e73bba71770e4c0ca5fb2a3c17e8e229/7.5.8/en-US/4923691cbf5a1902e10000000a42189c.html




5. Enter the Distinguished Name parts for a default SSL server PSE in the corresponding fields. For the default SSL server PSE, use a wildcard character (*) as the host name in the Name field.

6. In the next screen, you can decide whether the individual application servers should use the default Distinguished Name and system-wide SSL server PSE or individual PSEs.

7. You will then be returned to the Trust Manager. 8. In the Trust Manager expand the SSL Server PSE Node. 9. For each individual SSL Server PSE Node

• Select the application server using a double-click.

• The certificate details should be shown in the Own Certificate area.

• Select the menu Edit • Create Certificate Request.

• Select the option Use PSE Algorithm.

• A certificate request will be shown.

• Copy the content of the certificate request or use the option to save it as a .P10 file locally.

• You then will have to get the Certificate Request signed by the Certificate Authority of your choice. • Please note, the Trust Manager requires that the Certificate Request Response adheres to the PKCS#7 certificate chain for-

mat. This means that the response contains both the requester's signed public-key certificate as well as the CA's root certif-icate. As an alternative, the Certificate Authority may issue a stand-alone certificate in PEM format.

• You will receive a certificate request response, which needs to be imported.

• Expand the SSL Server PSE and select the application server you created the request for.

• Select the menu Edit • Import Create Response.

• Paste the content from the Certificate Request response or use the Import option to point to a local file with the content.

• Click Save. 10. To be able to communicate using SSL, the SAP Web Application Server must also possess the standard SSL client PSE. Therefore,

repeat the procedure for the standard SSL client PSE. 11. Using the trust manager (transaction STRUST):

• Create the standard SSL client PSE.

• In this case, you specify the CN part of the Distinguished Name (default = system ID). You only create one PSE, which is then distributed to the rest of the application servers.

• Generate a certificate request for the standard SSL client PSE.

• Send the certificate request to a Certificate Authority to be signed.

• Import the certificate request response into the server's standard SSL client PSE. As final step we will test the HTTPS / SSL setup. 1. Logon to your SAP BW system. 2. Start transaction SMICM (ICM Monitor). 3. Select the menu Goto • Services. 4. You should now see an entry for HTTPS with the assigned port and listed as active. 5. As second step you could also launch a sample BSP page using a HTTPS connection. 6. For example, start the URL https://<Server Name>:<HTTPS Port>/sap/bc/bsp/sap/it00/default.htm (You might have to activate the

sample application in transaction SICF).

6.2.4.2 Enable Profile Parameters for SAP BW to enable CORS After we configured our SAP BW system for HTTPS, we can now start the configuration for the connection towards SAP Analytics Cloud based on CORS. 1. Logon to your SAP BW system. 2. Start transaction RZ10.



Figure 6.58: Edit Profile Parameters

3. Select the Default profile for your system. 4. Select the option Extended Maintenance. 5. Click Change. 6. Confirm the warning message. 7. Select the menu Parameter • Create. 8. Create a new parameter with the following details:

• Parameter name: icm/HTTP/mod_0

• Parameter value: PREFIX=/,FILE=$(DIR_PROFILE)/rewrite.txt

Figure 6.59: New Parameter

9. Click Back twice in the toolbar. 10. Click Yes to confirm the changes. 11. The new parameter will be listed as part of your overall profile. 12. Click Back. 13. Click Yes to confirm the changes. 14. Select the menu Profile • Save. 15. Click Yes to activate the profile. We will use the file rewrite.txt to provide the CORS rules. For now, we entered the path to the file and file name as part of the profile parameters. You will have to restart the system for the changed profile to become active. We have to do additional changes, so we will continue with those and then restart the system.

6.2.4.3 Information Access Service (InA) and Ping Service As next step we need to ensure the Information Access Service (InA) is activated and the Ping Service is activated. 1. Logon to your SAP BW system. 2. Start transaction SICF.



Figure 6.60: SICF

3. Ensure SERVICE is selected for the Hierarchy Type. 4. Select the menu Program • Execute (F8). 5. Navigate to the follow path : default_host > sap > bw > ina.

Figure 6.61: List of Services

6. Ensure the service and all sub-elements are activated. 7. At this point, you should be able to call this URL:

https://<BW Server Name>/sap/bw/ina/GetServerInfo?sap-client=<BW Client Number> 8. Navigate back to transaction SICF. 9. Navigate to the follow path : default_host > sap > public > ping. 10. Ensure the service is activated.

6.2.4.4 Adding CORS Rewrite Rules Now we need to add the content of the CORS rewrite rules to the file. 1. Logon to OS level of your SAP BW system. 2. Navigate to the path /usr/sap/<System ID>/profile 3. Create a new file called rewrite.txt. 4. Add the following content to the file:

if %{HEADER:isSACOriginAllowed} = true setHeader isSACOriginAllowed false if %{HEADER:ORIGIN} regimatch ^(https:\/\/)?<HOSTNAME> [AND] if %{PATH} regimatch (\/sap($.*$)*\/bw\/ina\/*) setHeader isSACOriginAllowed true



if %{HEADER:isSACOriginAllowed} = true [AND] if %{REQUEST_METHOD} regimatch (GET|POST) begin setResponseHeader Access-Control-Allow-Origin %{HEADER:ORIGIN} setResponseHeader Access-Control-Expose-Headers x-csrf-token,sap-rewriteurl,sap-url-session-id,sap-perf-fesrec,sap-system setResponseHeader Access-Control-Allow-Credentials true setResponseHeader Vary origin end if %{HEADER:isSACOriginAllowed} = true [AND] if %{REQUEST_METHOD} stricmp OPTIONS begin regRewriteUrl ^/(.*) /sap/public/ping setResponseHeader Access-Control-Allow-Origin %{HEADER:ORIGIN} setResponseHeader Access-Control-Allow-Methods GET,POST setResponseHeader Access-Control-Allow-Headers x-csrf-token,x-sap-cid,authorization,mysapsso2,x-request-with,sap-rewriteurl,sap-url-session-id,content-type,accept-language setResponseHeader Access-Control-Max-Age 600 setResponseHeader Access-Control-Allow-Credentials true setResponseHeader Vary origin removeResponseHeader Set-Cookie removeResponseHeader Expires end

5. Replace <HOSTNAME> with the URL for your SAP Analytics Cloud tenant. 6. Save the changes to the file. 7. At this point, you might want to consider restarting the system.

Multiple Tenants

In case you would like to add more than one SAP Analytics Cloud tenant, you can add those using a logical OR.

For example:

if %{HEADER:ORIGIN} regimatch ^(https:\/\/)?<HOSTNAME#1> [OR]

if %{HEADER:ORIGIN} regimatch ^(https:\/\/)?<HOSTNAME#2> [OR]

if %{HEADER:ORIGIN} regimatch ^(https:\/\/)?<HOSTNAME#N> [AND]

if %{PATH} regimatch (\/sap($.*$)*\/bw\/ina\/*)

6.2.4.5 Configuring client-side browser We also need to verify the client-side browser configuration, to ensure cookies are accepted and popups are allowed. 1. Start Google Chrome. 2. Open the Settings for Google Chrome. 3. Click on Advanced to open the Advanced Settings. 4. Navigate to the area Privacy and Security. 5. Navigate to the area Content Settings and open the details. 6. Navigate to Cookies and open the details. 7. Under Allow Cookies click Add. 8. Here you should now add an entry to allow for cookies from your corporate domain or the domain that is used for your SAP BW

landscape. 9. After adding those entries, navigate back to the Content Settings area. 10. Select the area Pop-ups and redirects. 11. In the Allow section click Add. 12. Enter [*.]sapanalytics.cloud to add popups from your SAP Analytics Cloud tenant. 13. After those changes, close the Settings for the browser. At this point, you should be able to establish a connectivity from SAP Analytics Cloud to SAP BW using the User and Password authentica-tion option. For our example, we will setup the SAML Authentication in the next section and setup the connectivity using the SAML Au-thentication.



6.2.5 Setting up SAP BW Live Connectivity (SAP NetWeaver 7.52 or higher)

In this section we will review the steps required to configure the SAP BW system – release 7.52 or higher – for the connectivity with SAP Analytics Cloud.

SAP BW 7.52 SP01

Please apply SAP Note 2531811 or import ABAP 7.52 SP1 to fix CORS related issues in SAP NetWeaver

SAP Analytics Cloud and SAP BW

Please refer to SAP Note 2541557 on a regular basis, as the note provides important information on required updates for

your SAP BW system based upon new features in SAP Analytics Cloud.

6.2.5.1 Configuring SAP BW for HTTPS / SSL As part of the configuration for the CORS connectivity, we also need to make sure that our SAP BW system is configured with HTTPS / SSL. As first step we need to make sure the SAP Cryptographic Library is deployed.

Documentation for HTTPS / SSL

Please also refer to the documentation for further details:

https://help.sap.com/viewer/e73bba71770e4c0ca5fb2a3c17e8e229/7.5.8/en-

US/4923691cbf5a1902e10000000a42189c.html and also consult the following SAP Notes for further details: 2198198 and

510007.

Configure the profile parameters for the SAP BW system. 1. Logon to your SAP BW System. 2. Start transaction RZ10. 3. Select the instance profile and select the option Extended Maintenance. 4. Select the option Change. 5. Now ensure the following profile parameters are add / configured:

Profile Parameter Value

icm/ssl_config_<xx> CRED=<credential> [, CACHESIZE=<cache size>, LIFETIME=<max. lifetime>, VCLIENT=<SSL client verification>, CIPHERS=<Cipher Suites>]

icm/server_port_<xx> PROT=HTTPS, PORT=<port>,TIMEOUT=<timeout_in_ seconds>

icm/HTTPS/verify_client 0: Do not use certificates

1: Allow certificates (default)

2: Require certificates

Table 6.5: Profile Parameters

6. Save the changes and ensure the changes are being activated. 7. Restart your system. As next step we need to create the SSL Server PSE. 1. After the system has been restarted, login to the system. 2. Start transaction STRUST. 3. Select the entry SSL Server Standard. 4. Use a right-click and select the menu Create (or Replace in case a PSE already exists). 5. Enter the Distinguished Name parts for a default SSL server PSE in the corresponding fields. For the default SSL server PSE, use a

wildcard character (*) as the host name in the Name field. 6. In the next screen, you can decide whether the individual application servers should use the default Distinguished Name and system-

wide SSL server PSE or individual PSEs. 7. You will then be returned to the Trust Manager.





8. In the Trust Manager expand the SSL Server PSE Node. 9. For each individual SSL Server PSE Node

• Select the application server using a double-click.

• The certificate details should be shown in the Own Certificate area.

• Select the menu Edit • Create Certificate Request. • Select the option Use PSE Algorithm.

• A certificate request will be shown.

• Copy the content of the certificate request or use the option to save it as a .P10 file locally.

• You then will have to get the Certificate Request signed by the Certificate Authority of your choice.

• Please note, the Trust Manager requires that the Certificate Request Response adheres to the PKCS#7 certificate chain for-mat. This means that the response contains both the requester's signed public-key certificate as well as the CA's root certif-icate. As an alternative, the Certificate Authority may issue a stand-alone certificate in PEM format.

• You will receive a certificate request response, which needs to be imported.

• Expand the SSL Server PSE and select the application server you created the request for. • Select the menu Edit • Import Create Response.

• Paste the content from the Certificate Request response or use the Import option to point to a local file with the content.

• Click Save. 10. To be able to communicate using SSL, the SAP Web Application Server must also possess the standard SSL client PSE. Therefore,

repeat the procedure for the standard SSL client PSE. 11. Using the trust manager (transaction STRUST):

• Create the standard SSL client PSE.

• In this case, you specify the CN part of the Distinguished Name (default = system ID). You only create one PSE, which is then distributed to the rest of the application servers.

• Generate a certificate request for the standard SSL client PSE.

• Send the certificate request to a Certificate Authority to be signed. • Import the certificate request response into the server's standard SSL client PSE.

As final step we will test the HTTPS / SSL setup. 1. Logon to your SAP BW system. 2. Start transaction SMICM (ICM Monitor). 3. Select the menu Goto • Services. 4. You should now see an entry for HTTPS with the assigned port and listed as active. 5. As second step you could also launch a sample BSP page using a HTTPS connection. 6. For example, start the URL https://<Server Name>:<HTTPS Port>/sap/bc/bsp/sap/it00/default.htm (You might have to activate the

sample application in transaction SICF).

6.2.5.2 Information Access Service (InA) As first step we need to ensure the Information Access Service (InA) is activated. 1. Logon to your SAP BW system. 2. Start transaction SICF. 3. Ensure SERVICE is selected for the Hierarchy Type. 4. Select the menu Program • Execute (F8). 5. Navigate to the follow path : default_host > sap > bw > ina. 6. Ensure the service and all sub-elements are activated. 7. At this point, you should be able to call this URL:

https://<BW Server Name>/sap/bw/ina/GetServerInfo?sap-client=<BW Client Number>

6.2.5.3 Enable Profile Parameters for SAP BW to enable CORS As next step we will configure the Profile Parameters for our SAP BW system. 1. Logon to your SAP BW system. 2. Start transaction RZ10. 3. Select the Default profile for your system. 4. Select the option Extended Maintenance. 5. Click Change. 6. Confirm the warning message. 7. Select the menu Parameter • Create. 8. Create a new parameter with the following details:

• Parameter name: icf/cors_enabled

• Parameter value: 1 9. Click Back twice in the toolbar.



10. Click Yes to confirm the changes. 11. The new parameter will be listed as part of your overall profile. 12. Click Back. 13. Click Yes to confirm the changes. 14. Select the menu Profile • Save. 15. Click Yes to activate the profile. We changed the profile parameter for the default profile, which means that we will have to restart our system. In case you want to make a quick change, you can also use transaction RZ11 to make the change.

6.2.5.4 Adding SAP Analytics Cloud to the HTTP Whitelist As next step we will be adding SAP Analytics Cloud to the HTTP Whitelist of our SAP BW system. 1. Logon to your SAP BW system. 2. Start transaction UCONCOCKPIT. 3. Ensure the Scenario option I set to the HTTP Whitelist Scenario value.

Figure 6.62: Transaction UCONCOCKPIT

4. Click on the Display / Change icon (or press F5 on the keyboard). 5. Change the Mode for the entry Cross-origin Resource sharing to the value Active Check.

Figure 6.63: Changing Mode

6. Click on the Save icon. 7. Now double-click on the entry Cross-origin Resource Sharing in the table.



Figure 6.64: Cross-origin Resource Sharing

8. Navigate to the area Whitelist (right hand side). 9. Click on the Add Icon.

Figure 6.65: Toolbar

10. Add the following entries:

• Service Path: /sap/bw/ina

• Host rule: Enter your SAP Analytics Cloud host

• Allowed Methods: Enable GET, HEAD, POST, and OPTIONS

Figure 6.66: Input Window

11. For the option Allowed Headers add the following values (comma separated): X-CSRF-TOKEN,X-SAP-CID,AUTHORIZATION,MYSAPSSO2,X-REQUEST-WITH,SAP-REWRITEURL,SAP-URL-SESSION-ID,CONTENT-TYPE,ACCEPT-LANGUAGE

12. For the option Exposed Headers add the following values (comma separated): X-CSRF-TOKEN,SAP-REWRITEURL,SAP-URL-SESSION-ID,SAP-PERF-FESREC,SAP-SYSTEM

13. Enable the option Allow Credentials. 14. Click Next. 15. Click Save to save the configuration. 16. Close the transaction.



6.2.5.5 Configuring client-side browser We also need to verify the client-side browser configuration, to ensure cookies are accepted and popups are allowed. 1. Start Google Chrome. 2. Open the Settings for Google Chrome. 3. Click on Advanced to open the Advanced Settings. 4. Navigate to the area Privacy and Security. 5. Navigate to the area Content Settings and open the details. 6. Navigate to Cookies and open the details. 7. Under Allow Cookies click Add. 8. Here you should now add an entry to allow for cookies from your corporate domain or the domain that is used for your SAP BW

landscape. 9. After adding those entries, navigate back to the Content Settings area. 10. Select the area Pop-ups and redirects. 11. In the Allow section click Add. 12. Enter [*.]sapanalytics.cloud to add popups from your SAP Analytics Cloud tenant. 13. After those changes, close the Settings for the browser. At this point, you should be able to establish a connectivity from SAP Analytics Cloud to SAP BW using the User and Password authentica-tion option. For our example, we will setup the SAML Authentication in the next section and setup the connectivity using the SAML Au-thentication.

6.2.6 Establishing Trust between SAP BW, and SAML Identity Provider (IdP)

In the following sections we will setup Single-Sign-On (SSO) based on a SAML Authentication using SAP Cloud Platform Authentication Service as Identity Provider and we will configure SAP BW as a SAML Service Provider.

6.2.6.1 Enabling SAP BW as SAML Service Provider As first step, we will configure SAP BW as a SAML Service Provider. 1. Open a browser. 2. Launch the URL: https://<BW Server>:<HTTPS Port>/sap/bc/webdynpro/sap/saml2. 3. Logon to your SAP BW system.


4. Click Enable SAML 2.0 Support. 5. Select the option Create SAML 2.0 Local Provider.



Figure 6.68: Local Provider Configuration

6. Enter BWSAMLSP (for BW SAML Service Provider – but this is just a suggestion). 7. Click Next

Figure 6.69:

8. Leave the default value for the Clock Skew Tolerance. 9. Click Next.

Figure 6.70: Local Provider Configuration

10. Set the Selection Mode to the value Automatic. 11. Click Finish.




12. Click Edit. 13. Uncheck the option Sign Metadata. 14. Click Save. We configured the SAML Service Provider and in the next steps we need to download the met-data.

6.2.6.2 Downloading Meta-Data from SAP BW In this section we will download the meta-data as a file, so that we can import the meta-data later on into our SAML Identity Provider. 1. Open a browser. 2. Launch the URL: https://<BW Server>:<HTTPS Port>/sap/bc/webdynpro/sap/saml2. 3. Logon to your SAP BW system.


4. Click Metadata.



Figure 6.73: SAML Metadata

5. Uncheck Application Service Provider. 6. Uncheck Security Token Service. 7. Click Download Metadata 8. Ensure the file is saved to your local system. 9. Potentially rename the file, as often the file is just called metadata.xml and the next section will use the same file name. 10. Click Close after you downloaded the metadata.

6.2.6.3 Downloading Meta-Data from SAP Cloud Platform After we downloaded the metadata from the SAP BW system, we also need to download the metadata from our Identity Provider, in this case SAP Cloud Platform Authentication Service. 1. Logon to the SAP Cloud Platform Identity Authentication Administration page. 2. Logon with your credentials. 3. On the left-hand side navigate to Applications & Resources. 4. Navigate to the area Tenant Settings. 5. Click on the category SAML 2.0 Configuration. 6. Click on Download Metadata File. 7. Save the file to your local system. 8. Potentially rename the file, as often the file is just called metadata.xml.

6.2.6.4 Uploading SAP BW Meta-Data to SAP Cloud Platform We downloaded the metadata from our Identity Provider and our Service Provider (SAP BW). As next step we need to configure our SAP BW system as a trusted SAML Service Provider in our Identity Provider. 1. Logon to the SAP Cloud Platform Identity Authentication Administration page. 2. Logon with your credentials. 3. On the left-hand side navigate to Applications & Resources. 4. Navigate to the area Applications. 5. Click Add (bottom toolbar). 6. Enter SAP BW as application name. 7. Click Save. 8. Click on the Type category and ensure it is set to SAML 2.0. 9. Navigate back to the overview page for our new entry for SAP BW. 10. Click on SAML 2.0 Configuration. 11. Click on Browse for the Metadata File. 12. Navigate to the previously saved metadata file from your SAP BW system. 13. Select the XML file. 14. After the upload has finished click Save (bottom right). 15. Click on the category Name ID Attribute. 16. For our example we will use the option Display Name. 17. Click Save. 18. Click on the category Assertion Attributes. 19. Remove all of the default attributes. 20. Use the Add option and add the following entries:






E-Mail email







6.2.6.5 Uploading SAP Cloud Platform Meta-Data to SAP BW As next step we will upload the meta-data from SAP Cloud Platform to our SAP BW System. 1. Launch the following URL:

Launch the URL: https://<BW Server>:<HTTPS Port>/sap/bc/webdynpro/sap/saml2. 2. Logon to your SAP BW system. 3. Navigate to the area Trusted Providers.

Figure 6.74: Trusted Providers

4. Click Add. 5. Select the option Upload Metadata File.

Figure 6.75: Metadata Upload

6. Click Choose File. 7. Select the previously downloaded metadata file from our Identity Provider (SAP Cloud Platform). 8. Click Next.



Figure 6.76: Signed Metadata

9. In case you are being asked for a certificate for the signed metadata, you will have to get the certificate text from SAP Cloud Platform and save it as a certificate file.

10. Leave the screen open and open an additional browser session. 11. Logon to the SAP Cloud Platform Identity Authentication Administration page. 12. Logon with your credentials. 13. On the left-hand side navigate to Applications & Resources. 14. Navigate to the area Applications. 15. Click Tenant Settings. 16. Scroll down to the bottom of the page.

Figure 6.77: Signing Certificate

17. Select the complete content from the Certificate Text. 18. Create a new text file 19. Add the text -----BEGIN CERTIFICATE----- to the beginning of the file. 20. Add the text -----END CERTIFICATE----- to the end of the file. 21. Place the content of the certificate between those two texts. 22. Ensure the file is saved as a .cer file type. 23. Navigate back to the SAML 2.0 Configuration for SAP BW. 24. Select the option Upload from File. 25. Navigate to the .cer file that we just created. 26. Click Next.




27. Enter a new Alias for the BW Service Provider, for example BWSAMLSP. 28. Click Next.

Figure 6.79: Signature and Encryption

29. Accept the default options for Signature and Encryption area. 30. Click Next.

Figure 6.80: Single-Sign-On Endpoint

31. Ensure the HTTP Post is selected. 32. Click Next. 33. Accept the default Single Logout Endpoint. 34. Click Next. 35. Click Next for the Artifact Endpoints option. 36. Click Finish.




37. Ensure the newly created Trusted Provider is selected. 38. Click Edit. 39. Navigate to the lower screen for Identity Federation. 40. Click Add.

Figure 6.82: Name ID Formats

41. Select the option Unspecified. 42. Click OK.


43. Open the list of options for the User ID Mapping Mode (bottom right). 44. Select the option Logon ID. 45. Click Save. 46. Click Enable.



47. Click OK on the confirmation message.

6.2.6.6 Configuring User Details in SAP Cloud Platform Authentication Service As last step for this configuration, we need to configure the user details in our Identity Provider, which is SAP Cloud Platform Authentica-tion Service, so that the SAP BW Login ID is being stored as part of the Display Name property in our Identity Provider. Using the Display Name is part of the previous configuration we did. 1. Logon to the SAP Cloud Platform Identity Authentication Administration page. 2. Logon with your credentials. 3. On the left-hand side navigate to Users & Authorizations. 4. Click User Management. 5. Select the User Account that you would like to configure to be able to logon to SAP BW. 6. Use a double-click on the user to see the details. 7. Use the pencil icon (top right) to edit the user details. 8. Ensure the property Display Name is filled with the credentials for the SAP BW System. 9. Click Save. So far, we configured the live connection towards SAP HANA and SAP BW. In the next section we will setup the Live Connection towards the Universes on your SAP BusinessObjects system.



6.2.7 Setting up SAP BusinessObjects Universe Connectivity

In the previous sections we configured the connectivity towards SAP BW and SAP HANA. In the next sections we will setup the live con-nectivity towards SAP BusinessObjects Universes, including the scenario to authenticate the users via the SAML Authentication.

SAP Analytics Cloud and SAP Universes

Please refer to SAP Note 2527393 and 2527917 on a regular basis, as these note provides important information regarding

the Live Connection from SAP Analytics Cloud towards SAP Universes.

6.2.7.1 Configure Tomcat for HTTPS / SSL We will start the configuration by ensuring the Tomcat server is configured for HTTPS / SSL. In our scenario we will be re-using the Tomcat server from the SAP BusinessObjects Enterprise system.

Tomcat & HTTPS / SSL

Refer to the official Tomcat documentation to know how to configure the application server in SSL configuration:

https://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html and please refer to SAP Note 1648573.

1. Logon to the system where you Tomcat system is installed. 2. On the system create a new folder called SSL – for example on drive C create the folder C:\SSL. 3. Open a command prompt and navigate to the folder C:\SSL. 4. Execute the following command:

keytool -storepass <Password> -keypass <Password> -alias <Alias> -keystore C:\SSL\keystore.jks -genkeypair -keysize 2048 -keyalg RSA -dname “CN=biserver.dyndns.org, OU=PG, O=SAP, C=CA” -ext san=dns:biserver Replace <Password> with a password of your choice. Replace <Alias> with an alias of your choice. For example: keytool -storepass Password1 -keypass Password1 -alias tomcat -keystore C:\SSL\keystore.jks -genkeypair -keysize 2048 -keyalg RSA -dname “CN=BISERVER.DYNDNS.ORG, OU=PG, O=SAP, C=CA” -ext san=dns:biserver The command will generate the keystore file.

5. As next step we will generate a certificate signing request. 6. Enter the following command at the command prompt:

keytool -certreq -alias tomcat -file certreq.csr -keystore c:\ssl\keystore.jks

7. You will be asked to enter the password, which you configured. 8. After the command has been executed, navigate to the folder C:\SSL. 9. Open the file for the Certificate Signing Request, which we just created – certreq.csr. 10. Copy the content from the file. 11. Navigate to your Certificate Signing Authority and get a signed certificate for the request. 12. In case you are being asked, please ensure that you select the option of PKCS#7 encoding. 13. Download the certificate and also ensure that you download the root certificate. 14. Place both certificates into the folder C:\SSL. 15. Open the command prompts. 16. Navigate to the folder C:\SSL. 17. Execute the following command:

keytool -import -alias root -keystore tomcat.keystore -trustcacerts -file [name of the root certificate] Ensure you replace the placeholder with the name of the root certificate.

18. You will be asked to enter and re-enter the password you configured previously. 19. Execute the following command:

keytool -import -alias intermed -keystore tomcat.keystore -trustcacerts -file [name of the intermediate certificate]

https://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html



Ensure you replace the placeholder with the name of the intermediate certificate.

20. You will be asked to enter and re-enter the password you configured previously. 21. Execute the following command:

keytool -import -alias tomcat -keystore tomcat.keystore -trustcacerts -file [name of the signed certificate] Ensure you replace the placeholder with the name of the signed certificate request.

22. You will be asked to enter and re-enter the password you configured previously. After we added the certificates, we now need to configure the Tomcat server. 1. Navigate to the configuration folder for the Tomcat server. In our example:

\Program Files (x86)\SAP BusinessObjects\tomcat\conf 2. Open the file server.xml for editing (create a backup copy for safety). 3. Add the following section:

<Connector protocol="org.apache.coyote.http11.Http11NioProtocol" port="443" maxThreads="200" scheme="https" secure="true" SSLEnabled="true" keystoreFile=<Path to Keystore file> keystorePass=<Password> clientAuth="false" sslProtocol="TLS"/> Replace the placeholders with your values, for example: <Connector protocol="org.apache.coyote.http11.Http11NioProtocol" port="443" maxThreads="200" scheme="https" secure="true" SSLEnabled="true" keystoreFile=”C:\SSL\keystore.jks” keystorePass=”Password1” clientAuth="false" sslProtocol="TLS"/>

4. Save the changes. 5. Restart the Tomcat server. 6. You should now be able to open up the main Tomcat server page based on the configure port using https as protocol.

6.2.7.2 Install and configure SAP BOE Live Data Component As next step we need to download the SAP BOE Live Data Connect software and deploy it. 1. Logon to Service Marketplace. 2. Navigate to the Software Downloads (http://service.sap.com/swdc). 3. Select the option Installations & Upgrades. 4. Enter BOE Live Data Connect as search term. 5. Select the most recent version and download the software. 6. Extract the WAR file from the ZIP file. 7. Rename the WAR File to sap#boc#ina.war. 8. Copy the WAR File into the folder \Program Files (x86)\SAP BusinessObjects\tomcat\webapps. 9. Restart your Tomcat server. 10. Navigate to the folder \Program Files (x86)\SAP BusinessObjects\tomcat\conf 11. Create a new file called boe.properties. 12. Open the file with a text editor, like notepad and add the following text:

# BOE Server info # Restful Web Service is deployed on Web Application #Container Server. Its default port number is 6405 boe.hostname=http://<BOE_SYSTEM>:6405 boe.authenticationMode=secEnterprise boe.language=en-US boe.temporaryDocumentFolder=BOELiveProviderTempFolder boe.useUnvListCache=false boe.useUniverseCache=false Replace the placeholder <BOE_SYSTEM> with the name of your SAP BusinessObjects system. The above configuration will use the Enterprise authentication.

13. Save the changes to the file. 14. Start the Tomcat Configuration program. 15. Stop the Tomcat Server. 16. Navigate to the tab Java.

http://service.sap.com/swdc



17. Add the following line to the end of the text in the Java Options: -DBocInaAgentConfigurationFile=C:\Program Files (x86)\SAP BusinessObjects\tomcat\conf\boe.properties

18. Click Apply. 19. Click OK. 20. Navigate to the folder \Program Files (x86)\SAP BusinessObjects\tomcat\webapps\sap#boc#ina\WEB-INF. 21. Open the file web.xml with a text editor, such as notepad. 22. Look for the parameter name <param-name>cors.allowed.origins</param-name>. 23. Edit the line <param-value>*</param-value> and replace the * with the URL for your SAP Analytics Cloud tenant. 24. Save the changes to the file. 25. Restart the Tomcat Server.

6.2.7.3 Configuring SAP BusinessObjects Enterprise Rights For your SAP BusinessObjects Enterprise users to be able to access the Universes from SAP Analytics Cloud, these users do need to have access to the Universes, Connections, and they need to be able to create queries on top of the Universes. In the following steps we will create a dedicated User Group and assign the necessary rights to it. 1. Logon to the Central Management Console of your SAP BusinessObjects Enterprise system. 2. Logon with an administrative account. 3. On the CMC Home page select the option Users and Groups. 4. On the left-hand side, select Groups list. 5. Select the menu Manage • New • New group. 6. Enter SAC_Live_Universe as Group Name. 7. Click OK. 8. Navigate back to the CMC Home page. 9. On the CMC Home page select the option Applications. 10. Select the entry Web Intelligence. 11. Use a right-click and select the option User Security.

Figure 6.84: CMC Applications

12. Click Add Principals.



Figure 6.85: User Security

13. On the left-hand side select the entry Group List. 14. Select the previously created group SAC_Live_Universe. 15. Press the arrow in the middle to move the group to the Selected Users and Groups. 16. Click Add and Assign Security (bottom right). 17. Select the entry Full Control. 18. Use the arrow in the middle to move the entry Full Control to the Assigned Access Levels. 19. Click OK. 20. Click Close. 21. Navigate back to the CMC Home page. 22. Select the entry Universes in the category Organize. 23. Ensure the top-level folder Universes is selected. 24. Select the menu Manage • User Security. 25. Click Add Principals. 26. On the left-hand side select the entry Group List. 27. Select the previously created group SAC_Live_Universe. 28. Press the arrow in the middle to move the group to the Selected Users and Groups. 29. Click Add and Assign Security (bottom right). 30. Select the entry View. 31. Use the arrow in the middle to move the entry View to the Assigned Access Levels. 32. On the left-hand side select the tab Advanced.

Figure 6.86: Advanced

33. Click Add / Remove Rights.

Figure 6.87: Add / Remove Rights

34. Select the entry System • Universe. 35. Ensure the right Create and Edit Queries based on Universe is granted (green symbol).



36. Ensure the right Data Access is granted (green symbol). 37. Click Apply. 38. Select the entry System • Universe (Information Design Tool). 39. Ensure the right Create and Edit Queries based on Universe is granted (green symbol). 40. Ensure the right Data Access is granted (green symbol). 41. Click Apply. 42. Click OK. 43. Click OK. 44. Click Close. 45. Navigate back to the CMC Home page. 46. Select the entry Connections in the category Organize. 47. Ensure the top-level folder Connections is selected. 48. Select the menu Manage • User Security. 49. Click Add Principals. 50. On the left-hand side select the entry Group List. 51. Select the previously created group SAC_Live_Universe. 52. Press the arrow in the middle to move the group to the Selected Users and Groups. 53. Click Add and Assign Security (bottom right). 54. Select the entry View. 55. Use the arrow in the middle to move the entry View to the Assigned Access Levels. 56. On the left-hand side select the tab Advanced. 57. Click Add / Remove Rights. 58. Select the entry System • Relational Connection. 59. Ensure the right Data Access is granted (green symbol). 60. Click Apply. 61. Click OK. 62. Click OK. 63. Click Close. You can now use the previously created user group in SAP BusinessObjects Enterprise and assign the user groups to those users that should be able to use a live Universe connection in SAP Analytics Cloud.

6.2.7.4 Configuring client-side browser We also need to verify the client-side browser configuration, to ensure cookies are accepted and popups are allowed. 1. Start Google Chrome. 2. Open the Settings for Google Chrome. 3. Click on Advanced to open the Advanced Settings. 4. Navigate to the area Privacy and Security. 5. Navigate to the area Content Settings and open the details. 6. Navigate to Cookies and open the details. 7. Under Allow Cookies click Add. 8. Here you should now add an entry to allow for cookies from your corporate domain or the domain that is used for your SAP Busi-

nessObjects Enterprise landscape. 9. After adding those entries, navigate back to the Content Settings area. 10. Select the area Pop-ups and redirects. 11. In the Allow section click Add. 12. Enter [*.]sapanalytics.cloud to add popups from your SAP Analytics Cloud tenant. 13. After those changes, close the Settings for the browser. At this point we prepared all the systems for the connectivity with SAP Analytics Cloud, but we have not configured the SAML Authentica-tion part for the SAP BusinessObjects Universe connection, which is what we will configure in the next steps.

6.2.8 Establishing Trust between SAP BusinessObjects Enterprise and SAML Identity Provider (IdP)

In the following sections we will setup Single-Sign-On (SSO) based on a SAML Authentication using SAP Cloud Platform Authentication Service as Identity Provider and we will configure SAP BusinessObjects Enterprise as a SAML Service Provider, so that we then can use the SAML Authentication and achieve a direct live connection from SAP Analytics Cloud to the Universes with Single-Sign-On.

6.2.8.1 Configuring BOE.Properties file As first step for enabling the SAML authentication, we need to make some changes to the BOE.properties file we created previously as part of the Tomcat configuration.

1. Logon to the system where your Tomcat server is running. 2. Navigate to the folder \Program Files (x86)\SAP BusinessObjects\tomcat\conf 3. Open the file called boe.properties with a text editor, such as notepad. 4. Make the following changes:

boe.authenticationMode=saml boe.trustedauth.method=HTTP_HEADER boe.trustedauth.user.name.parameter=X-SAP-TRUSTED-USER boe.httpTimeout=180000 useProxy=false The first line should be a change and the other four lines will be additions to the file.

5. Save the changes.

6.2.8.2 Configuring SAP BOE Live Connect for SAML Authentication As next step we need to enable the SAML Authentication for the SAP BOE Live connect. 1. Logon to the system where your Tomcat server is running. 2. Navigate to the folder \Program Files (x86)\SAP BusinessObjects\tomcat\webapps\sap#boc#ina\WEB-INF. 3. Open the file web.xml for editing. 4. In the text editor search for the term SAML. 5. The first place you find, should match the following text:

   

6. Uncomment the sections, so that the text looks like this:   <context-param> <param-name>contextConfigLocation</param-name> <param-value> /WEB-INF/securityContext.xml </param-value> </context-param> 

7. Search a second time for the term SAML. 8. The second spot should match the following text:

 <!-- <filter> <filter-name>springSecurityFilterChain</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> </filter> <filter-mapping> <filter-name>springSecurityFilterChain</filter-name> <url-pattern>/*</url-pattern>

</filter-mapping> <listener> <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class> </listener> --> 

9. Uncomment the sections, so that the text looks like this:  <filter> <filter-name>springSecurityFilterChain</filter-name> <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class> </filter> <filter-mapping> <filter-name>springSecurityFilterChain</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> <listener> <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class> </listener> 

10. Save the changes to the file.

6.2.8.3 Configuring SAP BusinessObjects Enterprise As next step we will have to configure SAP BusinessObjects Enterprise for the SAML Authentication. 1. Logon to the Central Management Console of your SAP BusinessObjects Enterprise server. 2. On the CMC Home screen select the option Authentication. 3. Select the option Enterprise using a double-click.

Figure 6.88: Enterprise Authentication

4. Enable the option Trusted Authentication is enabled. 5. Click New Shared Secret. 6. Click Download Shared Secret. 7. The file will be placed into the Download location of your browser. 8. Click Update.



9. We now need to copy the downloaded file (TrustedPrincipal.conf) from the download location of the browser to the configured folder for the property Dbobj.trustedauth.home – by default this would be \Program Files (x86)\SAP BusinessObjects\SAP Busi-nessObjects Enterprise XI 4.0\java\pjs\container\bin.

Property Dbobj.trustedauth.home

You can logon to the Central Management Console and check the command line for the server WebApplicationContainer-

Server and check the configured value for the property Dbobj.trustedauth.home.

6.2.8.4 Downloading Meta-Data from SAP Cloud Platform As next step we need to download the metadata from our Identity Provider, in this case SAP Cloud Platform Authentication Service, and deploy the file to the Tomcat server. 1. Logon to the SAP Cloud Platform Identity Authentication Administration page. 2. Logon with your credentials. 3. On the left-hand side navigate to Applications & Resources. 4. Navigate to the area Tenant Settings. 5. Click on the category SAML 2.0 Configuration. 6. Click on Download Metadata File. 7. Save the file to your local system. 8. Rename the file to idp_metadata.xml. 9. Copy the file from your local system to the folder of the deployed SAP BOE Live web application of your Tomcat server, by default

that would be \Program Files (x86)\SAP BusinessObjects\tomcat\webapps\sap#boc#ina\WEB-INF\classes\metadata.

6.2.8.5 Uploading SAP BusinessObjects Metadata to SAP Cloud Platform We downloaded the metadata from our Identity Provider and now as next step we need to configure our SAP BusinessObjects Enterprise system as a trusted SAML Service Provider in our Identity Provider. 1. Open the URL:

https://<HOST>:<PORT>/sap/boc/ina/saml/metadata Replace <SERVER> with the name of your Tomcat Server where you deployed SAP BOE Live. Replace <PORT> with the configured port for HTTPS.

2. Upon opening the URL, the metadata file - spring_saml_metadata.xml – will be downloaded to the download folder of your browser. 3. Logon to the SAP Cloud Platform Identity Authentication Administration page. 4. Logon with your credentials. 5. On the left-hand side navigate to Applications & Resources. 6. Navigate to the area Applications. 7. Click Add (bottom toolbar). 8. Enter SAP BOE as application name. 9. Click Save. 10. Click on the Type category and ensure it is set to SAML 2.0. 11. Navigate back to the overview page for our new entry for SAP BOE. 12. Click on SAML 2.0 Configuration. 13. Click on Browse for the Metadata File. 14. Navigate to the previously saved metadata file from your SAP BOE system. 15. Select the XML file. 16. After the upload has finished click Save (bottom right). 17. Navigate back to the overview page for our new entry for SAP BOE. 18. Click on the category Name ID Attribute. 19. For our example we will use the option Employee Number. 20. Click Save. 21. Navigate back to the overview page for our new entry for SAP BOE. 22. Click on the category Assertion Attributes. 23. Remove all the default attributes. 24. Use the Add option and add the following entries:






E-Mail email







6.2.8.6 Configuring User Details in SAP Cloud Platform Authentication Service As next step for this configuration, we need to configure the user details in our Identity Provider, which is SAP Cloud Platform Authentica-tion Service. 1. Logon to the SAP Cloud Platform Identity Authentication Administration page. 2. Logon with your credentials. 3. On the left-hand side navigate to Users & Authorizations. 4. Click User Management. 5. Select the User Account that you would like to configure to be able to logon to SAP BusinessObjects Enterprise. 6. Use a double-click on the user to see the details. 7. Open the Details for the area Employee Information. 8. Use the pencil icon (top right) to edit the user details. 9. Ensure the property Employee Number is filled with the credentials for the SAP BusinessObjects System. 10. Click Save.

6.2.8.7 Configure SAML User Attributes Mapping We configured the SAML Authentication to use the Employee Number to use as the Name ID for authentication towards our SAP Busi-nessObjects Enterprise system. Because SAP BusinessObjects Enterprise does not provide an option to map the SAML Assertion Attributes to specific User Account details, there is no specific step that needs to be done at this point, but you have to ensure that the user name you enter in the previous step into the Employee Number attribute does match a User Account on your SAP BusinessObjects Enterprise system – to be specific, it needs to match the Account Name.

SAP BusinessObjects Enterprise SAML Attributes Mapping

As of now, only the Account Name attribute of the SAP BusinessObjects Enterprise User Account can be used for mapping

purpose and it is not configurable nor can it be set to another SAML Attribute.

6.2.9 Creating SAP Analytics Cloud Connections

After we configured the different data source for the usage with SAP Analytics Cloud and setup the SAML authentication between SAP Cloud Platform Authentication Service and our different data sources, we can now create the connections from SAP Analytics Cloud to the different systems and then create our first model in SAP Analytics Cloud using live connections. The following sections are not meant to explain what a data model is, or what is supported from SAP HANA or SAP BW, but instead it just outlines how you can establish the con-nection. We will look at creating models and stories in more details in a later section.

6.2.9.1 Configuring SAP HANA Connection In this section we will setup the connection from SAP Analytics Cloud to SAP HANA, including the setup for Single-Sign-On via the SAML authentication. 1. Logon to your SAP Analytics Cloud tenant. 2. Ensure that you authenticate with an administrative user, which has been configured for SAML with the SAP HANA System. 3. Click on the Home menu. 4. Select Connection. 5. Click on the “+” sign (top right) to add a new connection. 6. Open the list of connections for the Connect to Live Data option.



Figure 6.89: Live Data Connections

7. Select the entry SAP HANA using a double-click.

Figure 6.90: SAP HANA Connection

8. Enter a Name and Description for the new connection. 9. Ensure the Connection Type is set to Direct. 10. Enter the full qualified HANA server name for the Host option. 11. Enter the HTTPS Port, which was configured previously. 12. Enter EN as Language and select the Language entry for English. 13. Set the Authentication Method to SAML Single Sign On. 14. Click OK. You now have the connection to the SAP HANA system and we should now be able to create a model based on HANA views. 1. Logon to your SAP Analytics Cloud tenant. 2. Ensure that you authenticate with a user that is configured for the SAP HANA system. 3. Click on the Home menu. 4. Select the menu Create • Model.



Figure 6.91: Create Model

5. Select the option Get data from a datasource. 6. On the right-hand side select the option Live Data connection.

Figure 6.92: Live Data Connection

7. In the next screen set the System Type to SAP HANA.

Figure 6.93: System Details

8. For the Connection, select the previously connection to your SAP HANA System. 9. The option Data Source will then provide a list of all HANA views available to the selected user. 10. Select a model from your SAP HANA system. 11. Enter a Name and Description. 12. Click OK.



Figure 6.94: HANA Model

13. You will be provided with the list of Measures based on your SAP HANA Model, so be aware that your screen most likely looks differ-ent.

14. Click All Dimensions in the toolbar.

Figure 6.95: All Dimensions

15. Here you can change the description of your dimensions, decide to hide a dimension, and group your dimensions. 16. We will revisit all those options at a later section. For now, click the Save option in the toolbar. 17. Use the Save Model option (Disk Icon) in the toolbar to save the model. 18. Navigate to the Home menu. 19. Select the option Create • Story. 20. Select the option Add a Canvas Page. 21. Select the option Chart. 22. Your new model should now be shown in the list of available Datasources. 23. Select the model based on SAP HANA. 24. You should now be able to use the model and see the data in the chart.

Data Modeling & Story Design

Please note, that this is just to ensure the connectivity can be established. We will focus on Data Modeling and Story Design

later on in another section.

6.2.9.2 Configuring SAP BW Connection In this section we will setup the connection from SAP Analytics Cloud to SAP BW, including the setup for Single-Sign-On via the SAML authentication. 1. Logon to your SAP Analytics Cloud tenant. 2. Ensure that you authenticate with an administrative user, which has been configured for SAML with the SAP HANA System. 3. Click on the Home menu. 4. Select Connection. 5. Click on the “+” sign (top right) to add a new connection. 6. Open the list of connections for the Connect to Live Data option. 7. Select the entry SAP BW using a double-click.



Figure 6.96: SAP BW Connection

8. Enter a Name and Description for the new connection. 9. Enter the full qualified SAP BW server name for the Host option. 10. Enter the HTTPS Port, which was configured previously. 11. Enter the Client number. 12. Enter EN as Language and select the Language entry for English. 13. Set the Authentication Method to SAML Single Sign On. 14. Click OK. You now have the connection to the SAP BW system and we should now be able to create a model based on BW Queries: 1. Logon to your SAP Analytics Cloud tenant. 2. Ensure that you authenticate with a user that is configured for the SAP BW system. 3. Click on the Home menu. 4. Select the menu Create • Model. 5. Select the option Get data from a datasource. 6. On the right-hand side select the option Live Data connection. 7. In the next screen set the System Type to SAP BW. 8. For the Connection, select the previously connection to your SAP BW System. 9. The option Data Source will then provide a list of all BW Queries available to the selected user. 10. Select a BW Query from your SAP BW system. 11. Enter a Name and Description. 12. Click OK. 13. You will be provided with the list of Measures based on your SAP BW Query. 14. Click All Dimensions in the toolbar. 15. Here you can change the description of your dimensions, decide to hide a dimension, and group your dimensions. 16. Use the Save Model option (Disk Icon) in the toolbar to save the model. 17. Navigate to the Home menu. 18. Select the option Create • Story. 19. Select the option Add a Canvas Page. 20. Select the option Chart. 21. Your new model should now be shown in the list of available Datasources. 22. Select the model based on SAP BW. 23. You should now be able to use the model and see the data in the chart.

6.2.9.3 Configuring SAP BusinessObjects Universe Connection In this section we will setup the connection from SAP Analytics Cloud to SAP BusinessObjects Universes, including the setup for Single-Sign-On via the SAML authentication. 1. Logon to your SAP Analytics Cloud tenant. 2. Ensure that you authenticate with an administrative user, which has been configured for SAML with the SAP HANA System. 3. Click on the Home menu. 4. Select Connection. 5. Click on the “+” sign (top right) to add a new connection. 6. Open the list of connections for the Connect to Live Data option.



7. Select the entry SAP Universe using a double-click.

Figure 6.97: SAP Universe Connection

8. Enter a Name and Description for the new connection. 9. Enter the full qualified SAP BusinessObjects server name for the Host option. 10. Enter the HTTPS Port, which was configured previously. 11. Enter the Client number. 12. Enter EN as Language and select the Language entry for English. 13. Set the Authentication Method to SAML Single Sign On. 14. Click OK. You now have the connection to the SAP BusinessObjects system and we should now be able to create a model based on Universes. 1. Logon to your SAP Analytics Cloud tenant. 2. Ensure that you authenticate with a user that is configured for the SAP BusinessObjects system. 3. Click on the Home menu. 4. Select the menu Create • Model. 5. Select the option Get data from a datasource. 6. On the right-hand side select the option Live Data connection. 7. In the next screen set the System Type to SAP Universe. 8. For the Connection, select the previously connection to your SAP BusinessObjects Enterprise System. 9. Open the list of available Universes for the option Data Source. 10. Select a Universe from your SAP BusinessObjects system. 11. Enter a Name and a Description for the new model. 12. Click OK.



Figure 6.98: Query Panel

13. You will be shown the typical query panel for the Universe and you can now choose the dimensions and measure you would like to use.

14. Based on your selected Universe, select some dimension and measures and move them to the Selected Data section. 15. Click OK.

Figure 6.99: Universe Based Model

16. You will be presented with the list of measures based on your query on top of the selected Universe. 17. Click All Dimensions in the toolbar. 18. Here you can change the description of your dimensions, decide to hide a dimension, and group your dimensions. 19. Use the Save Model option (Disk Icon) in the toolbar to save the model. 20. Navigate to the Home menu. 21. Select the option Create • Story. 22. Select the option Add a Canvas Page. 23. Select the option Chart. 24. Your new model should now be shown in the list of available Datasources. 25. Select the model based on the SAP Universe. 26. You should now be able to use the model and see the data in the chart.



6.3 Configuring Import Connections for SAP Analytics Cloud In the previous sections we configured the Live connections towards SAP HANA, SAP BW, and SAP BusinessObjects Universes. In the fol-lowing sections we will establish the connections for Import for the same list of data sources, as well as a few additional data sources. We will go through the configuration of the Import Connections for SAP Analytics Cloud once using the Simple Deployment Kit for a Windows based operating system and we will also go through the configuration steps manually for a Linux based system.

6.3.1 Downloading the Software

As first step we will need to download the Simple Deployment Kit. 1. Logon to Service Marketplace. 2. Navigate to the Software Distribution Center (http://service.sap.com/swdc). 3. Select the option Support Packages and Patches. 4. Enter SAP Analytics Cloud Kit as search term. 5. Select the most recent version and download the ZIP file. 6. Place the ZIP file into a separate folder and unzip the file.

6.3.2 Installing the Simple Deployment Kit

The Simple Deployment Kit will install a Tomcat server, the SAP Cloud Connector, and the SAP Analytics Agent. In case your connection requires the SAP Java Connection – such as the Import Connection for SAP BW – you will have to install this manually as a post-installation step. Please note, that the Simple Deployment Kit is designed for a system which does not have a Tomcat Server, the SAP Cloud Connector, or the SAP Analytics Agent installed already.

Simple Deployment Kit Custom parameters

The file parameters-example.ini is included in the deployment kit .ZIP file. To overwrite the preset user settings used by the

deployment kit, rename this file to parameters.ini and provide the following custom parameters:

tomcatuser: Provide a user name for your Tomcat user.

tomcatpassword: Provide a password for your Tomcat user.

sccpassword: Provide a SAPCP Cloud Connector password.

To start the installation of the Simple Deployment Kit follow these steps: 1. Ensure you are logged in as an administrator on the operating system. 2. Navigate to the folder where you unzipped the software download. 3. Select the file setup.ps1. 4. Use a right-click and select the option Run with PowerShell. 5. In case you receive a warning about the program making changes to the computer, confirm that with Yes.

Figure 6.100: Windows PowerShell

6. In the PowerShell select option 1 to agree to the License Agreement. Enter 1 and press Enter on the keyboard.




Figure 6.101: Windows PowerShell

7. As next step we have to confirm, that we want to continue with the default parameters. 8. Enter 1 and press Enter on the keyboard. By default, the software will be installed at \Program Files\SAP\SAPAgentKit. 9. The system will then install the software with the default options and also assign passwords to the created accounts. 10. After the installation is finished, all information is stored in a file named Setup-Guide.html, which can be found in the installation

folder \Program Files\SAP\SACAgentKit. 11. In the PowerShell script hit Enter to exit it. 12. Navigate to the installation folder \Program Files\SAP\SACAgentKit. 13. Open the file Setup-Guide.html with a browser. 14. You should be able to call the following URL : https://<Server Name>:8443 based on the default installation. In the next section we will replace the default SSL certificate with a proper signed certificate.

6.3.3 Replacing the Default SSL Certificate

By default, the installation comes with a self-signed certificate, which we will replace with a proper signed certificate in the next steps. To replace the default certificate, follow these steps: 1. Logon to the system where you installed the SAP Cloud Connector. 2. Call the URL https://<Server Name>:8443. 3. In case you receive an error message about the site not secure, select the Advanced option and choose to continue to the site.

Figure 6.102: Cloud Connector

4. Logon to the SAP Cloud Connection. The credentials create as part of the installation, have been saved to the Setup-Guide.html file, available in the installation folder \Program Files\SAP\SACAgentKit.



Figure 6.103: Cloud Connector Administration

5. On the left-hand side select the menu Connector • Configuration. 6. In the section UI Certificate, select the option to Generate a new Certificate Signing Request.

Figure 6.104: UI Certificate

7. You will then be asked to provide the system details.

Figure 6.105: Certificate Request

8. Provide the details for the system and click Generate. 9. Depending on your browser configuration, you will either get prompted to save the request to a file or the file is being downloaded

to the configured Download location of your browser automatically. 10. The certificate request is saved as a PEM format. 11. Use the Certificate Request and obtain a Certificate response from your Certificate Authority. 12. Download the received certificate from your Certificate Authority and make sure you receive the PEM format with the complete

chain. 13. In the section UI Certificate, select the Upload option.



Figure 6.106: Certificate Upload

14. Select Browse. 15. Navigate to the certificate file. 16. Upload the certificate. 17. Click Import. 18. Restart the SAP Cloud Connector.

Change of Password

To change SAP Cloud Platform Cloud Connector password, go to the Configuration tab under User Interface > Authentica-

tion.

6.3.4 Configure SAP Cloud Connector

As next step we will have to setup the subaccount for the SAP Cloud Connector. To be able to configure the next step, we also will require a few details from our SAP Analytics Cloud tenant. To receive the required details: 1. Logon to your SAP Analytics Cloud tenant with an administrative account. 2. Navigate to Home • System • Administration. 3. Navigate to the tab Data Source Configuration. 4. Click on the pencil in the top right corner to edit the information.

Figure 6.107: SAP CP Account

5. Add your S-User for your company and SAP Analytics Cloud tenant. 6. Click Add S-User. 7. You will receive information about the Subaccount, Region Host, and Subaccount User. Take note of those details.

S-User & SAP Analytics Cloud Tenant

In case you do not know the S-User please see SAP Note 2397165 for further details on how to obtain the details via SAP

Support.

Now we can configure the details for the SAP Cloud Connector: 1. Logon to the system where you installed the SAP Cloud Connector. 2. Call the URL https://<Server Name>:8443. 3. Logon with the administrator account. 4. On the left-hand side select the menu entry Define Subaccount.



Figure 6.108: Subaccount

5. Provide the following details:

• Region Host: Select the entry from the provided list, matching the details you received in the previous steps.

• Subaccount: Enter the details received in the previous steps.

• Display Name: Enter a Description.

• Subaccount User: Enter the detailed received in the previous steps. • Password: Enter the password for the subaccount user.

• Location ID : Enter a Location ID, for example SACImportUS 6. In case you are using a proxy, provide the details in the HTTPS Proxy area. 7. Click Save (top right corner). 8. You will receive a message about the Location ID.

Figure 6.109: Confirmation Message

9. Click OK to confirm the message. 10. You should now see your Subaccount overview with the configured details.

6.3.5 Configuring Access Control

As next step we will have to define a system mapping in the SAP Cloud Connector. 1. Logon to the system where you installed the SAP Cloud Connector. 2. Call the URL https://<Server Name>:8443. 3. Logon with the administrator account.



Figure 6.110: Menu

4. On the left hand side – below your newly created Subaccount – select the option Cloud to On-Premise. 5. Ensure you select the tab Access Control.

Figure 6.111: Cloud to On-Premise

6. Click the “+” icon (top right corner) to add a new system. 7. Select the option Other SAP System.

Figure 6.112: New System Mapping

8. Click Next. 9. Select HTTP as Protocol. 10. Click Next.



Figure 6.113: System Mapping

11. Enter the following: • Internal Host: localhost (or the fully qualified host name)

• Internal Port: 8080 Please note, that these values refer to the Tomcat server where the SAP Analytics Cloud Agent is deployed.

12. Click Next. 13. Enter the following:

• Virtual Host: localhost (or the fully qualified host name) • Virtual Port: 8443

Please note, that the default values will be the internal host name and port, as specified in the previous step. You can rename the values, so that the internal host name and port are not exposed.

14. Click Next. 15. Select None for the Principal Type. 16. Click Next. 17. You can add a description. 18. Click Next.


19. Enable the option Check Internal Host. 20. Click Finish.




21. After you added the new system mapping, the column Check Result should display as Reachable, indicating that the SAP Cloud Con-nector can reach the SAP Analytics Cloud Agent.

22. Select the new system mapping in the table.

Figure 6.116: Resources

23. Click on the “+” icon for the second table – Resources Accessible.

Figure 6.117: New Resource

24. Enter the following:

• URL Path: /C4A_AGENT/

• Enabled: Activated • Access Policy: Path and all sub-paths

25. Click Save.

Figure 6.118: New Resource

26. Status for the Check Result in the upper table and Status for the URL Path in the lower table should both show a green status.



6.3.6 SAP JCo Deployment

For the connection to SAP BW and SAP ERP we will need the SAP JCo deployment. 1. Logon to Service Marketplace. 2. Navigate to the Software Distribution Center (http://service.sap.com/swdc). 3. Select the option Support Packages and Patches. 4. Enter Java Connector as search term. 5. Select the most recent version for your operating system platform and make sure you download the 64 bit version. 6. Stop the Tomcat server of your SAP Cloud Connector deployment. 7. Copy the files sapjco3.jar and sapjco3.dll (Windows deployment) to \Program Files\SAP\SACAgentKit\tomcat\lib. 8. Restart the Tomcat server.

6.3.7 Configuring SAP Analytics Cloud

As next step we will have to configure the Datasource Configuration in SAP Analytics Cloud. 1. Logon to your SAP Analytics Cloud tenant with an administrative account. 2. Navigate to Home • System • Administration. 3. Navigate to the tab Datasource Configuration. 4. Click on the pencil in the top right corner to edit the information. 5. Scroll down to the area On-premise data sources.

Figure 6.119: On-premise datasources

6. Click Add a new Location.

Figure 6.120: New Location

7. Enter the Location ID configured in the previous steps (case sensitive). 8. Enable the option Enable Agent.




Figure 6.121: New Location Details

9. Provide the necessary details: • Host: Enter the virtual host name you configured in the previous steps.

• Port: Enter the port for the virtual host you configured in the previous steps.

• User Name: Agent name specified in tomcat-users.xml

• Password: Agent password specified in tomcat-users.xml

Agent User

As part of the deployment using the Simple Deployment kit, the Agent user and password has been configured and the

information is available as part of the Setup-Guide.html file available at \Program Files\SAP\SACAgentKit. You can also use

the tomcat-users.xml file available at \Program Files\SAP\SACAgentKit\tomcat\conf to customize the setting.

Please note, that the user password is configured to be encrypted as part of the default deployment of the SAP Cloud Con-

nector.

10. Click Create. 11. Your new location will be added and should show with a green status.

Figure 6.122:

12. Click Save (top right corner). At this point, we configured all necessary steps and we should be able to setup Import connections towards our data source in SAP Analyt-ics Cloud now.

Mastering SAP Analytics Cloud

Documents

Transcript of Mastering SAP Analytics Cloud