Cloud Access Manager as an Identity Provider (IDP)
To configure Cloud Access Manager as an identity Provider
- In NetWeaver administration on the Configuration | Security | Authentication and Single Sign-On | SAML 2.0 page, click the Trusted Providers link. Click Add, and choose by uploading metadata file.
- In the Select Metadata step, choose the CloudAccessManagerMetadata.xml document downloaded in step 11 of Cloud Access Manager configuration - (Identity Provider Role) and click Next.
- In the Metadata Verification step, choose the certificate (PEM file) downloaded in step 11 of Cloud Access Manager configuration - (Identity Provider Role) and click Next.
- In the Provider Name step, type the alias name Cloud Access Manager and click Next.
- In the Signature and Encryption step, change the Single Sign-On Authorization Request Sign parameter to Never and click Next.
- Click Next through to the end, then click Finish.
- Click Edit, then under the Identity Federation tab, click Add to add a Name ID format.
- Under Format Name, choose Unspecified. Under Source Name, choose Logon ID.
- Click OK and then Save.
- Click Enable.
Enabling SSO to SAP NetWeaver applications
To allow single sign-on (SSO) to your NetWeaver applications
- In NetWeaver Admin, select Configuration | Security | Authentication and Single Sign-On.
- On the Authentication tab, highlight the ticket policy configuration. On the Authentication Stack tab, click Edit.
- Under Login Modules, click Add. Choose SAML2LoginModule from the dropdown list. Click Add again, and choose CreateTicketloginModule from the list.
-
Change the order and the flag status of the five login modules to match the following, then click Save. This will use federation, and fall back to forms if federation fails.
EvaluateTicketLoginModule SUFFICIENT SAML2LoginModule OPTIONAL CreateTicketLoginModule SUFFICIENT BasicPasswordLoginModule REQUISITE CreateTicketLoginModule OPTIONAL
