SAP Business Technology Platform

Introduction

Multi-factor authentication (MFA) is an extra layer of security used when logging into websites or apps to authenticate users through more than one required security and validation procedure that only they know or have access to. Security Assertion Markup Language (SAML) is a protocol for authenticating to web applications. SAML allows federated apps and organizations to communicate and trust one another’s users.

Acceptto™, as a SAML provider, improves the user login experience for SAP BTP users with intelligent and convenient MFA.

Pre-Requisites

1. An Acceptto account with a configured Identity Provider and LDAP Agent (See this page for instructions).

2. A BTP Cockpit user account with administrative access.

3. A user with administrative privileges for the Acceptto Cloud dashboard.

Configure SAP BTP as a Service Provider

1. Download the SAML metadata and certificate for your organization from Acceptto.

Metadata Download at https://sso.acceptto.com/myorganization/saml/download/metadata or view at https://sso.acceptto.com/myorganization/saml/metadata Certificate Download at https://sso.acceptto.com/myorganization/saml/download/cert

2. Log into your SAP BTP Cockpit portal as an administrator.

3. Click on your preferred Subaccount.

   

4. Navigate to the Security tab and click on Trust Configuration. Click on SAML Metadata to download SAP metadata for the next section.

5. On the Trust Configuration tab, click New Trust Configuration.

   

6. Upload the metadata file that was downloaded earlier from Acceptto. Provide a Name for the IdP setup and a name in the Link Text for user Login field that shows up on the user login screen.

   

7. Click Save.

8. Go to the Security tab and click on Users. Then, select Create for creating users to authenticate via Acceptto SSO.

9. Enter the User Name and E-Mail address and select the Acceptto IdP that was created earlier.

   

10. Go to the Security tab and click on Role Collection. Click the + button on the right corner.

    

11. Enter the name for Role Collection and click on Create.

12. Click on the created Role Collection and select Edit.

13. Add Roles and Users or User Group that you want to use an application or instance in Launchpad and click Save.

    

Acceptto SAML Configuration as Identity Provider (IdP)

1. Login to the Acceptto Dashboard with an administrative account and go to Applications.

2. Create a new application by selecting the Create New Application.

   

3. In the New Application form, enter the following values under the General tab:

   • Name - The application name displayed in the admin panel and application portal and used for push notifications and audit logs (e.g. SAP).
   • Type - Select "SAML Service Provider" from the options.
   • Out of Band Methods - Select the allowed methods for approving MFA requests
   • Message for MFA Requests - Enter the user-facing message for Push, SMS, and email MFA requests (optional)

   

4. Under the SAML Service Provider Configuration tab, enter the following values:

   • Issuer or Entity ID – The Issuer/EntityID of your SAP BTP can be copied from the SAP metadata that downloaded in the previous section.
   • Sign in URL - The Sign in URL of your SAP BTP can be copied from the SAP metadata that downloaded in the previous section.
   • NameID Format - Email Address.
   • Name Identifier - Email.

   

5. Click Save.

Test Your Setup

1. Go to your SAP BTP Launchpad portal.

2. Select Acceptto IdP for authentication via Acceptto SAML.

   

3. You will be redirected to the Acceptto SSO page.

   

4. After successful authentication, you’ll see the Acceptto MFA options. Select your desired method.

   

5. Finally, you will be redirected to the SAP Launchpad portal page via an easy and passwordless authentication method.

   

Notes:

• You can switch off the Default Identity Provider by navigating to the Trust Configuration Section and clicking on the pencil icon next to the Default Identity Provider. Uncheck the option Available for user logon. After this change, users will be redirected to the Acceptto SSO page directly.

• Depending on the Application or instance that is assigned to the users, it is possible that you need to map the assertion attributes and pass them in the SAML assertion like the below attributes.

Support

If you require assistance, please email us at support@acceptto.com

Sales

Want to learn more about our MFA solutions? Contact our Professional Services for a Demo today.

Disclaimer

All product names, trademarks, and registered trademarks are the property of their respective owners.

All company, product, and service names used in this document are for identification purposes only. The use of these names, trademarks, and brands do not constitute an endorsement by the Acceptto Corporation.