SAP Analytics Cloud Integration into Joule - Part 2

Introduction

In Part 1, we completed the foundational setup for SAP Joule by:

Creating SAP BTP subaccounts and spaces
Configuring SAP Cloud Identity Services
Enabling SAP Build Work Zone
Running the Joule Booster to establish system formations

In Part 2, we complete the integration by connecting SAP Analytics Cloud (SAC) to SAP Build Work Zone and Joule. This includes:

OAuth client creation in SAC
Design-time and runtime destination configuration
Content provider creation
Role consumption
User and role provisioning using Identity Provisioning Service (IPS)
Final Joule validation

Create OAuth Clients in SAP Analytics Cloud

To allow SAP Build Work Zone and Joule to securely access SAP Analytics Cloud content, OAuth clients must be configured in SAC.

SAP documentation reference:
Consume Role Definition Content from SAP Analytics Cloud

1. Create OAuth Client for Design-Time Access

The design-time OAuth client is used to:

Read SAC role definitions
Import analytical metadata into SAP Build Work Zone

Procedure

Log in to SAP Analytics Cloud
Navigate to:
System → Administration → App Integration
Under Configured Clients, choose Add an OAuth Client
Maintain the following values:
Name: sac-buildworkzone-dt (example)
Purpose: API Access
Access: User Provisioning
Authorization Grant: Client Credentials
Configure Token Lifetime:
Positive integer value
Units: minutes, hours, or days
If not specified, the token lifetime is infinite
Click Add

Save Credentials

Copy and store the Client ID
Click Copy Secret and save the Client Secret
Note the Token Service URL

Important
The client secret is displayed only once and cannot be retrieved later.

OAuth Clients Summary

After completing this step, you should have two OAuth clients in SAP Analytics Cloud:

1. Runtime OAuth Client (Auto-created by Joule Booster)

Created automatically during Joule booster execution
Used at runtime by Joule
Uses SAML Bearer Assertion
Client secret cannot be copied

2. Design-Time OAuth Client (Manually Created)

Used for:
Importing SAC roles
Reading analytical metadata
Client ID and secret are used in SAP BTP destinations

Picture 1.png

Create Design-Time Destination in SAP BTP

This destination enables SAP Build Work Zone to read role definitions from SAP Analytics Cloud.

Procedure

Sign in to the JouleBATTesting subaccount
Navigate to:
Connectivity → Destinations
Click Create Destination

Destination Configuration

Property	Value
Name	SAC_SWZ_DT
Type	HTTP
URL	https://<SAC-domain>/api/v1/cdm
Proxy Type	Internet
Authentication	OAuth2ClientCredentials
Client ID	SAC design-time OAuth Client ID
Client Secret	SAC design-time OAuth Client Secret
Token Service URL Type	Dedicated
Token Service URL	Token URL from SAC OAuth configuration

Additional Properties

Property	Value
HTML5.SetXForwardedHeaders	false
URL.headers.x-sap-sac-custom-auth	true

4. Click Save

Create Runtime Destination by Cloning

Instead of manually creating a runtime destination, reuse the destination created automatically by the Joule booster.

Picture 3.png

Procedure

Go to:
Connectivity → Destinations
Locate destination:
DYN_SAC_SSO
Click Clone
Provide a new name:
SAC_SWZ_RT

Additional Properties

Property	Value
sap-card-nominations-path	/api/v1/interest-cards
sap-start	true

5. Save the destination

Assign Required Roles to Users

Before proceeding, ensure the user has required roles.

Procedure

Go to:
Subaccount → Security → Users
Assign the following roles to the IdP user:
Launchpad_Admin
Launchpad_External_User

Create Content Provider in SAP Build Work Zone

This step imports SAC content and role definitions into SAP Build Work Zone.

Procedure

Go to Service Marketplace
Open SAP Build Work Zone
Choose Go to Application
Navigate to Channel Manager
Click + New Content Provider

Content Provider Configuration

Property	Value
Title	sac.analytics
Description	SAP Analytics Cloud content
ID	sac.analytics
Design-Time Destination	SAC_SWZ_DT
Runtime Destination	SAC_SWZ_RT
Runtime Destination for Dynamic Data	Default
Automatically add content	Enabled
Use IPS for authorizations	Enabled

6. Click Save

Results

SAC role definitions are imported into SAP Build Work Zone
System Owner role is intentionally not imported
Role changes in SAC require manual refresh from Channel Manager

Picture 9.png

Provision Users Using Identity Provisioning Service (IPS)

To allow users to access analytical insights via Joule, users, roles, and permissions must be synced from SAC to SAP Build Work Zone.

1. Configure SAP Analytics Cloud as Source System

Reference: SAP Analytics Cloud IPS documentation

Picture 10.png

Procedure

Open SAP Cloud Identity Services Admin Console
Navigate to:
Identity Provisioning → Source Systems
Add SAP Analytics Cloud as a source system

Mandatory Properties

Property	Value
Type	HTTP
URL	SAC base URL (no path)
ProxyType	Internet
Authentication	BasicAuthentication
User	SAC OAuth Client ID
Password	SAC OAuth Client Secret
OAuth2TokenServiceURL	SAC token service URL
sac.api.version	2 (recommended)