Product Alert Update Dec 19 – SAP Analytics Cloud and Google Chrome

[robert_horne]

Updated May 3rd 2024

Our latest communication on this topic is available here: https://community.sap.com/t5/technology-blogs-by-sap/third-party-cookies-and-sap-analytics-cloud/ba-...

Updated Dec 19th - See updated mitigation provided by Google in recent blog update

We will keep this blog and associated notes updated as we have more information

In an ongoing effort to combat the misuse of third-party cookies and align with the guidelines set by the UK's Competition and Markets Authority (CMA), Google Chrome has initiated the deprecation of third-party cookies. While this move holds advantages for consumer privacy, it also impacts the technology that underpins numerous web integrations commonly employed in enterprise software.

SAP Analytics Cloud relies on third-party cookies for various crucial workflows, which include:

• Live connections
  
  
  • Live connections to SAP Datasphere should not be affected
  
  
  • Live connections to SAP HANA Cloud will not be affected
  
  
  

• OData Technical Component (accessing OData sources through scripting)

• Embedding SAP Analytics Cloud (incorporating within another web app)

• Webpage widget (integrating other web apps within SAP Analytics Cloud)

• SAP Analytics Cloud embedded in line of business applications like: SAP S/4Hana Cloud, SAP Successfactors, SAP Ariba and others.

• Custom Widgets

3rd Party Cookie Deprecation of 1% of Browsers: Despite our collaborative efforts with the Chrome team to tackle the issues associated with 3rd party cookies ahead of complete deprecation, Google has unveiled plans for a trial to deactivate third-party cookies for "1% of Chrome Stable users". Consequently, starting in Q1 2024, an expanding segment of Chrome users can anticipate the disabling of third-party cookies, impeding access to workflows reliant on this technology

Users experiencing third-party cookies deactivation will be unable to execute the workflows mentioned above, including the integration of SAP Analytics Cloud into other applications such as S/4Hana Cloud, SuccessFactors, Ariba, and others.

Mitigations

Update Dec 19th - How to re-enable third party cookies:  In a recent blog from the Google team they provide detailed information on how the 1% trial will be rolled out on January 4th.

• See details here: https://blog.google/products/chrome/privacy-sandbox-tracking-protection/

The update from Google provides information about how users will be informed if they are included in the 1% trial that restricts third party cookies. It also shows how users will be able to opt out for 90 days and re-enable third party cookies.

Chrome Enterprise: To guarantee uninterrupted service, you can ensure that your user base utilizes Chrome Enterprise, exempt from the 1% of browsers subjected to third-party cookie deactivation in Q1 2024.

“As with the majority of Chrome experiments, most enterprise end users will be excluded from the 1% third-party cookie deprecation automatically. For the few that may be affected, enterprise administrators can set the BlockThirdPartyCookies policy to false to opt out their managed browsers ahead of the experiment and allow time to make necessary changes to not rely on this policy or third-party cookies.”

https://developers.google.com/privacy-sandbox/3pcd#enterprise_support

Microsoft Edge is also fully supported by SAP Analytics Cloud. If you are not already using Edge, it may be prudent to run a few test scenarios to see if it can be available as a backup browser in the case that any of your end users are affected. Although Edge is based on Chromium it doesn’t appear it will start to disable cookies for 1% of their users. If things change, we will update this blog with the latest information.

We are actively engaged in creating solutions that alleviate the need for customer intervention or mitigation. We will be posting more about those solutions in the coming days and weeks. Stay tuned to this blog and related SAP notes for further updates on this matter.

Driving awareness to your user base

Following Google's latest update Dec 14th, they have provided a temporary mitigation that should be effective for every use case. However, there remains a chance that your end users might be chosen to participate in the trial. If they are selected and are not aware of the potential problems and associated mitigations, this could cause IT tickets for your team. Therefore, it is advisable to explore optimal methods for raising awareness among your user base and IT support team to ensure the least disruption to business in the new year.

See related SAP Knowledge Base Article (KBA) for related information https://launchpad.support.sap.com/#/notes/3412305

 

[kcupersmith]

Do we know the impact of SAP Datasphere connections specifically when building a SAC stories based on DSP Analytical models?

[robert_horne]

karianne

Live connections to Datasphere should not be affected. We have internal mitigations for that case since we control both servers.

[hugh_gledhill]

Hi robert.horne

Does this affect all custom widgets? If no, how can we identify which custom widgets will be affected?

Thanks,

Hugh

[olizotte]

Hello robert.horne ,


What are the expected impacts on live connectivity to S/4 HANA On Premise and S/4 HANA Cloud Public Cloud?

Can we expect more detail around these areas in the upcoming days/weeks as well?


Thanks,

Olivier

[robert_horne]

Hi Olivier

S/4 HANA On Premise will be affected because this is on-prem and out of our control. On Premise domains and connectivity are out of our reach until we have an update. In this scenario you will want to use one of the mitigations we suggested.

For S/4HANA Cloud Public because that is a server controlled by SAP I'm more optimistic this will not be affected, but we are validating that currently.

I will be publishing more on solutions in the coming weeks.

 

[robert_horne]

Hi Hugh

It is my understanding that only custom widgets that call external services that require third party cookies will be affected.

I will be updating the blog soon with more information on that. It is my understanding that the problem doesn't directly conflict with the feature, except for the case of calling other servers.

Adding the PM of Custom Widgets for visibility  and correctness marouferchichi

[marianomunoz]

Hi,

Should we understand that the Chrome Enterprise version is only exempt in Q1 2024? What about the future?

Thx

Mariano

[robert_horne]

This should be good until Q3 2024. By then we should have a solution in place that we are collaborating with Google on.

[Marco_Ch]

Hello Robert

Thank you for the information.

This Product Alert is now very dedicated to the SAC. Is there any information about other software solutions from SAP that will also have problems with this?

Is there no SAP-wide alert information? Because I hardly believe that SAC stands alone.

[yannmiquel]

Hi Robert,

Will the live connection between SAC and HANA Cloud also be concerned ? This one : https://help.sap.com/docs/SAP_ANALYTICS_CLOUD/00f68c2e08b941f081002fd3691d86a7/5bd569b3f75f49f29e9ec...

Thank you for your help

Yann

[yannmiquel]

Hi Robert,

Is the use of a corporate IDP also be affected by this ? In this type of configuration : 2411608 - SAP Analytics Cloud SAML authentication configuration *** Collective KBA ***

Thank you

Yann

Edit: I don't see any issue with the corporate IDP (SAML) and 3rd party cookies disabled

[robert_horne]

I have confirmed that Live Connections to HANA Cloud will not be affected.

[yannmiquel]

Thank you! My little test reached the same conclusion.

[yannmiquel]

I tried to use BO 4.3 sp2 (// HANA Cloud + own IDP) with 3rd party cookies disabled and everything seems to work. Nonetheless I would be surprised that the xsuaa works with this parameter.

[robert_horne]

I'm not currently aware of a global one, but I will keep looking and post here if and when I find one. In general it is very specific to each application and the specific use cases for that application. When thinking about a general case you will find it when applications embed other web applications often requiring third party cookies.

[robert_horne]

There should be no issue with corporate IDP setups. In general these workflows use cookies but not third party cookies. Browser redirects are the primary workflow and cookies are first party cookies as the domains in the address bar when the redirects are happening between the IDP and application.

[scj]

Hi Robert, customer contact who owns the SAC tenant received the email notification with Subject : [IMPORTANT Note from SAP SAC] Product Alert – SAP Analytics Cloud and Google Chrome. Other IT contact would like to subscribe on the notification moving forward. would you know how they can subscribe? Thanks

[Henry_Banks]

Hi sharmanejayobo

two ways of doing this

either in the 'sap for me portal' - an S-user needs to subscribe to the various notifications for that  system (i believe 'Customer Communication' is the right one for this notice) https://me.sap.com/systemsprovisioning/getNotified

or in the SAC tenant itself, under System > Administration > Notifications > System Event Notification...  you can add 'Additional Email Recipients' manually (these dont consume a license, and dont need a user role assigned)

regards, H

[robert_horne]

I just received this blog link from Google which provides more information on how the 1% Trial will be rolled out and how if selected a user can opt-out to ensure their website works.

https://blog.google/products/chrome/privacy-sandbox-tracking-protection/

In the coming hours I will update this blog with this information.

[robert_horne]

I have updated the body of the blog with new information provided by a recent Blog from Google. https://blog.google/products/chrome/privacy-sandbox-tracking-protection/

[robert_horne]

Also please see the latest update on the blog.

[cgueler]

Hi Robert,
I would like to know, whether also Apple clients working with Google Chrome browser are also affectted of this trial of Google ?

Best regards
Cengiz

[Henry_Banks]

Hi robert.horne thanks for this blog.

Can i just check, this is how a customer knows if they are on Corporate Chrome? (therefore excluded from the 1%)

Secondly, about that Google blog (thanks for linking) do i understand it correctly that the workaround (if you are in the 1%) it's a simple toggle to enable?

Regards,

H

[robert_horne]

henry.banks yes you are correct on both accounts.

[robert_horne]

I'm not an expert on Chrome, but I can say that I haven't read anything to suggest that Apple clients are being exempted from the trial.

[matteo_s]

Hi Robert,

thanks for this update. Might I ask you a little clarification? When you say "OData Technical Component (accessing OData sources through scripting)" you are referring specifically and only to use OData via Analytical Applications or Optimized Stories's scripts?

That means - if I understand correctly - that all the import connection that are based on OData are NOT affected by 3rd party cookies. Correct?

 

Thanks and Best Regards.

[robert_horne]

I believe that is correct. OData imports data connects from the SAC server and not from the browser. Its when we connect to multiple servers from the same browser session.

[neil_phillips2]

Hi ,

Can you confirm when the next update to this blog for the current status including any ongoing time based risks will be published please ?

[ABA2]

Is there any new information regarding the issue with SAP Analytics Cloud (SAC) Live Connectivity in BW4? The latest update recommended using EDGE. Is establishing a tunnel connection a potential solution for this?

[robert_horne]

We have a new updated blog here: https://community.sap.com/t5/technology-blogs-by-sap/third-party-cookies-and-sap-analytics-cloud/ba-...