How to generate a SAML assertion by Using SAP Cloud Identity Services (IAS)

[anna_xu2]

Hi,

Could anyone please share details on how to generate a SAML assertion response through API for SAC (SAP Analytic Cloud Embedded Lite) by using SAP Cloud Identity Services (IAS)

We are trying to figure out how IAS could provide a SAML assertion response by API so that our application could call it for live connection at SAC.

I know that there is a tiger demo application which used to provide the SAML Assertion for SAC, however, our security expert suggest us to  call IAS API to generate the SAML response directly. 

I would need to know the detailed steps to generate SAML assertions by using IDP (SAP IAS) API.

Thank you,

Anna

[anna_xu2]

Below is the SAML Assertion SAMPLE we needed: <?xml version="1.0" encoding="UTF-8"?> <saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://onntvudbzxtzccg8gxrtf8x.authentication.us31.hana.ondemand.com/saml/SSO/alias/onntvudbzxtzccg..." ID="_e94f9b08228c6b5a84b97c717ac1f270" IssueInstant="2024-09-30T07:51:59.185Z" Version="2.0"> <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">tiger</saml2:Issuer> <saml2p:Status> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Success"/> </saml2p:Status> <saml2:Assertion xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion" ID="_5c8ef919fd221bb269ef69b20d86bd8d" IssueInstant="2024-09-30T07:51:59.185Z" Version="2.0"> <saml2:Issuer>tiger</saml2:Issuer> <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"> <ds:SignedInfo> <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/> <ds:Reference URI="#_5c8ef919fd221bb269ef69b20d86bd8d"> <ds:Transforms> <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/> <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/> </ds:Transforms> <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/> <ds:DigestValue>DSxHzU0f7Ckvg8D48L7AJsiwLHJS6p2IiG1BErn2G3w=</ds:DigestValue> </ds:Reference> </ds:SignedInfo> <ds:SignatureValue> T86G0LCBtplHQQU61ylqV3m6XvECr3YF847+f9U30RtLR5tmJUbngvsqu91vXs+8CXBrW+HOOpqx&#13; Uy6VkU5Xmv5RRORK/rAKtWJIlyAXMUbsRNQ6qs83ynHIuQvwG7Yk7nmYORcy3ALGK10HS/hQ8e8P&#13; 9TIRlu5jLk7QhEpvkXowMRqhWCDc9XcOYtRJlcwxFa9Yd0jtj7YUsQg0+Ad4yPVwLpMkEfKHSoKc&#13; zrGd+mOgBrycyEQEQ0AMeuUyDIIoZG0MBxaLu/EGjUQGkaHVZ9ok6O/0vw37lfcqR5skupPX8qvm&#13; BWZYYnyHLZiff2+BIjS/RmKvGNfQ/FhQ4vCntw== </ds:SignatureValue> </ds:Signature> <saml2:Subject> <saml2:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">jin.chen06@gmail.com</saml2:NameID> <saml2:SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"> <saml2:SubjectConfirmationData NotOnOrAfter="2024-10-01T07:51:59.185Z" Recipient="https://onntvudbzxtzccg8gxrtf8x.authentication.us31.hana.ondemand.com/saml/SSO/alias/onntvudbzxtzccg..."/> </saml2:SubjectConfirmation> </saml2:Subject> <saml2:Conditions NotBefore="2024-09-28T07:51:59.185Z" NotOnOrAfter="2024-10-01T07:51:59.185Z"> <saml2:AudienceRestriction> <saml2:Audience>https://onntvudbzxtzccg8gxrtf8x.authentication.us31.hana.ondemand.com</saml2:Audience> </saml2:AudienceRestriction> </saml2:Conditions> <saml2:AuthnStatement AuthnInstant="2024-09-30T07:51:59.186Z" SessionNotOnOrAfter="2024-10-01T07:51:59.186Z"> <saml2:AuthnContext> <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession</saml2:AuthnContextClassRef> </saml2:AuthnContext> </saml2:AuthnStatement> </saml2:Assertion> </saml2p:Response>

[gregorw]

Can you provide details which target system you want to connect via the live data connection?

[adityawsharma]

Hi @anna_xu2 , not sure if you found the answer to this, you can use the method as described in OSS note 3429585 - How to generate SAML assertion for SuccessFactors using IAS - SAP for Me which can help with the steps in IAS. You can skip the steps within SuccessFactors as mentioned in this note. Hope this helps.

Thanks,

Aditya

[Emileh]

This note has been removed....