Logging on to SAP CPI using SAP users with SSO enabled

Most SAP Integration Suite / CPI is enabling SSO to make it easier to create and manage users. It makes it a lot easier to log in and work on your iflows.

If you have sent up the connections it also means you cannot use S-Users to login to the systems anymore. But that is not really true. You still have options to login with your s-users. It depends on the system you are using.

The S-user you are using should have roles on the CPI system you are trying to connect to for those tricks to work.

Neo

On the neo platform, you have your CPI URL that looks like the following https://xxxx-tmn.hci.eu1.hana.ondemand.com/itspaces.

To log in you go first to https://xxxx-tmn.hci.eu1.hana.ondemand.com/cxf then you get a popup to login via Basic Authentication.

If successful you will get an error “No service was found.”

Then just go to the itspaces URL and you are logged in with that user.

Cloud Foundry

In CF you have the option to specify which Authentication providers can be used for Logon. The Default which is SAPs authentication provider is always active.

On CF an authentication service is used. You will see this URL once you try to log in before it is redirected. In general it looks something like the following.

https://xxx.authentication.eu10.hana.ondemand.com/login?login_hint=%7B%22origin%22%3A%22sap.default%22%7D

To log in you will need to ask the system to use a different authentication provider. That is done with the login_hint parameter.

Once you have logged in you will see the following.

Then you can go to your CPI/Cloud Integration URL and start using it with your S-User credetials.

Why do we care

In the Figaf tool, we have found the APIs that the user has had some advantages compared to the public APIs delivered. And then sometimes it is a lot easier to use S-Users than create people in the Active Directory.