Multiple IdPs along with SAP Id Service

[sandeep_joseph]

Dear All,

My usecase is to use a third party idP for certain users and the default SAP Id service for some others. The application knows when to use what. To achieve this I configured the third party IdP in the trusted IdP section. However I don't find the option to have the SAP Id service together with this. Is there a possibility to configure the SAP Id service the same way you define a third party IdP? If yes, how do I get the metadata file? Or is there a simpler way to always have the SAP IdP?

As per the documentation, when you have multiple IdPs, you could choose by using the parameter saml2idp, as follows.

https://<app name>.hana.ondemand.com/index.jsp?saml2idp=<idp name>

Where do I get the <idp_name> from? Is it the name that you find in the metadata file (which is a URL!)? . And could there be a special value for the SAP Id service?

Thanks,

Sandeep

[GregTutt]

By any chance, did you find a way to do this ?

I have the same need... we are using IDP from an external system but would like to connect to the application using our developer accounts on HCP.

[ChrisPaine]

It is possible to set up multiple IdP s and then specify which one to use in the URL that you use to access the system. As mentioned above. But you'll need to pay for using the SAP IdP at that point as you can't keep the default. Not worth it for a couple of users I'd think

[GregTutt]

Thanks Chris it solves the mistery

[gregorw]

Also others have the same question:

[gregorw]

Hi Sandeep,

I facing the same issue with SAML2 authentication to an ABAP System. The documentation described the URL parameter saml2idp but I have tried to use the IDP Alias which I can maintain in the WebDynpro application started with transactin code SAML2. But that does not work :-(. Have you found a solution for your requirement on the cloud platform?

Best regards

Gregor

[LutzR]

Hi Gregor, did you solve your issue with saml2idp on an ABAP system? I am facing the same issue. Using saml2idp seems to switch off the default SAML2 IDP but does not activate the one stated in the parameter.

Thanks,

Lutz

Message was edited by: Lutz Rottmann

Sorry bothering anybody for reactivating this old thread. I just found out this moment that documentation is wrong. The necessary value for saml2idp is not from the Alias but from the Name attribute of an IDP. Regards, Lutz