Set up SSO with SAP BTP and Neptune DXP - Open Edition

SAP Cloud Identity Services – Identity Authentication is the standard product from SAP to control and manage authentication to SAP Cloud applications and is available as subscription in SAP BTP.

In the SAP BTP subaccount create a new subscription to the service Cloud Identity Services with plan default and select Create.

You will receive an email to activate your account for Identity Authentication Service. Select the link to Activate and set a password for the Administration user to access the Administration console.

In the subaccount under Security - Trust Configuration, select the Establish Trust button.

The tenant which has been created, will be shown in the list. Select it and select Next.

In the next screen, select the domain which ends with ondemand.com and select Next.

You can configure the name, description and link text or leave it as suggested. Select Next and Finish.

In the Cloud Identity Services administration console, a new application is automatically configured with the trust that has been established.

In this application, you need to add a new client ID and client secret which will be used later in the Neptune DXP – Open Edition. Go to Client Authentication under Application APIs.

Select the Add button under Secrets.

Add a description for this secret and select Save.

Copy the client ID and client secret and save them, you will need them in the upcoming steps.

Under Trust, select OpenID Connect Configuration.

Here you add a new Redirect URI that matches the hostname of the neptune-dxp application on SAP BTP.

Within Neptune DXP – Open Edition Cockpit, in the System Settings select the Authentication tab. Select Edit and Add a new OpenID Connect authentication.

Enter the following values in the mandatory fields:

Save and restart the Neptune DXP - Open Edition by selecting Restart.

After the restart, launch the Neptune DXP - Open Edition in a new private window or another browser, and ensure the SAP BTP login option is available.

Select Sign in, and you should be directed to the Cloud Identity Service login page.

From the Neptune DXP - Open Edition Cockpit, open Role and select Add, to add a new role.

On the ACL tab, select All Edit and Save.

From the cockpit, open Security Group and create a new security group with the name "Administrator".

Assign the role you have created above and select Save.

Login to SAP Cloud Identity Services Administration Console, go to Users & Authorizations and select Groups.

Create a new group with the same name as in the Security Group in Neptune DXP - Open Edition. In this case: "Administrator".

Add the user to this group for which you want to login to Neptune DXP - Open Edition.

Login to Neptune DXP - Open Edition using SAP BTP option, and now, you will be able to access the Cockpit.

From the Cockpit, open the User tool and select your user. The user is correctly mapped to the Administrator Group, therefore there is no need to assign users are roles within this tool. The user and roles assignment can be managed in SAP Cloud Identity Services.