Cbox ID
SAP Cloud Identity Services
SAP Cloud Identity Services
Single sign-on (SAML 2.0)
In the portal, choose SAP Cloud Identity Services under Enterprise SSO and Start with SAP Cloud Identity Services. Then, in SAP Cloud Identity Services:
- In the administration console for SAP Cloud Identity Services, under Applications and Resources, choose the Applications tile and choose Create.
- Enter a Display Name, select SAML 2.0 as the Protocol Type, and save.
- On the Trust tab, under SINGLE SIGN-ON, choose SAML 2.0 Configuration and use Load from URL with our metadata URL below.
- Set Subject Name Identifier to Email and Default Name ID Format to Email.
- Under Tenant Settings → SAML 2.0 Configuration, choose Download Metadata File — or give us https://<tenant-id>.accounts.ondemand.com/saml2/metadata.
The values the portal shows
| SAP Cloud Identity Services field | Value |
|---|---|
| Load from URL (Trust → SINGLE SIGN-ON → SAML 2.0 Configuration) | The portal's SP metadata URL (https://…/sso/saml/…/metadata) |
| Subject Name Identifier (Trust → SINGLE SIGN-ON) | Email |
| Default Name ID Format (Trust → SINGLE SIGN-ON) | Email |
What to bring back
Copy Download Metadata File — the URL, or the XML — and paste it into the portal's Metadata URL or XML. Prefer the URL.
The assertion must be signed, and must carry the person's email address as an attribute or as a NameID in the emailAddress format. See Any SAML 2.0 provider for the details.
SAP Cloud Identity Services's own guide: https://help.sap.com/docs/cloud-identity-services/cloud-identity-services/configure-saml-2-0-service-provider.
Then verify your domain and turn single sign-on on in the portal: Enterprise SSO.
Related
- Identity provider guides — every provider the portal guides you through.
- Enterprise SSO — the portal's five steps.