WIXLIB

Live Data Connection to SAP S/4HANALive data connections allow you to connect your data sources with SAP AnalyticsCloud. Any changes made to your data in the source system are reflected immediately.The benefit of connecting to data this way is that the data stays in the source systemso large amounts of data do not need to be transferred. The existing models in thesource system can also be used directly by SAP Analytics Cloud to build story andvisualization on that model and perform online analysis without data replication.For a list of supported system types and limitations, please see System Requirementsand Technical Prerequisites and Limitations to S/4HANA websites.Live Data Connection to S/4HANAYou can create a Live Data Connection to SAP S/4HANA using Path and Cloudconnection types:Path — If you want to connect to an on-premise SAP S/4HANA systemCloud — If you want to connect to an SAP S/4HANA Cloud Edition using SSO or OAuthPath ConnectionPrerequisites for S/4HANA Path connection You have installed and configured an HTTP server of your choice on port 443 inthe same network as your on-premise system. This example uses Apache HTTPserver. Your SAP S/4HANA system supports Info Access Service (InA), version 4.10.0or above. You have info access user setup on your SAP S/4HANA system to allow all userswho will use the live connection.1

Setup1. Apache HTTP Server configuration stepsa. Configure the Apache HTTP Server by opening Apache24\conf\httpd.conffile in Notepad.b. Add the following rules at the end of the file:#Configure SSL on the default HTTPS port 443LoadModule ssl module modules/mod ssl.soListen 443SSLEngine OnSSLCertificateFile "/path/to/ssl.cert"SSLCertificateKeyFile "/path/to/ssl.key"SSLProxyEngine onSSLProxyCheckPeerCN OffSSLProxyCheckPeerName Off2

NOTE: You may need to specify the ssl.cert certificate and ssl.key keyfile certified by yourCertificate Authority in order to run Apache HTTPS Server.#Specify the required modulesLoadModule proxy module modules/mod proxy.soLoadModule proxy http module modules/mod proxy http.soLoadModule headers module modules/mod headers.soLoadModule xml2enc module modules/mod xml2enc.so#Define the qualified domain name of the SAP Analytics Cloud URLDefine SAP ANALYTICS CLOUD SAP Analytics Cloud URL ProxyRequests offProxyPreserveHost onRequestHeader append X-Custom-Host {SAP ANALYTICS CLOUD}NOTE: Fill the squared brackets with the domain name of your SAP Analytics Cloud URL.For example if the URL is https://mytenant.eu1.sapbusinessobjects.cloud, then:Define SAP ANALYTICS CLOUD mytenant.eu1.sapbusinessobjects.cloud #Configure pass rules for remote HANA system(s)ProxyPass / PATH / http(s):// Remote SAP S/4HANA SystemHost : Port /ProxyPassReverse / PATH / http(s):// Remote SAP S/4HANA SystemHost : Port /c. Add the following rule if you’re using basic authentication to suppress thebrowser’s default authentication dialog when a user enters incorrectcredentials:#Role to suppress the browser’s default authentication dialog Location / PATH / Header unset www-authenticate /Location d. Test if the dispatcher rules for the remote system work properly. Byopening the following URL you’ll see the JSON response:https:// Apache Web Host / PATH /sap/bw/ina/GetServerInfoe. Add the following lines after all pass rules for remote systems:#Pass Rules for SAP Analytics CloudProxyPass / https:// {SAP ANALYTICS CLOUD}/ProxyPassReverse / https:// {SAP ANALYTICS CLOUD}/3

f. Restart the Apache service to make your changes effective.g. You can test if the rules are set up correctly. By opening the following URLSAP Analytics Cloud login page should open: https:// Apache Web Host /2. Configure Route rules for SAML SSO (optional).If you want to use SAML SSO, you should configure them for the same IdP, whereremote system and SAC are using same SAML ID Provider to authenticate. For moreinformation see Enabling SAML Single Sign-On (SSO)a. Configure rules for the central SAPCP SAML Redirect Node#Central Redirect Node rulesProxyPass /authn/ https:// authn. region .hana.ondemand.com/ProxyPassReverse /authn/ https://authn. region .hana.ondemand.com /ProxyPass /authn/ https:// authn. region .hana.ondemand.com:443/ProxyPassReverse /authn/https://authn. region .hana.ondemand.com:443/ Location /authn/ ProxyHTMLEnable onSetOutputFilter proxy-htmlProxyHTMLCharsetOut *RequestHeader unset Accept-EncodingProxyHTMLURLMap https:// Your SAML Provider / / Your SAMLProvider Path /ProxyHTMLURLMap https:// {SAP ANALYTICS CLOUD}/ /ProxyHTMLURLMap https:// {SAP ANALYTICS CLOUD}:443/ /ProxyPassReverseCookiePath / /authn/ /Location NOTE: You can find the region value in your SAP Analytics Cloud URL. If your regionis eu1, you should omit the region value in this rewrite rule.For example, https://authn.hana.ondemand.comNOTE: Above configuration supports a SAML session and relative path redirection fromthe SAP HANA XS SAML logon. Replace Your SAML Provider Path with a path forSAML authentication. For example, the path to your identity provider.4

b. Configure SAML Rules for remote HANA System#Rules for the remote S/4HANA systemProxyPass / PATH / https:// Remote SAP S/4HANA System Host : Port /ProxyPassReverse / PATH / https:// Remote SAP S/4HANA SystemHost : Port / Location / PATH / ProxyPassReverse /ProxyPassReverseCookiePath / / PATH /ProxyHTMLEnable onSetOutputFilter proxy-htmlProxyHTMLCharsetOut *RequestHeader unset Accept-EncodingProxyHTMLURLMap https:// {Your Identity Provider URL}/SAML Provider Path /ProxyHTMLURLMap /sap/ / PATH /sap/ /Location / YourNOTE: Fill the squared brackets by specifying a path and the Host of your S/4HANAInstance. This must be HTTPS only.c. Add rules for SAML Identity Providersi. If you use the SAP Cloud Platform Identity Authentication service(IAS), add the following#SAML rules for Cloud Platform IDP Service (IAS)ProxyAddHeaders offProxyPassReverseCookieDomain IAS Server Your Reversed Proxy HostName ProxyPass /saml2/ https:// IAS Server :443/saml2/ProxyPassReverse /saml2/ https:// IAS Server :443/saml2/ Location /saml2/ ProxyHTMLEnable onSetOutputFilter proxy-htmlProxyHTMLCharsetOut *RequestHeader unset Accept-EncodingProxyHTMLURLMap https:// SAP Analytics Cloud Server : Port /sap/sapProxyHTMLURLMap https://authn. region .hana.ondemand.com//authn/ProxyHTMLURLMap https:// SAP SAP S/4HANA System Host : Port / PATH 5

/Location ProxyPass /universalui/ https:// IAS Server :443/universalui/ProxyPassReverse /universalui/ https:// IASServer :443/universalui/d. At the end of the file, after the pass rules for SAP Analytics Cloud, add thefollowing#Pass Rules for SACProxyPass / https:// {SAP ANALYTICS CLOUD}/ProxyPassReverse / https:// {SAP ANALYTICS CLOUD}/ LocationMatch " / /sap/fpa/ui/tenants/.* /logout.*" ProxyHTMLEnable onProxyHTMLDocType " !DOCTYPE html " XMLSetOutputFilter proxy-htmlRequestHeader append X-Custom-Host {SAP ANALYTICS CLOUD}ProxyHTMLCharsetOut *RequestHeader unset Accept-EncodingProxyHTMLURLMap https://authn. region .hana.ondemand.com//authn/ /LocationMatch e. Restart Apache to apply your changes.3. After Apache restarted you can test if the setup has been performed successfullya. Access SAP Analytics Cloud via the Apache HTTP server URL and the portyou configured. For example, https://myapachehost:443i. If you configured SAML SSO you should verify that the Apache HTTPserver URL redirects within the same domain as the HTTP server youconfigured. This means if navigating to the https://myapachehost sitethe login URL should contain the IdP system information you setuplike: roviderii. If you haven’t configured SAML SSO, log on with your IDPcredentialsiii. Verify that you are redirected back to SAP Analytics Cloud and thatthe domain is still the reverse proxy.6

4. Create a Live Data Connection to SAP HANA in SAP Analytics Cloud:a. Log onto of SAP Analytics Cloud and go to MainMenu Connection Connections (Add Connection) Live DataConnection SAP S/4HANAb. In the dialog, enter a name for your new connectionNOTE: The connection name cannot be changed later.c. Set the connection type to Pathd. In the Path Prefix field, enter the / PATH value defined above.e. Specify the Client of your on-premise S/4HANA serverf. Choose a Default Language from the list optionally.NOTE: This language will always be used for this connection. It cannot be changed byusers without administrator privileges. Please make sure you have installed a languageon your SAPCP system before adding a language code otherwise SAC will default tothe language specified by your system metadata.g. Select an Authentication Method and set the required informationi. Select SAML Single Sign-On if you’re using SAML SSO.NOTE: If you want to use SAML Single Sign-On (SSO) you need to enable it byfollowing the steps under Enabling Single Sign-On (SSO) under Administration.ii. Choose User Name and Password if you use basic authentication to loginto HANA and enter your credentials for the remote system.7

iii. If you select None, your SAP HANA administrator must expose the InAservice on the SAP HANA XS server without any authenticationrequirement, or configured SAP HANA to authenticate you via othermeans, for example via X.509 client certificate or Kerberos. In suchcases, the authentication if necessary should be achieved via your SAPHANA configuration.h. Then select OK5. Define the reverse proxy hostname in SAP Analytics Cloud under Administration.By performing this action your reverse proxy hostname will replace the URL ofyour SAP Analytics Cloud system included in e-mail notifications sent to users.a. Go to System Administrationb. Choose System Configuration tab8

c. Click on the pencil icon to edit the settings.d. Enter the reverse proxy host name in Reverse Proxy Host optione. Click on SaveCloud ConnectionConnection to SAP S/4HANA Cloud Edition with SSOPrerequisites for Cloud with SSO You are using SAP Cloud Platform Identity Authentication Service for your SAPS/4HANA system. You must have already set up an SAP S/4HANA access user on your SAPS/4HANA system. For more information, see Integration with SAP AnalyticsCloud. You are not using a reverse proxy to connect to your SAP Analytics Cloudsystem. This is explained in KBA 2538239 If you want to use SAML SSO, you should configure them for the same IdP,where remote system and SAC are using same SAML ID Provider toauthenticate. For more information see Enabling SAML Single Sign-On (SSO)9

NOTE: During the SSO Configuration you must enable the checkbox:"Identity Provider will also be used for Live Data connections with SAML Single Sign Onto S/4HANA Cloud Edition"Setup1. Create a Live Data Connection to SAP HANA in SAP Analytics Cloud:a. Log onto of SAP Analytics Cloud and go to MainMenu Connection Connections (Add Connection) Live DataConnection SAP S/4HANAb. In the dialog, enter a name for your new connectionNOTE: The connection name cannot be changed later.c. Set the connection type to SAP S/4HANA Cloudd. In the Host field, enter the URL for your SAP S/4HANA system. For example, MySystem .s4hana.ondemand.come. Specify the Client of your on-premise S/4HANA serverf. Choose a Default Language from the list optionally.NOTE: This language will always be used for this connection. It cannot be changed byusers without administrator privileges. Please make sure you have installed a languageon your SAPCP system before adding a language code otherwise SAC will default tothe language specified by your system metadata.i. Under Authentication Method select SAML Single Sign-Ong. Then select OKConnection to SAP S/4HANA via OAuthPrerequisites for Cloud with OAuth With OAuth 2.0, you do not need to configure SAP Analytics Cloud to use thesame SAML identity provider (IdP) as you use for SAP S/4HANA cloud edition.10