SAP Analytics Cloud Integration into Joule – Part 2

Introduction

In Part 1, we completed the foundational setup for SAP Joule by:

Creating SAP BTP subaccounts and spacesConfiguring SAP Cloud Identity ServicesEnabling SAP Build Work ZoneRunning the Joule Booster to establish system formations

In Part 2, we complete the integration by connecting SAP Analytics Cloud (SAC) to SAP Build Work Zone and Joule. This includes:

OAuth client creation in SACDesign-time and runtime destination configurationContent provider creationRole consumptionUser and role provisioning using Identity Provisioning Service (IPS)Final Joule validation

Create OAuth Clients in SAP Analytics Cloud

To allow SAP Build Work Zone and Joule to securely access SAP Analytics Cloud content, OAuth clients must be configured in SAC.

SAP documentation reference:
Consume Role Definition Content from SAP Analytics Cloud

1. Create OAuth Client for Design-Time Access

The design-time OAuth client is used to:

Read SAC role definitionsImport analytical metadata into SAP Build Work Zone

Procedure

Log in to SAP Analytics CloudNavigate to:
System → Administration → App IntegrationUnder Configured Clients, choose Add an OAuth ClientMaintain the following values:
Name: sac-buildworkzone-dt (example)
Purpose: API Access
Access: User Provisioning
Authorization Grant: Client CredentialsConfigure Token Lifetime:
Positive integer value
Units: minutes, hours, or days
If not specified, the token lifetime is infiniteClick Add

Save Credentials

Copy and store the Client IDClick Copy Secret and save the Client SecretNote the Token Service URL

Important
The client secret is displayed only once and cannot be retrieved later.

OAuth Clients Summary

After completing this step, you should have two OAuth clients in SAP Analytics Cloud:

1. Runtime OAuth Client (Auto-created by Joule Booster)

Created automatically during Joule booster executionUsed at runtime by JouleUses SAML Bearer AssertionClient secret cannot be copied

2. Design-Time OAuth Client (Manually Created)

Used for:
Importing SAC roles
Reading analytical metadataClient ID and secret are used in SAP BTP destinations

Create Design-Time Destination in SAP BTP

This destination enables SAP Build Work Zone to read role definitions from SAP Analytics Cloud.

Procedure

Sign in to the JouleBATTesting subaccountNavigate to:

Click Create Destination

Destination Configuration

PropertyValueNameSAC_SWZ_DTTypeHTTPURLhttps://<SAC-domain>/api/v1/cdmProxy TypeInternetAuthenticationOAuth2ClientCredentialsClient IDSAC design-time OAuth Client IDClient SecretSAC design-time OAuth Client SecretToken Service URL TypeDedicatedToken Service URL Token URL from SAC OAuth configuration

Additional Properties

PropertyValueHTML5.SetXForwardedHeadersfalseURL.headers.x-sap-sac-custom-auth true

4. Click Save

Create Runtime Destination by Cloning

Instead of manually creating a runtime destination, reuse the destination created automatically by the Joule booster.

Procedure

Go to:

Locate destination:
DYN_SAC_SSOClick CloneProvide a new name:
SAC_SWZ_RT

Additional Properties

PropertyValuesap-card-nominations-path/api/v1/interest-cardssap-start true

​ SAP Analytics Cloud Integration into Joule – Part 2IntroductionIn Part 1, we completed the foundational setup for SAP Joule by:Creating SAP BTP subaccounts and spacesConfiguring SAP Cloud Identity ServicesEnabling SAP Build Work ZoneRunning the Joule Booster to establish system formationsIn Part 2, we complete the integration by connecting SAP Analytics Cloud (SAC) to SAP Build Work Zone and Joule. This includes:OAuth client creation in SACDesign-time and runtime destination configurationContent provider creationRole consumptionUser and role provisioning using Identity Provisioning Service (IPS)Final Joule validationCreate OAuth Clients in SAP Analytics CloudTo allow SAP Build Work Zone and Joule to securely access SAP Analytics Cloud content, OAuth clients must be configured in SAC.SAP documentation reference:Consume Role Definition Content from SAP Analytics Cloud1. Create OAuth Client for Design-Time AccessThe design-time OAuth client is used to:Read SAC role definitionsImport analytical metadata into SAP Build Work ZoneProcedureLog in to SAP Analytics CloudNavigate to:System → Administration → App IntegrationUnder Configured Clients, choose Add an OAuth ClientMaintain the following values:Name: sac-buildworkzone-dt (example)Purpose: API AccessAccess: User ProvisioningAuthorization Grant: Client CredentialsConfigure Token Lifetime:Positive integer valueUnits: minutes, hours, or daysIf not specified, the token lifetime is infiniteClick AddSave CredentialsCopy and store the Client IDClick Copy Secret and save the Client SecretNote the Token Service URLImportantThe client secret is displayed only once and cannot be retrieved later.OAuth Clients SummaryAfter completing this step, you should have two OAuth clients in SAP Analytics Cloud:1. Runtime OAuth Client (Auto-created by Joule Booster)Created automatically during Joule booster executionUsed at runtime by JouleUses SAML Bearer AssertionClient secret cannot be copied2. Design-Time OAuth Client (Manually Created)Used for:Importing SAC rolesReading analytical metadataClient ID and secret are used in SAP BTP destinationsCreate Design-Time Destination in SAP BTPThis destination enables SAP Build Work Zone to read role definitions from SAP Analytics Cloud.ProcedureSign in to the JouleBATTesting subaccountNavigate to:Connectivity → Destinations Click Create DestinationDestination ConfigurationPropertyValueNameSAC_SWZ_DTTypeHTTPURLhttps://<SAC-domain>/api/v1/cdmProxy TypeInternetAuthenticationOAuth2ClientCredentialsClient IDSAC design-time OAuth Client IDClient SecretSAC design-time OAuth Client SecretToken Service URL TypeDedicatedToken Service URL Token URL from SAC OAuth configurationAdditional PropertiesPropertyValueHTML5.SetXForwardedHeadersfalseURL.headers.x-sap-sac-custom-auth true4. Click SaveCreate Runtime Destination by CloningInstead of manually creating a runtime destination, reuse the destination created automatically by the Joule booster.ProcedureGo to:Connectivity → Destinations Locate destination:DYN_SAC_SSOClick CloneProvide a new name:SAC_SWZ_RTAdditional PropertiesPropertyValuesap-card-nominations-path/api/v1/interest-cardssap-start true 5. Save the destinationAssign Required Roles to UsersBefore proceeding, ensure the user has required roles.ProcedureGo to:Subaccount → Security → Users Assign the following roles to the IdP user:Launchpad_AdminLaunchpad_External_UserCreate Content Provider in SAP Build Work ZoneThis step imports SAC content and role definitions into SAP Build Work Zone.ProcedureGo to Service MarketplaceOpen SAP Build Work ZoneChoose Go to ApplicationNavigate to Channel ManagerClick + New Content ProviderContent Provider ConfigurationPropertyValueTitlesac.analyticsDescriptionSAP Analytics Cloud contentIDsac.analyticsDesign-Time DestinationSAC_SWZ_DTRuntime DestinationSAC_SWZ_RTRuntime Destination for Dynamic DataDefaultAutomatically add contentEnabledUse IPS for authorizationsEnabled6. Click SaveResultsSAC role definitions are imported into SAP Build Work ZoneSystem Owner role is intentionally not importedRole changes in SAC require manual refresh from Channel ManagerProvision Users Using Identity Provisioning Service (IPS)To allow users to access analytical insights via Joule, users, roles, and permissions must be synced from SAC to SAP Build Work Zone.1. Configure SAP Analytics Cloud as Source SystemReference: SAP Analytics Cloud IPS documentationProcedureOpen SAP Cloud Identity Services Admin ConsoleNavigate to:Identity Provisioning → Source Systems Add SAP Analytics Cloud as a source systemMandatory PropertiesPropertyValueTypeHTTPURLSAC base URL (no path)ProxyTypeInternetAuthenticationBasicAuthenticationUserSAC OAuth Client IDPasswordSAC OAuth Client SecretOAuth2TokenServiceURLSAC token service URLsac.api.version2 (recommended)2. Configure TransformationsNavigate to TransformationsPaste the JSON from:Default transformation for SAP Analytics Cloud SCIM API v23. Configure SAP Build Work Zone as Target SystemReference: SAP Build Work Zone IPS documentationUse the service key JSON from SWZInstanceKeyConfigure:API URLOAuth client IDOAuth client secretUse default transformation from SAP documentationRun Provisioning JobsSimulate ProvisioningGo to SAC Source System → JobsClick Run Now on Simulate JobVerify logs:Identity Provisioning → Provisioning Logs✔ No errors should appearExecute ProvisioningRun Read JobCheck provisioning logs againValidate User ProvisioningLog in to SAP Build Work Zone as Launchpad_AdminGo to:Settings → Identity Provisioning Enter SAC user emailValidate role IDs are correctly assignedCreate Joule User Role CollectionProcedureCreate User (ex – testuser@test.com)Go to JouleBATTesting → Security → Role CollectionsCreate role collection:Joule_UserAdd:Joule rolesLaunchpad_Admin (if site admin access is required)Assign role collection to IdP usersLog out and log back inIndex Data Using Just Ask and Validate JouleReference: SAP Joule documentationImportant Validation RulesSAC models must:Belong to the same userBe indexed under Just Ask using the same identityExample user:testuser@test.comIf models are indexed under a different user, Joule will not return results.SAP Analytics Cloud Integration into Joule – Part 1Reference Linkhttps://help.sap.com/doc/de3af3c0f81642dbaa4d36172ed57a72/CLOUD/en-US/79bfc83ab386450c8cd9c7937ce26a3a.pdfThanksAshraf   Read More Technology Blog Posts by SAP articles 

#SAP

#SAPTechnologyblog