SAML2 solution example for ABAP (Fiori) authenticated by SAP J2EE (UME LDAP)

Recently I have some customers asking to implement Fiori authentication. They don't want the users to key in the SAP username / password. Instead, everyone shall enter their Active Directory username / password.

First we install a brand new SAP J2EE instance, then point the UME to LDAP

Then we install the Identity Federation component, using SUM

Now configure SAML2 in J2EE NWA. Make sure when you create the service, the operation mode needs to be "Identity Provider and Service Provider"

Finally download the metadata for next step

Go to ABAP instance, in this case, the S/4 server, run tcode SAML2, then create the local provider, then download metadata xml file

In Trusted provider, upload the metadata xml file which we exported in J2EE instance

Identity Federation, choose Logon ID

Now go back to J2EE Instance, upload the metadata xml file which we've just downloaded from the ABAP instance (via tcode SAML2)

Identity Federation, create the same with Logon ID

Now go to the WebGUI or any SICF service of the S/4 ABAP instance, it will re-direct to the J2EE instance login page

After login using the Active Directory user name / password, it will re-direct to the WebGUI page