Skip to Content
Technical Articles

Single Sign-On (SSO) with SAP Business ByDesign

SAP Business ByDesign (ByD) supports service provider initiated as well as identity provider initiated Single Sign-On (SSO) and Single Log-Out (SLO). In this post I would like to address some frequently asked questions with regards to SSO and SLO.


Where to get information how to configure SSO?

Embedded in ByD, Single Sign-On (SSO) can be configured in work center Application and User Management >> Common Tasks >> Configure Single Sign-On. All technical data required to configure the Identity provider are available on this UI and can be downloaded into a “SP Metadata” file.

Furthermore ByD supports OAuth 2.0 SAML Bearer authentication for principal propagation using ByD OData services.

The ByD documentation or the ByD Help Center (Side Car im ByD UI) provides detailed information under the key words: “Front-End Single Sign-On”, “Configure Your Solution for Single Sign-On”, “Configure Microsoft® Active Directory Federation Services 2.0” and “Configure Okta”.

The SAP Enterprise Support Academy provides the recorded Meet The Expert Session “Web-based SSO in SAP Cloud Products” in its replay library: SAP Enterprise Support Academy.

Some Identity Provider (IdP) published guidelines or tutorials for SSO configuration with ByD as well; for example MS Azure AD:

Which Identity Providers are supported by ByD?

ByD can be used with any SSO Identity Provider (IdP) that supports SAML 2.0. For example SAP Cloud Platform Identity Authentication, Microsoft Azure AD, OKTA, iWelcome, Microsoft ADFS (Active Directory Federation Service), SAP Cloud Identity Provider and many more.

ByD supports SAML 2.0 and OAuth 2.0 SAML Bearer authentication.

User provisioning in ByD

The ByD user lifecycle is tightly coupled with the ByD Employee lifecycle.
In ByD business users and key users are always assigned to employees or service agents (we call this concept “named user”). This means you have to create (hire) the employee or service agent first; then you can decide if the employee/service agent gets access to the system and you can assign access rights to the employee/service agent.

Assigning the access rights, changing user ID, password or e-mail has to be done in ByD.
However you can easily extract the access rights per user (the list of authorizations assigned to users) using the ByD OData for Analytics API, for example in order to perform a Segregation of Duty (SOD) scanning in external systems (for example SAP GRC).
Please note, ByD comes with an embedded Segregation of Duty (SOD) functionality as part of the ByD user and access management process incl. standard SOD checks and possibilities to enhance these.

You can setup ByD security policies such that no password logon is possible and users are forced to logon via SSO and some central IdP.
In this case, if an employee resigns, you can lock the user in the central IdP and hence the user cannot logon to ByD anymore because authentication is possible via IdP only. If needed you can even enforce a logout in all systems using single-log out (SLO).

Which Name ID formats are supported by ByD?

Per default ByD uses the NameID format “unspecified” for user mapping. ByD maps the NameID of SAML-assertions on the ByD User Alias.

Additionally ByD support the name ID format “emailAddress“. In this case ByD maps the NameID of the SAM-assertion on the ByD user e-mail address of the ByD employee contact data.

Using multiple Identity Provider and ByD tenants with SSO

Each ByD-Tenant represents a single Service Provider, which can be “connected” to one or more Identity Provider. For each Service Provider SAML-based SSO is configured separately. Therefore SSO can be used for all your ByD Tenants in parallel and you can use multiple identity provider.

Does ByD support LDAP?

LDAP is basically a storage and requires direct TCP/IP connections without Proxy/Reverseproxy. For that reason you can’t use LDAP in the Cloud.

If LDAP is required to manage some customer on-premise systems, you may connect LDAP to your IdP, but you can’t connect LDAP to ByD directly.

Does ByD support user propagation/OAuth?

Yes, ByD OData supports OAuth. You find an example and more details in my blog post Configure OAuth 2.0 for SAP ByDesign OData Services.

You must be Logged on to comment or reply to a post.
  • Thanks Knut.
    Our Centrify SSO is re-directing to which seems to route to the Silverlight version.  Is there any way of modifying the URL so it re-directs to the HTML5 UI?



    • Hello

      what about the following link? this is the link we use to log on ByD HTML5 UI (Not the RUI)





    • Hi Lee,

      currently the Silverlight version is still the default. The default UI is planed to be changed to HTML5 as soon as HTML5 UI has been completed and our customers got some time to get used to the new visual design.

      Please check the blog post for more details. The blog post describes how to access the HTML5 UI already now as well.

      Best regards,

    • /
      • Hi Manuel Peschke Knut Heusermann 

        Is there any documentation to configure between SAP Business ByDesign and OKTA?

        I configured with ByD. In Okta, If I click Application Icon, it is showing “Signing into Application” and redirect to SSO “”. It is repeating again and again.

        Can you please help me on this topic?


        Sankaran A

        • Hi Sankaran,

          Since the 1708 release you can change the default UI to HTML5, as described in the “How to access the HTML5 client” section of Stefanie’s blog post.

          Means that you can now use the standard SSO URL ( in Okta. Please try with that.

          Other items to check:

          • Import the ByD SSO Metadata to Okta
          • Import the Okta Signature and Encryption certificate in ByD (“Identity Provider” tab)
          • Make sure you’re sending the ByD user ID for the SSO authentication

          If you still having problems you can send me screenshots of your Okta and ByD configuration and I can compare it to my setup.




          • Dear Manuel Peschke

            Thanks for your support.

            1. Created a new app in Okta
            2. General Screen

            3. Assign User (My ByD Username is “Sankaran”. So I have edited here)


            4. Once setup was done, I have downloaded a metadata file from Okta.

            5. uploaded the metafile in ByD


            6. ByD –  Identity Provider (View 2)


            7. ByD – MySystem View

            8. Once If I click the icon from Okta application panel, It is showing Signing in and redirects to Okta URL and ByD’s SSO URL. It is repeating the process. 



            Please guide me if I miss any steps here.



            Sankaran A


          • Hi Sankaran,


            I could reproduce the issue on my side when I used as SSO URL.

            When I compared it with my current configuration I noticed that we are using this SSO URL:

            I was successfully able to login after I added /sap/saml2/sp/acs to the SSO URL in Okta and re-created the Identity Provider with the updated metadata in ByD. Here are the SAML Settings I'm using:


            I hope changing the SSO URL fixes your problem. If not, please let me know.




          • /
          • /
          • /
          • Hi Karolina,


            Looks like you used the pre-configured "SAP Cloud for Customer" app in Okta. I'm not sure if that is compatible with SAP ByD.

            I recommend to create an app from the scratch for ByD using the steps and settings posted by Sankaran above.

            Let me know how it turns out.




          • Awesome! Glad to hear it worked!


            Yes, it also works well with SAP's mobile apps. If you use the "-sso" URL it will automatically redirect to Okta for authentication within the mobile app.




          • Hi Manuel,

            So I trying to configure this now for a different ByD instance and I am receiving the same error as before, I have created a completely new app and followed the same steps, any ideas what it could be?



          • Hi Karolina,

            My guess would be that an URL (SSO URL or Audience Restriction URL) in the Okta configuration is wrong.

            And please make sure to download the metadata from the new Okta app created for that instance into ByD.

            If that doesn't help I recommend opening a ticket with SAP and/or Okta as they will be able to do an SSO trace.

            Let me know the outcome.



  • Anyone came across Azure AD error?

    Additional technical information:
    Correlation ID: e7591fc5-6abb-4bfc-9f15-3adb659d58f1
    Timestamp: 2017-06-08 02:53:39Z
    AADSTS70001: Application with identifier 'HTTPS://' was not found in the directory TENANTID


      • Hello,


        we are facing the same issue with Microsoft Azure. We opened a ticket with Microsoft and it is under correction.

        Here are the messages from Microsoft :

        I´ve been investigating the application and indeed is not allowing to do it as the Service Principal is in direct relation with the Identifier. Right now, the application SAP by Design in Azure does not supports the HTTPS pattern for the Identifier field in our backend, and from there the issue. I am working with the Product Group to make this work and accept HTTPS links

        and last one :

        As you know we have identified the reason that the application does not work. The Application metadata needs to be updated to accept HTTPS:// urls.  That cannot happen yet due to an issue with Graph API that does not accept wildcards in the identifier URL.

        Product Group is working on it. Will send you another update on Friday.

        I'll keep you updated when problem is resolved.

        Best regards,



  • Hello,

    For your information, I had the same Azure AD error. But I delete the SAP ByDesign app in Azure and re-add it. Then, it is working now.

    Also, you need to send incident to SAP changing Identifier from "HTTPS" to "https".





  • Hi.


    If you have an issue " AADSTS500115: The reply ur specified in the request is misssing or not a valid URL" , this is the solution:

    To resolve the issue, I downloaded the SP Metadata from SAP ByD and loaded into AzureAD, this provided me with the correct Replay URL, It appears that the defaults which are associated with the AzureAD Marketplace app do not work as expected.