How to use REST API in SAP Analytics Cloud to update user profile in embedded scenarios
Introduction
Currently, I am employed as a Business Process Consultant in the SAP Analytics & Insight Team, primarily focusing on SAP Analytics Cloud and SAP Data Warehouse Cloud.
More and more customers are using iFrame to embed SAP Analytics Cloud into external web apps and 3rd party software, e.g. salesforce.com. By modifying the URL parameters of the embedded SAP Analytics Cloud iFrame, it is possible to hide the main menu, toolbar and pagebar and to embed SAP Analytics Cloud in the look and feel of the web app. This creates a homogeneous appearance for the enduser and results in single point of entry.
While using SAP Analytics Cloud embedded, the question on how to update the user profile settings occurs regularly.
It is possible to use the SCIM API (System for Cross-domain Identity Management) to update the user profile (e.g. changing the Data Access Language, Language or Date Formatting) and simultaneously supporting the single frontend illusion.
In this blog I describe the process of updating the user profile using the REST API based on SCIM.
Configuration Steps
Configuration SAP Analytics Cloud
I am using basic authentication against the token service. The first step is to create an Oauth client in SAP Analytics Cloud.
Figure 1: Adding OAuth Clients in SAP Analytics Cloud
By clicking on ‘Add a New OAuth Client’ a new pop-up window opens
Figure 2: create OAuth Clients in SAP Analytics Cloud
Figure 3: OAuth Client Information
General SCIM API
SAP Analytics Cloud exposes a REST API based on SCIM 2.0. This API allows you to
- Create, read, update, and delete users and teams.
- Set user profile preferences.
- Assign existing roles to users and teams.
Detailed information regarding SCIM 2.0 can be found here
From now on, I need a tool called Postman. Postman is a tool to test and operate RESTful APIs. It is a client Software.
Basis Authentication against the token service via Postman
Open Postman
Step #1: Create a new Request
Click on GET Request
Figure 4: Create new request in postman
In the request I enter the following parameters for connecting to SAP Analytics Cloud:
- GET: https://<SAC tenant>.authentication.<Data center>.hana.ondemand.com/oauth/token?grant_type=client_credentials
- Authorization:
- Select TYPE ‘Basic Auth’
- Enter the username and the secret from our OAuth client
- Username Postman = OAuth client ID
- Password Postman = Secret
Figure 5: request OAuth access token
Response:
- 403: Not authorized
- 400: Bad request
- 200: OK
Figure 6: Obtain OAuth access token
I must pass this access_token as a bearer token in the Authorization header of all following API requests. It is important to copy the access_token without “”. Having this access_token, I could already post a GET request for getting the users. For changing the users, I need an additional csrf token (Cross-Site-Request-Forgery).
Step #2: Obtain x-csrf-token
- Create a new GET request
- GET: https://<your-SAC-system>.<region>.sapanalytics.cloud/api/v1/scim/Users
- Authorization TYPE: No Auth
Figure 7: Authorization Type for obtaining x-csrf-token
- Include the following headers with your GET request
- Authorization Bearer <Access_Token> (This is the access token I know from step 1)
- x-sap-sac-custom-auth true
- x-csrf-token fetch
Figure 8: Headers for obtaining x-csrf-token
- Click ‘Send’
- If everything is set up I will get a X-csrf-token in the Headers of the response.
Figure 9: Response with x-csrf-token
Step #3: Update user profile
For this step I need the access token and the x-csrf-token that I obtained in the previous steps.
At first, I need to retrieve the current user profile with a GET request.
- Create a new GET request
- GET: https://<your-SAC-system>.<region>.sapanalytics.cloud/api/v1/scim/User/<username>
- Authorization TYPE: No Auth
- Include the following headers with the GET request:
- Authorization Bearer <Access_Token> (The access token we know from step 1)
- x-sap-sac-custom-auth true
- x-csrf-token <x-csrf-token> (Step 2)
Figure 10: GET request for user profile
- In the response body I get all the information about the user. I copy this response body.
Now I can update the current user profile with a PUT request.
- Change the request from GET to PUT
- PUT: https://<your-SAC-system>.<region>.sapanalytics.cloud/api/v1/scim/User/<username>
- Authorization TYPE: No Auth
- Include the following headers with the GET request:
- Authorization: Bearer <Access_Token> (The access token we know from step 1)
- x-sap-sac-custom-auth: true
- x-csrf-token: <x-csrf-token> (Step 2)
- Chose raw as format and select JSON from the dropdown box.
- Paste the response body from the previous GET request (i.e. from the GET request which delivered user profile) to the PUT request body and change one of the parameters.
You can find all the parameters that can be changed here.
Figure 11: Update user with copying and changing body
- If everything is correct I will get a “Status 200” notification
- Also, I will see the updated body response of the user.
- I can doublecheck the new settings in the SAC Profile settings.
Response:
- 404: Not Found
- 403: Not authorized
- 400: Bad Request
- 200: OK
Figure 12: Profile settings SAC
Conclusion
As described in the introduction, there are many more possibilities using the REST API, as the API allows you to
- Create, read, update, and delete users and teams.
- Set user profile preferences.
- Assign existing roles to users and teams.
For a better understanding how the authentication works all the steps are done manually. With Postman it is also possible to automate this with variables.
Go ahead and check out the SAP Analytics Cloud APIs in your system, I am looking forward to your feedback and comments!
Hi Lucas,
First of all, great blog. Nice hands-on guide on how to use SCIM.
I have one question which I hope you know the answer to: What happens with the content of a user when you delete this via SCIM? If you delete a user via the SAC UI you get different options. Are there additional parameters available?
Kind regards,
Martijn van Foeken | Interdobs
Hi Martijn,
thank you very much for your feedback. Yes, you are right when deleting the user in SAC you have two options
You could use the SCIM API to remove the user from SAC. Doing so will delete their personal content and public content will not be re-assigned.
Best regards,
Lukas
Hi Lukas,
thanks for your very interesting blog.
Could this scenario be used in a case where a sac report is embedded in a iframe on external web, and users don’t need to enter credentials (using a concurrent user) ?
thanks
Anthony
Hi Anthony,
even with SAC embedded reports you have to enter your credentials. Of course, if you are using SSO for the web app you could pass these credentials to SAC.
Best regards,
Lukas
thanks lukas
Anthony
Hello Lukas,
Thanks for your great blog!. It’s very helpful information for me.
I have a question about Team Provisioning API. User Provisioning API ( /api/v1/scim/Users/ ) is working fine like your blog.
When I tried Team Provisioning API, Groups API ( /api/v1/scim/Groups ) is working. But, Team API ( /api/v1/scim/Groups/<Team_ID> ) return not found page error(404).
For example, Even I can find Team ID ‘AA’ from Groups API return value. ‘/api/v1/scim/Groups/AA’ is not working with 404 error.
Have I any mistake when I call Team API?
Best regards,
Jaewon.
Hi Jaewon, good catch! I have the same issue and it looks like something is not working correctly. I checked the help page but this is exactly what we do: https://help.sap.com/viewer/298f82da4b184d1fb825b7ffe365e94a/release/en-US/a0572791c8444bda9084d8b07a982b4f.html
I will get back to you, when I have an answer.
Best regards,
Lukas
Hi Lukas,
I’ve found a notes # about TEAM API error.
https://launchpad.support.sap.com/#/notes/2857395
That API had defect in SAC Public API. As Notes, It was fixed at the 2019.24 version. But some additional setting is needed to use TEAM API as I understand.
I hope it will help you to find answer.
Best regards,
Jaewon.
Hi Jaewon, these are the only workarounds for SAC running on cloud foundry so far
Best regards,
Lukas