Technical Articles
Common issues when connecting SAP Analytics Cloud with SAP Marketing Cloud
Disclaimer
This blog is not relevant for SAP Analytics Cloud, embedded edition. You can check in the Set Up Your Marketing Solution application to see if you have the embedded edition. For more information, see online documentation. Setup of SAP Analytics Cloud, Embedded Edition/SAP Analytics Cloud.
Overview
Integrating SAP Marketing Cloud with SAP Analytics Cloud allows you to make full use of the analytic capabilities of SAP Analytics Cloud to explore marketing data. You can, for example, build analytics stories based on the delivered CDS views or on your own custom CDS views and use them in the Analytics and Report Gallery application. The Live Data Connection allows users to run SAP Marketing Cloud CDS query views without data replication. The analytical query is delivered as CDS content and is exposed via the analytical engine and the InA protocol via the REST services under /sap/bw/ina/ to SAP Analytics Cloud.
Before connecting SAP Analytics Cloud with SAP Marketing Cloud, you must identify the environment where SAP Analytics Cloud is hosted. The following environments are available:
- SAC Neo Tenant
- SAP Cloud Foundry Tenant
Once you identify the environment, you must follow the proper setup tasks for your environment.
To ensure a successful integration, there are several aspects to check. Not seeing the analytical stories in the Analytics and Report Gallery, is one of the main symptoms of an incomplete setup. In this post, I will provide you solutions to a list of common issues encountered.
Common Issues
Trusted Identity Provider does not match
The Provider Name or the Signing Certificate that you can find in the Outbound Communication section of the Communication Arrangement for the Scenario SAP_COM_0065 in the SAP Marketing Cloud system does not match the Trusted Identity Provider in the SAP Analytic Cloud system.
To verify the Signing Certificate, you can download it from the Communication Arrangement in the SAP Marketing Cloud system. Then, open it with a plain text editor (for example, Notepad).
If the Signing Certificate differs from what you see in the Trusted Identity Providers of SAP Analytic Cloud, then delete the Trusted Identity Provider and create a new one with the Signing Certificate that you have just downloaded from the SAP Marketing Cloud system.
For more information, see online documentation. Setting Up a Communication Arrangement (Step 6) and Setting Up the Outbound Connections from SAP Marketing Cloud to SAP Analytics Cloud.
Those links are for the Neo tenant, if your installation is for the Cloud Foundry tenant check the corresponding section under the Cloud Foundry tenant.
OAuth password must be reset
The secret password defined in the OAuth client configuration in the SAC tenant does not correspond to the secret password defined for the outbound communication user of the Communication System in the SAP Marketing Cloud system.
To ensure that both passwords match, you need to re-enter the secret password in SAC and SMC.
For more information, see online documentation. Adding a New OAuth Client (Step 2) and Setting up a Communication System (Step 6)
Those links are for the Neo tenant, if your installation is for the Cloud Foundry tenant check the corresponding section under the Cloud Foundry tenant.
OAuth Client ID is wrong
The OAuth client ID defined in the OAuth client configuration in the SAC tenant does not correspond to the OAuth 2.0 Client ID defined for the outbound communication user of the Communication System in the SAP Marketing Cloud system.
Replace the OAuth 2.0 Client ID of the Outbound Communication User of the Communication System defined in the SAP Marketing Cloud system with the OAuth Client ID value defined in the OAuth Client configuration in the SAC tenant.
For more information, see online documentation. Setting up a Communication System (Step 6) and Adding a New OAuth Client (Step 2). In case of an SAP Cloud Foundry Tenant, the OAuth Client ID is generated upon saving.
Those links are for the Neo tenant, if your installation is for the Cloud Foundry tenant check the corresponding section under the Cloud Foundry tenant.
The Username in SMC does not match the SAML user mapping
The Username in SAP Marketing Cloud must match the SAML User mapping in the SAC tenant.
Upper case issue between Identity Provider (IdP) user and SAC user
It is important that Username is defined in uppercase. If you have a Corporate Identity Provider (IdP) where the Username are defined in lower case, the Identity Authentication service (IAS) must be instructed to convert the Username to uppercase.
Apply the following step in your IAS tenant:
-
- Login as tenant administrator to the IAS tenant
- Go to “Applications” tile -> select your SAC application.
- Go to “Trust” tab
- Click on “Apply Function to Subject Name Identifier” section -> here choose the option “Uppercase”.
For more information, see online documentation. Convert Subject Name Identifier to Uppercase or Lowercase
OAuth2SAML Audience does not match
The OAuth 2.0 SAML Audience defined in the OAuth 2.0 Settings of the Communication System in the SAP Marketing Cloud system does not match the OAuth2SAML Audience visible in the OAuth Clients section of the SAC tenant.
The most common error is that the audience is defined with the prefix https:// in the SAC tenant but in SAP Marketing Cloud system, the prefix https:// is missing. For Cloud Foundry Tenant, the OAuth2SAML Audience must be an exact match between SAC tenant and SAP Marketing Cloud system. (including the https:// prefix)
For more information, see online documentation. Setting Up a Communication System (Step 03) and Adding a New OAuth Client (Step 01)
Tenant ID
For the SAP Cloud Foundry Tenant, the tenant ID entered in the communication arrangement for the communication scenario SAP_COM_0065 in the SAP Marketing Cloud system must be in lowercase. Even if you see the system name as “91B6F” in the SAC tenant, the right value to enter is “91b6f”.
For more information, see online documentation. Setting Up a Communication Arrangement (Step 4)
Missing Trusted Origin
You did not enter the host name of the SAP Marketing Cloud system (e.g. https://myXXXX.s4hana.ondemand.com) in the Trusted Origins section in the SAC tenant.
For more information, see online documentation. Adding SAP Marketing Cloud as a Trusted Origin with SAP Analytics Cloud
Conclusion
Those are the most encountered issues for the integration between SAP Analytics Cloud and SAP Marketing Cloud. If you are still facing an issue after having verified all proposed solutions, you can open an incident under the component CEC-MKT-ISG-ME.
More Information
You can use Set Up Your Marketing Solution to help you on setting up Analytics scenarios. See online documentation. SAP Marketing Cloud online documentation.
For more information, see online documentation. Integration with SAP Analytics Cloud (1SO)
Nice Blog with very valuable information, thanks Marc! 🙂
Hello Marc,
great Blog! ... one thing came into my mind and I'm not sure if this might also be an issue?
Here you can see that 6 "terms" need to be used as OAuth scope:
https://help.sap.com/viewer/0f9408e4921e4ba3bb4a7a1f75f837a7/2108.500/en-US/dec7b565c3eb4f058f41cfffd44bca35.html
In contrast, the generated services in the Marketing Cloud are 7:
Why is SAP_BW_INA_EXECUTEBICS_HTTP not in the list? Why is this one not relevant?
Best regards, Martin
Services
Hello Martin,
SAP Analytic Cloud doesn't make any call to those /sap/bw/ina API which require the OAuth Scope SAP_BW_INA_EXECUTEBICS_HTTP, this is why this OAuth scope is not listed in the documentation.
Best regards,
Marc
Hi Marc,
where and how can I add the INA Role to the user. It is not described in the documentation and I am getting the error that the INA role is missing, ask you admin to add the role ina or something like this.
Hello Yoro,
We had another customer having a similar issue where they got the error message "InA role is missing".
In there case, the problem was located in their IDP where the login SAML attribute was e-Mail. But for SAP Marketing Cloud the login works via the Custom SAML User Mapping with the SAML assertion based on Login name.
See step 7 in the documentation: https://help.sap.com/viewer/0f9408e4921e4ba3bb4a7a1f75f837a7/2111.500/en-US/b4228320aa404482943b9e61f9629b16.html
See the question from this customer the SAP community: https://answers.sap.com/questions/13508367/sac-smc-marketing-cloud-live-connection-fails-erro.html
If you still face an issue, you can open an incident under the component CEC-MKT-ISG-ME.
Best regards,
Marc
Hi Marc / all,
thanks for the insights. When reading https://help.sap.com/docs/SAP_MARKETING_CLOUD/0f9408e4921e4ba3bb4a7a1f75f837a7/b4228320aa404482943b9e61f9629b16.html?locale=en-US help, I'm under the impression, that I need to use the Identity / Authentication Service that came with Marketing Cloud also on SAC. We currently use Azure AD in SAC and use Identity / Authentication in Proxy Mode (with Azure AD) on Marketing Cloud.
Kind regards / Cheers
Jens
Hello Jens,
You can use your own corporate identity provider. Please check the following documentation User Provisioning (with Corporate Identity Provider)
Best regards,
Marc
Thanks Marc,
I must admit I also asked quite the same question as a proper "Question" here 🙂
I seem to get that one could use a corporate IdP before IAS when using that in proxy mode and to my knowledge we are doing exactly that for SMC currently.
However, we directly connected SAC to the bespoke corporate IdP (being Microsoft Azure AD) and did not connect SAC to the IAS of SMC.
Is this then still supported?
Cheers
Jens