Grant Users Access to Open Connectors, Capability within SAP Integration Suite

[JingjingWang]

In this blog steps to add user to access Open Connectors capability has been captured. If you use SAP Open Connectors in Neo platform, please refer to the blog: Add users to your SAP Cloud Platform Open Connectors tenant. 

Prerequisites 

You need to following prerequisites to get started

SAP BTP Integration Suite tenant 

SAP BTP Intergration Suite Open Connectors tenant 

Context 

The Open Connectors tenant has been created with the first Integration Suite provisioner as the initial admin user, whoever activates Open Connectors capability. Please check the chapter below to find out who is the first Integration Suite provisioner. 

You have two main steps to complete to add the user to Open Connectors tenant. The first step is to grant the Open Connectors tile visibility of SAP Integration Suite to the user. And the second step then is, to add the user as a member of the Open Connectors tenant. 

 

Grant the Open Connectors tile visibility

The user who wants to see the Open Connectors tile from SAP Integration Suite must have been added into the “Integration_Provisioner” or “OpenConnectors_User” role collection in SAP BTP cockpit. Below, you can see an example of how to add users to the “OpenConnectors_User” role collection. 

1. Open your BTP account and go to Security >> Role Collections.


2. Select “OpenConnectors_User” role collection and add the user.

Add the user to Open Connectors tenant 

1. Ask the admin user to login with the SAP Open Connectors tenant. If you don’t know who the admin user of your SAP Open Connectors tenant is, please check the chapter below to find who is the first Integration Suite provisioner (the initial admin user of your SAP Open Connectors tenant).  


2. Open “Security->Identity->Members” page and click the “Add Member” button (see below).


3. Add the user as a member with the selection role.

          Note: 

          If you used the default SAP Identity provider (https://accounts.sap.com) as your corporate identity provider, please pay attention for following points: 

• Only S-User ID, P-User ID, D-User ID and I-User ID can be used to add member (no e-mail addresses). 


• The user must be in capital letters. 


• [Optional] If you used the custom identity provider, the value of member depends on how to configure in your IAS. Please check the chapter (Get the ID value of the current logged user) below to find the value. 

 

[Optional] Find who is the first Integration Suite provisioner 

1. Log into SAP Integration Suite and click Manage Capabilities.


2. The first Integration provisioner is shown in popup window (Provisioned By).

 

[Optional] Get the ID value of the current logged user. 

1. Ask the user who wants to be added to Open Connectors tenant to login to SAP Integration Suite. 


2. Open the developer tools of the browser, see example below.


3. Click the “Preserve log” and “Disable cache” checkboxes in the Network tab.


4. Click the “Extend Non-SAP Connectivity” tile. The browser will do a Single Sign-on to Open Connectors. You will get the error message “No authorized user found”. Don’t worry about it because it is expected that you haven’t been added to SAP Open Connectors tenant. 


5. Filter “assert” http request in the browser and copy the “SAMLResponse” text from the request.


6. Decode this text with SAML decoder (see example below), and you will get the text in xml format.


7. Format the xml text and copy the value of “NameID” attribute of the “Subject” node.


8. Ask your admin user to add a new member with this value to Open Connectors tenant. 

 

References: 

1. KBA: 3035458 - "No authorized user found" error in Open Connectors 


2. Configuring user access for Integration Suite capabilities