SAP Analytics Cloud Integration into Joule – Part 2

Introduction

In Part 1, we completed the foundational setup for SAP Joule by:

• Creating SAP BTP subaccounts and spaces
• Configuring SAP Cloud Identity Services
• Enabling SAP Build Work Zone
• Running the Joule Booster to establish system formations

In Part 2, we complete the integration by connecting SAP Analytics Cloud (SAC) to SAP Build Work Zone and Joule. This includes:

• OAuth client creation in SAC
• Design-time and runtime destination configuration
• Content provider creation
• Role consumption
• User and role provisioning using Identity Provisioning Service (IPS)
• Final Joule validation

Create OAuth Clients in SAP Analytics Cloud

To allow SAP Build Work Zone and Joule to securely access SAP Analytics Cloud content, OAuth clients must be configured in SAC.

SAP documentation reference:
Consume Role Definition Content from SAP Analytics Cloud

1. Create OAuth Client for Design-Time Access

The design-time OAuth client is used to:

• Read SAC role definitions
• Import analytical metadata into SAP Build Work Zone

Procedure

1. Log in to SAP Analytics Cloud
2. Navigate to:
   System → Administration → App Integration
3. Under Configured Clients, choose Add an OAuth Client
4. Maintain the following values:
   Name: sac-buildworkzone-dt (example)
   Purpose: API Access
   Access: User Provisioning
   Authorization Grant: Client Credentials
5. Configure Token Lifetime:
   Positive integer value
   Units: minutes, hours, or days
   If not specified, the token lifetime is infinite
6. Click Add

Save Credentials

• Copy and store the Client ID
• Click Copy Secret and save the Client Secret
• Note the Token Service URL

Important
The client secret is displayed only once and cannot be retrieved later.

OAuth Clients Summary

After completing this step, you should have two OAuth clients in SAP Analytics Cloud:

1. Runtime OAuth Client (Auto-created by Joule Booster)

• Created automatically during Joule booster execution
• Used at runtime by Joule
• Uses SAML Bearer Assertion
• Client secret cannot be copied

2. Design-Time OAuth Client (Manually Created)

• Used for:
  Importing SAC roles
  Reading analytical metadata
• Client ID and secret are used in SAP BTP destinations

Create Design-Time Destination in SAP BTP

This destination enables SAP Build Work Zone to read role definitions from SAP Analytics Cloud.

Procedure

1. Sign in to the JouleBATTesting subaccount
2. Navigate to:
   Connectivity → Destinations
3. Click Create Destination

Destination Configuration

Additional Properties

4. Click Save

Create Runtime Destination by Cloning

Instead of manually creating a runtime destination, reuse the destination created automatically by the Joule booster.

Procedure

1. Go to:
   Connectivity → Destinations
2. Locate destination:
   DYN_SAC_SSO
3. Click Clone
4. Provide a new name:
   SAC_SWZ_RT

Additional Properties

 

5. Save the destination

---

Assign Required Roles to Users

Before proceeding, ensure the user has required roles.

Procedure

1. Go to:
   Subaccount → Security → Users
2. Assign the following roles to the IdP user:
   Launchpad_Admin
Launchpad_External_User

   

---

Create Content Provider in SAP Build Work Zone

This step imports SAC content and role definitions into SAP Build Work Zone.

Procedure

1. Go to Service Marketplace
2. Open SAP Build Work Zone
3. Choose Go to Application
4. Navigate to Channel Manager
5. Click + New Content Provider

Content Provider Configuration

Property	Value
Title	sac.analytics
Description	SAP Analytics Cloud content
ID	sac.analytics
Design-Time Destination	SAC_SWZ_DT
Runtime Destination	SAC_SWZ_RT
Runtime Destination for Dynamic Data	Default
Automatically add content	Enabled
Use IPS for authorizations	Enabled

6. Click Save

---

Results

• SAC role definitions are imported into SAP Build Work Zone
• System Owner role is intentionally not imported
• Role changes in SAC require manual refresh from Channel Manager

---

Provision Users Using Identity Provisioning Service (IPS)

To allow users to access analytical insights via Joule, users, roles, and permissions must be synced from SAC to SAP Build Work Zone.

---

1. Configure SAP Analytics Cloud as Source System

Reference: SAP Analytics Cloud IPS documentation

Procedure

1. Open SAP Cloud Identity Services Admin Console
2. Navigate to:
   Identity Provisioning → Source Systems
3. Add SAP Analytics Cloud as a source system

Mandatory Properties

Property	Value
Type	HTTP
URL	SAC base URL (no path)
ProxyType	Internet
Authentication	BasicAuthentication
User	SAC OAuth Client ID
Password	SAC OAuth Client Secret
OAuth2TokenServiceURL	SAC token service URL
sac.api.version	2 (recommended)

---

2. Configure Transformations

• Navigate to Transformations
• Paste the JSON from:
  Default transformation for SAP Analytics Cloud SCIM API v2

---

3. Configure SAP Build Work Zone as Target System

Reference: SAP Build Work Zone IPS documentation

• Use the service key JSON from SWZInstanceKey
• Configure:
  API URL
  OAuth client ID
  OAuth client secret
• Use default transformation from SAP documentation

---

Run Provisioning Jobs

Simulate Provisioning

1. Go to SAC Source System → Jobs
2. Click Run Now on Simulate Job
3. Verify logs:
   Identity Provisioning → Provisioning Logs

✔ No errors should appear

Execute Provisioning

1. Run Read Job
2. Check provisioning logs again

---

Validate User Provisioning

1. Log in to SAP Build Work Zone as Launchpad_Admin
2. Go to:
   Settings → Identity Provisioning
3. Enter SAC user email
4. Validate role IDs are correctly assigned

---

Create Joule User Role Collection

Procedure

1. Create User (ex – testuser@test.com)
2. Go to JouleBATTesting → Security → Role Collections
3. Create role collection:
   Joule_User
4. Add:
   Joule roles
   Launchpad_Admin (if site admin access is required)
5. Assign role collection to IdP users
6. Log out and log back in

---

Index Data Using Just Ask and Validate Joule

Reference: SAP Joule documentation

Important Validation Rules

• SAC models must:
  Belong to the same user
  Be indexed under Just Ask using the same identity
• Example user:
  testuser@test.com

If models are indexed under a different user, Joule will not return results.

SAP Analytics Cloud Integration into Joule – Part 1

Reference Link
https://help.sap.com/doc/de3af3c0f81642dbaa4d36172ed57a72/CLOUD/en-US/79bfc83ab386450c8cd9c7937ce26a3a.pdf

Thanks
Ashraf

 SAP Analytics Cloud Integration into Joule – Part 2IntroductionIn Part 1, we completed the foundational setup for SAP Joule by:Creating SAP BTP subaccounts and spacesConfiguring SAP Cloud Identity ServicesEnabling SAP Build Work ZoneRunning the Joule Booster to establish system formationsIn Part 2, we complete the integration by connecting SAP Analytics Cloud (SAC) to SAP Build Work Zone and Joule. This includes:OAuth client creation in SACDesign-time and runtime destination configurationContent provider creationRole consumptionUser and role provisioning using Identity Provisioning Service (IPS)Final Joule validationCreate OAuth Clients in SAP Analytics CloudTo allow SAP Build Work Zone and Joule to securely access SAP Analytics Cloud content, OAuth clients must be configured in SAC.SAP documentation reference:Consume Role Definition Content from SAP Analytics Cloud1. Create OAuth Client for Design-Time AccessThe design-time OAuth client is used to:Read SAC role definitionsImport analytical metadata into SAP Build Work ZoneProcedureLog in to SAP Analytics CloudNavigate to:System → Administration → App IntegrationUnder Configured Clients, choose Add an OAuth ClientMaintain the following values:Name: sac-buildworkzone-dt (example)Purpose: API AccessAccess: User ProvisioningAuthorization Grant: Client CredentialsConfigure Token Lifetime:Positive integer valueUnits: minutes, hours, or daysIf not specified, the token lifetime is infiniteClick AddSave CredentialsCopy and store the Client IDClick Copy Secret and save the Client SecretNote the Token Service URLImportantThe client secret is displayed only once and cannot be retrieved later.OAuth Clients SummaryAfter completing this step, you should have two OAuth clients in SAP Analytics Cloud:1. Runtime OAuth Client (Auto-created by Joule Booster)Created automatically during Joule booster executionUsed at runtime by JouleUses SAML Bearer AssertionClient secret cannot be copied2. Design-Time OAuth Client (Manually Created)Used for:Importing SAC rolesReading analytical metadataClient ID and secret are used in SAP BTP destinationsCreate Design-Time Destination in SAP BTPThis destination enables SAP Build Work Zone to read role definitions from SAP Analytics Cloud.ProcedureSign in to the JouleBATTesting subaccountNavigate to:Connectivity → Destinations Click Create DestinationDestination ConfigurationPropertyValueNameSAC_SWZ_DTTypeHTTPURLhttps://<SAC-domain>/api/v1/cdmProxy TypeInternetAuthenticationOAuth2ClientCredentialsClient IDSAC design-time OAuth Client IDClient SecretSAC design-time OAuth Client SecretToken Service URL TypeDedicatedToken Service URL Token URL from SAC OAuth configurationAdditional PropertiesPropertyValueHTML5.SetXForwardedHeadersfalseURL.headers.x-sap-sac-custom-auth true4. Click SaveCreate Runtime Destination by CloningInstead of manually creating a runtime destination, reuse the destination created automatically by the Joule booster.ProcedureGo to:Connectivity → Destinations Locate destination:DYN_SAC_SSOClick CloneProvide a new name:SAC_SWZ_RTAdditional PropertiesPropertyValuesap-card-nominations-path/api/v1/interest-cardssap-start true 5. Save the destinationAssign Required Roles to UsersBefore proceeding, ensure the user has required roles.ProcedureGo to:Subaccount → Security → Users Assign the following roles to the IdP user:Launchpad_AdminLaunchpad_External_UserCreate Content Provider in SAP Build Work ZoneThis step imports SAC content and role definitions into SAP Build Work Zone.ProcedureGo to Service MarketplaceOpen SAP Build Work ZoneChoose Go to ApplicationNavigate to Channel ManagerClick + New Content ProviderContent Provider ConfigurationPropertyValueTitlesac.analyticsDescriptionSAP Analytics Cloud contentIDsac.analyticsDesign-Time DestinationSAC_SWZ_DTRuntime DestinationSAC_SWZ_RTRuntime Destination for Dynamic DataDefaultAutomatically add contentEnabledUse IPS for authorizationsEnabled6. Click SaveResultsSAC role definitions are imported into SAP Build Work ZoneSystem Owner role is intentionally not importedRole changes in SAC require manual refresh from Channel ManagerProvision Users Using Identity Provisioning Service (IPS)To allow users to access analytical insights via Joule, users, roles, and permissions must be synced from SAC to SAP Build Work Zone.1. Configure SAP Analytics Cloud as Source SystemReference: SAP Analytics Cloud IPS documentationProcedureOpen SAP Cloud Identity Services Admin ConsoleNavigate to:Identity Provisioning → Source Systems Add SAP Analytics Cloud as a source systemMandatory PropertiesPropertyValueTypeHTTPURLSAC base URL (no path)ProxyTypeInternetAuthenticationBasicAuthenticationUserSAC OAuth Client IDPasswordSAC OAuth Client SecretOAuth2TokenServiceURLSAC token service URLsac.api.version2 (recommended)2. Configure TransformationsNavigate to TransformationsPaste the JSON from:Default transformation for SAP Analytics Cloud SCIM API v23. Configure SAP Build Work Zone as Target SystemReference: SAP Build Work Zone IPS documentationUse the service key JSON from SWZInstanceKeyConfigure:API URLOAuth client IDOAuth client secretUse default transformation from SAP documentationRun Provisioning JobsSimulate ProvisioningGo to SAC Source System → JobsClick Run Now on Simulate JobVerify logs:Identity Provisioning → Provisioning Logs✔ No errors should appearExecute ProvisioningRun Read JobCheck provisioning logs againValidate User ProvisioningLog in to SAP Build Work Zone as Launchpad_AdminGo to:Settings → Identity Provisioning Enter SAC user emailValidate role IDs are correctly assignedCreate Joule User Role CollectionProcedureCreate User (ex – testuser@test.com)Go to JouleBATTesting → Security → Role CollectionsCreate role collection:Joule_UserAdd:Joule rolesLaunchpad_Admin (if site admin access is required)Assign role collection to IdP usersLog out and log back inIndex Data Using Just Ask and Validate JouleReference: SAP Joule documentationImportant Validation RulesSAC models must:Belong to the same userBe indexed under Just Ask using the same identityExample user:testuser@test.comIf models are indexed under a different user, Joule will not return results.SAP Analytics Cloud Integration into Joule – Part 1Reference Linkhttps://help.sap.com/doc/de3af3c0f81642dbaa4d36172ed57a72/CLOUD/en-US/79bfc83ab386450c8cd9c7937ce26a3a.pdfThanksAshraf Read More Technology Blog Posts by SAP articles 

#SAPCHANNEL