single-sign-onsap-cloud-foundry

SAP Cloud Platform and Cloud Foundry XSAUAA login

I have build an application using Mendix (mendix.com) and deployed it on the SAP Cloud Platform on a Cloud Foundry landscape. The users are using SSO/XSAUAA for an automatically login.

My login.html looks like this:

<!doctype html>
<html>
    <head>
        <script>
            window.location.assign("/xsauaalogin/")
        </script>
    </head>
</html>

When the application starts, the login.html will be called automatically and the user will be redirected to the url https://applicationurl.com/xsauaalogin/

Since I am using the SAP Cloud Platform and Cloud Foundry, following page is opening automatically:

enter image description here

Now the user has to click on the link accounts.sap.com first to be redirected to be logged in automatically and redirected to the application.

My goal is to achieve that the user hasn't need to click on accounts.sap.com, instead this should be done automatically. And I am struggling with that and don't know how to do that. I think that page (see screenshot above) is located somewhere on the server and I don't have access to that html-file and can't change that page/html-code. Because If I would have access to it, I would just use redirect-functionality.

Can someone help me? How can I skip this step our initiate the "accounts.sap.com" click automatically? Maybe I can change something in my login.html? Another url instead of just /xsauaalogin/ ?

Best regards and thanks, Ömer

Solution

  • I don't have any experience with Mendix so I might be missing the point a bit but in general you wouldn't require any login page as this is handled by the UAA service of the SAP cloudfoundry platform.

    This service will interact with the configured indentity provider(s) in your subaccount. The standard SAP ID service is configured as as default IDP provider - this is the 'accounts.sap.com' link you are seeing.

    Normal behavior would be that the 'xs-security.json' of the UAA service referenced by your app contains no specific links to custom logon pages and as such the default logon page of the SAP ID IDP provider should show up.

    If wanted additional IDP providers can be configured and one of them can be indicated as the default handler. If the standard SAP IDP handler remains as an active handler as well then it is shown as an alternative logon url ( like in your screen shot ).