3563695 - How to create an OData connection to SAP Datasphere in SAP Analytics Cloud

• It is requested to create a new OData Service Connection in SAP Analytics Cloud connecting to SAP Datasphere
• Which authentication types should be selected?
• What configuration should be done in advance on SAP Datasphere tenant?

• SAP Analytics Cloud (SAC)
• SAP Datasphere

 An OAuth 2.0 client with Interactive Usage purpose must be created in SAP Datasphere to consume data via the OData API, because the connection requires a valid SAML-based user context.

Scenario 1: Log on to both SAC and Datasphere in same browser session

1. Log on to SAC tenant and navigate to Connections > Create a new OData Service Connection.
2. Authentication Type set to OAuth 2.0 Authorization Code, then note down the Redirect URL for this connection.
3. Keep the dialog open and open a new browser tab to logon to SAP Datasphere system, navigate to System > Administration > App Integration
4. Note down Authorization URL and Token URL under OAuth Clients in this page.
5. Click to add an OAuth Client
6. Give it a name and Purpose set to Interactive Usage, for Redirect URL input the information copied in step 2
7. Click Add and Copy the Secret (The secret Key for this OAuth client can only be copied during creation.)
8. Note down the Client ID for this new-created OAuth Client in SAP Datasphere.
9. Navigate back to SAC and open the previous page for creating Odata Service Connection.
10. Give it a connection name.
11. Data Service URL should be in following format:
    https://<TenantURL>.cloud.sap/api/v1/dwc/consumption/relational/<SpaceID>/<View>
    1. The same URL retrieved from "Generate OData Request" > "Service"
12. OAuth Client ID please use the ID copied in step8.
13. Secret is the Secret key copied in step7.
14. Input Token URL and Authorization URL copied in step4.
15. Click Create.
    => One Pop-up dialog to Datasphere IdP will appear and then closed automatically without inputting any user credential due to existing session of SAP Datasphere in same browser window.

Scenario 2: Log on to both SAC and Datasphere (using same IdP) in different browser session

1. Log on to SAC tenant and navigate to Connections > Create a new OData Service Connection.
2. Authentication Type set to OAuth 2.0 Authorization Code, then note down the Redirect URL for this connection.
3. Open a new private browser window (or another browser) to logon to SAP Datasphere system, navigate to System > Administration > App Integration
4. Note down Authorization URL and Token URL under OAuth Clients in this page.
5. Click to add an OAuth Client
6. Give it a name and Purpose set to Interactive Usage, for Redirect URL input the information copied in step 2
7. Click Add and Copy the Secret (The secret Key for this OAuth client can only be copied during creation.)
8. Note down the Client ID for this new-created OAuth Client in SAP Datasphere.
9. Navigate back to SAC in the other browser window where the connection dialog is still open.
10. Give it a connection name.
11. Data Service URL should be in following format:
    https://<TenantURL>.cloud.sap/api/v1/dwc/consumption/relational/<SpaceID>/<View>
    1. The same URL retrieved from "Generate OData Request" > "Service"
12. OAuth Client ID please use the ID copied in step8.
13. Secret is the Secret key copied in step7.
14. Input Token URL and Authorization URL copied in step4.
15. Click Create.
    => One Pop-up dialog to Datasphere IdP will appear and then closed automatically without inputting any user credential due to existing IdP session (SAC is using same IdP).

Scenario 3: Log on to both SAC and Datasphere (using different IdP) in different browser session

1. Log on to SAC tenant and navigate to Connections > Create a new OData Service Connection.
2. Authentication Type set to OAuth 2.0 Authorization Code, then note down the Redirect URL for this connection.
3. Open a new private browser window (or another browser) to logon to SAP Datasphere system via different IdP, navigate to System > Administration > App Integration
4. Note down Authorization URL and Token URL under OAuth Clients in this page.
5. Click to add an OAuth Client
6. Give it a name and Purpose set to Interactive Usage, for Redirect URL input the information copied in step 2
7. Click Add and Copy the Secret (The secret Key for this OAuth client can only be copied during creation.)
8. Note down the Client ID for this new-created OAuth Client in SAP Datasphere.
9. Navigate back to SAC in the other browser window where the connection dialog is still open.
10. Give it a connection name.
11. Data Service URL should be in following format:
    https://<TenantURL>.cloud.sap/api/v1/dwc/consumption/relational/<SpaceID>/<View>
    1. The same URL retrieved from "Generate OData Request" > "Service"
12. OAuth Client ID please use the ID copied in step8.
13. Secret is the Secret key copied in step7.
14. Input Token URL and Authorization URL copied in step4.
15. Click Create.
    =>A pop-up dialog to the Datasphere IdP will appear. Because no existing SAML-based user context is available, enter the credentials used to log on to SAP Datasphere.

Additional Note:

• Same behavior with pop-up to Datasphere IdP could be also observed when using the connection to create model.
• It is recommended to check option Share these credentials when sharing this connection. Otherwise, another SAC user getting the connection share needs to enter all OAuth information (Client ID, Secret, Token URL, Authorization URL) at the first time when using the connection to either create model or refresh job.

• SAC Guide on how to create OData Service Connection: Import Data Connection to OData Services | SAP Help Portal 
• SAP Datasphere Guide: Create OAuth2.0 Clients to Authenticate Against SAP Datasphere | SAP Help Portal 
• KBA 3737462 - OData Connection from SAC to Datasphere fails with http 406 and “Connection to service failed: OData services”
• KBA 3447176 - "Connection to service failed: OData Services" error appears when trying to create an OData Services Connection

OData, OAuth 2.0, Authorization Code, SAP Datasphere, SAP Analytics Cloud, SAC, DWC, OData Service Connection, import connection, Interactive Usage, SAML, acquired data, how to, best practice , KBA , LOD-ANA-AQU-ODATA , Acquiring Data into SAC using an ODATA connection , How To