3656881 - Error: "Authorization required." when typing an analytical utterance in Joule

• Configure Joule and SAP Analytics Cloud integration using a custom attribute
• After typing an analytical utterance in Joule, you get the following message: 

• • Authorization required.
    It seems you don't have permission to use SAP Analytics Cloud. If the problem continues, please contact your administrator.
    
    

• SAP Analytics Cloud's SAML Single Sign-On (SSO) Configuration is set to USERID or Custom SAML User Mapping
  • Furthermore, the Custom SAML User Mapping values aren't e-mails

Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental. 

• SAP Analytics Cloud (SAC) tenants supporting Joule integration

1. Log into a Joule instance that has been linked with SAP Analytics Cloud
2. Type in an analytical utterance (e.g., show sales by location)
3. An "Authorization required" message is returned, but the user logged into Joule is authorized for SAP Analytics Cloud

By default, the integration between Joule and SAP Analytics Cloud is done through e-mail. If SAP Analytics Cloud's authentication setup is done on a separate attribute, further configuration in SAP Cloud Identity and the BTP subaccount hosting Joule is required.

The attribute needs to be added into the Joule SAP Cloud Identity application in order for the user to be logged into SAP Analytics Cloud.

1. Determine which attribute contains the attribute value used to log into SAP Analytics Cloud. In this example, it's Login Name.
   • 
2. Update Joule IAS application to add this attribute

   1. Navigate to the Joule application in SAP Cloud Identity. Choose Attributes. In "Self-defined Attributes", click on Add.

      • 
   2. Now, add the attribute as appropriate. For the above example, we use "login_name" for Name, "Identity Directory" as Source, and "Login Name" as Value. Once this has been done, hit Save.
      • 
3. In the BTP subaccount hosting Joule, update the DYN_SAC_SSO destination as follows. Hit Save when complete.

   Field	Value	Note
   Name Id Format	urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
   User Id Source	$['user_attributes'].['<attribute_name>'][0]	<attribute_name> is the Name used above. In our example, it'll be $['user_attributes'].['login_name'][0]

   

KBA , LOD-ANA-JOU , SAC and Joule integration , Problem