SAP Analytics Cloud

SAP BW Live Connection Setup

Implementation Template – New Tenant Migration

1.      Scope and Overview

This document is a repeatable implementation template for enabling SAP Analytics Cloud (SAC) live data connections to one or more SAP BW (or SAP BW/4HANA) systems in a new or replacement SAC tenant. Cross-checked against the official SAP Help Portal documentation for "Live Data Connection to SAP BW Using a Direct CORS Connection via Unified Connectivity".

1.1    What This Guide Covers

•        Verifying and permanently enabling CORS on each BW ABAP Application Server.

•        Configuring the HTTP Allowlist (UCONCOCKPIT) with the full set of required headers and methods as per SAP documentation.

•        Configuring SameSite=None cookie attributes required by modern browsers (Chrome 80+).

•        Re-creating BW Live Connections in the new SAC tenant with exact technical names.

•        Validating connectivity end-to-end using the BW GetServerInfo URL and SAC story execution.

•        Reviewing SAC license and capacity unit usage.

•        Post-migration checklist and SSO planning.

1.2    High-Level Process Flow

1.     Collect reference data from the old SAC tenant (connection names, host, port, client).

2.     Verify/enable CORS on each BW system (RZ11 / RZ10).

3.     Configure SameSite cookie attributes via ICM rewrite rules (SAP Note 2887651).

4.     Add the new SAC tenant to the BW HTTP Allowlist (UCONCOCKPIT / /NUCONCOCKPIT).

5.     Verify BW connectivity from the browser (GetServerInfo URL test).

6.     Re-create BW Live Connections in the new SAC tenant with exact technical names.

7.     Validate by opening representative stories.

8.     Repeat steps 2–7 for every additional BW system.

9.     Plan and implement SSO (SAML/SNC).

10.  Decommission or clean up old tenant connections.

2.      Prerequisites

2.1    SAP BW / NetWeaver Version

SAP BW CORS support via UCONCOCKPIT requires SAP NetWeaver AS ABAP at a minimum of the versions listed below. If your system is below these levels, a different setup path (ICM script-based CORS, SAP Note 2596285) is required and is outside the scope of this template.

2.2    Access and Authorizations Required

•        BW System:  SAP GUI access with authority to run RZ10, RZ11, /NUCONCOCKPIT (UCONCOCKPIT), SM59, SMICM. OS-level access to write the ICM rewrite file (SID>adm user).

•        Old SAC Tenant:  Admin or Connection Manager role (to read existing connection details).

•        New SAC Tenant:  Admin role + Create, Read, Update, Delete and Maintain permissions for Connections + Execute permission for Other Data Sources.

•        SAC Standard Roles:  Admin, Application Creator, BI Content Creator, BI Admin, or Planner Reporter are sufficient for connection creation.

2.3    Information to Collect Before Starting

3.                                      1   Verify / Enable CORS in BW

Repeat this entire phase for every BW system (e.g., QB1, PB1) that will be connected.

3.1    Check Current CORS Status (RZ11 – No Restart Required)

11.  Log on to the BW system ([SID]) in SAP Logon.

12.  Run transaction RZ11.

13.  In the Parameter Name field enter icf/cors_enabled and click Display.

14.  Review the Current Value field.

15.  If the value is 1: CORS is active. Skip to step 7.

16.  If the value is 0 or the parameter is absent: click Change Value, set New Value to 1, and click Save. This change is temporary (lost on restart).

17.  Record current status in the post-migration checklist (Section 9).

3.2    Make CORS Permanent (RZ10 – Restart Required)

18.  Run transaction RZ10.

19.  In the Profile field, select DEFAULT. If you have multiple authentication methods, choose the DEFAULT profile from the list.

20.  Select Extended Maintenance and click Display (or Change).

21.  Search for parameter icf/cors_enabled.

22.  If it exists: set value to 1.

23.  If it does not exist: click Parameter Create, enter parameter name icf/cors_enabled and value

1.

24.  Click Save and then Activate the profile.

25.  If you receive an error that profiles don't correspond to active profiles: go to Utilities > Import Profiles > Of Active Servers.

26.  Schedule a system restart during a maintenance window. The permanent setting only takes effect after restart.

4.      Phase 2 – SameSite Cookie Configuration

Required for Chrome 80+ and other modern browsers. Without this step, user authentication to live connections will fail with session/cookie errors even if CORS is correctly enabled.

4.1    Why This Is Needed

SAC live connections are cross-site (the BW domain differs from the SAC domain). Chrome 80+ and other browsers treat cookies without an explicit SameSite attribute as SameSite=Lax, which blocks

them in cross-site contexts. The BW system must be configured to issue all cookies with SameSite=None; Secure.

4.2    Create the ICM Rewrite File

27.  Log on to the operating system of the BW ABAP AS with the [SID]adm user.

28.  Create the file /sapmnt/[SID]/profile/rewrite.txt using a text editor.

29.  Add the following rewrite script content to the file and save:

4.3    Register the Rewrite File in RZ10

30.  Run transaction RZ10, open the DEFAULT profile in Extended Maintenance.

31.  Add or update the parameter icm/HTTP/mod_0 with the value:

PREFIX=/,FILE=$(DIR_PROFILE)/rewrite.txt

32.  Save and activate the profile.

33.  Schedule a system restart for this change to take effect.

5.            3     Configure BW HTTP Allowlist (UCONCOCKPIT)

The HTTP Allowlist in UCONCOCKPIT controls which SAC tenants are permitted to make cross-origin InA requests to the BW system. This must be configured for every SAC tenant (old and new) that needs live access.

5.1    Access UCONCOCKPIT

34.  In SAP Logon, run transaction /NUCONCOCKPIT (the leading /N forces a new session on some systems; you can also run UCONCOCKPIT directly).

35.  Change Scenario to HTTP Allowlist Scenario (older NW versions may show this as "HTTP Whitelist Scenario").

36.  Change the Mode of Cross-origin Resource Sharing to Active Check.

37.  Double-click Cross-origin Resource Sharing.

38.  Click Display / Change to enter edit mode.

5.2    Add the New SAC Tenant to the Allowlist

39.  Under Allowlist (SAP BW) or click To Allowlist (SAP BW/4HANA), click Add / New Entry. A dialog opens.

40.  Set Service Path to /sap/bw/ina.

41.  Set Host Rule to the SAC tenant hostname only (no https://, no trailing slash, no path).

Example:

[newtenant.eu10.hana.ondemand.com]

42.  If both the old and new tenant must run in parallel, add both hostnames separated by a comma:

[oldtenant.eu10.hana.ondemand.com],[newtenant.eu10.hana.ondemand.com]

43.  Set Allowed Methods: select GET, HEAD, POST, and OPTIONS.

44.  Set Allowed Headers (comma-separated, case-insensitive):

x-csrf-token, x-sap-cid, authorization, mysapsso2, x-request-with, sap-rewriteurl, sap-url-session-id, content-type, accept-language

45.  Set Exposed Headers (comma-separated):

x-csrf-token, sap-rewriteurl, sap-url-session-id, sap-perf-fesrec, sap-system

46.  Ensure Allow Credentials is selected.

47.  Ensure Allow Private Network Access is selected.

48.  Click OK to close the input dialog, then Save (Ctrl+S).

5.3    Verify the ICF /sap/bw/ina Package Is Active

The InA (Information Access) ICF package must be enabled on the BW system for SAC to communicate.

49.  Run transaction SICF.

50.  Navigate to the path default_host > sap > bw > ina.

51.  Ensure the service is active (not greyed out). Activate if necessary.

52.  Also verify basic authentication is configured on the /sap/bw/ina package or a higher-level package.

6.                                      4   Browser Pre-Check (GetServerInfo URL Test)

Before creating the SAC connection, verify BW is reachable over HTTPS from a browser. This catches SSL and network issues before you involve the SAC UI.

53.  Open an Incognito/InPrivate browser window.

54.  Navigate to:

https://[BW_HOST]/sap/bw/ina/GetServerInfo?sap-client=[CLIENT]

55.  You should be redirected to a login page (if using form auth) or receive a JSON/XML response.

A 404 or certificate error indicates a problem. Do NOT proceed until this URL returns valid data.

56.  If a certificate dialog appears in the browser: accept/trust the BW server certificate before proceeding to SAC connection setup.

57.  If using SSO: verify you are redirected to your Identity Provider (IdP) login page and that after authentication you see a valid GetServerInfo response (not a 404).

7.                                      5   Collect Reference Data from Old SAC Tenant

Log in to the OLD SAC tenant before creating connections in the new tenant.

58.  Navigate to the Main Menu > Connections.

59.  Locate each BW Live connection (e.g., QB1Live, PB1Live).

60.  Open each connection and record the following:

8.            6     Create BW Live Connections in the New SAC Tenant

Perform the following steps once per BW system. Use the reference data collected in Phase 5.

61.  Log in to the new SAC tenant ([newtenant URL]).

62.  Go to Main Menu > Connections > click + (Create).

63.  In the "Select a Data Source" dialog, expand Connect to Live Data and select SAP BW.

64.  Fill in the connection details exactly as recorded from the old tenant:

65.  Click Save — do NOT click Test Connection before saving on some NW versions, as a failed test can prevent saving.

66.  After saving, use the ... menu or pencil icon to Edit and then Test Connection.

67.  Successful test shows a green checkmark. Proceed to Phase 7.

68.  If the test fails, refer to Section 10 (Troubleshooting).

69.  Repeat this phase for every additional BW system (e.g., PB1Live).

9.                                      7   Validate Stories and Models

70.  In the new SAC tenant, open at least three representative stories that use each new connection.

71.  Expect a credential prompt for BW login (Username/Password) until SSO is configured. This is expected behavior at this stage.

72.  Verify that charts, tables, and KPIs render with actual data.

73.  Test planning stories (if applicable) to confirm write-back functionality.

74.  If a story reports "connection does not exist": the technical name in the new tenant does not match the old tenant exactly. Delete and recreate the connection with the correct name.

75.  If a story opens but shows no data (no error): BW authorizations are missing for your user on the underlying InfoProviders or BEx queries. Engage BW Security to grant the required roles.

76.  Document the test results in the sign-off checklist (Section 11).

10.      Phase 8 – License and Capacity Unit Review

Optional, but recommended as a final step to confirm the new tenant is correctly licensed.

77.  In the new SAC tenant, navigate to Main Menu > System > Administration > System Monitor (or click the i icon at the bottom-left of the home screen).

78.  Navigate to the Licenses / Capacity Units tab.

79.  Review total licenses allocated vs. activated users.

80.  If capacity-unit based licensing is in use, confirm the unit allocation matches the expected contract.

81.  For discrepancies, contact your SAP licensing or Customer Success partner — do not attempt to adjust capacity units directly.

11.     Troubleshooting Reference

12.      Next Steps and Recommendations

12.1    Configure SSO (High Priority)

With Username/Password authentication, users must re-enter BW credentials on every session. Configure SAML 2.0 SSO to eliminate this:

•        Ensure SAC and the BW ABAP AS use the same SAML Identity Provider (IdP).

•        In SAC: System > Administration > Security > SAML Single Sign-On.

•        In BW: configure SAML 2.0 SP using transaction SAML2.

•        After SSO is live, edit each BW Live connection in SAC to change Authentication from Username/Password to SAML SSO.

•        Test SSO by logging in to SAC and opening a live story — no separate BW credential prompt should appear.

•        Reference: SAP Help – "Enable a Custom SAML Identity Provider" in SAC documentation.

12.2    Audit All Connections

•        Review all connections in both the old and new tenant. Any connection with suffix variants (e.g., 'QB1LivePDF', 'QB1Dev') must be individually assessed — identify which models reference them and recreate if needed.

•        Remove connections from the new tenant that are not required.

•        Do not decommission the old tenant until all stories have been validated in the new tenant.

12.3    Browser and Client Hygiene

•        Communicate to end users that they should allow pop-ups from the SAC domain and third-party cookies from the BW domain in their browsers.

•        Chrome and Edge are the primary supported browsers; test all key stories in both.

•        For embedded SAC scenarios, review the SameSite cookie FAQ (SAP Blog 2020-02-08).

12.4    Documentation and Governance

•        Maintain a connection registry (connection name, BW system, host, port, client, owning team, date created).

•        Review capacity unit / license consumption quarterly.

•        Repeat this entire process template for any future BW system additions or SAC tenant replacements.

13.      Implementation Sign-Off Checklist

Complete the table below after each customer implementation. One row per BW system.

Implemented by:  __________________________    Date:  __________________________

Customer sign-off:  __________________________    Date:  __________________________

14.      SAP Notes and Documentation Reference