## 4.3.2  Consume Role Definition Content from SAP Analytics Cloud
Learn how to consume user role definitions from SAP Analytics Cloud as CDM content in SAP Build Work Zone.
For your users to use analytical insights in Joule, their SAP Analytics Cloud user accounts, roles, and permissions need to be synced to SAP Build Work Zone using the Identity Provisioning Service (IPS). Before doing that, the user role definitions from SAP Analytics Cloud must be consumed as CDM content so they are defined and available in SAP Build Work Zone. The basic steps are as follows:
- Create two OAuth clients in SAP Analytics Cloud to allow SAP Build Work Zone to access the role definitions during design time and runtime configuration.
- Create two destinations in the SAP BTP subaccount used for Joule analytical insights. The first you manually create and use the design time OAuth client you created in SAP Analytics Cloud. The second you can clone from the runtime destination created automatically when running the Joule booster, and add a few additional properties to point to the runtime OAuth client you created new in SAP Analytics Cloud.
- Create a content provider in SAP Build Work Zone to actually import and consume the role definitions, using the configured destinations, from SAP Analytics Cloud.

For users to use analytical insights, the role their user account is assigned to in SAP Analytics Cloud must have the Read permission on the Joule privilege (seen above). If you create custom roles, ensure you set the permission for this privilege.

Role definitions (seen above) with these permissions then in SAP Analytics Cloud need to be made available in SAP Build Work Zone by synching them as CDM content.
Follow the detailed steps below to complete these configurations.
## Create an OAuth Client for Design Time in SAP Analytics Cloud
## Procedure
1. Sign in to your SAP Analytics Cloud tenant as administrator.
2. From the side navigation, choose System Administration .
3. Choose the App Integration tab.
4. Under Configured Clients , select Add an OAuth Client .
5. In the dialog, add a name for the OAuth client (for example sac-buildworkzone-dt ).
6. From the Purpose list, select API Access .
7. From the Access list, select User Provisioning .
8. From the Authorization Grant list, select Client Credentials .
9. Set the Token Lifetime .
When the access token expires, clients must use a valid refresh token to obtain a new access token. An administrator can set both the value and unit. Available time units include days, hours, and minutes.
The lifetime value must be a positive integer. If this value is not provided, the lifetime value will be infinite by default.
10. Select Add . A client Secret will be automatically generated.
11. Select Copy Secret and save the secret for reference.
##  Caution
You will not be able to view or edit the secret again. If you lose the secret, you must delete the OAuth client from SAP Analytics Cloud and create another one to generate a new secret.
## Results
A Client ID will be generated once the OAuth client is created. Copy this down for later as you'll need it when creating the destinations in your SAP BTP subaccount. You can find it by choosing the Edit OAuth Client icon button and opening the Edit OAuth Client dialog in SAP Analytics Cloud:

## Create an OAuth Client for Runtime in SAP Analytics Cloud
## Procedure
1. Sign in to your SAP Analytics Cloud tenant as administrator.
2. From the side navigation, choose System Administration .
3. Choose the App Integration tab.
4. Under Configured Clients , select Add an OAuth Client .
5. In the dialog, add a name for the OAuth client (for example sac-buildworkzone-rt ).
6. From the Purpose list, select API Access .
7. From the Access list, select Data Export Service .
8. From the Authorization Grant list, select SAML 2.0 Bearer .
9. Set the Token Lifetime .
When the access token expires, clients must use a valid refresh token to obtain a new access token. An administrator can set both the value and unit. Available time units include days, hours, and minutes.
The lifetime value must be a positive integer. If this value is not provided, the lifetime value will be infinite by default.
10. Select Add . A client Secret will be automatically generated.
11. Select Copy Secret and save the secret for reference.
##  Caution
You will not be able to view or edit the secret again. If you lose the secret, you must delete the OAuth client from SAP Analytics Cloud and create another one to generate a new secret.
## Results
A Client ID will be generated once the OAuth client is created. Copy this down for later as you'll need it when creating the destinations in your SAP BTP subaccount. You can find it by choosing the Edit OAuth Client icon
button and opening the Edit OAuth Client dialog in SAP Analytics Cloud:

After creating the design and runtime OAuth clients, you should now have two OAuth clients:

## Create a Design Time Destination in Your SAP BTP Subaccount
## Procedure
1. Sign in to the SAP BTP subaccount where Joule and SAP Build Work Zone are set up.
2. From the side navigation, choose Connectivity Destinations and select Create From Scratch to create a new destination from scratch and select Create .
3. Under Destination Details , set the following property values:
4. Under Additional Properties , use the New Property button to add the following additional properties:
5. Choose Create to create the design time destination.
| Property Name          | Value                                                                                                                                           |
|------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------|
| Name                   | SAC_SWZ_DT                                                                                                                                      |
| Type                   | HTTP                                                                                                                                            |
| URL                    | https://<Fully qualified SAP Analytics Cloud domain name>/api/v1/cdm                                                                            |
| Proxy Type             | Internet                                                                                                                                        |
| Authentication         | OAuth2ClientCredentials                                                                                                                         |
| Client ID              | Copy and paste the Client ID of the OAuth client you created for the design time destination in SAP Analytics Cloud.                            |
| Client Secret          | Paste the secret you previously copied when you created the OAuth client for the design time destination in SAP Analytics Cloud.                |
| Token Service URL      | Copy the Token URL from SAP Analytics Cloud under the OAuth Clients section in the System Administration App Integration tab and paste it here. |
| Token Service URL Type | Dedicated                                                                                                                                       |
| Additional Property Name          | Value   |
|-----------------------------------|---------|
| HTML5.SetXForwardedHeaders        | false   |
| URL.headers.x-sap-sac-custom-auth | true    |
## Create a Runtime Destination by Cloning in Your SAP BTP Subaccount
## Context
Instead of manually creating a new runtime destination, you can clone the existing destination that was automatically created when you ran the Joule booster earlier to enable analytical insights, and add a few additional properties.
## Procedure
1. Sign in to the SAP BTP subaccount where Joule and SAP Build Work Zone are set up.
2. From the side navigation, choose Connectivity Destinations and find the runtime destination named DYN\_SAC\_SSO already created for SAP Analytics Cloud.
3. The existing destination uses OAuth2SAMLBearerAssertion authentication, and the URL is the fully qualified domain name of your SAP Analytics Cloud tenant.
3. Select the existing DYN\_SAC\_SSO destination and choose Duplicate to create a new destination based of it.
4. Under Destination Details , give your duplicated runtime destination a new name. For example, SAC\_SWZ\_RT .
5. Under Destination Details , replace the following property values with the details from your runtime OAuth client created in SAP Analytics Cloud:

| Property Name          | Value                                                                                                                            |
|------------------------|----------------------------------------------------------------------------------------------------------------------------------|
| Token Service User     | Copy and paste the Client ID of the OAuth client you cre- ated for the runtime destination in SAP Analytics Cloud.               |
| Token Service Password | Paste the secret you previously copied when you created the OAuth client for the design time destination in SAP Analytics Cloud. |
6. Under SAML Properties , set the following property values:
7. Under Additional Properties , use the New Property button to add the following additional properties:
8. Choose Create to save changes and create the runtime destination.
| Property Name   | Value                                                                                                              |
|-----------------|--------------------------------------------------------------------------------------------------------------------|
| Client Key      | Copy and paste the Client ID of the OAuth client you cre- ated for the runtime destination in SAP Analytics Cloud. |
| Additional Property Name   | Value                  |
|----------------------------|------------------------|
| sap-card-nominations-path  | /api/v1/interest-cards |
| sap-start                  | true                   |
## Create a Content Provider in SAP Build Work Zone
## Procedure
1. Sign in to the SAP BTP subaccount where Joule and SAP Build Work Zone are set up.
2. From the side navigation, choose Services Service Marketplace and find and select SAP Build Work Zone.
3. Choose Go to Application to open SAP Build Work Zone Site Manager.
4. From the side navigation, choose Channel Manager .
5. Choose + New Content Provider .
6. In the New Content Provider dialog, enter the following information:
| Field                   | Value                                                                              |
|-------------------------|------------------------------------------------------------------------------------|
| Title                   | sac.analytics                                                                      |
| Description             | Enter a description for the content provider.                                      |
| ID                      | sac.analytics                                                                      |
| Design-Time Destination | Select the design time destination you created earlier. In our example, SAC_SWZ_DT |
Field
| Runtime Destination                                                      | Select the runtime destination you created earlier. In our example, SAC_SWZ_RT   |
|--------------------------------------------------------------------------|----------------------------------------------------------------------------------|
| Runtime Destination for Dynamic Data                                     | Use default runtime destination                                                  |
| Automatically add all content items to subaccount                        | true (enabled)                                                                   |
| Use the Identity Provisioning service to provision user au- thorizations | true (enabled)                                                                   |
| Include group and catalog assignments to roles.                          | false (disabled)                                                                 |
7. Choose Save to create the content provider.
## Results
Once the content provider is created, the role definitions from SAP Analytics Cloud will be imported into SAP Build Work Zone. You can check this by choosing Content Manager from the side navigation. Note the System Owner role is never imported into SAP Build Workzone and another user account and role for that person to use analytical insights.

## Role definitions from SAP Analytics Cloud are now available in SAP Build Work Zone.
If changes are made to the roles and permissions in SAP Analytics Cloud after this initial import, these changes won't be automatically reflected in SAP Build Work Zone. You must manually sync the roles and permissions again by navigating to the Channel Manager page and using the refresh button associated with the sac.analytics provider.
## Next Steps
Now that the role definitions are available, the next step is to actually provision your users from SAP Analytics Cloud to SAP Build Work Zone using IPS.
## Value