2487567 - Troubleshooting SAML assertions when configuring SAML SSO in SAP Analytics Cloud (SAC)

You are configuring SAML SSO in SAP Analytics Cloud (SAC).
When you validate the account you get an error message, pop-up window or a screen with this message:

• We've encountered an unexpected issue.
• Please try again later or contact your system administrator if the problem persists.
• It seems your profile is not configured for this system.

• SAP Analytics Cloud (Enterprise)
• SAML identity provider (IDP) (Note: must support SAML 2.0)

Option 1 : Install a Chrome Extension

There are multiple tools and extensions that can help read SAML assertions. In this example, the SAML Chrome panel is used.

1. Install the SAML Chrome panel extension.
2. Capture and display SAML assertions by opening Chrome Developer Tools (CTRL+Shift+I / F12) and selecting the SAML tab.

Activate this extension in Chrome Incognito mode as well while validating the SAML configuration.

To do that go to: Chrome menu Extensions:

What to capture

1. When you are offered to validate your configuration, open your incognito Window.
2. Open the Chrome Web development tools (F12 or Option + Command + I in MacOS).
3. Paste the URL from the validate windows.
4. You should get redirected from SAP Analytics Cloud to your SAML IdP
5. Type your username / password, after you should be redirected back to SAP Analytics Cloud.

In the last entry for the SAML Plugin, search for the content NameID, similar to:

<Subject>
            <NameID>username</NameID>
            <SubjectConfirmation Method="urn:oasis:names:tc:SAML:2.0:cm:bearer"><SubjectConfirmationData
                InResponseTo="Sca4e6250-4899-4885-9f8d-3b7ceb21ca59-YtIF1X5MFKLMDLYJ8J2Zfju1bZXoUQ9Zr8UDbXK.C4w"
                NotOnOrAfter="2017-06-09T21:08:20.858Z"
                Recipient="https://authn.hana.ondemand.com/saml2/sp/acs/a14f33c4c/axxxx"/></SubjectConfirmation>
</Subject>

NOTE:

If the NameID or other user attributes do not apper in the SAML tool, the SAML assertions may be encrypted.
This applies if  "<EncryptedAssertion xmlns="urn:oasis:names:tc:SAML:2.0:assertion">" is visible in the SAML traces.
In this case, encryption should be disabled until troubleshooting is complete.

Option 2: Using the Google Chrome Developer Tools "Network" Trace

If you are unable to install an additional Google Chrome Extension, you can troubleshoot SAML Responses using the Network tab in the Google Chrome Developer Tools by following the steps below;

1. When you are offered to validate your configuration, open your Incognito Window.
2. Open the Chrome Web Developer Tools (F12 or Option + Command + I in MacOS) and navigate to the Network tab.
3. Complete the Verify Account workflow with the Network tab open
4. Look for the call with the HTTP Status Code "302" in the format of https://<tenant name>.authentication.eu10.hana.ondemand.com/saml/SSO/alias/<tenant name>.aws-live-eu10
5. Open this call and navigate to the "Header" tab
6. Scroll down and look for "SAMLResponse"
7. Copy and Paste this encoded response into your chosen SAML decoder and search for the NameID

Case Sensitivity

Custom SAML logon to SAP Analytics Cloud is case-sensitive. Users can log on only if their SAML User Mapping that's entered into SAP Analytics Cloud is a case-sensitive match to the NameID that's sent by your SAML Identity Provider.

Example:

In Step 3, you will be asked to choose a User Attribute to map to your identity provider, which can be either Email, USER ID, or Custom SAML User Mapping. In this example, Custom SAML User Mapping is used. Here, the credential "user@company" is provided, as this is the expected SAML NameID from the IdP. Please see the expected results below;

Successful "Verify Account" NameID: <NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">user@company.com</NameID>

Unsuccessful "Verify Account" NameID: <NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified">User@company.com</NameID>

You can configure SAML authentication using one of three fields as the SAML User Mapping. In all cases, you need to enter values into SAP Analytics Cloud using the exact same case as will be sent by your SAML Identity Provider:

• Custom SAML User Mapping: This is the most flexible option, as it provides an additional column in the Security > Users page, where you can enter the values by which your Identity Provider will identify each user in the NameID attribute of their SAML assertion. This is commonly used when SAML identifiers are arbitrary upper-, lower-, or mixed-case strings rather than email addresses.
• Email: You can use this option if email addresses are regularly used as identifiers by your Identity Provider. But it is recommended only if you are certain that the Identity Provider uses upper/lower case in a consistent manner (e.g., always all-lowercase), so as to avoid the likelihood of values being entered with mismatches in SAP Analytics Cloud.
• USER ID: USER ID values in SAP Analytics Cloud are always uppercase, and are limited to alphanumeric characters. Use USERID as the SAML user mapping only when you are certain that the NameIDs from your IdP will always be uppercase and limited to the same characters.

TIP: Check the values (Name, Userid, email etc.) stored in the IDP to see that they match.

For example SAP IAS (Identity Authentication Services) will use https://<>.accounts.ondemand.com/ui/protected/profilemanagement

Changing the Login Credential used within SAP Analytics Cloud when a Custom SAML IdP is already configured

Please note: If you wish to change the SAML User Mapping / Login Credential used for authentication between your IdP and SAP Analytics Cloud, please revert to Default IdP and change the NameID value in your IdP, and then reconfigure SAP Analytics Cloud with your Custom SAML 2.0 Identity Provider using the guide below;

https://help.sap.com/viewer/00f68c2e08b941f081002fd3691d86a7/release/en-US/3651184dad944aa2b361ad029a7a8cae.html

• SAP Analytics Cloud administration community topic page
• 2571892 - Best Practice - How to configure SAP Analytics Cloud SAML SSO using Azure Active Directory Services
• SAML SSO and User Management in SAC with SAP Identity Authentication Service | SAP Blogs
• 2411608 - SAP Analytics Cloud SAML authentication *** Collective KBA ***
• 2659735 - Troubleshooting CORS issues with SAP Analytics Cloud (SAC)
• 2569847 - Where can you find SAC user assistance (help) to use, configure, and operate it more effectively?
• Have a question? Ask it here and let our amazing SAP community help! Or reply and share your knowledge!
• 2487011 - What information do I need to provide when opening an case for SAP Analytics Cloud?
• 2511489 - Troubleshooting performance issues in SAP Analytics Cloud
• Search for SAP Analytics Cloud content using Google or Bing:
• • https://www.google.com/search?q=site%3Ahttps%3A%2F%2Fuserapps.support.sap.com+SAP+Analytics+Cloud
  • https://www.bing.com/search?q=site%3Ahttps%3A%2F%2Fuserapps.support.sap.com+SAP+Analytics+Cloud
  • Note: Add relevant text or warning/error messages to the text search field to filter results.
• SAP Analytics Cloud Connection Guide
• Getting Started with SAP Analytics Cloud Expert Community page
• SAP Analytics Cloud Get More Help and SAP Support
• Need More Help? Contact Support or visit the solution finder today!

Your feedback is important to help us improve our knowledge base.

SAML, SSO, authentication, EPM-ODS, Cloud for Analytics, C4P, Cloud4Analytics, CloudforAnalytics, Cloud 4 Planning, HCP, C4A, BOC, SAPBusinessObjectsCloud, BusinessObjectsCloud, BOBJ, BOBJcloud, BOCloud., BICloud, SBOC, SAC, It seems your profile is not configured for this system,e-mail, SAC SAML is not working in SAC Production Tenant, SAC SAML is not working, SAC Production is no more accessible due to SAML, SAC SAML is not working in SAC Production Tenant. SAP Cloud for Planning, sc4p, c4p, cforp, cloudforplanning, Cloud for Analytics, Cloud4Analytics, CloudforAnalytics, Cloud 4 Planning, BOC, SAPBusinessObjectsCloud, BusinessObjectsCloud, BOBJcloud, BOCloud., SAC, SAP AC, Cloud-Analytics, CloudAnalytics, SAPCloudAnalytics,Error, Issue, System, Data, User, Unable, Access, Connection, Sac, Connector, Live, Acquisition, Up, Set, setup, Model, BW, Connect, Story, Tenant, Import, Failed, Using, Working, SAML, SSO, sapanalyticscloud, sap analytical cloud, sap analytical cloud, SAC, sap analyst cloud, connected, failure, stopped, sap analyst cloud, https://hcs.cloud.sap, https://hanacloudservices.cloud.sap, https://cloudanalytics.accounts.ondemand.com, https://hanacloudservices-us.accounts.ondemand.com, https://www.sap.com, https://help.sap.com, predictive analytics (analysis), data analysis (analytics) tools, analytics tools, sap analytics cloud, data literacy, advanced analytics, data democratization, analytics software, real time analytics, self service analytics, advanced data analytics, analytics as a service, analytics cloud / cloud analytics, saas analytics, cloud bi, enterprise planning, cloud data analytics, cloud based analytics, analytics cloud platform, modern analytics, real time analysis, cloud analytics solution(s), what is sap analytics cloud, cloud analytics tools, analytics in the cloud, cloud analytics software epm, business intelligence, , KBA , sso implementation halted , sso account verification error , sac third-party cookies are blocked , single sign on not working - certificate , certificate needs applied , single sign on not working sac kba , use the saml chrome dev tools panel. , to see the id which is synced with sac u , sac kba saml devtools panel , sac kba saml dev tools panel , sso single sign on broken , saml , LOD-ANA-ADM , SAC Administration , LOD-ANA-BI , Business Intelligence Functionality, Analytic Models , LOD-ANA-PL , Planning , LOD-ANA-BR , SAC Boardroom , LOD-ANA-PR , SAC Predictive , How To