2472944 - FAQ: Single Sign-On errors using SAML, Kerberos, X.509 and Analysis for Office

This knowledge based article aims to document the typical errors you could see when trying to configure single sign on with HANA Database.

These errors will only become visible after you have switched on all the necessary tracing:

1: Turn on tracing with this SQL:

ALTER SYSTEM ALTER CONFIGURATION ('indexserver.ini', 'SYSTEM') set ('trace', 'authentication') = 'debug' with reconfigure;

For HTTP based logins via SAP HANA XS, please execute:

ALTER SYSTEM ALTER CONFIGURATION ('indexserver.ini', 'SYSTEM') SET ('trace', 'authorization') = 'info' WITH RECONFIGURE;

ALTER SYSTEM ALTER CONFIGURATION ('xsengine.ini', 'SYSTEM') set ('trace', 'authentication') = 'debug' with reconfigure;

ALTER SYSTEM ALTER CONFIGURATION ('xsengine.ini', 'SYSTEM') set ('trace', 'xssession') = 'debug' with reconfigure;

ALTER SYSTEM ALTER CONFIGURATION ('xsengine.ini', 'SYSTEM') set ('trace', 'xsauthentication') = 'debug' with reconfigure;

2:Reproduce the issue you are seeing for the SSO.

3: Turn off tracing with this SQL:

ALTER SYSTEM ALTER CONFIGURATION ('indexserver.ini', 'SYSTEM') UNSET ('trace', 'authorization')  WITH RECONFIGURE;

ALTER SYSTEM ALTER CONFIGURATION ('indexserver.ini', 'SYSTEM') UNSET ('trace', 'authentication');

ALTER SYSTEM ALTER CONFIGURATION ('xsengine.ini', 'SYSTEM') UNSET ('trace', 'authentication');

ALTER SYSTEM ALTER CONFIGURATION ('xsengine.ini', 'SYSTEM') UNSET ('trace', 'xssession');

ALTER SYSTEM ALTER CONFIGURATION ('xsengine.ini', 'SYSTEM') UNSET ('trace', 'xsauthentication');

4: Generate a full system dump with the steps given in SAP Note 1732157

5: For more information on the error files please see SAP Note 2434356

SAP HANA Database 1.0 + 2.0

KBA , HAN-DB-SEC , SAP HANA Security & User Management , Problem