2761078 - Failed to Verify Account when trying to enable custom IdP in SAP Analytics Cloud (SAC) *** Collective KBA ***

"Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental."

Below errors appear when trying to enable custom IdP in SAP Analytics Cloud (SAC):

• "Sorry, we've encountered an error during the account verification setup. Please try again later." 

• "We were not able to verify your account. Check your login credential and try again."

The below errors can be seen in web browser HAR trace:

• errorDetails: [{message: "uploadIdPMetadata failed with 500 status", bUIMessage: false, bWarning: false}]
• errorDetails: [{message: "uploadIdPMetadata failed with 404 status", bUIMessage: false, bWarning: false}]

SAP Analytics Cloud (Enterprise Edition).

1. In SAC, From the side navigation, go to : System -> Administration -> Security.
2. Select Edit.
3. In the 'Authentication Method' area, select SAML Single Sign-On (SSO) if it is not already selected.
4. In the 'SAML Single Sign-On (SSO) Configuration' area, configure "Custom SAML IdP", as per the steps mentioned in the below guide: Enable a Custom SAML Identity Provider 
5. In step 4 (Confirm that the mapping is working), enter "<Your Unique Identifier>"
6. Click "Verify Account" button.
   
   >> Notice the below errors:

• "Sorry, we've encountered an error during the account verification setup. Please try again later."
• "We were not able to verify your account. Check your login credential and try again."

Multiple reasons for the failure of verifying account include:

• Incorrect IdP meatadata uploaded (See KBAs 2692774 , 2833096, 3461594, 3542912 & 2780306).
  >> Notice the following error message in the 'Chrome Console' log : "uploadIdPMetadata failed with 500 status".
• The validation attempt may have been used in the same browser session where some user has already been authenticated in SAC.
• The email ID on IdP side is different with the email on SAC. NameID is case sensitive. The User ID, Email, or Custom SAML User Mapping must match the values in SAML IdP exactly. For example, if the NameId returned by the SAML IdP is user@company.com and the email used in SAP Analytics Cloud is User@company.com the mapping will fail. (See KBA 3430315).
• In the IDP metadata, HTTP protocol is used instead of the HTTPS protocol for endpoints. The security policy in the CF environment strictly requires HTTPS for SSO and SLO endpoints (See KBA 3639255).
• A trusted identity provider with the same uploaded certificate exists (See KBA 3623621).
• The bundling process should have been started through IDP Admin by following "Create or Modify a Bundled SAP Cloud Identity Services Tenant" so the same IDP cannot be used with legacy Self Service SAML (See KBA 3719380).

• Ensure that the IdP metadata is uploaded in correct format according to KBAs 2692774 , 2833096, 3461594, 3542912 & 2780306.
  => If still unsure where is incorrect with the IdP metadata, please create one incident to component LOD-ANA-AUT.
• Ensure that the Verify Account step should be done in a completely new browsing session by copying the URL provided in the Verify Your Account dialog.
  • Recommend using Incognito mode (Google Chrome) or InPrivate mode (Microsoft Edge) as this serves as a new browsing session where the user should be redirected to IdP logon page to enter credential.
  • Always make sure an existing Incognito window is not already open and that the User has not already authenticated in SAC using a different logon token, as this may cause the Verify Account step to be successful even if SAML is not configured correctly.
• Ensure to use the same email ID on both SAC and IDP sides, matching the case exactly (See KBA 3430315).
• Ensure to use the HTTPS protocol for all endpoints, including SLO and SSO (See KBA 3639255).
• To use legacy Self Service SAML, the bundling process in Identity Provider Administration needs to be completed, or a different IdP can be used (See KBA 3719380).

• KBA : 2692774 - SAML self-service fails verifying the account with the custom identity provider in SAP Analytics Cloud
• KBA : 2833096 - Verify account with Custom SAML IDP fails in SAP Analytics Cloud (SAC) 
• KBA : 3461594 - Error "We were not able to verify your account. Check your login credential and try again" happened when click Verify Account for step 4 of configuring custom IDP in SAP Analytics Cloud (SAC)
• KBA : 2411608 - SAP Analytics Cloud SAML authentication configuration *** Collective KBA ***
• KBA : 2569847 - Where can you find user assistance (help) for SAP Analytics Cloud to use, configure and operate it more effectively? 
• KBA : 2487011 - What information do I need to provide when opening incidents with SAP Analytics Cloud (Hint: Use component LOD-ANA*)
• Ask a question on the SAP Community!
• SAP Analytics Cloud > Learning > Guided Playlists
• SAP Analytics Cloud > Learning > Guided Playlists > Getting Support

Your feedback is important to help us improve our knowledge base.

SAP Cloud for Planning, sc4p, c4p, cforp, cloudforplanning, EPM-ODS, Cloud for Analytics, Cloud4Analytics, CloudforAnalytics, Cloud 4 Planning, BOC, SAPBusinessObjectsCloud, BusinessObjectsCloud, BOBJcloud, BOCloud., SAC, SAP AC, Cloud-Analytics, CloudAnalytics, SAPCloudAnalytics, SAML, SSO, IdP, Verify, Account, enable, Authentication, AUT, uploadIdPMetadata , metadata , KBA , LOD-ANA-AUT , SAC Authentication / Login , Problem