3347581 - Error "Response doesn't have any valid assertion which would pass subject validation" encountered at verify account step when configure custom SAML IDP in SAP Datasphere

Got error "Response doesn't have any valid assertion which would pass subject validation" at verify account step when configure custom SAML IDP in Datasphere.

• SAP Datasphere

1. Login to customer Datasphere tenant.
2. Go to System-> Administration->Security.
3. Click edit and upload the IDP metadata in Step 2.
4. Click verify account in step 4. 
5. Notice that error "Response doesn't have any valid assertion which would pass subject validation" happens.

The attribute "Groups" is not set to "sac" in IDP.

Based on the step 7 in the help guide: Enabling a Custom SAML Identity Provider, the attribute "Groups" need to be set to "sac" in IDP, although it is Datasphere.

KBA , DS-AUT , Authorizations (Locks, etc.) , Problem