3542912 - Failed to Verify Account after uploading metadata file when trying to enable Custom IdP in SAP Analytics Cloud (SAC)

• In step 4 of configuring custom IDP in SAC by following the steps in the SAC help guide, Enable a Custom SAML Identity Provider (Legacy Custom IdP) | SAP Help Portal, click the Verify Account button. The following error message pops up:
  • "Sorry, we've encountered an error during the account verification setup. Please try again later."
  • The error below can be seen in the web browser HAR trace:
    • errorDetails: [{message: "uploadIdPMetadata failed with 500 status", bUIMessage: false, bWarning: false}]

1. 1. 0: {message: "uploadIdPMetadata failed with 500 status", bUIMessage: false, bWarning: false}
      1. bUIMessage: false
      2. bWarning: false
      3. message: "uploadIdPMetadata failed with 500 status"
      4. message: "uploadIdPMetadata failed with 500 status"
      5. stack: ""
      6. status: 500

SAP Analytics Cloud 2024.21 

1. Login to SAC.
2. Go to System -> Administration -> Security.
3. Upload SAML IDP metadata.
4. Click Verify Account.
5. Notice that error happens.

• The error encountered during the account verification setup in SAC when configuring a custom IDP suggests a problem with the SAML IDP metadata processing. The specific error message "uploadIdPMetadata failed with 500 status" indicates that the server encountered an unexpected condition that prevented it from fulfilling the request. This is typically a server-side error, which in this context is likely due to the format or structure of the SAML metadata provided.
• In SAML configurations, metadata files describe the settings and capabilities of an Identity Provider (IdP) or a Service Provider (SP). The <EntitiesDescriptor> tag in the metadata file is used to encapsulate multiple <EntityDescriptor> elements, each representing a SAML entity. However, some systems, including possibly SAC, expect a single <EntityDescriptor> directly if only one IdP or SP is being configured. If the metadata file includes the <EntitiesDescriptor> tag, it might not be parsed correctly by the system, expecting only a single <EntityDescriptor>.

To fix the issue with the SAML IDP metadata, edit the metadata file by removing the <EntitiesDescriptor> tag at the beginning and the corresponding </EntitiesDescriptor> tag at the end. Ensure that the file contains only the <EntityDescriptor> tag without being enclosed within an <EntitiesDescriptor> tag.

• KBA 2692774 - SAML self-service fails verifying the account with the custom identity provider in SAP Analytics Cloud
• KBA 2833096 - Verify account with Custom SAML IDP fails in SAP Analytics Cloud (SAC) 
• KBA 3461594  - Error "We were not able to verify your account. Check your login credential and try again" happened when click Verify Account for step 4 of configuring custom IDP in SAP Analytics Cloud (SAC)
• KBA 2411608 - SAP Analytics Cloud SAML authentication configuration *** Collective KBA ***

SAML, SSO, authentication, SAP, Analytics Cloud, SAC, IdP, Metadata, 500, custom, configuration, HAR, verify, account, failed , KBA , LOD-ANA-AUT , SAC Authentication / Login , Problem