3648446 - Troubleshooting SAML2 Federation / NameID errors with configuration examples

After a successful authentication to the Identity Provider (IDP), user is redirected back to SAP but gets an "401 Not authorized" error screen, a logon screen, or a logon popup.

On a Security Diagnostic Tool trace, errors such as below are found:

• Federation error: Format '<format>' is not supported for user assignment.
• Federation error: No user with email '<username>' found.
• User source <email_address> is longer than maximum length of a user name: 12  characters.
• Federation error: <email_address> does not exist in client <client_number>.

There's a requirement to understand how the Name ID configuration interacts between ABAP server side (transaction SAML2) and IDP.

"Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental."

• SAP NetWeaver
• ABAP platform

SAML2, Federation, Name ID, NameID, Format is not supported for user assignment, No user with email found, User source is longer than maximum length of a user name: 12  characters, email does not exist in client, 401, Not Authorized, logon screen, User Id Source, Assertion Subject Name Id, Assertion Attribute , KBA , BC-SEC-LGN-SML , SAML 2.0 for ABAP , BC-IAM-IDS , Identity Authentication Service , How To