3654917 - analysis office single sign-on (sso) connection failure to hana

• Single Sign-On (SSO) connection from Q system to HANA generates a login panel for the user.
• Error message displayed: "Analysis Office currently is not able to establish a connection."
• Error details from logs: "The remote server returned an error: (401) Unauthorized."
• Works as expected in production environment 
• Assertion authentication for user  failed with reason: ptime::PtimeException
• InternalError: dberror(CallableStatement.execute): 129 - transaction rolled back by an internal error: Remote Source is not accessible: Cannot open database requested by the login. The login failed. 

Security & User Management
SAP Analysis for Microsoft Office 2.8 

1. Attempt to connect Analysis Office to Q using SSO authentication.
2. Observe that a login panel is displayed instead of automatic authentication.
3. Review error message: "Analysis Office currently is not able to establish a connection."

• Missing role assignment in the Quality Assurance environment for users experiencing the issue. Specifically, the role `sap.bc.ina.service.v2.userRole::INA_USER` was not assigned.
• Potential misalignment in configuration settings between production and quality assurance ENVIRONMENTS, including SAML Identity Provider and Kerberos settings.
• Time zone discrepancies may also contribute to authentication failures.

1. Assign the missing role `sap.bc.ina.service.v2.userRole::INA_USER` to affected users in the Quality Assurance environment.
2. Verify and align configuration settings between  production and quality assurance ENVIRONMENTS:

• Ensure the SAML Identity Provider matches the production configuration.
• Confirm Kerberos settings are consistent across environments.

      3. Review and align time zone settings for the HANA database and client machines. Refer to SAP documentation for time zone alignment:

• [Time Zone Support | SAP Help Portal](https://help.sap.com/docs/SAP_S4HANA_ON-PREMISE/7f05ca069f8744759f48892c6d307fab/e62db853dcfcb44ce10000000a174cb4.html).

       4. If the issue persists, reproduce the error and collect the following information:

• Full system info dump for both the SYSTEM DB and Tenant DB.
• Debug-level tracing logs for authentication components.
• System date and time of issue reproduction.
• User name used during reproduction.

Refer to SAP Knowledge Base Articles for additional troubleshooting steps:

• 2621384 - SAML SSO not working with Analysis for Office; prompts for login( https://me.sap.com/notes/2621384 ).
• 2472944 - FAQ: Single Sign-On errors using SAML, Kerberos, X.509 and Analysis for Office( https://me.sap.com/notes/2472944).
• 3642107 - Assertion authentication for user failed with reason: ptime::PtimeException ( https://me.sap.com/notes/3642107).

analysis office, sso failure, hana connection, unauthorized error, 401 error, edw_qas, edw_prd, sap hana, single sign-on, sap.bc.ina.service.v2.userRole::INA_USER, kerberos settings, saml identity provider, time zone alignment, authentication error , KBA , HAN-DB-SEC , SAP HANA Security & User Management , BI-RA-AO-XLA , Excel Addin , Problem