3758870 - SAML Login Failures Due to Email Case Mismatch Between IdP and SAP Analytics Cloud (SAC)

The following behavior occurs in SAP Analytics Cloud (SAC):

• Users experience SAML authentication failures on subsequent login attempts when email addresses have case mismatches between SAP Analytics Cloud (SAC) and the Cloud Identity Provider (IdP). 
• This occurs because SAC automatically updates user email addresses to match the IdP format during first login, causing a mismatch with the configured SAML subject name identifier. 

• SAP Analytics Cloud Enterprise

SAP Analytics Cloud is configured to use 'email' as the subject name identifier in SAML authentication. The issue arises when:

1. A user is created in SAC with a lowercase email (e.g., user.user@example.com)
2. During first SAML login, the IdP returns the email in CamelCase format (e.g., User.User@example.com)
3. SAC automatically updates the user's email field to match the IdP format
4. On subsequent login attempts, the nameID and email fields no longer match
5. SAML authentication fails because the tenant requires nameID and email to be identical

The root cause of the issue remains that the nameID and the email in the SAML are different. 

Since the tenant is configured for ‘email’ as the subject name identifier, nameID and email are required to match.

There are two ways to solve the issue:

1. Change from using ‘email’ as the subject name identifier to using ‘custom’. This will decouple the email field from the nameID.
2. Update the SAML assertion being sent to have matching nameID and email.

• KBA 2569847 - Where can you find SAC user assistance (help) to use, configure, and operate it more effectively?
• KBA 2487011 - What information do I need to provide when opening a case for SAP Analytics Cloud?
• KBA 2511489 - Troubleshooting performance issues in SAP Analytics Cloud
• SAP Analytics Cloud Connection Guide
• SAP Analytics Cloud Get More Help and SAP Support
• Need More Help? Contact Support 

Your feedback is important to help us improve our knowledge base.

SAP Cloud for Planning, sc4p, c4p, cforp, cloudforplanning, Cloud for Analytics, Cloud4Analytics, CloudforAnalytics, Cloud 4 Planning, BOC, SAPBusinessObjectsCloud, BusinessObjectsCloud, BOBJcloud, BOCloud., SAC, SAP AC, Cloud-Analytics, CloudAnalytics, SAPCloudAnalytics,Error, Issue, System, Data, User, Unable, Access, Connection, Sac, Connector, Live, Acquisition, Up, Set, setup, Model, BW, Connect, Story, Tenant, Import, Failed, Using, Working, SAML, SSO, sapanalyticscloud, sap analytical cloud, sap analytical cloud, SAC, sap analyst cloud, connected, failure, stopped, sap analyst cloud, predictive analytics (analysis), data analysis (analytics) tools, analytics tools, sap analytics cloud, data literacy, advanced analytics, data democratization, analytics software, real time analytics, self service analytics, advanced data analytics, analytics as a service, analytics cloud / cloud analytics, saas analytics, cloud bi, enterprise planning, cloud data analytics, cloud based analytics, analytics cloud platform, modern analytics, real time analysis, cloud analytics solution(s), what is sap analytics cloud, cloud analytics tools, analytics in the cloud, cloud analytics software epm, business intelligence, sap analyst cloud,sac hot news sac kba  , KBA , LOD-ANA-AUT , SAC Authentication / Login , Problem