3768376 - Getting HTTP Status 500 – Internal Server Error when trying to log on to SAP Analytics Cloud (SAC) tenant via legacy custom IdP

• Getting HTTP Status 500 – Internal Server Error when trying to log on to SAP Analytics Cloud (SAC) tenant via legacy custom IdP
• The following error could be observed in HAR file:
  • Request URL: https://<SAC FQDN>/sso/login/callback?error=access_denied&error_description=Invalid+status+%5Burn%3Aoasis%3Anames%3Atc%3ASAML%3A2.0%3Astatus%3AResponder%5D+for+SAML+response+<...> 
  • Response:
    • Status:500
    • Content: Internal Server Error

• SAP Analytics Cloud (Enterprise Edition), running on Cloud Foundry (CF)
• Legacy Custom IdP enabled (see SAC Help)

1. Access SAC tenant which has legacy custom IdP enabled.
2. Enter credential in IdP logon page.
   • Error happens when redirecting back to SAC

• In the HAR file, you may find another reqeust https://<...>.authentication.us10.hana.ondemand.com/saml/SSO/alias/<...> which contains SAML response.
• By decoding the SAML response, you could find the following information
  

      <samlp:Status>
          <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder"/>
          <samlp:StatusMessage>
              Unable to verify the signature
          </samlp:StatusMessage>
      </samlp:Status>

• It means that  the custom IdP rejects the SAML request including a new X509Certificate, which is different from the previous X509Certificate uploaded with SAC SAML metadata into IdP (even though that it has not yet expired).

SAP Development will investigate why a new X509Certificate is sent in the SAML request.

Workaround:

1. Download new SAC SAML metadata from <tenantName>.authentication.<datacenter>.hana.ondemand.com/saml/metadata 
   • e.g. tenant URL companyA.us10.sapanalytics.cloud would use companyA.authentication.us10.hana.ondemand.com/saml/metadata
2. Update the new SAC SAML metadata into your IdP

• KBA: 2734550 - HTTP status 500 - Internal Server Error when logging out from SAP Analytics Cloud (SAC) with custom SAML Identity Provider enabled
• KBA: 2625235 - HTTP Status 500 – Internal Server Error in SAP Analytics Cloud (SAC)
• KBA: 2569847 - Where can you find SAC user assistance (help) to use, configure, and operate it more effectively?
• KBA: 2487011 - What information do I need to provide when opening an case for SAP Analytics Cloud?
• Have a question? Ask it here and let our amazing SAP community help! Or reply and share your knowledge!
• Need More Help? Contact Support or visit the solution finder today!

Your feedback is important to help us improve our knowledge base.

SAP Cloud for Planning, sc4p, c4p, cforp, cloudforplanning, EPM-ODS, Cloud for Analytics, Cloud4Analytics, CloudforAnalytics, Cloud 4 Planning, BOC, SAPBusinessObjectsCloud, BusinessObjectsCloud, BOBJcloud, BOCloud., SAC, SAP AC, Cloud-Analytics, CloudAnalytics, SAPCloudAnalytics, directory, error, 500, logoff, logout, exit, saml, saml2, saml, sso, Cloud-Analytics,  slo, acs, log out, log in，access_denied，/sso/login/callback, Unable to verify the signature , KBA , LOD-ANA-AUT , SAC Authentication / Login , Problem