3801193 - schedule publication fails with “you weren’t logged on to the remote data source automatically” (sap analytics cloud)

Symptom

Scheduling publications for stories based on BW live connection (with Advanced Features) fails.
Error in SAC: “Info: You weren’t logged on to the remote data source automatically. Please ask your administrator to verify the SAML Single Sign-On configuration for connection .”
Opening the story in “isSch=true” context can return “Error 404 - Not found” for the InA AUTH endpoint.
Connection and stories work without Advanced Feature configuration; issue happens only with scheduling/advanced features.

Environment

Product: SAP Analytics Cloud
SAC Live Data Connection HANA

Reproducing the Issue

Create or use a BW live data connection in SAC with Advanced Features enabled (scheduling).
Create a publication for a story using that connection and run it (manual or scheduled).
Observe the failure with the SAML SSO error during publication generation.
Optional: Open the same story with scheduling context (isSch=true) and observe a 404 for the InA AUTH endpoint.

Cause

Principal Propagation failing. In traces, the forwarded client certificate subject can be invalid (for example, ending with “@this-default-was-not-configured.invalid”) or not mapped to a backend user. This results from SAML/IdP attribute mapping and/or Cloud Connector subject pattern not producing a valid X.509 subject, and/or missing trusted reverse proxy settings between Web Dispatcher and the backend.

Resolution

Verify SAML attribute mapping in the IdP used by SAC so that required attributes (for example, email or user id) are present and not defaulted (no “@this-default-was-not-configured.invalid”). Refer to: 2789431 - After enabling custom SAML SSO… e-mails are overwritten with @unknown.org or @this-default-was-not-configured.invalid and 2519989 - How do I map Roles Using SAML Attributes in SAP Analytics Cloud?
Configure Principal Propagation subject patterns in SAP Cloud Connector so the generated certificate CN matches the backend user mapping (for example, CN=). Refer to: Configure subject patterns for principal propagation and 2727260.
In the backend (CERTRULE), import a sample certificate that reflects the SCC subject pattern (for example, CN=) and create a rule mapping CN to the backend user (Login With: User Name).
Establish trust for the reverse proxy path:
1. In the backend, set icm/trusted_reverse_proxy_ with the Subject/Issuer of the proxy client certificate (for example, Web Dispatcher or SCC). Refer to: 2052899 - ICM - Multiple Trusted Reverse Proxies and 3000086 - HttpHandleCertificate: intermediary is NOT trusted / 2805092 - Usage of icm/trusted_reverse_proxy_<x>.
2. Optionally import the Web Dispatcher client certificate into backend “SSL server Standard” (STRUST). Refer to: 3238733 - Import a Certificate Into STRUST PSE Certificate List.
Ensure the backend requests and accepts client certificates: set VCLIENT (icm/server_port_*) or icm/HTTPS/verify_client=1 as appropriate. Refer to: 2885371 - Ensure server prompts for client X.509 certificate.
Adjust SICF logon order for /sap/bw/ina/GetServerInfo so “Logon Using SSL Certificate” is first (alternative procedure). Refer to: 3137235 - “You were not automatically logged on…”.
Validate SAML endpoints: ensure /sap/saml2/sp/acs/ is accessible via the reverse proxy and (if applicable) ACS URL is set correctly. Refer to: 2848757 - SAML2 - Assertion Consumer Service - ACS URL.
Restart ICM to activate new parameters (SMICM → Administration → ICM restart) and re-test scheduling.

Keywords

sac schedule publication, you weren’t logged on to the remote data source automatically, saml sso, principal propagation, cloud connector, subject pattern, certrule, web dispatcher, icm trusted reverse proxy, vclient, getserverinfo 302, ina auth 404, acs url, ssl certificate logon, bw live advanced features , KBA , LOD-ANA-LDC-HAN , SAC Live Data Connection HANA , Problem

Product

SAP Analytics Cloud 1.0