3805962 - Error 'Failed to retrieve SAML assertion from Identity Provider' when creating SAP SuccessFactors connection in SAP Datasphere

When creating an SAP SuccessFactors connection in Datasphere, the following error message is displayed:

--------------------------------------------------------

Connection "XXXX" couldn’t be created.
We can provide the following information to assist either you or an SAP engineer to solve the issue:

Correlation ID: XXXXXXXXXX
HTTP Status: 500 error
Error Code:
Technical Message: Failed to retrieve SAML assertion from Identity Provider. Verify the IdP configuration in the connection settings.

---------------------------------------------------------

When configuring the connection, select "OAuth 2.0" for Authentication Type and set Configure Identity Provider to "true" (Dynamic Generation of SAML Assertions).

"Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental."  

SAP Datasphere

1. Select SAP SuccessFactors connection type.
2. Enter the connection details, choose OAuth 2.0 for Authentication Type, and set Configure Identity Provider to true. 
3. Click the "Create Connection" button.

Incorrect Identity Provider (IdP) configuration in the connection settings. 

Please review the prerequisites in the following guides:

• How to create a SAP SuccessFactors Connection - OAuth 2.0 (with IdP) | SAP Help Portal
• Configuring Dynamic Generation of SAML Assertions for SAP SuccessFactors Connections | SAP Help Portal

(1) Verify the IdP settings 1-6 are correct.

1. IdP Token Endpoint: https://<IAS tenant host>/oauth2/token.  IAS tenant host obtained from Step 1: How to register Identity Authentication as OAuth2 Client Application in SAP SuccessFactors → Section 1.
2. IdP Client ID: Obtain from Step 2: Create and configure an OpenID Connect (OIDC) Application in Identity Authentication → Section 2.(d)
3. IdP Client Secret: Obtain from Step 2: Create and configure an OpenID Connect (OIDC) Application in Identity Authentication → Section 2.(d)
4. IdP User Identifier: Obtain from Step 1: How to register Identity Authentication as OAuth2 Client Application in SAP SuccessFactors → Section 1
5. IdP User Password: Obtain from Step 1: How to register Identity Authentication as OAuth2 Client Application in SAP SuccessFactors → Section 1
6. IdP Dependency Name: Obtain from Step 3: Create and Configure a SAML 2.0 Application in Identity Authentication → Section 3.(3)

(2) Test the token retrieval directly with a command line client (curl):

---------------------------------------------------------

curl -X POST "https://<IAS-tenant-host>/oauth2/token" -H "Content-Type: application/x-www-form-urlencoded" -u "<Idp Client ID>:<Idp Client Secret>" -d "grant_type=password&username=<Idp User identifier>&password=<Idp User password>&token_format=saml2&response_type=token"

---------------------------------------------------------

• Interpret curl result: 
  • "301 Moved Permanently" indicates an incorrect token endpoint; 
  • "Client authentication failed" indicates client ID/secret issues; 
  • "User authentication failed" indicates user credential issues; 
  • other errors may occur depending on configuration. 
• If the curl command succeeds and returns an access token, please open a support ticket to SAP under component DS-DI-CON. 

• How to create a SAP SuccessFactors Connection - OAuth 2.0 (with IdP) | SAP Help Portal
• Configuring Dynamic Generation of SAML Assertions for SAP SuccessFactors Connections | SAP Help Portal

SuccessFactors, OAuth, SAML, Dynamic Generation of SAML Assertions , KBA , DS-DI-CON , Connections , Problem