bug in XS Admin tool makes SAML break ?

[holger_brasch]

Hi community,

need your help today. We have latest HANA revision and have observed the following:

We have BO environments connected to HANA via SAML SSO with specific SAML provider names.

In the past the following parameter saml_service_provider_name located in the indexserver.ini file was empty by default and SAML worked ok.

With latest XS Admin tool we have observed the following behavior:

1.) saml_service_provider_name is empty

2.) access the tab "SAML Service provider" and realize the tool suggests a default service provider [SID][instance no.] eg. HDB23
3.) check parameter saml_service_provider_name located in the indexserver.ini and you will see that the entry is updated with "HDB23"

4.) as a result SAML is broken from BO CMC with generic error message:

Connection Failed: The test of the HANA SSO ticket used to log onto the HANA DB has failed due to:
[10]: invalid username or password. (FWM 02133)

Any ideas how to stop that? A write protection applied to the ini file is not an option btw 🙂

There is a note out there but it is not connected to the HANA XS Admin tool:
Note 1987828:SAML SSO between HANA and BI failed with errors

Best regards, Holger

Message was edited by: Tom Flanagan

[holger_brasch · Accepted solution]

... got the explanation today from development and also a SAP note in lightspeed :

2127582 - SAML SSO between HANA SP09 and BI fails with error:
Assertion is not intended for this ser...

Hope that helps others in future.

Thanks colleagues, Holger

[former_member235355 · Accepted solution]

Fantastic. Just got through all of the configuration for getting SSO via OpenSSL working only to encounter this exact issue. Thanks for posting the solution.