SAC - Changing the User Attributes 'USER ID' to 'Custom SAML Mapping' - What's the impact?

[alexandru_negoescu]

Dear SAC Community,

I'm facing a big question with potential impact to plenty of SAC users (thousands).

I would like to change the User Attributes (Security area) the famous step 3 in SAC Administration > Security, from the current value which is USER ID (see screenshot) to "Custom SAML Mapping" (we are using our SAML/SSO implementation)

Why this change?

Simply because we have one user that has a different USER ID than the rest of us...

NameID in SAC (USER ID) is case sensitive. The NameID Mapping must match the values in SAML IdP exactly. For example, if the User ID returned by the SAML IdP is 'BOND007s' and the NameID used in SAP Analytics Cloud is 'BOND007S' the mapping will fail => user cannot authenticate.

The filed in SAC responsible for this is SAML_USER_MAPPING (not visible when using the USER ID - setup in SAC).

Solution

It seems that the solution is to use the option Custom SAML Mapping. Not difficult...could be done, but...

Problems I have if I change it:

1. I'm not sure the impact this could cause to the system and actual users deployed on SAC --- any idea?
2. There is any specific setup to be done after changing this setting?
3. Do you have any experience with this kind of situations?

Any guidance, help, ideas or tips are highly appreciated!

Best Regards

Alex

[anegoescu]

Hello all,

As solution here:

Even if we have done the necessary to make the UID and the SAML_SUBJECT uppercase - the assertion was working also correctly => uppercase, but SAC refused to let the user in.

Same symptoms as before, user does not exist in your system.

Solution: Contacting the Support SAP, they were able to see with the SAC operations teams and delete the user cache on the database (SAC side).

After this operation, the user was able to login without any problem.

Best Regards

Alex