SAC LiveConnection SSO using SAML failes after linux migration

[#1]

Dear Community,

hope you might have an idea to the issue thats killing my brain since some time now.

We have a working SAC Live Connection Setup using SAML. The SSO experience for our enduser when using the SAC, this works fine and without issues on our windows systems.

As we currently plan a migration to linux application servers we encounter a problem here. When moving the AppServer to a Linux System we run into a strange SAML issue when trying to open the connections. We did not change anything regarding the authencation or saml process but live connections fail with a SAML Error

(a SAML Trace shows auth is called without problems all SAML returncodes look fine but

GET https://ourserver.com/sap/bw/ina/GetServerInfo?sap-client=001 401 (Unauthorized)

When calling the url by hand the Info shows without any problem or further authentication.

All Tests for the SAML Setup do work fine i can login - all saml traces are ok and don´t show any errors.

After switching back to the Windows AppServer the behaviour is back to normal and works as designed.

The only thing i found as an further error was the return telling me my browser does not support SPNEGO, but not sure if thats just an artifact of tracing.

I´d be pleased if you have an idea where to have a deeper look.

best regards

Peter

[reuscpe · Accepted solution]

Follow up on the topic. We were able to solve the issue by ourselfs.

Problem was located to our CORS file, we had the SAMESITE Cookie Rule missing in the cors file of the Linux Server.
The Errors showing were missleading and it took us some time to find the issue.

@Community If you run into the same issues, have a look at your CORS settings 😉

/FIN

[ShailendarAnugu]

Hi Peter,

I would advice you to. create ticket under LOD-ANA-LDC-BW component to investigate further.

thanks,

Shailu.

[ShailendarAnugu]

Hi Peter,

have you reconfigured the SAML after migration in BW system? because the certificates within metadata contains the hostnames and its certificates based on it.

if not, please redo the configuration.

Thanks,

Shailu.

[reuscpe]

Hey Shailu, thanks for your reply.

We are using virtual hostnames that move together with the instance (linux instance has the same name)

I still reconfigured everything and i get a CORS error now.

My CORS Setup includes already SAC to BW (as mentioned within the documentations) but seems like the 3 way here needs another cors rule?

Access to XMLHttpRequest at 'https://ourias.accounts.ondemand.com/saml2/idp/sso/ourias.accounts.ondemand.com?SAMLRequest=keystuff=http%3A%2F%2Fwww.w3.org%2F2001%2F04%2Fxmldsig-more%23rsa-sha256&Signature=sig' (redirected from 'https://oursac.eu10.sapanalytics.cloud/lcs/scc/mobile/BQ0LIVESSO/sap/bw/ina/GetServerInfo?sap-client=001') from origin 'https://oursac.eu10.sapanalytics.cloud' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

And do we need to set a cors ON the ias ?