The metadata file retrieved from the SAML 2.0 Configuration of ABAP System is of type "WSFED" and not the required "SAML2.0"

[Former Member]

Dear Guru's,

I'm trying to get Single Sign-On working between a Trusted Provider (CA Siteminder) and a Netweaver Gateway.

So far we went throught the tutorials to configure the Gateway so that it is linked with the Trusted Provider.

The guy responsible for the Trusted Provider then asked us to provide the metadata file of the Gateway.

We provided him the metadata file but when he is trying to load this metadata file into his system, it is complaining about the fact that it is a "WSFED" file instead of a "SAML 2.0".

Our metadata contains a node "m:RoleDescriptor"

<m:RoleDescriptor 
xsi:type="fed:ApplicationServiceType" 
protocolSupportEnumeration="http://docs.oasis-open.org/ws-sx/ws-trust/200512 http://schemas.xmlsoap.org/ws/2005/02/trust http://docs.oasis-open.org/wsfed/federation/200706" 
xmlns:fed="http://docs.oasis-open.org/wsfed/federation/200706" 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">

This is the only reference to WSFED we could find in the entire metadata file we downloaded form the configuration.

Does any of you has a clue what the possible problem could be?

Thanks

Kind regards

Jérémy

[Former Member · Accepted solution]

Hi all,

I found the solution,

Apparently when downloading the metadata we initially choosed the wrong options.

You have 3 checkboxes:

• Service Provider
• Application Service Provider
• Security Token Service

And we checked those 3 checkboxes when downloading the metadata. apparently the CA SiteMinder only needed the metadata where only the first checkbox needed to be checked:

• Service Provider

Hope I helped everybody out there with the same issue!

Have a nice day!

[TomVanDoo]

hmmm maybe a long shot:

1. Export the metadata of SAML2 Configuration of ABAP System (for import into the Identity Provider system). 

   For metadata export you need to access SAML2 Configuration of ABAP System using the reverse proxy's host and port (rather than directly).

   Click the link Metadata in the SAML2.0 UI and save the file in a target file location. 

   Alternatively, export SP metadata through the following URL: https://<proxy host>:<proxy port>/saml2/sp/metadata?sap-client=<ABAP_CLIENT>

Could that have anything to do with it?

source: Configuring SAML for Use in SAP Gateway - SAP Gateway Foundation (SAP_GWFND) - SAP Library

Was browsing through help pages for another question from a client...

[Former Member]

Thanks Tom but it didn't help.

The URL with al those SAP Notes you are referring to does not apply to our system.

Thanks!