How To Fix ICF_SYSTEM_LOGIN201 - SSO logon not possible; invalid host name for issuing cookie

SAP Error Message - Details

• Message type: E = Error

• Message class: ICF_SYSTEM_LOGIN - Messages for System Logon

• Message number: 201

• Message text: SSO logon not possible; invalid host name for issuing cookie

What causes this issue?

To enable the Web browser to send the MYSAPSSO2 cookie to the server
after it is issued, the URL must include a fully qualified domain name
(FQDN).

System Response

The system issues an error message and will not allow you to continue with this transaction until the error is resolved.

How to fix this error?

Call the logon with a fully qualified domain name.
Define the profile parameter <ZK>icm/host_name_full</> with a fully
qualified domain name.
See Note 654982 <zk>URL Requirements due to Internet Standards</>.

Procedure for System Administrators

Error message extract from SAP system. Copyright SAP SE.

Smart SAP Assistant

• What is the cause and solution for SAP error message ICF_SYSTEM_LOGIN201 - SSO logon not possible; invalid host name for issuing cookie ?

  The SAP error message ICF_SYSTEM_LOGIN201 indicates that there is an issue with Single Sign-On (SSO) logon due to an invalid host name for issuing cookies. This typically occurs when the system is unable to validate the hostname used in the SSO configuration against the hostname of the server where the SAP system is running.
  Cause:
  
  Mismatch in Hostname: The hostname configured for the SSO is different from the actual hostname of the SAP server. This can happen if the hostname is incorrectly set in the SSO configuration or if there are DNS issues.
  Cookie Domain Issues: The domain specified for the cookie may not match the domain of the SAP system, leading to cookie rejection.
  SSL Configuration: If SSL is enabled, there may be issues with the SSL configuration that prevent proper cookie handling.
  Network Configuration: Network settings or firewall rules may be affecting the ability to issue or receive cookies.
  
  Solution:
  
  
  Check Hostname Configuration:
  
  Verify the hostname configured in the SSO settings. Ensure it matches the actual hostname of the SAP server.
  You can check the hostname in the SAP system using transaction SM51 or SICF to see the active services and their hostnames.
  
  
  
  Update SSO Configuration:
  
  If you are using a third-party identity provider (IdP), ensure that the IdP is configured with the correct hostname.
  Update the SSO configuration in the SAP system to reflect the correct hostname.
  
  
  
  Cookie Domain:
  
  Ensure that the cookie domain is set correctly. It should match the domain of the SAP system.
  Check the settings in the SSO configuration for the cookie domain and adjust as necessary.
  
  
  
  SSL Configuration:
  
  If SSL is being used, ensure that the SSL certificates are correctly installed and configured.
  Check the SSL settings in the SAP system and ensure that they are compatible with the SSO setup.
  
  
  
  Network and Firewall Settings:
  
  Verify that there are no network issues or firewall rules that could be blocking cookie transmission.
  Ensure that the necessary ports are open and that there are no proxy issues.
  
  
  
  Testing:
  
  After making changes, test the SSO functionality to ensure that the issue is resolved.
  Use browser developer tools to check for any cookie-related errors in the console.
  
  
  
  Related Information:
  
  SAP Notes: Check for any relevant SAP Notes that may provide additional guidance or updates related to SSO and this specific error message.
  Documentation: Review the SAP documentation on configuring SSO, especially if you are using a specific authentication method (e.g., Kerberos, SAML).
  Logs: Check the SAP system logs (transaction SM21) and the ICF logs for any additional error messages that may provide more context on the issue.
  
  By following these steps, you should be able to identify and resolve the issue causing the ICF_SYSTEM_LOGIN201 error.