How To Fix SAML2020 - The user account of IDP [&1] is not yet federated in system &2 (&3)

SAP Error Message - Details

• Message type: E = Error

• Message class: SAML2 - SAML2 Nachrichten

• Message number: 020

• Message text: The user account of IDP [&1] is not yet federated in system &2 (&3)

What causes this issue?

The user account from the identity provider is not federated in the
local system.

System Response

No federation found.

How to fix this error?

Log on with a local user in the system and activate the option for
federation. At the next logon, this information is used to federate the
identity provider account directly with the local account.

Procedure for System Administrators

The system issues an error message and will not allow you to continue with this transaction until the error is resolved.

Error message extract from SAP system. Copyright SAP SE.

Smart SAP Assistant

• What is the cause and solution for SAP error message SAML2020 - The user account of IDP [&1] is not yet federated in system &2 (&3) ?

  The SAP error message SAML2020 indicates that there is an issue with the federation of a user account from the Identity Provider (IDP) in the SAP system. Specifically, it means that the user account from the IDP has not been properly federated or mapped to a corresponding user account in the SAP system.
  Cause:
  
  User Not Federated: The user account from the IDP has not been set up in the SAP system. This can happen if the user has not been created in the SAP system or if the federation settings are not correctly configured.
  Configuration Issues: There may be issues with the SAML configuration, such as incorrect settings in the Service Provider (SP) or IDP configurations.
  User Mapping: The mapping between the IDP user attributes and the SAP user attributes may not be correctly defined, leading to the system not recognizing the user.
  
  Solution:
  
  Create User in SAP: Ensure that the user account from the IDP exists in the SAP system. You may need to create the user manually or ensure that the provisioning process is working correctly.
  Check Federation Configuration: Review the SAML configuration settings in both the IDP and the SAP system. Ensure that the SAML assertions are correctly configured and that the user attributes are being sent correctly.
  User Mapping: Verify the user mapping settings in the SAP system. Ensure that the attributes sent by the IDP (like email, username, etc.) match the attributes expected by the SAP system.
  Test SAML Configuration: Use tools or logs to test the SAML configuration and see if the assertions are being sent correctly. Check for any errors in the logs that might indicate what is going wrong.
  Consult Documentation: Refer to the SAP documentation for SAML configuration and federation to ensure that all steps have been followed correctly.
  
  Related Information:
  
  SAML (Security Assertion Markup Language): A standard for exchanging authentication and authorization data between parties, particularly between an IDP and a Service Provider (SP).
  Identity Provider (IDP): The system that provides user authentication and identity information.
  Service Provider (SP): The system that provides services to users and relies on the IDP for authentication.
  SAP Notes: Check for any relevant SAP Notes or Knowledge Base Articles (KBAs) that may address this specific error or provide additional troubleshooting steps.
  
  If the issue persists after following these steps, it may be beneficial to consult with your SAP Basis team or reach out to SAP support for further assistance.