How To Fix WSS022 - No trusted certificate for SAML authentication found (DN &1&2)

SAP Error Message - Details

• Message type: E = Error

• Message class: WSS - Web Services Security

• Message number: 022

• Message text: No trusted certificate for SAML authentication found (DN &1&2)

What causes this issue?

The system received a SAML assertion, which is not trusted by the SAP
system.

System Response

The system issues an error message and will not allow you to continue with this transaction until the error is resolved.

How to fix this error?

The SAML assertion (issuer &V3&) is using a X.509 certificate (&V1&&V2&)
for signing, which was not trusted by the SAP system. To trus the issuer
of the SAML assertion, obtain the certificate of the SAML issuer, and
import it into the System PSE.
Please ensure user mapping has been maintained. Please refer to the SAP
documentation and note 1254821.
SAML Issuer: &V3&
Certificate DN: &V1&&V2&
If you use report RSUSREXTID for maintaing the mapping, the following
information if usefull:
Type of External ID:SA
Prefix of External Name: &V4&
Name of Issuer: &V1&&V2&

Procedure for System Administrators

Error message extract from SAP system. Copyright SAP SE.

Smart SAP Assistant

• What is the cause and solution for SAP error message WSS022 - No trusted certificate for SAML authentication found (DN &1&2) ?

  Certainly! Here's a detailed explanation of the SAP error message:
  
  SAP Error Message:
  WSS022 No trusted certificate for SAML authentication found (DN &1&2)
  
  Cause:
  This error occurs when the SAP system attempts to perform SAML (Security Assertion Markup Language) authentication but cannot find a trusted certificate corresponding to the Distinguished Name (DN) provided in the SAML assertion. Essentially, the system is trying to validate the signature or trust the issuer of the SAML token but fails because the certificate used to sign the SAML assertion is not present or not trusted in the SAP system's certificate store.
  Common reasons include:
  
  The certificate of the Identity Provider (IdP) is not imported or trusted in the SAP system.
  The certificate has expired or been revoked.
  The DN in the SAML assertion does not match any trusted certificate in the SAP system.
  The certificate is imported but not assigned correctly to the SAML configuration.
  The certificate store or trust configuration is incomplete or corrupted.
  
  
  Solution:
  To resolve this error, follow these steps:
  
  
  Identify the DN in the error message:
  
  The error message will show the DN (Distinguished Name) of the certificate that the system is trying to find.
  
  
  Check the certificate in the SAP system:
  
  Go to transaction STRUST (Trust Manager).
  Verify if the certificate corresponding to the DN is imported under the correct PSE (Personal Security Environment), usually the SAML PSE or SSL client PSE.
  If the certificate is missing, import the correct certificate from the Identity Provider (IdP).
  
  
  
  Import the IdP certificate:
  
  Obtain the public certificate of the IdP that signs the SAML assertions.
  Import this certificate into the SAP system’s trust store (STRUST).
  Make sure to add it under the correct PSE used for SAML authentication.
  
  
  
  Verify certificate validity:
  
  Check if the certificate is valid (not expired or revoked).
  If expired, request a new certificate from the IdP and import it.
  
  
  
  Check SAML configuration:
  
  In transaction SAML2, verify the configuration of the Identity Provider.
  Ensure the certificate is assigned correctly to the IdP configuration.
  Re-import or update the metadata if necessary.
  
  
  
  Restart or refresh services:
  
  After importing the certificate, restart the relevant services or perform a cache refresh to ensure the new certificate is recognized.
  
  
  
  Test SAML authentication again:
  
  Try the SAML login or authentication process to confirm the issue is resolved.
  
  
  
  
  Related Information:
  
  
  Transactions:
  
  STRUST – Manage certificates and PSEs.
  SAML2 – Configure SAML 2.0 authentication.
  SMICM – To restart ICM if needed.
  
  
  
  SAP Notes:
  
  Check SAP Notes related to SAML configuration and certificate management.
  Example: SAP Note 1799611 - "SAML 2.0: How to configure SAML 2.0 in SAP NetWeaver AS ABAP"
  
  
  
  Documentation:
  
  SAP Help Portal: SAML 2.0 Configuration Guide.
  SAP Security Guide for SAML authentication.
  
  
  
  Additional Tips:
  
  Always ensure the system clocks of the SAP system and IdP are synchronized to avoid token validity issues.
  Use the SAML trace tools or logs to get more details on the authentication failure.
  If using metadata files for IdP configuration, ensure they are up to date.
  
  
  
  
  Summary:
  The error WSS022 No trusted certificate for SAML authentication found (DN &1&2) means the SAP system cannot find or trust the certificate used by the IdP for SAML authentication. The solution is to import and trust the correct IdP certificate in the SAP system’s trust store (STRUST) and ensure the SAML configuration is correct.
  
  If you need help with specific steps or commands, feel free to ask!