"Error while generating Service Provider metadata" when exporting SAML2 Metadata

Products

• Network Observability

Issue/Introduction

When you attempt to export SAML2 Service Provider metadata using the SsoConfig utility in DX NetOps, the export fails. You see the following error in the terminal: Error while generating Service Provider metadata

Additionally, the SSOService.log or terminal output may contain: Service Provider ID can not be null or empty

Environment

• DX NetOps Performance Management (all versions)
• SAML 2.0 Authentication configuration

Cause

1. Incorrect Entity ID Format: The saml.sp.metadata.entityId in the saml.properties file is configured with a full FQDN or an IP address, but the generator requires a shortname.
2. Missing Absolute Path: The export utility requires a full absolute directory path for the filename, rather than just a filename.

Resolution

1. Log in to the NetOps Portal server as the root or install user.
2. Navigate to the SSO configuration directory: cd /opt/CA/PerformanceCenter/sso/webapps/sso/configuration/
3. Open the saml.properties file for editing.
4. Locate the saml.sp.metadata.entityId property and update it to the shortname of the server.
   • Incorrect: saml.sp.metadata.entityId=####.ww.xx.yyy.zzz
   • Correct: saml.sp.metadata.entityId=####
5. Ensure the saml.sp.metadata.hostname property is set to the full FQDN of the Portal server.
   • Correct: saml.sp.metadata.hostname=####.ww.xx.yyy.zzz
6. Save the file and run the SsoConfig utility.
7. Navigate to DX NetOps > Export SAML2 Service Provider Metadata.
8. When prompted to Enter a valid filename, provide a full absolute path.
   • Example: /opt/ssometadata.xml
9. The utility generates the metadata file at the specified location.

Additional Information

 For full SAML 2.0 configuration steps, refer to the SAML 2.0 Authentication in Single-Sign On documentation.