topic Re: SAProuter: in Application Development and Automation Discussions

SAProuter:

daphneo — Thu, 15 Sep 2022 15:15:25 GMT

We are trying to connect to our SAP Server via SAProuter using a 3rd party app.

There's a SAProuter instance running on the SAP side, and one running on the 3rd party app side.

Certificates have been exchanged between the two.

If we connect from the 3-rd party server directly to the SAP router (i.e. not using the SAProuter on the 3-rd party server), then it works.

But when we try connecting like:

/H/3rd-party_ip/H/SAProuter/H/SAP IP then it fails with error:

GSS-API(maj): No credentials were supplied

Could't acquire ACCEPTING credentials for

Now normally this will indicate the certificates does not match up.

Here's the funny thing:

The saprouter on the SAP server's side is starting with the following params. Note the cert name:

SAP Network Interface Router, Version 40.4

command line arg 0: C:\SAP\saprouter\saprouter.exe

command line arg 1: -r

command line arg 2: -W

command line arg 3: 60000

command line arg 4: -R

command line arg 5: C:\SAP\saprouter\saprouttab

command line arg 6: -K

command line arg 7: p:CN=XYZRPDMZ01P, OU=0001152479, OU=SAProuter, O=SAP, C=DE

That is also the certificate name installed on the 3rd party server.

But when we connect the error is as below.

Note the target certificate name. Why is the target this name (the sapserv2 cert) since neither of the SAProuters are starting up with this name?

*** ERROR => SncPEstablishContext() failed for target='p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE' [D:/depot/b 3638]

*** ERROR => SncPEstablishContext()==SNCERR_GSSAPI [D:/depot/bas/75 3604]

GSS-API(maj): No credentials were supplied

Unable to establish the security context

target="p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE"

<<- SncProcessOutput()==SNCERR_GSSAPI

*** ERROR => NiSncIInitHdlSecurity: SncProcessOutput failed (sncrc=-4;000000F576ABA730) [nisnc.c 1202]

*** ERROR => NiSncHandleForAddr C10/-1, 194.39.xyz.xx (rc=-17) [nirout.cpp 4130]

*** ERROR => NiRClientHandle: NiRExRouteCon for C10/-1 'zasmapxyz.ogl.int' failed (rc=-17) [nirout.cpp 3489]

*** ERROR => SncPAcquireCred()==SNCERR_GSSAPI [D:/depot/bas/75 1465]

GSS-API(maj): No credentials were supplied

Could't acquire ACCEPTING credentials for

name="p:CN=XYZRPDMZ01P, OU=0001152479, OU=SAProuter, O=SAP, C=DE"

<<- SncProcessInput()==SNCERR_GSSAPI

*** ERROR => NiSncIProcIn: SncProcessInput failed (sncrc=-4;000000F576ABA730;1789) [nisnc.c 1003]

*** ERROR => NiSncIProcOpcode: NiSncIProcIn failed (rc=-17) [nisnc.c 337]

*** ERROR => NiBufIIn: NiBufIProcMsg failed (rc=-17) [nibuf.cpp 2828]

*** ERROR => NiBufReceive C11/-1 '52.169.123.456 failed (rc=-17) [nirout.cpp 3326]

Re: SAProuter:

Isaias_SAP — Thu, 15 Sep 2022 19:28:30 GMT

Hello Daphne,

Can you clarify the saprouter string used when the issue happens?

/H/3rd-party_ip/H/SAProuter/H/SAP IP

Is it like:

/H/SAProuter at 3rd-party_ip/H/SAProuter at your end/H/SAP server IP

You have also mentioned "That is also the certificate name installed on the 3rd party server.".

Is the same certificate used at both saprouters? Each saprouter should have its own certificate...

Regards,

Isaías

Re: SAProuter:

daphneo — Thu, 15 Sep 2022 20:58:02 GMT

Hi Isaias.

Yes, the router string you have is as is when it fails: /H/SAProuter at 3rd-party_ip/H/SAProuter at your end/H/SAP server IP. (this is being run from the 3-party's server).

And also, yes, both SAProuter have it's own SAProuter. What was meant is that at our end (SAP App Server side), we are starting saprouter with -K CN=XYZRPDMZ01P, OU=0001152479, OU=SAProuter, O=SAP, C=DE.

That is the certificate given to and installed at the 3-rd party. We have installed their certificate our side (different name).

What I'm not getting is why it complains about sapserv2 certificate:

Unable to establish the security context

target="p:CN=sapserv2, OU=SAProuter, O=SAP, C=DE"

Re: SAProuter:

Isaias_SAP — Thu, 15 Sep 2022 23:40:30 GMT

Hello Daphne,

Thank you for the confirmation / clarification.

Where exactly do you see the

GSS-API(maj): No credentials were supplied
Could't acquire ACCEPTING credentials for

error?

Is the 3rd-party application (not the saprouter at the 3rd-party server) connecting to SAP using SNC too?

Because then there are two SNC trusts / tunnels / connections involved.

The 3rd-party app will establish an SNC "tunnel" directly with the SAP system, not with any of the saprouters.

The two saprouters will establish an SNC "tunnel" between them.

So, we will have two independent SNC tunnels, one going within another.

Regards,

Isaías