Question Re: S Number Changed - Cannot Log Into CAL in Technology Q&A

S Number Changed - Cannot Log Into CAL

hardyp180 — Tue, 16 Jun 2015 11:07:33 GMT

Hello!

My old S Number expired and I have a new one. However when I try to log into the CAL website using either number (via certificate) I get told I have been authenticated, and then some gobbledegook about not being able to access the "tenant" until I have been approved and....

"after a while you will be allowed access but we will not tell you when, you have to guess" - honestly that is what it says, and...

"please contact the tenant administrator" with no instructions on how to do so.

Does this seem normal behaviour for any sort of website to everyone else? Am I crazy for thinking this is strange?

Has anyone had a similar experience? Does anyone know how to contact the elusive tenant administrator?

Here in Australia the phone company Telstra made certain no-one could ever contact them by not allowing email queries and making sure you had to wait two hours on the phone before you could talk to anyone. I think the ombudsman forced them to buck up their ideas.

Cheersy Cheers

Paul

Re: S Number Changed - Cannot Log Into CAL

stanimir_eisner — Tue, 16 Jun 2015 12:13:54 GMT

Hello Paul,

Your SAP CAL tenant is owned by your old S-user and only this user, actually the tenant administrator, can approve access requests coming from other users. Can you login SAP CAL with your old S-user?

Due to security and data privacy reasons we do not expose the contacts of our users. If you want to get access to the tenant of somebody else you should know how to contact him.

Best regards,

Stanimir

Re: S Number Changed - Cannot Log Into CAL

hardyp180 — Tue, 16 Jun 2015 22:19:41 GMT

Hello,

As I said I tried logging in using both S numbers i.e. the very first thing I tried was using the certificate for my old S number as I reasoned that S number was linked to my account so that was the one to used.

I only tried the other S number when the first one failed. I think the problem is that the original S number has expired i.e. I cannot use it for the SAP support portal any longer, or SCN.

Just to be clear about this:-

A "tenant administrator" is someone who has set up an account on the CAL?

I presume when the message "you have been authenticated" comes up it does not actually mean "you have been authenticated" but rather that "an attempt will be made to authenticate you".

I just tried pressing "cancel" when the list of two certificates came up, but I still got the "you have been authenticated" message and the confusing message about tenants.

How can I get to a screen where I can set up a new account using my new S number? How can I kill the old account?

Typing in cal.sap.com in a web browser just starts the automatic "authentication" process.

Cheersy Cheers

Paul

Re: S Number Changed - Cannot Log Into CAL

stanimir_eisner — Wed, 17 Jun 2015 06:23:38 GMT

Hello Paul,

When you login https://cal.sap.com for the first time you automatically get a new tenant dedicated to your user who become the first and only tenant administrator. You can differ the tenants by the tenant ID in the URL. For more information see https://cal.sap.com/res/doc_en/frameset.htm?729e7cfaa8c84423b89ba81b0a7ff974.html

So login htpps://cal.sap.com with your new S-user and you'll be able to create a new account in your new tenant.

The best way to delete your old account is to login with your old S-number. Could you try to login with user and password as the problem could be in the client certificate? Please use a private window to avoid the automatic login with the client certificate. Also you could report an incident to let the colleagues from SAP ID Service look at the login problem.

Alternatively you can go to the AWS Management Console and terminate your old instances from there.

Best regards,

Stanimir

Re: S Number Changed - Cannot Log Into CAL

hardyp180 — Wed, 17 Jun 2015 11:22:38 GMT

Everything is working now.

Clicking on your link above took me into the CAL without the automatic login, whereas if I typed the exact same ting into a browser I got the automatic login.

I arrived on a blank white page, and pressed the "login" button. I chose my new S number certificate, and I was authenticated using my "P" number from the SCN.

Then I chose a "solution" and then was able to start to create an account, then I went to AWS and created a new access key, and used that .to complete the creation of the account, then I could activate the solution, my "P" number appeared against the solution, all good.

I then deleted my old AWS access key for good measure.

Thanks for trying to help me I really appreciate it.

Going into my AWS account let me see once again a really good example of how such a web application should be, very intuitive, everything obvious and easy to understand. I can't honestly say the same for the CAL site!

Cheersy Cheers

Paul

Re: S Number Changed - Cannot Log Into CAL

hardyp180 — Fri, 26 Jun 2015 05:52:21 GMT

Today I decided to create my first "instance" with the new settings.

I created an instance, chose a "master password", and waited the hour until it was set up.

Then I used the "remote desktop" from the instance page, the user name was "administrator" and I put in the master password I had chosen.

All was well, up came the screen with the A4H SAP logon pad.

I then tried to log in as SAP* in client 000, which is the first step in the overly complicated process of setting up the DEVELOPER user.

However the logon pad did not recognise the master password. I made sure my caps lock was off, and tried again using SAP*, DDIC and DEVELOPER in the clients (000 and 001) where they are supposed to have accounts.

No luck anywhere, I am convinced I cannot type the wrong password nine times in a row when I am being ultra careful.

It must be the correct password surely, otherwise the remote desktop login would have failed?

Why does this have to be so difficult?

Why does this have to be agony?

I remember a blog on SCN about installing some (non-SAP) product and the writer said "this is easy - not SAP's version of easy, but Microsoft easy".

If I had any advice to SAP it would be to try and make life simpler for your customers. Clearly if the CAL is anything to go by there is no commitment to this idea at all, whatever top management might have to say.

Re: S Number Changed - Cannot Log Into CAL

manfred_stein — Fri, 26 Jun 2015 11:18:52 GMT

Hi Paul

Can you give us a few hints. My first question is if you manage to proceed to the SAP logon screen , which confirms that the backend system is up an running and responsive.

Short remark: I got to admit that I always enter the system coordinates manually in SAP Logon pad and then start log on from there, so I am not the right person to judge usability of our connection links,

Greetings,

Manfred

Re: S Number Changed - Cannot Log Into CAL

hardyp180 — Sat, 27 Jun 2015 01:04:45 GMT

Hello,

What happened was I chose a master password when creating the instance - let us say for the sake of argument it was Abc12345.

Then when the instance was ready I press on "connect" and the remote desktop box appears. The
pem" file is uploaded and then I am asked what the password is for user "administrator".

I type in Abc12345 and all is well. A big blue screen appears with the IP address at the top and the icons down the left hand side e.g. a SAP Logon pad ICON for A4H and an Eclipse ICON.

I open up the SAP Logon Pad and try to log in as user SAP* in client 000 which is always the first step in the process of unlocking the developer key for use DEVELOPER.

In the past the password for logging onto to A4H as SAP* or DEVELOPER was always the same as the password for user "administrator" that you typed in when calling up the remote logon session in the first place.

Yesterday that was clearly not the case.

After I had given up I pressed the "terminate instance" button which will hopefully stop Amazon charging me for X days access to a system that it was impossible to access.

I will try again in a few days and see what happens. To be honest I don't expect there is anything you can do at the SAP end as you say that you don't log in the same way as the "users" like myself, so that would make it impossible to replicate the problem.

I am just hoping this was a one off glitch. I never had any problems last year, the password to the SAP system was always the same as the password to the remote desktop.

Cheersy Cheers

Paul

Re: S Number Changed - Cannot Log Into CAL

manfred_stein — Fri, 03 Jul 2015 14:39:26 GMT

Hi Paul

thanks for your thorough answer and sorry for the late answer, I was knocked out in the beginning of the week. Actually I do not understand the behavior of the system, your assumption that the password is identical across the important users is correct, when our deployment process does not run into an error (which it didn't if you received a logon screen). I reached out to a couple of colleagues in the meantime, acutally the system should reach you with developer already registered.

Let me see if I can convince the colleagues to actively join the discussion

Manfred

Re: S Number Changed - Cannot Log Into CAL

hardyp180 — Sat, 04 Jul 2015 01:56:33 GMT

I left it a week and tried again, and this time everything worked fine. So it must have been a one off problem that was fixed by SAP in the week just gone by.

It has always seemed strange to be that the DEVELOPER user is not automatically created with a developer key, you have to go via the SAP* account and transactions SLICENSE and SECSTORE and another SAP web site to enable this.

That seems far to complicated and totally at odds with the "run simple" message SAP pushes at it's major events.

Cheersy Cheers

Paul