417 authorization cloud connector to trial subaccount cloud Foundry

[cesar]

Hi Team

I created a new trial account with access to BTP. It has a global account and trial subaccount with dev space with cloud foundry instance created

with my User for trial BTP subaccount

and the above data i tried to connect my local cloud connector (from my laptop in localhost:8443 ) to my new btp trial subaccount (cloud foundry feature set B)

But I get this error:

 417 An authorization problem ocurred when downloading the configuration.  Check the spelling of the subaccount name, user, and password. See "Log And Trace Files"

The log shows generic authorization error:

2022-05-27 01:35:48,002 -0300#WARN#com.sap.ui5.resource.ResourceUtil#https-jsse-nio2-8443-exec-10# #An error occured when accessing the /META-INF/ui5.properties! Reason: The /META-INF/ui5.properties could not be found!
2022-05-27 01:35:48,027 -0300#WARN#com.sap.ui5.resource.ResourceServlet#https-jsse-nio2-8443-exec-10# #Could not find property "x-sap-ui5-BuildTimestamp" in ui5.properties or MANIFEST.MF or the value is not valid! Using System.currentTimeMillis as cachebuster timestamp.
2022-05-27 01:36:12,717 -0300#WARN#com.sap.scc.util.JvmUtils#https-jsse-nio2-8443-exec-8# #SAP JVM monitor classes are not available, run without extended monitoring. Root cause: java.lang.ClassNotFoundException: com.sap.jvm.monitor.vm.ThreadAnnotationKey
2022-05-27 01:36:12,722 -0300#INFO#com.sap.scc.rt#https-jsse-nio2-8443-exec-8# #JVM (without monitor classes) is loaded
2022-05-27 01:44:54,025 -0300#WARN#com.sap.scc.config#https-jsse-nio2-8443-exec-5# #Cannot find host mapping configuration file C:\SAP\scc20\scc_config\cf.us10.hana.ondemand.com\faxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxfe\backends.xml
2022-05-27 01:44:54,095 -0300#WARN#com.sap.scc.config#https-jsse-nio2-8443-exec-5# #Creating an sslContextProvider for account faxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxfe@cf.us10.hana.ondemand.com without SSLContext. Keystore did not contain a certificate.
2022-05-27 01:44:54,690 -0300#INFO#com.sap.scc.security#https-jsse-nio2-8443-exec-5# #TLSSocketFactory: enabled are TLSv1, TLSv1.1, TLSv1.2
2022-05-27 01:44:54,975 -0300#INFO#com.sap.scc.security#https-jsse-nio2-8443-exec-5# #Will retrieve Connectivity CA certificate from SAP Cloud Platform
2022-05-27 01:44:54,975 -0300#INFO#com.sap.scc.security#https-jsse-nio2-8443-exec-5# #Executing Http Get request to https://connectivitycertsigning.cf.us10.hana.ondemand.com:443/certificate/management/v1/trusted/ca/a...
2022-05-27 01:44:56,710 -0300#INFO#com.sap.scc.security#https-jsse-nio2-8443-exec-5# #Returned Http Response with code 200
2022-05-27 01:44:56,720 -0300#INFO#com.sap.scc.security#https-jsse-nio2-8443-exec-5# #Connectivity CA certificate retrieved successfully from SAP Cloud Platform
2022-05-27 01:45:19,005 -0300#INFO#com.sap.scc.security#https-jsse-nio2-8443-exec-5# #New RSA keypair was generated. Key size used 4096, time 21970 ms
2022-05-27 01:45:19,305 -0300#INFO#com.sap.scc.security#https-jsse-nio2-8443-exec-5# #Send Certificate Signing Request for Cloud Connector certificate to SAP Cloud Platform
2022-05-27 01:45:19,305 -0300#INFO#com.sap.scc.security#https-jsse-nio2-8443-exec-5# #Executing Http Post request to https://connectivitycertsigning.cf.us10.hana.ondemand.com:443/certificate/management/v1/sign/account/faxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxfe
2022-05-27 01:45:22,125 -0300#INFO#com.sap.scc.security#https-jsse-nio2-8443-exec-5# #Returned Http Response with code 401
2022-05-27 01:45:22,170 -0300#INFO#com.sap.scc.config#https-jsse-nio2-8443-exec-5# #Stopping service channels on faxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxfe[CCSTRL01LOC]@cf.us10.hana.ondemand.com
2022-05-27 01:45:22,220 -0300#ERROR#com.sap.scc#https-jsse-nio2-8443-exec-5# #SCC handshake failed: 401 — Unauthorized
com.sap.scc.servlets.SccHandshakeException: SCC handshake failed: 401 — Unauthorized

I have all the relevant authorizations in my subaccount, but nothing works

seems like I need something in my new btp trial subaccount, because i don't have any problems if I try to connect my local cloud connector to another subaccount.

also, I see the "Universal Id home page" when I login to my new btp trial account which I couldn't connect from my cloud connector.  

 If I use my another btp account that i can connect with success through my cloud connector, i don't see the Universal Id home page.

I tried with note 2461997 and 2571763, but nothing works

I create my new BTP trial account following this steps https://developers.sap.com/tutorials/hcp-create-trial-account.html 

Any suggest? I will apreciate your comments.

Regards!

[Margit_Wagner]

Hi @AntalP , @cesar

We have received your request and are in the process of evaluating the problem,
Please allow for a delay in our response
Kind regards
Margit
 

[AntalP · Accepted solution]

Hi Cesar,

The 401 HTTP code means that authentication failed on the SAP BTP. There could be some reasons for this issue:

 - wrong password for the email

- same email is assigned to other S-users / P-users

- email is not verified

Please try to open the https://accounts.sap.com , select the forgot password link, reset the password and try to add the subaccount again with the new password.

When a role is missing the HTTP return code is 403.

[cesar · Accepted solution]

Hi AntalP

you are rigth. There is something wrong with my account.

Finally I was able to connect through my new BTP trial account when I select "forgot password link", as you sugggested and I did get a new password.

This option assigned me two passwords for one e-mail, maybe there is something wrong but now I have this 

for this links 
https://account.hanatrial.ondemand.com/
https://groups.community.sap.com/
I have to use my e-mail and old password

but, for this link
https://accounts.sap.com
I have to use my e-mail (same e-mail wich I used on the above links) but with a new password generated today.
with the new password I can connect my local clou connector to the my BTP trial account with success. I don't understand what happenned but with this option i can use my cloud connector with btp trial account

thanks for your help AntalP. Best Regards!

[Illya]

Hi @AntalP , @cesar,

if you see the SAP Universal ID homepage to sign in and do not see the SAP Universal ID homepage in all other cases, then it seems, that your SAP ID user need to be linked to the new SAP Universal ID user. The BTP uses the SAP ID user and that is why no password work.

Do the following steps and try again:
Sign in to SAP Universal ID: account.sap.com
On the Accounts page link your SAP ID user to the SAP Universal ID user. You should receive a proposal.
To be sure step into the detail screen of your linked user and reset the Account password. You can forgive the same password.

Good luck!

BR,
Illya

[NiklasSiemer]

Hi, Please consider to open an icident in support portal. From the first look I would assume it's something user related which can just get fixed by support team. Even if it's another issue they can help.

Best regards,
Niklas

[AntalP]

Hi Cesar,

The screenshot shows that the trial account is created in US East (VA) - AWS (cf.us10.hana.ondemand.com) region while the log entry shows a subaccount certificate signing request to a different region, cf.ap21.hana.ondemand.com that belongs to Singapore - Azure. In the cloud connector log file could you look for the trial subaccount entry, 

https://connectivitycertsigning.cf.us10.hana.ondemand.com:443/certificate/management/v1/sign/account/f...

[cesar]

Hi, AntalP Thank for your quick response. You are rigth, about the host name. I update the details and I tried to connect again but I get the same error with the host cf.us10.hana.ondemand maybe my user btp trial account need another authorization but I don't find what I missing

[duckys]

have you find solution cesar, i have the same problem