Current Security Context Not Trusted When Using Linked Server From ABAP

[Matt_Fraser]

Hello,

I am experiencing a head-scratcher of a problem when trying to use a Linked Server connection to query a remote SQL Server database from our R/3 system. We have had this working just fine for some time, but after migrating to new hardware and upgrading OS, DBMS, and R/3, now we are running into problems.

The target database is a named instance on SQL Server 2000 SP3, Windows 2000 Server. The original source R/3 system was 4.7x2.00, also on SQL Server 2000 (SP4), Windows 2000 Server. I had been using a Linked Server defined via SQL Enterprise Manager (actually defined when the source was on SQL Server 7), which called an alias defined with the Client Network Utility that pointed to the remote named instance. This alias and Linked Server worked great for several years.

Now we have migrated our R/3 system onto new hardware, running Windows Server 2003 SP1 and SQL Server 2005 SP1. The application itself has been upgraded to ECC 6.0. I performed the migration with a homogeneous system copy, and everything has worked just fine. I redefined the Linked Server on the new SQL 2005 installation, this time avoiding the alias and referencing the remote named instance directly, and it tests out just fine using queries from SQL Management Studio. It also tests fine with OSQL called from the R/3 server console, both when logged on as SAPServiceSID with a trusted connection, and with a SQL login as the schema owner (i.e., 'sid' in lowercase). From outside of R/3, I cannot make it fail. It works perfectly.

That all changes when I try to use the Linked Server within an ABAP application, however. The basic code in use is

EXEC SQL.

SET XACT_ABORT ON

DELETE FROM [SERVER\INSTANCE].DATABASE.dbo.TABLE

ENDEXEC.

The only thing different about this code from that before the upgrade/migration is the reference to [SERVER\INSTANCE] which previously used the alias of just SERVER.

The program short dumps with runtime error DBIF_DSQL2_SQL_ERROR, exception CX_SY_NATIVE_SQL_ERROR. The database error code is 15274, and the error text is "Access to the remote server is denied because the current security context is not trusted."

I have set the "trustworthy" property on the R/3 database, I have ensured SAPServiceSID is a member of the sysadmin SQL role, I've even made it a member of the local Administrators group on both source and target servers, and I've done the same with the SQL Server service account (it uses a domain account). I have configured the Distributed Transaction Coordinator on the source (Win2003) system per Microsoft KB 839279 (this fixed problems with remote queries coming the other way from the SQL2000 system), and I've upgraded the system stored procedures on the target (SQL2000) system according to MS KB 906954. I also tried making the schema user a member of the sysadmin role, but naturally that was disastrous, resulting in an instant R/3 crash (don't try this in production!), so I set it back the way it was (default).

What's really strange is no matter how I try this from outside the R/3 system, it works perfectly, but from within R/3 it does not. A search of SAP Notes, SDN forums, SAPFANS, Microsoft's KnowledgeBase, and MSDN Forums has not yielded quite the same problem (although that did lead me to learning about the "trustworthy" database property).

Any insight someone could offer on this thorny problem would be most appreciated.

Best regards,

Matt

[Former Member]

I was able to workaround the problem with the SAP 'sid' database user having reduced permissions to where access to a remote database caused SS Error 15247 - current security context not trusted problem with linked servers. Create a separate DB user and login at the SQL Server level and then a new DBCON connection in TCODE DBCO or dbacockpit pointing back to the same SAP SQL Server database. Be sure to use the new SQL Server DB login and password credentials in the DBCON connection configuration. Within the ABAP program that will be accessing the remote database, be sure to connect to your new secondary connection to the same SAP database that has the linked server definition pointing to the remote server.

An example:

DATA: R_COUNT TYPE I VALUE 0.

EXEC SQL.

CONNECT TO 'SAPSID2' AS 'C1' <---- this connection uses the new SS user credentials, not sid or SAPServiceSID

ENDEXEC.

EXEC SQL.

SELECT * INTO :R_COUNT FROM OPENQUERY(LINK2RDB,

'select count(*) from REMOTEDB..REMOTETABLE')

ENDEXEC.

EXEC SQL.

DISCONNECT 'C1'

ENDEXEC.

*

EXEC SQL.

SET CONNECTION DEFAULT

ENDEXEC.

SKIP.

WRITE: / R_COUNT.