HANA Express SPS4 Upgrade - Trust Configuration Error

[StevenDeSaeger]

Hi,

I just upgraded our HANA Express SPS3 instance towards SPS4 without any issues.

This system had an active, working SAML trust configuration setup with SAP IDP.

I am getting the following error now when I access the XSA Advanced Cockpit and go to the Trust Configuration settings:

One of the major reasons for us doing the upgrade was hoping that we would get the SAML logon auto-redirect configuration setup working as stated on 2608476 - How to automatically redirect users to SAML IdP on HANA XSA

A first test already shows that this is NOT the case .. the logon screen is still the default XSA. But obviously this might be impacted by the above error which seems to suggest that something is wrong anyways - although the link to the IDP logon is still active and can be used - SAML authentication still works.

[lucasvaccaro]

Hi Steven, an error should be recorded in the uaa.log file when that happens. Are you able to find it?

[StevenDeSaeger]

Thanks Lucas for your response ...

I had a look at the 'uaa.log' but no errors so far I can see .. The log did not change after I entered the XS admin trust configuration.

Here is what I see as most recent ( the start at least - didn't copy it all ) - I only see 2 'warnings' ...

[2019-08-24 11:20:56.570]  IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  INFO --- XSUAAConfig: Keystore does exist. Loading from secure store
[2019-08-24 11:20:56.678]  IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  INFO --- XSUAAConfig: Configuration for DB trust: jwt
[2019-08-24 11:20:56.685]  IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  INFO --- XSUAAConfig: Configuration for UAA_URL: https://<....>:39032/uaa-security
[2019-08-24 11:20:56.725]  IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  INFO --- XSUAAConfig: Configuration for SAML_AUTO_REDIRECT: true
[2019-08-24 11:20:57.059]  IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  INFO --- XSUAAConfig: Configuration for SAML2 entityID: <...>
[2019-08-24 11:20:57.125]  IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  INFO --- XSUAAConfig: Configuration for jwt.token.refresh.format: opaque
[2019-08-24 11:20:57.140]  IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  INFO --- XSUAAConfig: Configuration for JWT ISSUER: http://<...>/UAA
[2019-08-24 11:20:57.213]  IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  INFO --- XSUAAConfig: Configuration for require_https: true
[2019-08-24 11:21:02.338] /uaa-security IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  INFO --- HANAFlyway: UAA: SAP version 1.0.8, based on Cloudfoundry UAA 4.24.0
[2019-08-24 11:21:02.338] /uaa-security IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  INFO --- HANAFlyway: HANA: Flyway migration enabled, DB version: 2.00.040.00.1553674765
[2019-08-24 11:21:02.347] /uaa-security IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  INFO --- HANAFlyway: dataSource: class name = org.apache.tomcat.jdbc.pool.DataSource
[2019-08-24 11:21:02.352] /uaa-security IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  INFO --- HANAFlyway: dataSource: DB URL = jdbc:sap://vhcalhxedb:39013
[2019-08-24 11:21:02.352] /uaa-security IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  INFO --- HANAFlyway: dataSource: DB username = SYS_XS_UAA
[2019-08-24 11:21:02.383] /uaa-security IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  INFO --- VersionPrinter: Flyway 4.2.0 by Boxfuse
[2019-08-24 11:21:02.390] /uaa-security IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  INFO --- DbSupportFactory: Database: jdbc:sap://vhcalhxedb:39013 (HDB 2.0)
[2019-08-24 11:21:03.583] /uaa-security IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  INFO --- DbValidate: Successfully validated 139 migrations (execution time 00:00.393s)
[2019-08-24 11:21:03.636] /uaa-security IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  INFO --- DbMigrate: Current version of schema "SYS_XS_UAA": 4.21.0.8
[2019-08-24 11:21:03.637] /uaa-security IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  INFO --- DbMigrate: Schema "SYS_XS_UAA" is up to date. No migration necessary.
[2019-08-24 11:21:04.208] /uaa-security IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  INFO --- SAMLKeyManager: Loaded service provider certificate service-provider-cert
[2019-08-24 11:21:07.312] /uaa-security IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  INFO --- Audit: IdentityProviderModifiedEvent ('id=f2c7ce4d-7283-487d-a1c5-5f19e0a7aee3; type=ldap; origin=ldap; zone=uaa'): principal=IdentityProvider{id='f2c7ce4d-7283-487d-a1c5-5f19e0a7aee3', originKey='ldap', name='UAA LDAP Provider', type='ldap', active=false}, origin=[caller=null], identityZoneId=[uaa]
[2019-08-24 11:21:07.370] /uaa-security IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  INFO --- Audit: IdentityProviderModifiedEvent ('id=612c4f08-2ece-413a-a07f-188a0242f493; type=saml; origin=avnrvqjov.accounts.ondemand.com; zone=uaa'): principal=IdentityProvider{id='612c4f08-2ece-413a-a07f-188a0242f493', originKey='avnrvqjov.accounts.ondemand.com', name='UAA SAML Identity Provider[avnrvqjov.accounts.ondemand.com]', type='saml', active=true}, origin=[caller=null], identityZoneId=[uaa]
[2019-08-24 11:21:07.385] /uaa-security IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  INFO --- Audit: IdentityProviderModifiedEvent ('id=84598c03-54b4-4006-b521-a2eaa2edae34; type=uaa; origin=uaa; zone=uaa'): principal=IdentityProvider{id='84598c03-54b4-4006-b521-a2eaa2edae34', originKey='uaa', name='uaa', type='uaa', active=true}, origin=[caller=null], identityZoneId=[uaa]
[2019-08-24 11:21:07.579] /uaa-security IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  INFO --- Audit: IdentityZoneModifiedEvent ('id=uaa; subdomain='): principal=org.cloudfoundry.identity.uaa.zone.IdentityZone@1c374, origin=[caller=null], identityZoneId=[uaa]




[2019-08-24 11:21:08.483] /uaa-security IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  WARN --- GenericTypeAwarePropertyDescriptor: Invalid JavaBean property 'clientDetailsService' being accessed! Ambiguous write methods found next to actually used [public void org.cloudfoundry.identity.uaa.oauth.UaaAuthorizationEndpoint.setClientDetailsService(org.cloudfoundry.identity.uaa.zone.ClientServicesExtension)]: [public void org.springframework.security.oauth2.provider.endpoint.AbstractEndpoint.setClientDetailsService(org.springframework.security.oauth2.provider.ClientDetailsService)]
[2019-08-24 11:21:12.424] /uaa-security IdentityZone:  correlation_id:  -  [localhost-startStop-1] ....  WARN --- TemplateMode: [THYMELEAF][localhost-startStop-1] Template Mode 'HTML5' is deprecated. Using Template Mode 'HTML' instead.

[domonkos_varga]

Hi guys!

Did any of you manage to solve the problem? I have the exact same error, and I spent half a day trying to even find a clue. Nothing, but this post.

Thanks,

Domonkos