JCO SNC Connection Problems (wrong User)

[#1]

Hi,

We use a JCO Connection from a Java System (MULE 3.8.7) to our SAP System for 10 years. Now we try to secure this connection. We followed Note 2473413 and installed the latest SapCryptoLib for Linux, use the latest sapjcoLib and interchanged the certificates.

When we try to connect to our SAP System it only works when the SNC_MODE is set to "0". When we activate the SNC_MODE with "1" we got the error "JCO_ERROR_LOGON_FAILURE : name or password is incorrect". But the crendentials are correct. They fit perfectly when setting SNC_MODE to "0".

We found out, that the Linux User running the jvm is used for establishing the connection and is rejected by the SAP System. This user is not set in the JCO settings - so why is he used?

What did we wrong?

Regards,
Michael Lanser

[simon_luser]

Please check the property "jco.client.snc_sso", this is per default 1 which means the SNC identity is used for authentication. If you really want to use user/pw for authentication and SNC only for encryption of the connection, you need to set this property to 0.

[MichaelLanser]

Hi Simon,

i changed the property to 1 with no effect.

Our SapDestinationRegistry.ini:

[DF1]
jco.client.lang=DE
jco.client.mshost=sapdf1enq.hv.devk.de
jco.client.client=100
jco.client.snc_lib=/opt/mule/sap/lib/boot/libsapcrypto.so
jco.client.passwd=***
jco.client.snc_sso=0
JCO_DESTINATION=DF1
jco.client.snc_partnername=p:CN=t-krb-bhvxsap102, OU=Zentralekonten, DC=produktion, DC=devk, DC=de
jco.client.group=DF1_Group
jco.client.snc_mode=1
USE_MESSAGE_SERVER=true
jco.client.user=TT***
jco.client.snc_qop=3
jco.client.snc_myname=p:CN=JCO3,O=SAP,C=DE
jco.client.r3name=DF1
jco.client.msserv=3601
[DI1]
jco.client.lang=DE
jco.client.mshost=sapdi1enq.hv.devk.de
jco.client.client=100
jco.client.snc_lib=/opt/mule/sap/lib/boot/libsapcrypto.so
jco.client.passwd=***
jco.client.snc_sso=0
JCO_DESTINATION=DI1
jco.client.snc_partnername=p:CN=t-krb-bhvxsap101, OU=Zentralekonten, DC=produktion, DC=devk, DC=de
jco.client.group=DI1_Group
jco.client.snc_mode=1
USE_MESSAGE_SERVER=true
jco.client.user=TT***
jco.client.snc_qop=3
jco.client.snc_myname=p:CN=JCO3,O=SAP,C=DE
jco.client.r3name=DI1
jco.client.msserv=3601<br>

Here is the ErrorMessage:

com.sap.conn.jco.JCoException: Initialization of repository destination DI1 failed: Establishing connection to communication partner failed at CPIC-CALL: CMRCV on convId: 49734242 with rc: 20
connection parameters: TYPE=B DESTINATION=DI1 CLIENT=100 USER=TT***PASSWD= LANG=DE MSHOST= sapdi1enq.hv.devk.de MSSERV=3601 R3NAME=DI1 GROUP=DI1_Group SNC_MODE=1 SNC_QOP=3 SNC_MYNAME="p:CN=JCO3, O=SAP, C=DE" SNC_SSO=0 PCS=1

LOCATION CPIC (TCP/IP) with Unicode
ERROR GSS-API(maj): No credentials were supplied
Unable to establish the security context
target="p:CN=t-krb-bhvxsap101, OU=Zentralekonten,
DC=produktion, DC=devk, DC=de"
TIME Wed Sep 7 10:24:33 2022
RELEASE 753
COMPONENT SNC (Secure Network Communication)
VERSION 6
RC -4
MODULE /bas/753_REL/src/krn/snc/sncxxall.c
LINE 3604
DETAIL SncPEstablishContext
SYSTEM CALL gss_init_sec_context
COUNTER 4

at com.sap.conn.jco.rt.RfcDestination.getSystemID(RfcDestination.java:1560) ~[sapjco3.jar:20220520 2359 [3.1.6 (2022-05-18)]]
at com.sap.conn.jco.rt.RepositoryManager.getRepository(RepositoryManager.java:28) ~[sapjco3.jar:20220520 2359 [3.1.6 (2022-05-18)]]
at com.sap.conn.jco.rt.RfcDestination.initRepository(RfcDestination.java:1464) ~[sapjco3.jar:20220520 2359 [3.1.6 (2022-05-18)]]
at com.sap.conn.jco.rt.RfcDestination.getRepository(RfcDestination.java:1846) ~[sapjco3.jar:20220520 2359 [3.1.6 (2022-05-18)]]
at com.sap.conn.jco.rt.RfcDestination.getRepository(RfcDestination.java:40) ~[sapjco3.jar:20220520 2359 [3.1.6 (2022-05-18)]]

Regards,
Michael

[simon_luser]

The issue is on SNC layer that no credentials are supplied, please check your PSE that you have the correct credentials in place. For further advise I guess the best is to contact SAP support via an incident.

[MichaelLanser]

I already contacted the SAP Support but they said that this is an consultig question and wouldn´t be answered in an incident.

The PSE is secured with the Linux technical User because he needs the permission to open it. How should I use the SAP User for it?