JCO SNC Connection Problems (wrong User)

[#1]

Hi,

We use a JCO Connection from a Java System (MULE 3.8.7) to our SAP System for 10 years. Now we try to secure this connection. We followed Note 2473413 and installed the latest SapCryptoLib for Linux, use the latest sapjcoLib and interchanged the certificates.

When we try to connect to our SAP System it only works when the SNC_MODE is set to "0". When we activate the SNC_MODE with "1" we got the error "JCO_ERROR_LOGON_FAILURE : name or password is incorrect". But the crendentials are correct. They fit perfectly when setting SNC_MODE to "0".

We found out, that the Linux User running the jvm is used for establishing the connection and is rejected by the SAP System. This user is not set in the JCO settings - so why is he used?

What did we wrong?

Regards,
Michael Lanser

[MarkusTolksdorf]

Hi Michael,

When using SNC, implicitly jco.client.snc_sso is set to 1 meaning that the SNC identity is supposed to be used for the logon. In case there is no mapping on the backend side, this will certainly fail like you are seeing it. In case you like to use other credentials, you need to set jco.client.snc_sso to 0 for the destination in use

Best regards,
Markus

[MichaelLanser]

I just tried snc_sso = 0 with no effect (Mentioned in the first answer from Simon).

[MarkusTolksdorf]

Interesting Simon's reply was not shown to me initially ...
But with his second reply he is right. The Linux user is not associated with the PSE, see https://launchpad.support.sap.com/#/notes/2642538. It explains how SAP Cryptolib needs to be configured for an external client with JCo as an example. If you need more help, this is indeed a security consulting topic.

Best regards,
Markus