JCO SNC Connection Problems (wrong User)

[#1]

Hi,

We use a JCO Connection from a Java System (MULE 3.8.7) to our SAP System for 10 years. Now we try to secure this connection. We followed Note 2473413 and installed the latest SapCryptoLib for Linux, use the latest sapjcoLib and interchanged the certificates.

When we try to connect to our SAP System it only works when the SNC_MODE is set to "0". When we activate the SNC_MODE with "1" we got the error "JCO_ERROR_LOGON_FAILURE : name or password is incorrect". But the crendentials are correct. They fit perfectly when setting SNC_MODE to "0".

We found out, that the Linux User running the jvm is used for establishing the connection and is rejected by the SAP System. This user is not set in the JCO settings - so why is he used?

What did we wrong?

Regards,
Michael Lanser

[HAL9000]

I recommend to drop parameter jco.client.snc_myname if using the SAP Common Crypto Lib. And by the way, also jco.client.snc_partnername is superfluous if using parameter jco.client.mshost.
Anyway, if that does not help, I guess that you maybe have not set the OS environment variable SECUDIR to your PSE directory, its certificate store is empty, the file(s) are missing completely, or your OS user does not have read permission to it.

For getting support on issues with the SAP Common Crypto Lib please use support component BC-IAM-SSO-CCL. Your root cause error message "No credentials were supplied" does not stem from JCo, but from the used SNC library.

[MichaelLanser]

Hi Stefan,

i dropped both parameters (snc_myname, snc_partnername) - with no effect. I try to forward the incident to your proposed component.

Reagards,

Michael

[simon_luser]

Please check the property "jco.client.snc_sso", this is per default 1 which means the SNC identity is used for authentication. If you really want to use user/pw for authentication and SNC only for encryption of the connection, you need to set this property to 0.

[MichaelLanser]

Hi Simon,

i changed the property to 1 with no effect.

Our SapDestinationRegistry.ini:

[DF1]
jco.client.lang=DE
jco.client.mshost=sapdf1enq.hv.devk.de
jco.client.client=100
jco.client.snc_lib=/opt/mule/sap/lib/boot/libsapcrypto.so
jco.client.passwd=***
jco.client.snc_sso=0
JCO_DESTINATION=DF1
jco.client.snc_partnername=p:CN=t-krb-bhvxsap102, OU=Zentralekonten, DC=produktion, DC=devk, DC=de
jco.client.group=DF1_Group
jco.client.snc_mode=1
USE_MESSAGE_SERVER=true
jco.client.user=TT***
jco.client.snc_qop=3
jco.client.snc_myname=p:CN=JCO3,O=SAP,C=DE
jco.client.r3name=DF1
jco.client.msserv=3601
[DI1]
jco.client.lang=DE
jco.client.mshost=sapdi1enq.hv.devk.de
jco.client.client=100
jco.client.snc_lib=/opt/mule/sap/lib/boot/libsapcrypto.so
jco.client.passwd=***
jco.client.snc_sso=0
JCO_DESTINATION=DI1
jco.client.snc_partnername=p:CN=t-krb-bhvxsap101, OU=Zentralekonten, DC=produktion, DC=devk, DC=de
jco.client.group=DI1_Group
jco.client.snc_mode=1
USE_MESSAGE_SERVER=true
jco.client.user=TT***
jco.client.snc_qop=3
jco.client.snc_myname=p:CN=JCO3,O=SAP,C=DE
jco.client.r3name=DI1
jco.client.msserv=3601<br>

Here is the ErrorMessage:

com.sap.conn.jco.JCoException: Initialization of repository destination DI1 failed: Establishing connection to communication partner failed at CPIC-CALL: CMRCV on convId: 49734242 with rc: 20
connection parameters: TYPE=B DESTINATION=DI1 CLIENT=100 USER=TT***PASSWD= LANG=DE MSHOST= sapdi1enq.hv.devk.de MSSERV=3601 R3NAME=DI1 GROUP=DI1_Group SNC_MODE=1 SNC_QOP=3 SNC_MYNAME="p:CN=JCO3, O=SAP, C=DE" SNC_SSO=0 PCS=1

LOCATION CPIC (TCP/IP) with Unicode
ERROR GSS-API(maj): No credentials were supplied
Unable to establish the security context
target="p:CN=t-krb-bhvxsap101, OU=Zentralekonten,
DC=produktion, DC=devk, DC=de"
TIME Wed Sep 7 10:24:33 2022
RELEASE 753
COMPONENT SNC (Secure Network Communication)
VERSION 6
RC -4
MODULE /bas/753_REL/src/krn/snc/sncxxall.c
LINE 3604
DETAIL SncPEstablishContext
SYSTEM CALL gss_init_sec_context
COUNTER 4

at com.sap.conn.jco.rt.RfcDestination.getSystemID(RfcDestination.java:1560) ~[sapjco3.jar:20220520 2359 [3.1.6 (2022-05-18)]]
at com.sap.conn.jco.rt.RepositoryManager.getRepository(RepositoryManager.java:28) ~[sapjco3.jar:20220520 2359 [3.1.6 (2022-05-18)]]
at com.sap.conn.jco.rt.RfcDestination.initRepository(RfcDestination.java:1464) ~[sapjco3.jar:20220520 2359 [3.1.6 (2022-05-18)]]
at com.sap.conn.jco.rt.RfcDestination.getRepository(RfcDestination.java:1846) ~[sapjco3.jar:20220520 2359 [3.1.6 (2022-05-18)]]
at com.sap.conn.jco.rt.RfcDestination.getRepository(RfcDestination.java:40) ~[sapjco3.jar:20220520 2359 [3.1.6 (2022-05-18)]]

Regards,
Michael

[simon_luser]

The issue is on SNC layer that no credentials are supplied, please check your PSE that you have the correct credentials in place. For further advise I guess the best is to contact SAP support via an incident.

[MichaelLanser]

I already contacted the SAP Support but they said that this is an consultig question and wouldn´t be answered in an incident.

The PSE is secured with the Linux technical User because he needs the permission to open it. How should I use the SAP User for it?

[MarkusTolksdorf]

Hi Michael,

When using SNC, implicitly jco.client.snc_sso is set to 1 meaning that the SNC identity is supposed to be used for the logon. In case there is no mapping on the backend side, this will certainly fail like you are seeing it. In case you like to use other credentials, you need to set jco.client.snc_sso to 0 for the destination in use

Best regards,
Markus

[MichaelLanser]

I just tried snc_sso = 0 with no effect (Mentioned in the first answer from Simon).

[MarkusTolksdorf]

Interesting Simon's reply was not shown to me initially ...
But with his second reply he is right. The Linux user is not associated with the PSE, see https://launchpad.support.sap.com/#/notes/2642538. It explains how SAP Cryptolib needs to be configured for an external client with JCo as an example. If you need more help, this is indeed a security consulting topic.

Best regards,
Markus