SAP CPI HTTPS Inbound with Client Certificate

[ONavas]

Hi everybody,

I try to call an Integration flow with Client Certificate.

I created a keystore in SAP Passport from my S-User.

Uploaded the Keystore to the CPI Keystore and afterwards generated and downloaded the Certificate from there.

The Certificate is selected in the Integration Flow.

My S-User has the ESBMessaging.send role and with Basic Auth it works.

For testing I call the endpoint from Postman, where No Auth is selected and I added the keystore in Postman as Authentification for the host. But the result is always this one:

"An Authentification object was not found in the SecurityContext".

So my question is: what am I doing wrong? I googled and checked the SAP blog but just found old explanations for Client Certificate with UserRole. But I want directly in the flow.

Thanks a lot for your help.

Cheers,

Adam

[ONavas]

Hi Adam,

Have you solved this issue? I have the same error with OSS certificate in Service Key, also the same error occurs if I configure directly the iflow with a certificate instead of ESBMessaging role.

I found in http log an error with http401, and at the same date/time, the in trace log I found the content of the incoming certificate. With a compares plugin in Notepad++, I confirm both are the same certificate.


I appreciate if you share your solution if you have found one.

[kunapareddy1]

Hi Adam.. could you please advise if you managed to identify the root cause for the issue as I have encountered the same issue while using postman and using the self signed certificated generated and maintaining the certificate on the service key on Integration Suite

[Ryan-Crosby]

Hi anilkumar.kunapareddy - a self-signed certificate is not something that is supported on account of the load balancing configuration and what root certificates the system(s) will support. See the help here - https://help.sap.com/docs/CLOUD_INTEGRATION/368c481cd6954bdfa5d0435479fd4eaf/4509f605e83c4c939a91b81...

You can do what I have done and download your SAP Passport certificate/key pair for your s-user id. You can create a service key against that certificate and configure Postman to use that key pair for sending messages to Integration Suite.

Regards,

Ryan Crosby

[kunapareddy1]

Thank you so much Ryan for the response. Much appreciated. Will try the suggested approach.

[former_member226]

TO add to what Toushif said above, in case you are using a cloud foundary CPI then please follow https://blogs.sap.com/2019/08/14/cloud-integration-on-cf-how-to-setup-secure-http-inbound-connection...

[toushif]

Hello Adam,

Please check out this blog:

https://blogs.sap.com/2017/06/05/cloud-integration-how-to-setup-secure-http-inbound-connection-with-...

Kind regards,

Toushif.