Save certificates into TrustedCAs Keystore from Java Mapping error

[josem_mudarralara2]

Dear experts,

I have following Java code which was working properly on a SAP PI 7.31 installation, but not in a new SAP PO 7.50. This Java code is executed from a Java Mapping, which it works fine when executing from Operation Mapping Test tab (ESR), but not from the interface itself (Advanced Adapter Engine). The purpose of this is code is to connect to a server, download the SSL Certificate and save it into the TrustedCAs view of the keystore in SAP PO. Everything works fine except the part to store the certificate into the keystore.

...
Object keystoreManager = null;		
try {
	InitialContext ctx = new InitialContext();
	keystoreManager = ctx.lookup("keystore");			
} catch (Exception e) {				
	return false;
}
Class<?> classKeyStoreManager = keystoreManager.getClass();
Method methodGetKeyStore = classKeyStoreManager.getMethod("getKeystore", java.lang.String.class );
Object[] paramGetKeyStore = { keyStoreView };
KeyStore keyStore = (KeyStore) methodGetKeyStore.invoke(keystoreManager, paramGetKeyStore);
...
keyStore.setCertificateEntry(alias, cert); // It raises the exception here!
...

I've successfully tested to save the certificate into DEFAULT view of the Keystore insted of TrustedCAs view. So, it seems the issue is related to permission issues with TrustedCAs view. I understand that in both cases (TrustedCAs and DEFAULT views), the same user Guest is performing the operation.

This is the captured stack trace via XPI Inspector:

Well, I've found the Note "1788571 - Protection domains for PI mapping classes" and I've tried to set up permissions to the domain "sap.com/com.sap.xi.services", but doesn't work.

Any ideas?

Thanks in advance and regards,

Jose.

[josem_mudarralara2 · Accepted solution]

Dear all,

I will share how I fixed this issue. I moved the Java code to write the certificate from Java Mapping to Adapter Module. Then, I've set up permission domains in NWA for "write entry into a view" and "write entry" for my Adapter Module APP (domain name) and this one: sap.com/com.sap.aii.af.app

It seems the permission domains took effect for Adapter Module instead of Java Mapping.

So, with this code into the Adapter Module, I just configured a dummy communication channel to be triggered via HTTP Lookup from the Mapping.

Best regards,

Jose.