Trust Issue While Implementing LDAP Authentication in SAP Cloud Connector

[#1]

Dear Experts, 

I have a requirement to implement the LDAP Authentication method in SAP Cloud Connector to replace traditional file based authentication which we normally use to login with Administrator user.

Now I got in touch with our Active Directory Server Admin Team who has access to the host. He help us configuring the parameters for LDAP configuration like, Host, Alternate Host, Search Rules and with the Roles part.

However after that when I tried to test I got the error as below.

• Connecting to URL ldaps://XXXXXXXXXXX:636
• Exception performing authentication. Retrying... throwing exception javax.naming.CommunicationException: XXXXXXXXXXX:636 [Root exception is javax.net.ssl.SSLException: java.lang.RuntimeException:
Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty]

• Connecting to URL ldaps://XXXXXXXXXXXXXX:636
• Exception performing authentication throwing exception javax.naming.CommunicationException: XXXXXXXXXXXXXXXXXXX:636 [Root exception is javax.net.ssl.SSLException: java.lang.RuntimeException:
Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty]
• Returning null principal.
• Authentication for user Username failed

After further researching I consulted the Note https://me.sap.com/notes/0003041841
Requested System Certificate, Intermediate Certificate and Root Certificate of the LDAP Server and created a seprate cer file by merging those 3 certificate. Executed the below command to add the certificate to the CACERT file in my SAP JVM Folder 
"keytool -import -storepass changeit -file <certificate used by LDAP server> -keystore cacerts -alias <e.g. LDAP_xyz>";

Still the same error is coming. 
I believe our SAP Cloud Connector is using that same JVM only.


There is another option I seen inside the LDAP Configuration Page which is the LDAP trust store where there is no certificate added. I am not sure if I need to add the same certificate there also.

I verified the JAVA_HOME path defined as G:\sapjvm_8 under User Variables from Environment Variable section and also checked from services.msc the executable path of Cloud Connector is G:\SAP\scc20\SCCHost.exe

Can you please suggest how to fix this?

I have also attached a screenshot of the current LDAP Configuration Screen with Confidential data masked for security purpose.
But do I need to also import the certificate in the LDAP trust store which is highlighted in the Screenshot?

Thanks and Regards
Anurag

[Anurag004]

Hi All, 

Since I have resolved the issue I am sharing my experience.
Short answer was indeed those certificates were needed to be imported in the LDAP Trust Store itself.
Also if your Cloud Connector has Master and Shadow concept, you also need to import those certificates in the same way in Shadow Node's LDAP Trust Store.
I am preparing a complete Blog Post where I will share my other Lesson Learnt Experience as well while implementing LDAP Authentication for SAP Cloud Connector.

Thanks and Regards
Anurag