Hello,
we try to get logon via certificate working on our PI. C4C tenant should logon on PI via client certificate.
Following steps we configured, but logon does not work.
1. C4C: in communication arrangement "Business Partner Replication to SAP ERP":
authentication method = SSL Client Certificate
Certificate = SAP Business ByDesign System Key Pair
Hostname = url-to.our.system.com
2. C4C: Download certificate (certificate.cer)
3. PI: HTTP is enabled and works
4. PI: ume.logon.allow_cert=true
5. PI: Uploaded certificate.cer to user in UME in PI in tab certificates
Certificate was created for:
CN=M000000000740187798,OU=I000000000740187798 - BusinessByDesign,O=SAP Trust Community,C=DE
Certificate was signed by:
CN=SAP Passport CA,O=SAP Trust Community,C=DE
Valid from 01.04.2015
Valid to: 01.04.2017
6. PI: created custom ruleconfiguration zcertlogon with following properties:
ClientCertLoginModule = SUFFICIENT; Options: Rule1.getUserFrom=wholeCert
EvaluateTicketLoginModule = SUFFICIENT
EvaluateAssertionTicketLoginModule = SUFFICIENT
BasicPasswordLoginModule = REQUISITE
CreateTicketLoginModule=OPTIONAL
7. PI: Attached custom ruleconfiguration to sap.com/com.sap.aii.adapter.soap.app*XISOAPAdapter as template.
Loginmodules from *XISOAPAdapter are the same as zcertlogon.
Properties of *XISOAPAdapter where not changed:
template = zcertlogon
policy_domain = /XISOAPAdapter
auth_method = basic
realm_name = XISOAPApps
8. With this configuration we try to do a test from C4C to PI with scenario "Business Partner Replication to SAP ERP" - "Replicate Business Partner to SAP ERP" - Check connection.
9. Error in C4C:
Checking connection failed.
Ping failed.
Error accessing service; Service Ping ERRPR: Unauthorized (401).
10. Error in PI Logs and Traces:
LOGIN.FAILED
User: N/A
IP Address: xx.xx.xx.xx
Authentication Stack: sap.com/com.sap.aii.adapter.soap.app*XISOAPAdapter
Authentication Stack Properties:
template = zcertlogon
policy_domain = /XISOAPAdapter
auth_method = basic
realm_name = XISOAPApps
Login Module Flag Initialize Login Commit Abort Details
1. com.sap.engine.services.security.server.jaas.ClientCertLoginModule SUFFICIENT ok false false
#1 Rule1.getUserFrom = wholeCert
2. com.sap.security.core.server.jaas.EvaluateTicketLoginModule SUFFICIENT ok false true
3. com.sap.security.core.server.jaas.EvaluateAssertionTicketLoginModule SUFFICIENT ok exception true Received no SAP Authentication Assertion Ticket.
4. com.sap.engine.services.security.server.jaas.BasicPasswordLoginModule REQUISITE ok false false
5. com.sap.security.core.server.jaas.CreateTicketLoginModule OPTIONAL ok false true
No logon policy was applied
What did we forgot? Is the sequence in zcertlogon not correct?
Are the properties maintained correctly?
What is with this "auth_method = basic", which is originally maintained in *XISOAPAdapter - does this mean only basic authentication works or does it allow basic authentication too?
Help appreciated,
Regards,
Julia