SAPRouter Error !

[Former Member]

Hi all

I am trying to create the certificate for SAP (SCR), when I use the command to do so, its throwing me the below error:

[root@sman linux-x86_64-glibc2.3]# clear

[root@sman linux-x86_64-glibc2.3]# ./sapgenpse get_pse -v -r certreq -p local.pse "CN=XXXX, OU=0000XXXXX, OU=SAProuter, O=SAP, C=DE"

ERROR in unix_dlopen(): dlopen("libsapcrypto.so") FAILED:

"libsapcrypto.so: cannot open shared object file: No such file or directory"

Loading of shared library "libsapcrypto.so" failed!

You might need to define the shared library search path LD_LIBRARY_PATH

Can anyone please take a look and let me know what would be the error:

Thanks

Srikar

[markus_doehr2]

The problem is, that the libsapcrypto.so is not found since it's not in the LD_LIBRARY_PATH of user "root".

I suggest the following:

- copy "sapgenpse" and "libsapcrypto.so" to your kernel directory

- copy the "ticket" to /usr/sap/<SID>/Dxxxxx/sec

- logon as <sid>adm and execute the same command in whatever directory you want to generate the certificate.

Markus

[Former Member]

Hi Markus

I have done accordingly, now it throwing the error as below:

omtr-sap-sman:osmadm 3> /usr/sap/saprouter/linux-x86_64-glibc2.3/sapgenpse get_pse -v -r certreq -p local.pse "CN=omtr, OU=0000894394, OU=SAProuter, O=SAP, C=DE"

Got absolute PSE path "/home/osmadm/sec/local.pse".

Please enter PIN: ****

Please reenter PIN: ****

Supplied distinguished name: "CN=omtr, OU=0000894394, OU=SAProuter, O=SAP, C=DE"

Creating PSE with format v2 (default)

No License ticket file found (trying /home/osmadm/sec/ticket):

No License ticket file found (trying /usr/local/secude/etc/ticket):

get_pse: Can't create PSE.

ERROR in af_create: (18946/0x4a02) Ticket error : "No License ticket file found (trying /home/osmadm/sec/ticket):

No License ticket file found (trying /usr/local/secude/etc/ticket):

"

ERROR in ??: (18946/0x4a02) Ticket error : "No License ticket file found (trying /home/osmadm/sec/ticket):

No License ticket file found (trying /usr/local/secude/etc/ticket):

What would be wrong now ?

Sri

[markus_doehr2]

> omtr-sap-sman:osmadm 3> /usr/sap/saprouter/linux-x86_64-glibc2.3/sapgenpse get_pse -v -r certreq -p local.pse "CN=omtr, OU=0000894394, OU=SAProuter, O=SAP, C=DE"

> Got absolute PSE path "/home/osmadm/sec/local.pse".

If you put your PSE path there you need to copy the ticket also to that location /home/osmadm/sec. Then try again.

Markus

[Former Member]

Hey Markus thanks for the reply, I have done and could successfully get the certificate and importe it successfully. Now when I try to start the saprouter it ending up with error as below: (output of dev_rout file)

-

---

trc file: "dev_rout", trc level: 1, release: "710"

-

---

Tue Aug 26 14:21:48 2008

SAP Network Interface Router, Version 39.1 (SP3)

command line arg 0: ./saprouter

command line arg 1: -r

command line arg 2: -G

command line arg 3: routerlog

command line arg 4: -S

command line arg 5: 3299

command line arg 6: -K

command line arg 7: p:CN=omtr, OU=0000894394, OU=SAProuter, O=SAP, C=DE

trcfile dev_rout

SncInit(): Initializing Secure Network Communication (SNC)

AMD/Intel x86_64 with Linux (st,ascii,SAP_UC/size_t/void* = 8/64/64)

SncInit(): Trying builtin default as a

gssapi library name: "sncgss.so".

• ERROR => DlLoadLib: dlopen()= sncgss.so: cannot open shared object file: No such file or directory -> DLENOACCESS (0,Success) [dlux.c 314]

• ERROR => SncPDLInit(): DlLoadLib("sncgss.so")=DLENOACCESS

[sncxxdl.0340]*** ERROR => SncPDLInit()==SNCERR_INIT, Adapter (#0) sncgss.so not loaded

[sncxxdl.0604]<<- SncInit()==SNCERR_INIT

sec_avail = "false"

• ERROR => NiSncInit: SncInit failed (rc=-1) [nisnc.c 653]

• ERROR => main: NiSncInit failed (rc=-17) [nirout.cpp 1350]

*****************************************************************************

*

• ERROR SNC processing failed:

• SncInit

*

• TIME Tue Aug 26 14:21:48 2008

• RELEASE 710

• COMPONENT NI (network interface)

• VERSION 39

• RC -17

• MODULE nisnc.c

• LINE 652

• DETAIL NiSncInit: sncrc=-1

• COUNTER 3

*

*****************************************************************************

<<- ERROR: SncDone()==SNCERR_INIT_FIRST

Please take a look and suggest me what is wrong ?

Thanks

[Former Member]

Hi Markus when I am trying to start the SAProuter now its coming to reading routtab stage and getting struck, when I tried to see the dev_rout file, its not getting created:

• ERROR => CTrcOpen: fopen dev_rout

-

---

trc file: "dev_rout", trc level: 1, release: "710"

-

---

Thu Aug 28 09:30:56 2008

SAP Network Interface Router, Version 39.1 (SP3)

command line arg 0: ./saprouter

command line arg 1: -r

command line arg 2: -R

command line arg 3: /usr/sap/saprouter/saprouttab

command line arg 4: -S

command line arg 5: 3299

command line arg 6: -K

command line arg 7: p:CN=omtr, OU=0000894394, OU=SAProuter, O=SAP, C=DE

trcfile dev_rout

SncInit(): Initializing Secure Network Communication (SNC)

AMD/Intel x86_64 with Linux (st,ascii,SAP_UC/size_t/void* = 8/64/64)

SncInit(): Trying environment variable SNC_LIB as a

gssapi library name: "/usr/sap/saprouter/libsapcrypto.so".

File "/usr/sap/saprouter/libsapcrypto.so" dynamically loaded as GSS-API v2 library.

The internal Adapter for the loaded GSS-API mechanism identifies as:

Internal SNC-Adapter (Rev 1.0) to SECUDE 5/GSS-API v2

main: pid = 1516, ppid = 1256, port = 3299, parent port = 0 (0 = parent is not a saprouter)

no logging active

reading routtab: '/usr/sap/saprouter/saprouttab'

What could be the issue ?

Thanks

Sri

[markus_doehr2]

> *** ERROR => CTrcOpen: fopen dev_rout

Is the logged on user permitted to create files in the directory you are when you start the saprouter?

Markus

[Former Member]

Hi Markus I am logged in as <sidadm>, I think this user is not permitted to create the files, can you let me know how to tackle this ?

I tried to start the saprouter from the root, here is the output of dev_rout file:

-

---

trc file: "dev_rout", trc level: 1, release: "710"

-

---

Thu Aug 28 12:02:21 2008

SAP Network Interface Router, Version 39.1 (SP3)

command line arg 0: ./saprouter

command line arg 1: -r

command line arg 2: -R

command line arg 3: /usr/sap/saprouter/saprouttab

command line arg 4: -S

command line arg 5: 3299

command line arg 6: -K

command line arg 7: p:CN=omtr, OU=0000894394, OU=SAProuter, O=SAP, C=DE

SncInit(): Initializing Secure Network Communication (SNC)

AMD/Intel x86_64 with Linux (st,ascii,SAP_UC/size_t/void* = 8/64/64)

SncInit(): Trying environment variable SNC_LIB as a

gssapi library name: "/usr/sap/saprouter/libsapcrypto.so".

File "/usr/sap/saprouter/libsapcrypto.so" dynamically loaded as GSS-API v2 library.

The internal Adapter for the loaded GSS-API mechanism identifies as:

Internal SNC-Adapter (Rev 1.0) to SECUDE 5/GSS-API v2

main: pid = 2189, ppid = 927, port = 3299, parent port = 0 (0 = parent is not a saprouter)

reading routtab: '/usr/sap/saprouter/saprouttab'

Thanks

Sri

Edited by: Srikar Vankadaru on Aug 28, 2008 8:04 PM

[markus_doehr2]

Try the following:

login as root

cd /usr/sap
chown -Rf <sid>adm:sapsys saprouter

Then try again to start it.

Markus

[Former Member]

Hi Markus its coming to this point and hanging:

-

---

[root@omtr-sap-sman ~]# cd /usr/sap

[root@omtr-sap-sman sap]# chown -Rf osmadm:sapsys saprouter

[root@omtr-sap-sman sap]# su - osmadm

omtr-sap-sman:osmadm 9> ./saprouter -r -R /usr/sap/saprouter/saprouttab -S 3299 -K "p:CN=omtr, OU=0000894394, OU=SAProuter, O=SAP, C=DE"

trcfile dev_rout

no logging active

-

---

What would be wrong now ?

Thanks

Sri

[markus_doehr2]

What do you see in dev_rout now?

Markus

[Former Member]

The saprouter folder was not having the files "cred_v2"& "local.pse" which were generated during the certificate generation process, I coped those files to the saprouter directory and started the router, which solved my problem.

Thanks to all again for the support.

[selvakumar_p]

hi Markus,

I have faced the saprouter sapgenpse error.

Could you please help me.

the errors are given below

Got absolute PSE path "/home/eppadm/sec/local.pse".

Please enter PIN: ********

Please reenter PIN: ********

Supplied distinguished name: "CN=XXXXXXXX, OU=YYYYYYYY, OU=SAProuter, O=SAP, C=DE"

Creating PSE with format v2 (default)

No License ticket file found (trying /home/eppadm/sec/ticket):

No License ticket file found (trying /usr/local/secude/etc/ticket):

get_pse: Can't create PSE.

ERROR in af_create: (18946/0x4a02) Ticket error : "No License ticket file found (trying /home/eppadm/sec/ticket):

No License ticket file found (trying /usr/local/secude/etc/ticket):

"

ERROR in ??: (18946/0x4a02) Ticket error : "No License ticket file found (trying /home/eppadm/sec/ticket):

No License ticket file found (trying /usr/local/secude/etc/ticket):

Anybody know or attended this error Please guide me.

Regards,

rose.

[markus_doehr2]

The error message is pretty clear:

> No License ticket file found (trying /home/eppadm/sec/ticket):

> No License ticket file found (trying /usr/local/secude/etc/ticket):

> get_pse: Can't create PSE.

> ERROR in af_create: (18946/0x4a02) Ticket error : "No License ticket file found (trying /home/eppadm/sec/ticket):

> No License ticket file found (trying /usr/local/secude/etc/ticket):

> "

> ERROR in ??: (18946/0x4a02) Ticket error : "No License ticket file found (trying /home/eppadm/sec/ticket):

> No License ticket file found (trying /usr/local/secude/etc/ticket):

If you download the sapcrypto software you will also have a file "ticket" which is the license. Copy that file in one of the given directorries.

Markus

[selvakumar_p]

hi Markus,

The command succeeded.

thank you very much for your guide

now i want where to create file "srcert".

/usr/sap/saprouter/

or

/usr/sap/saprouter/linux-x86_64-glibc2.3

give me solution

Regards,

rose.