SNC processing failed on saprouter - could not establish OSS connection

[Former Member]

It must be very simple solution but I am posting it to get a quick reply.

I could not establish OSS connection. When I run RFC test connection I get error "ERROR: SNC processing failed: SncSessionInitiatorAK"

dev_rout on saprouter says something like "No credentials found for this name (not logged on) "

Any idea how i can fix it.

Thanks

[Former Member]

Hi KVR,

I have the same problem here as you. Can you guide me how did you solve this issue. I will appreciate that. Thank you.

[Former Member]

Hi all.

I have the same problem here as you. Can you guide me how did you solve this issue. recently renewel the sap router after that iam facing this problem RFC problem in SM59 SAP_OSS rfc connection problen sap router reneweled sucess fully 

please check the below script

Microsoft Windows [Version 5.2.3790]

(C) Copyright 1985-2003 Microsoft Corp.

C:\Documents and Settings\soladm>cd..

C:\Documents and Settings>cd..

C:\>cd saprouter

C:\saprouter>dir

Volume in drive C has no label.

Volume Serial Number is C4C3-C7F7

Directory of C:\saprouter

04/24/2013  07:18 PM    <DIR>          .

04/24/2013  07:18 PM    <DIR>          ..

03/01/2012  02:07 PM            37,459 Changelog.txt

05/02/2012  04:16 PM               159 cred_v2_old

02/04/2012  01:23 AM               891 LEGAL.TXT

02/04/2012  01:22 AM             2,708 LICENSE.TXT

05/02/2012  04:14 PM             2,551 local.pse_old

04/24/2013  07:18 PM    <DIR>          nt-x86_64

04/24/2013  07:18 PM    <DIR>          ntia64

04/24/2013  07:18 PM    <DIR>          ntintel

05/02/2012  03:38 PM                 0 SIGNATURE.SMF

05/02/2012  04:09 PM             3,028 srcert_old

02/29/2012  07:06 AM                80 ticket

12/10/2011  03:12 AM                 0 Ver555.pl34

12/10/2011  03:08 AM             2,766 WHICH.TXT

              10 File(s)         49,642 bytes

               5 Dir(s)   4,063,006,720 bytes free

C:\saprouter>cd nt-x86_64

C:\saprouter\nt-x86_64>

C:\saprouter\nt-x86_64>sapgenpse get_pse -v -r certreq -p local.pse "CN=sol, OU=

0000868687, OU=SAProuter, O=SAP, C=DE"

Got absolute PSE path "C:\saprouter\local.pse".

Please enter PIN:

Please reenter PIN:

Supplied distinguished name: "CN=sol, OU=0000868687, OU=SAProuter, O=SAP, C=DE"

Creating PSE with format v2 (default)

Generating key (RSA, 2048-bits) ... succeeded.

certificate creation... ok

PSE update... ok

PKRoot... ok

Generating certificate request... ok.

C:\saprouter\nt-x86_64>dir

Volume in drive C has no label.

Volume Serial Number is C4C3-C7F7

Directory of C:\saprouter\nt-x86_64

04/27/2013  10:34 AM    <DIR>          .

04/27/2013  10:34 AM    <DIR>          ..

04/27/2013  10:34 AM               992 certreq

05/02/2012  04:03 PM               992 certreq_req

03/01/2012  12:15 PM         2,420,736 sapcrypto.dll

03/01/2012  02:07 PM                42 sapcrypto.lst

03/01/2012  12:15 PM            15,360 sapgenpse.exe

05/02/2012  04:09 PM             3,028 srcert_old

               6 File(s)      2,441,150 bytes

               2 Dir(s)   4,062,994,432 bytes free

C:\saprouter\nt-x86_64>dir

Volume in drive C has no label.

Volume Serial Number is C4C3-C7F7

Directory of C:\saprouter\nt-x86_64

04/27/2013  10:34 AM    <DIR>          .

04/27/2013  10:34 AM    <DIR>          ..

04/27/2013  10:34 AM               992 certreq

05/02/2012  04:03 PM               992 certreq_req

03/01/2012  12:15 PM         2,420,736 sapcrypto.dll

03/01/2012  02:07 PM                42 sapcrypto.lst

03/01/2012  12:15 PM            15,360 sapgenpse.exe

05/02/2012  04:09 PM             3,028 srcert_old

               6 File(s)      2,441,150 bytes

               2 Dir(s)   4,062,969,856 bytes free

C:\saprouter\nt-x86_64>dir

Volume in drive C has no label.

Volume Serial Number is C4C3-C7F7

Directory of C:\saprouter\nt-x86_64

04/27/2013  10:42 AM    <DIR>          .

04/27/2013  10:42 AM    <DIR>          ..

04/27/2013  10:34 AM               992 certreq

05/02/2012  04:03 PM               992 certreq_req

03/01/2012  12:15 PM         2,420,736 sapcrypto.dll

03/01/2012  02:07 PM                42 sapcrypto.lst

03/01/2012  12:15 PM            15,360 sapgenpse.exe

04/27/2013  10:41 AM             3,024 srcert.txt

05/02/2012  04:09 PM             3,028 srcert_old

               7 File(s)      2,444,174 bytes

               2 Dir(s)   4,063,473,664 bytes free

C:\saprouter\nt-x86_64>ren srcert.txt srcert

C:\saprouter\nt-x86_64>dir

Volume in drive C has no label.

Volume Serial Number is C4C3-C7F7

Directory of C:\saprouter\nt-x86_64

04/27/2013  10:43 AM    <DIR>          .

04/27/2013  10:43 AM    <DIR>          ..

04/27/2013  10:34 AM               992 certreq

05/02/2012  04:03 PM               992 certreq_req

03/01/2012  12:15 PM         2,420,736 sapcrypto.dll

03/01/2012  02:07 PM                42 sapcrypto.lst

03/01/2012  12:15 PM            15,360 sapgenpse.exe

04/27/2013  10:41 AM             3,024 srcert

05/02/2012  04:09 PM             3,028 srcert_old

               7 File(s)      2,444,174 bytes

               2 Dir(s)   4,063,473,664 bytes free

C:\saprouter\nt-x86_64>sapgenpse import_own_cert -c srcert -p local.pse

Please enter PIN:

CA-Response successfully imported into PSE "C:\saprouter\local.pse"

C:\saprouter\nt-x86_64>

C:\saprouter\nt-x86_64>sapgenpse seclogin -p local.pse

running seclogin with USER="soladm"

Please enter PIN:

Added SSO-credentials for PSE "C:\saprouter\local.pse"

   "CN=sol, OU=0000868687, OU=SAProuter, O=SAP, C=DE"

C:\saprouter\nt-x86_64>sapgenpse -r -V 2 -K "p=CN=sol, OU=0000868687, OU=SAProut

er, O=SAP, C=DE"

sapgenpse: Unknown/missing command: '-r'

try "sapgenpse -h" for list of available commands.

C:\saprouter\nt-x86_64>saprouter -r -V 2 -K "p=CN=sol, OU=0000868687, OU=SAProut

er, O=SAP, C=DE"

trcfile  dev_rout

*****************************************************************************

*

*  ERROR       SNC processing failed:

*              SncSetMyNameU

*

*  TIME        Sat Apr 27 10:50:02 2013

*  RELEASE     700

*  COMPONENT   NI (network interface)

*  VERSION     38

*  RC          -17

*  MODULE      nisnc.c

*  LINE        661

*  DETAIL      NiSncInit: sncrc=-35

*  COUNTER     3

*

*****************************************************************************

C:\saprouter\nt-x86_64>cd ..

C:\saprouter>sapgenpse get_my_name -v -n issuer

'sapgenpse' is not recognized as an internal or external command,

operable program or batch file.

C:\saprouter>dir

Volume in drive C has no label.

Volume Serial Number is C4C3-C7F7

Directory of C:\saprouter

04/27/2013  10:46 AM    <DIR>          .

04/27/2013  10:46 AM    <DIR>          ..

03/01/2012  02:07 PM            37,459 Changelog.txt

04/27/2013  10:46 AM               151 cred_v2

05/02/2012  04:16 PM               159 cred_v2_old

02/04/2012  01:23 AM               891 LEGAL.TXT

02/04/2012  01:22 AM             2,708 LICENSE.TXT

04/27/2013  10:44 AM             2,551 local.pse

05/02/2012  04:14 PM             2,551 local.pse_old

04/27/2013  10:50 AM    <DIR>          nt-x86_64

04/24/2013  07:18 PM    <DIR>          ntia64

04/24/2013  07:18 PM    <DIR>          ntintel

05/02/2012  03:38 PM                 0 SIGNATURE.SMF

04/27/2013  10:41 AM             3,024 srcert.txt

05/02/2012  04:09 PM             3,028 srcert_old

02/29/2012  07:06 AM                80 ticket

12/10/2011  03:12 AM                 0 Ver555.pl34

12/10/2011  03:08 AM             2,766 WHICH.TXT

              13 File(s)         55,368 bytes

               5 Dir(s)   4,064,014,336 bytes free

C:\saprouter>cd nt-x86_64

C:\saprouter\nt-x86_64>sapgenpse get_my_name -v -n issuer

Opening PSE "C:\saprouter\local.pse"...

PSE (v2) open ok.

Retrieving my certificate... ok.

Getting requested information... ok.

SSO for USER "soladm"

  with PSE file "C:\saprouter\local.pse"

Issuer  : CN=SAProuter CA, OU=SAProuter, O=SAP, C=DE

C:\saprouter\nt-x86_64>cd ..

C:\saprouter>saprouter -r -V 2 -K "p=CN=sol, OU=0000868687, OU=SAProuter, O=SAP,

C=DE"

trcfile  dev_rout

*****************************************************************************

*

*  ERROR       SNC processing failed:

*              SncSetMyNameU

*

*  TIME        Sat Apr 27 10:55:49 2013

*  RELEASE     700

*  COMPONENT   NI (network interface)

*  VERSION     38

*  RC          -17

*  MODULE      nisnc.c

*  LINE        661

*  DETAIL      NiSncInit: sncrc=-35

*  COUNTER     3

*

*****************************************************************************

C:\saprouter

[Reagan]

This message was moderated.

[former_member227283]

hi,

i thing you also have to set enviorement USER=<user with which u have created credential>.

thanks,

Anil

[former_member227283]

Yes , renewing the certificate will require restart of sap router.

Can you share few line of dev_route file, which will give some idea abt error..

Thanks

Anil

[Former Member]

Here is my dev_rout says:

• ERROR => SncPAcquireCred()==SNCERR_GSSAPI [sncxxall.c 1432]

GSS-API(maj): No credentials were supplied

GSS-API(min): No credentials found for this name (not logged on) (USER=Unknown)

Could't acquire INITIATING credentials for

name="p:CN=xxx, OU=xxx, OU=xxx, O=SAP, C=DE"

• ERROR => ErrISetSys: error info too large [err.c 944]

Thu Oct 1 10:13:37 2009

ERROR GSS-API(maj): No credentials were supplied

GSS-API(min): No credentials found for this name (not logged on) (USER

name="p:CN=xxx, OU=xxx, OU=xxx, O=SAP, C=DE"

TIME Thu Oct 1 10:13:37 2009

RELEASE 700

COMPONENT SNC (Secure Network Communication)

VERSION 5

RC -4

MODULE sncxxall.c

LINE 1432

DETAIL SncPAcquireCred

SYSTEM CALL gss_acquire_cred

ERRNO

ERRNO TEXT

DESCR MSG NO

DESCR VARGS GSS-API(maj): No credentials were supplied;;;;

;;;;GSS-API(min): No credentials found for this name (not logged on) (USER;;;;

;;;;name="p:CN=xxx, OU=xxx, OU=xxx, O=SAP, C=DE"

DETAIL MSG N

DETAIL VARGS

COUNTER 4371114

<<- ERROR: SncSessionInitiatorAK()==SNCERR_GSSAPI

• ERROR => NiSncIInitHdlSecurity: SncSessionInitiatorAK failed (rc=-4;1005a9910) [nisnc.c 1082]

• ERROR => NiSnc2Connect C520/-1, 194.39.131.34 (rc=-17) [nirout.cpp 2816]

I have recreated the cred_v2 file. I hope this will fix the issue but do I need to restart saprotuer to take into affect?

[JPReyes]

yes, you need to restart the saprouter

Regards

Juan

[former_member227283]

Hi Bill,

Can you check whether you certificate has been expired or not.

Follow the below step.

1. Stop the SAP ROUTER.

2. Rename the file dev_rout to dev_rout_old

3. Start the sap router.

4. goto sm59 and do connection test of rfc called as SAPOSS

pls let me the know status.

Thanks

Anil

[Former Member]

The certificate is valid, I have ran:

• sapgenpse seclogin -l

• sapgenpse get_my_name -n validity

When check rfc connection I get the error that is posted above: Error Details ERROR: SNC processing failed: SncSessionInitiatorAK

[Former Member]

Hi,

I am not sure but I saw a notification in the SAP market place that SAP is having problems with SAP RFC and they were working on SAP RFC issue.

Regards

Vikranth Kolan

[Former Member]

Where do you see the message. Could you post the link

[Former Member]

I

[Former Member]

If i recreate credential file do i need to restart saprouter?

[Former Member]

HI Bill,

Yes you have to restart the SAProuter.

Before creating the credential file. Please try this.

Login to the Syste.

Execute T-code OSS1> Parameter> Technical Settings & Check the settings as below

SAProuter A Customer Side:-

SAProuter1:

Name : <HOST_NAME OF YOU SAPROUTER>

IP ADDRESS: <LOCAL IP ADDRESS OF YOU SAPROUTER> (There should not be any space before & after this IP address)

Instance No: 99

SAProuter at SAP End

Name : sapserv2

IP Address : 194.39.131.34 (There should not be any space before & after this IP address)

Instance No: 99

SAPnet Message Server

Name: oss001

DB NAME : O01

Instance No: 01

Check this & try. Hpe this will help

[Former Member]

I tried OSS1 transaction earlier but I am not able to connect

[JPReyes]

As i said before, I think your best shot is to redo the certificates and re-register the services

Regards

Juan

[Former Member]

Do renewing the certificate requires restarting of saprouter?

[anindya_bose]

in SM59, for SAPOSS connection check the Logon/Security tab. Do you have SNC activated? Change it to inactive and then try connection test

[Former Member]

How do I know if it was started under registered user.

Under SM59 SNC is inactive already

[JPReyes]

When you created the certificates you specified a user... read the documentation on http://service.sap.com/saprouter

Also, can you open connections on SAP Marketplace? if that works then your problem is related to your router settings on your system, then simply change the settings on transaction OSS1 and the RFC will be regenerated.

Regards

Juan

[anindya_bose]

Use transaction OSS1 to regenerate the RFC

[Former Member]

I tried to opening the connection from sap. It didnt work, it says ERROR SNCp

[JPReyes]

Is this a new SNC or was working before?... if its a new installation I recommend you to go through the installationj guide and do it again.

Regards

Juan

[Former Member]

This is not a new connection, it was working before but I guess it stopped working after we restart it due to power failure

[JPReyes]

Ok... then again, check if saprouter is running as a service under the right user.

Regards

Juan

[Former Member]

we run saprouter as root

[Former Member]

Hi Bill,

Please check the command you are trying to execute saprouter.

If possible please paste the same here.

Cheeers.....,

Raghu

[Former Member]

I get the following error in dev_rout

• ERROR => SncPAcquireCred()==SNCERR_GSSAPI [sncxxall.c 1432]

GSS-API(maj): No credentials were supplied

GSS-API(min): No credentials found for this name (not logged on) (USER=Unknown)

What is this mean?

[Former Member]

when i ran sapgenpse seclogin -l to check the credentials it lists as:

DIRACCESS=FALSE

CRLCHECK=FALSE

what is this mean?

[Former Member]

Please check all these commands ..

#generating the certificate

./sapgenpse get_pse -v -r certreq -p local.pse "CN=<Hostname>, OU=<Customer SMP ID >, OU=SAProuter, O=SAP, C=DE"

#importing the certificate to saprouter

./sapgenpse import_own_cert -c srcert -p local.pse

#checking whether the certificate is installed or not

./sapgenpse seclogin -p local.pse -O root

#starting the router with SNC

saprouter -r -G routerlog -S 3299 -K "p:CN=tdep, OU=<Customer SMP ID >, OU=SAProuter, O=sap, C=DE"

#checking whether the certifcate is installed or not

./sapgenpse get_my_name -n issuer

#starting the SAP Router

./saprouter -r -G routerlog -S 3299 -K "p:CN=<Hostname>, OU=<Customer SMP ID >, OU=SAProuter, O=SAP, C=DE"

[Former Member]

Check whether these env variables are set ..

export SECUDIR=/usr/sap/saprouter;

export SNC_LIB=/usr/sap/saprouter/libsapcrypto.so;

export LD_LIBRARY_PATH=/usr/sap/saprouter;

[JPReyes]

Did you register the credetial according to the guide?...

Also, did you started the SAProuter with the registered user?

Regards

Juan