404 error while accessing sicf services via apache reverse proxy

[Former Member]

Hi,

I set up an reverse proxy with apache 2.2 and try to access SICF Services via this proxy. I got the following error message from the sap system:

Service cannot be reached

The termination occurred in system SMP with error code 404 and for the reason Not found.

The selected virtual host was 0 .

What can I do?

Please select a valid URL.

If you do not yet have a user ID, contact your system administrator.

ErrorCode:ICF-NF-http-c:000-u:SAPSYS-l:E-i:NE-SSMP01_SMP_00-v:0-s:404-r:Notfound

When I access J2EE services via the proxy it works.

Is there any configuration which have to be done in the ABAP Stack for accessing Services via the proxy server?

For tests I tried to access the simple ping service ( /default_host/sap/public/ )

Thanks and best regards,

Tim

[Former Member]

For one, the services are deactivated by default. You should only activate those which you use.

Please check in SICF whether the service you are testing is activated?

> simple ping service

You might for example not want your SAP system to be pinged from the internet, so you need to proactively enable this, and possibly use network zones to make it "crispy on the outside and softer on the inside"..

Note that the authentication settings also "cascade" down the service hierarchy as inherited settings!

Cheers,

Julius

[Former Member]

Hi Julius,

the Service is up and running and I allready tested it successfully without proxy.

The following error from the dev_icm trace file could be interesting:

[Thr 4260] IctCmOpen#1712 R '/sap/public/ping?sap-client=001&&&GZ=1&A6E90000&'.0 (- MEM) 419430400 27 -> 000000000E8E1C90 -1 rc=20

Best regards,

Tim

[Former Member]

Hi,

Please check the Reverse proxy wiki on SDN : it has excellent information for Apache as a reverse proxy.

For example :

For an abap backend you need at least the Apache directive :

ProxyPreserveHost on

Did you redirect the URL only to the java stack port ?

In case of a dual stack system, I always use the abap ICM as a frontend for both abap and java URLs.

Regards,

Olivier

[Former Member]

Hi Oliver,

I allready checked the SDN posts for the reverse proxy. Maybe I missed something.

The ProxyPreserveHost is on.

I redirect to the ICM. I only redirected to the J2EE for tests. This worked by the way withe the same conifiguration.

Here is my apache config:

VirtualHost *:5443>

ServerName domain.com

ServerAdmin test.de

ProxyPreserveHost On

#ProxyVia On

#AllowEncodedSlashes On

##########################

1. Rewrite Rules

1. - forward sap/public/ping?sap-client=001 -> Test Ping

1. - Passthrough /sap/public/ping/*

1. - Redirect any other URL -> Test Ping

RewriteEngine On

RewriteRule ^/sap/public/ping?sap-client=001$ /sap/public/ping?sap-client=001 [R,L]

RewriteRule ^/sap/public/(.*) /sap/public/$1 [PT,L]

RewriteRule (.*) /sap/public/ping?sap-client=001 [R,L]

RewriteLog logs/rewrite_SMP.log

RewriteLogLevel 3

#

##########################

##########################

1. Reverse Proxy to

#

1. - Disable Forward Proxy

1. - Allow Connections from All

1. - Reverse Mapping for 302 Response

1. - Forward / Requests to domain.com:8000

ProxyRequests Off

<Proxy *>

AddDefaultCharset off

Order Allow,Deny

Allow from all

</Proxy>

1. Forward Rules

ProxyPass /sap/public/ping http://domain.com:8000/sap/public/ping?sap-client=001

ProxyPassReverse / http://domain.com:8000/

#

##########################

</VirtualHost>

Best regards,

Tim

[Former Member]

Hi Tim,

The problem may come from an incorrecorrect rewrite rule.

As an example,

to redirect all URL beginning with /sap to a specific abap stack (using https) , I use the following rewrite rule :

RewriteRule ^/sap/(.*) https://myabapserver:443/sap/$1 [P,L]

I don't use a ProxyPass directive.

Regards,

Olivier

[Former Member]

Hi Oliver,

thank you very much for the straight tip. Now it works.

I don't understand why the same configuration works fine with j2ee applications and not with abap. So I have to read the guide for the rewrite engine again

Best regards,

Tim