J2EE AE rejected user

[Former Member]

We had a SOAP -> RFC scenario running fine until we install the SP10 to our SAP Netweaver2004s.

After the SP10 installation all our calls to a RFC take this error:

com.sap.aii.af.ra.ms.api.DeliveryException: XIAdapterFramework:GENERAL:com.sap.aii.af.ra.ms.api.ConfigException: Unauthorized: J2EE AE rejected user. Reason: Principal propagation is not active, but technical IS service user was not used (J2EE_ADMIN).

Please, some idea about where could be the problem?

[Former Member]

And also make sure the PP (principal propogation) is configured as mentioned in this doc..

http://help.sap.com/saphelp_nw04/helpdata/en/45/0f16bef65c7249e10000000a155369/frameset.htm

refer SAP Note 974873

Thanks-Gopal

[Former Member]

Hi guys, I'm stucked in this problem yet.

We have installed the Principal Propagation but the error persists. If we check the PP on in the sender/receiver agreement we got a 401 Unauthorized error. It's a little different message error but it seems to be the same problem.

Could the SP10 have screwed up the SAP_XI_APPL_SERV_USER role?

[Former Member]

Hi -

If you don't have a requirement to use PP, then there's no need to configure it since the configuration is somewhat complex. Since the original error message pointed to a PP related error, my suggestion was to check whether any of the PP related configuration had been turned on or enabled, either accidentally or not. Only if you need PP should you proceed with its full configuration. Otherwise make sure any PP related settings in each component is disabled.

Regards,

Jin

[Former Member]

By default Soap Adapter servlet is protected..After installation, did you change the web.xml of adapter j2EE WAS? this can be modified using Visual Administrator..

hope this might help...

thanks-GS

[Former Member]

You're right, this is a weird error. Do you know if any principal propagation (PP) related configuration was initiated since applying SP10?

Don't have any great suggestions, but I would start by checking if any of the PP related settings have been enabled in the various components - for example, in this case, the error text seems to imply that the Integration Server (IS) user XIISUSER or PIISUSER was not used when the IS attempted to pass on the message to the Adapter Engine (AE). So first I would check if the IS, for whatever reason, has PP enabled or active(SXMB_ADM --> Configure Principal Propagation). In Note 974873 there is a PP configuration guide attached to the Note. It describes other areas where you can check for PP related configuration.

Regards,

Jin