ITS returns 409 for ~okCodes specified in URL

[Former Member]

Hi Folks,

we just had a HANA update with an upgrade to 7.40.

The problem is that the ITS / ICF behaves different now.

I had specified a ~okCode parameter In my service in SICF that was previously used as a fallback if no ~okCode parameter was used in the URL.

Now I can ONLY use that okCode at initialization at my application otherwise I get an 409 Server Response:

This is a huge problem to us because the link to the application without any ~okCode has been distributed a lot and changing all that location will take a huge effort and problems. And there are other calls that use a different ~okCode for initialization.

I also tried to use ~okcode_permit (note  1501768 ) but that didn't help.

How can I solve this or get rid of the restrictive okCode checking.

Thx for your support!

[cris_hansen]

Hi Sebastian,

Please share: kernel version/patch level and SAP_BASIS/support package level.

Thanks,

Cris

[Former Member]

Hi Cristiano,

Kernel Release 742 Patch Level 318

SAP_BASIS: 740 SP Level 0013

Hope that helps

Thx

Seb

[cris_hansen]

Hello Sebastian,

SAP note 1501768 holds true. You will need to play around ~okcode_permit and find a suitable value for your service.

I couldn't find a new correction for this settings, except SAP note 2114798 (which was delivered in SAPKB74012).

Kind regards,

Cris

[Former Member]

So this means that I cannot define a "fallback" okcode if none if specified in the URL and simultaneously use ~okcopde_permit as a whitelist?

[former_member194364]

Hello Sebastian,

is the "fallback" okcode always the same value?

have you set this value as well in the specified ~okcode_permit whitelist?

Are you setting ~okcode in the 'GUI Configuration' of your IAC or are you using the WEBGUI service?

Regards,

Oisin

[Former Member]

Hi Oisin,

yes the fallback okCode should be always the same.

I am using the GUI Configuration of my Service in the SICF transaction

... and yes I have tried to specifiy it also in the ~okcode_whitelist but this still prevents the service from being called with any other okcode defined in ~okcode parameter

the behavior needs to be

1) if none specified use the fallback okCode.

2) If one is specified check against the whitelist and proceed if listed.

any idea how to accomplish that?

Thx

Seb

[former_member194364]

Hi Seb,

it is slightly possible. It depends on the parameter that is passed in the URL.

I tested myself.

I created a test WEBGUI service called: webgui-okcode with the following parameters

• ~WEBGUI 1
• ~OKCODE_PERMIT /5,/2
• ~OKCODE_PROHIBIT /3
• ~TRANSACTION SM04
• ~OKCODE /5

Tested the following URLS

/sap/bc/gui/sap/its/test/webgui-okcode?sap-client=000&~transaction=*sm04 dynp_okcode=/5

OR

/sap/bc/gui/sap/its/test/webgui-okcode?sap-client=000&~transaction=*sm04&~okcode=/5

the OKCode is called; this is the same as calling the URL

/sap/bc/gui/sap/its/test/webgui-okcode?sap-client=000

TESTING

/sap/bc/gui/sap/its/test/webgui-okcode?sap-client=000&~transaction=*sm04 dynp_okcode=/2

the /2 okcode code is executed

even though have the parameter ~OKCODE /5 is set in the GUI Configuration.

TESTING

/sap/bc/gui/sap/its/test/webgui-okcode?sap-client=000&~transaction=*sm04&~okcode=/2

or

/sap/bc/gui/sap/its/test/webgui-okcode?sap-client=000&~okcode=/2

I get the

"

The termination occurred with error code  409  and for the reason  Conflict.

"

for a final test I made sure /3 did not execute so I called

/sap/bc/gui/sap/its/test/webgui-okcode?sap-client=000&~transaction=*sm04 dynp_okcode=/3

and

/sap/bc/gui/sap/its/test/webgui-okcode?sap-client=000&~okcode=/3

I get the following message

Service call /sap/bc/gui/sap/its/test/webgui to transaction sm04 was terminated because : ok code /3 is prohibited as start ok code in service webgui for transaction sm04

The termination occurred with error code  409  and for the reason  Conflict.

Hope this helps.

Regards,

Oisin

__________________________________________________