Principal Propagation Problems

[Former Member]

Hello All,

I have upgraded our XI to SP19 and want to run the following scenario:

have a webdynpro application on EP6 which calls a synchronos SOAP Adapter from XI which goes to R/3 via RFC, gets some data from the RFC and returns the data back to the webdynpro application on the portal.

I have followed all the weblogs and SAP's documentation on creating the tickets and configuring the J2EE engines and ABAP side.

The problem I am getting is that when I try to call the WS, an actual message is created in the XI, goes to R3 and gets the following response:

<SAP:AdditionalText>com.sap.aii.af.ra.ms.api.DeliveryException: error while processing message to remote system:com.sap.aii.af.rfc.core.client.RfcClientException: could not get a client from JCO.Pool: com.sap.mw.jco.JCO$Exception: (103) RFC_ERROR_LOGON_FAILURE: Name or password is incorrect. Please re-enter</SAP:AdditionalText>

When I remove the principal propagation checkbox from the sender/reciever agreements in the XI - the scenario runs fine, so I know its working.

Of course, the user i logon to the portal has been defined in the XI and in the R3 client.

Does anyone have any idea?

Thanks!

Haim.

[Former Member]

Hello Haim ,

I configured a similar scenario with the following details :

XML Spy <=> XI <=> R/3

But the only hinderance in this is with requirement that what ever soap client we try to communicate it should be able to generate assertion tickets. Hence i couldnt make XML spy to work 100% but what i did is when i tested the message over the XI stack itself , it works when the user defining has SAP_XI_APPL_serv_user role with all stacks reporting the same user name. So as a whole it works on SAP stacks. Now the key question i have is how to set up initial connection settings. Any ideas from you , whether client auth from soap client with sap works?

[Former Member]

Haim,

Do you have the correct support pack for this. You should be on:

Release XI 3.0 (6.40): You applied support package 19.

Release XI 7.0 (7.00): You applied suport package 10.

Can you see the OSS notes:

Note 974873 - Principal Propagation

Note 992860 - Principal Propagation - corrections

Note 996315 - Secure store for "XI Principal Propagation"

Also check the user has the same roles mentioned in the weblog:

/people/alexander.bundschuh/blog/2007/01/16/principal-propagation-in-sap-xi

Also check the same user is used in the SM59 transaction.(RFC Destination) Might be some where you are using the user who dont have sufficient privileges for principal propogation.

---Satish

[Former Member]

Hi, sorry for not mentioning, i'm on XI 3.0 with SP19.

OSS notes just repeat what i've done..

The second one says I need to be on SP20, but im not on it.

I've implemented the corrections and now instead of getting the previous error, im getting a new error:

<SAP:Stack>HTTP response contains status code 401 with the description Unauthorized Authorization error when sending using HTTP (error code: 401, error text: Unauthorized)</SAP:Stack>

The Role was assigned to the user which is the same id in all three systems - EP, XI and R3.

What RFC destination are you refering to? Where am I using RFC destinations?

my reciever communication channel is type RFC and has the PP flag on.

R/3 is returning the error message as I understand it, not the XI...

Do you have any other suggestions??

Thanks!

Haim.

[Former Member]

Haim,

Usually 401 comes when your userid and pwd and wrong. Check in SU01 whether any of user is locked.

---Satish

[Former Member]

Hi,

The user is not locked...

and the password cant be wrong as we're talking about logon tickets - there is no password...

question - in the reciever communication channel which is of type RFC, im specifying the username and password of a specific user in the R3 system which im accessing. is that OK for this scenario?

Thanks again for helping,

Haim.

[Former Member]

That should be fine Haim.

---Satish

[Former Member]

Great, but it still does'nt work...

[Former Member]

Hi,

Can anyone please help??

Has anyone ever tried to do Principal Propagation between EP and R/3 through XI?

Thanks,

Haim.

[Former Member]

i am actually laying my hands through , Quick question : in the receiver communication channel you should have some thing called "Enable principal propagation " instead of entering the regular username and password for R/3 communication channel ? that the basic principle of Principal propagation right?

I am starting my installation over this and if possible would like to know any issues that you came across. My aim is to develop a scenario between

Third party SOAP client <=> XI <=> R/3. Any notes from you ?

Only question i have is w.r.t. configuring SOAP client and XI . The key i am thinking to manage is When ever SOAP client or any client trying to get data from a Webservice hosted on XI , XI requests for a username and password while employing this approach once authenticated through J2EE engine , then implement the whole process rather using any certificates concept bet SOAP client and XI. Please advice as i think this might work.

[Former Member]

This is exactly what im trying to do, though its not enough to enable that checkbox... there is a guide of some configurations that are needed.

However, this seems not to work unfortunately...

If you have any ideas, you'll be well rewarded

Thanks,

Haim.

[Former Member]

Did you try enabling sxmb_adm and w.r.t. interfaces u r working ? i will definately and thats fine with points if both of us get something running thats great do you have yahoo id or gmail id for exchanging details over chat ?

Also , what did you do w.r.t. configuring XI and backend client for R/3 comm channel ?