SUM SP17 fails on Specify OS User credentials

[Former Member]

Hi,

I am upgrading Netweaver from 7.4 to 7.5 using SUM SP17 patch 8

After logging in to SUM from my browser using http://<server>:1128/lmsl/sumjava/VA6/index.html I get to the the Specify OS User credentials screen where I enter  my local va6adm user. The step fails and the message says to look at SAP Note 927637, which I have done but not totally understanding. I have tried adding the row service/admin_user=./va6adm and restarting, but without success.

The INPUT_OS_USER_PASSWORDS_02 contains

Sep 8, 2016 11:47:53 AM [Info  ]: Process ID 93, name sapcontrol has been started.

Sep 8, 2016 11:47:53 AM [Info  ]:  Command line: sapcontrol -nr 00 -host SEVA162 -prot NI_HTTPS -function ParameterValue SAPPROFILE

Sep 8, 2016 11:47:53 AM [Info  ]:  Standard out: D:\usr\sap\VA6\SUM\sdt\tmp\SAPCONTROL_PARAMETERVALUE_00_08.OUT

Sep 8, 2016 11:47:53 AM [Info  ]: Process ID 93 has been started.

Sep 8, 2016 11:47:53 AM [Info  ]: Waiting for process ID 93, name sapcontrol to finish.

Sep 8, 2016 11:47:53 AM [Info  ]: Process ID 93, name sapcontrol has been finished, exit code 1.

Sep 8, 2016 11:47:53 AM [Info  ]: Error in detection of instance profile path/dir via sapcontrol

Sep 8, 2016 11:47:53 AM [Warning]: Can not find profile on central instance. System PKI will not be used.

Sep 8, 2016 11:47:53 AM [Info  ]: Process ID 94, name sapcontrol has been started.

Sep 8, 2016 11:47:53 AM [Info  ]:  Command line: sapcontrol -nr 00 -host SEVA162 -prot NI_HTTPS -function AccessCheck Stop

Sep 8, 2016 11:47:53 AM [Info  ]:  Standard out: D:\usr\sap\VA6\SUM\sdt\tmp\SAPCONTROL_ACCESSCHECK_00_07.OUT

Sep 8, 2016 11:47:53 AM [Info  ]: Process ID 94 has been started.

Sep 8, 2016 11:47:53 AM [Info  ]: Waiting for process ID 94, name sapcontrol to finish.

Sep 8, 2016 11:47:54 AM [Info  ]: Process ID 94, name sapcontrol has been finished, exit code 1.

Sep 8, 2016 11:47:54 AM [Info  ]: Process ID 95, name sapcontrol has been started.

Sep 8, 2016 11:47:54 AM [Info  ]:  Command line: sapcontrol -nr 00 -host SEVA162 -prot NI_HTTPS -function ParameterValue SAPPROFILE

Sep 8, 2016 11:47:54 AM [Info  ]:  Standard out: D:\usr\sap\VA6\SUM\sdt\tmp\SAPCONTROL_PARAMETERVALUE_00_09.OUT

Sep 8, 2016 11:47:54 AM [Info  ]: Process ID 95 has been started.

Sep 8, 2016 11:47:54 AM [Info  ]: Waiting for process ID 95, name sapcontrol to finish.

Sep 8, 2016 11:47:54 AM [Info  ]: Process ID 95, name sapcontrol has been finished, exit code 1.

Sep 8, 2016 11:47:54 AM [Info  ]: Error in detection of instance profile path/dir via sapcontrol

Sep 8, 2016 11:47:54 AM [Warning]: Can not find profile on central instance. System PKI will not be used.

Sep 8, 2016 11:47:54 AM [Info  ]: Process ID 96, name sapcontrol has been started.

Sep 8, 2016 11:47:54 AM [Info  ]:  Command line: sapcontrol -nr 00 -host SEVA162 -prot NI_HTTPS -function GetProcessList

Sep 8, 2016 11:47:54 AM [Info  ]:  Standard out: D:\usr\sap\VA6\SUM\sdt\tmp\SAPCONTROL_GETPROCESSLIST_00_04.OUT

Sep 8, 2016 11:47:54 AM [Info  ]: Process ID 96 has been started.

Sep 8, 2016 11:47:54 AM [Info  ]: Waiting for process ID 96, name sapcontrol to finish.

Sep 8, 2016 11:47:54 AM [Info  ]: Process ID 96, name sapcontrol has been finished, exit code 3.

Sep 8, 2016 11:47:54 AM [Info  ]: The sapcontrol service on host SEVA162 and instance 00 is started.

Sep 8, 2016 11:47:54 AM [Info  ]: Dialog eliminator UserCredentialsEliminator does not allow to omit dialog UserCredentialsDialog

Sep 8, 2016 11:48:03 AM [Info  ]: Boolean variable message: false

Sep 8, 2016 11:48:03 AM [Info  ]: Process ID 97, name sapcontrol has been started.

Sep 8, 2016 11:48:03 AM [Info  ]:  Command line: sapcontrol -nr 00 -host SEVA162 -user va6adm-prot NI_HTTPS -function ParameterValue SAPPROFILE

Sep 8, 2016 11:48:03 AM [Info  ]:  Standard out: D:\usr\sap\VA6\SUM\sdt\tmp\SAPCONTROL_PARAMETERVALUE_00_10.OUT

Sep 8, 2016 11:48:03 AM [Info  ]: Process ID 97 has been started.

Sep 8, 2016 11:48:03 AM [Info  ]: Waiting for process ID 97, name sapcontrol to finish.

Sep 8, 2016 11:48:03 AM [Info  ]: Process ID 97, name sapcontrol has been finished, exit code 0.

Sep 8, 2016 11:48:03 AM [Info  ]: Process ID 98, name sapcontrol has been started.

Sep 8, 2016 11:48:03 AM [Info  ]:  Command line: sapcontrol -nr 00 -host SEVA162 -user va6adm-systempki \\SEVA162\sapmnt\VA6\SYS\profile\VA6_J00_SEVA162 -function AccessCheck Stop

Sep 8, 2016 11:48:03 AM [Info  ]:  Standard out: D:\usr\sap\VA6\SUM\sdt\tmp\SAPCONTROL_ACCESSCHECK_00_08.OUT

Sep 8, 2016 11:48:03 AM [Info  ]: Process ID 98 has been started.

Sep 8, 2016 11:48:03 AM [Info  ]: Waiting for process ID 98, name sapcontrol to finish.

Sep 8, 2016 11:48:03 AM [Info  ]: Process ID 98, name sapcontrol has been finished, exit code 1.

Sep 8, 2016 11:48:03 AM [Info  ]: Process ID 99, name sapcontrol has been started.

Sep 8, 2016 11:48:03 AM [Info  ]:  Command line: sapcontrol -nr 00 -host SEVA162 -user va6adm-systempki \\SEVA162\sapmnt\VA6\SYS\profile\VA6_J00_SEVA162 -function GetProcessList

Sep 8, 2016 11:48:03 AM [Info  ]:  Standard out: D:\usr\sap\VA6\SUM\sdt\tmp\SAPCONTROL_GETPROCESSLIST_00_05.OUT

Sep 8, 2016 11:48:03 AM [Info  ]: Process ID 99 has been started.

Sep 8, 2016 11:48:03 AM [Info  ]: Waiting for process ID 99, name sapcontrol to finish.

Sep 8, 2016 11:48:03 AM [Info  ]: Process ID 99, name sapcontrol has been finished, exit code 1.

Sep 8, 2016 11:48:03 AM [Info  ]: The sapcontrol service on host SEVA162 and instance 00 is not started.

Sep 8, 2016 11:48:03 AM [Info  ]: Process ID 100, name sapcontrol has been started.

Sep 8, 2016 11:48:03 AM [Info  ]:  Command line: sapcontrol -nr 00 -host SEVA162 -user va6adm-systempki \\SEVA162\sapmnt\VA6\SYS\profile\VA6_J00_SEVA162 -function GetProcessList

Sep 8, 2016 11:48:03 AM [Info  ]:  Standard out: D:\usr\sap\VA6\SUM\sdt\tmp\SAPCONTROL_GETPROCESSLIST_00_06.OUT

Sep 8, 2016 11:48:03 AM [Info  ]: Process ID 100 has been started.

Sep 8, 2016 11:48:03 AM [Info  ]: Waiting for process ID 100, name sapcontrol to finish.

Sep 8, 2016 11:48:03 AM [Info  ]: Process ID 100, name sapcontrol has been finished, exit code 1.

Sep 8, 2016 11:48:03 AM [Info  ]: The sapcontrol service on host SEVA162 and instance 00 is not started.

Sep 8, 2016 11:48:03 AM [Info  ]: Dialog eliminator UserCredentialsEliminator does not allow to omit dialog UserCredentialsDialog

The command:sapcontrol -nr 00 -host SEVA162 -user va6adm-prot NI_HTTPS -function ParameterValue SAPPROFILE gives

[Former Member · Accepted solution]

contd....

The command:sapcontrol -nr 00 -host SEVA162 -user va6adm-prot NI_HTTPS -function ParameterValue SAPPROFILE gives

sapparam: sapargv(argc, argv) has not been called!

sapparam(1c): No Profile used.

sapparam: SAPSYSTEMNAME neither in Profile nor in Commandline

08.09.2016 13:30:21

ParameterValue

FAIL: HTTP error, HTTP/1.1 401 Unauthorized

If I add the password to the command line for my va6adm user, it works

I also get a lot of errors in the output files saying

Loading instance PSE failed

[Former Member · Accepted solution]

Hello Johan,

A couple of things.

1. I would suggest you update your hostagent before starting. Older levels of hostagent have caused countless problems in the past.

2. Did you run startup confighostagent <SID> before you started SUM ?

3. Have you tried performing a restart of the sapstartsrv service ?

4. As additional bedtime reading have a look at the following additional note: 1563660 - sapcontrol, user authorization issues (SUM)

5. Please explain what part of 927637 is causing a misunderstanding and we'll try and help you out.

Give the above a try and come back to us if it's still not working for you.

KR,

Amerjit

[isaias_freitas · Accepted solution]

Hello Johan,

The command:sapcontrol -nr 00 -host SEVA162 -user va6adm-prot NI_HTTPS -function ParameterValue SAPPROFILE gives

sapparam: sapargv(argc, argv) has not been called!
sapparam(1c): No Profile used.
sapparam: SAPSYSTEMNAME neither in Profile nor in Commandline

Looks like the issue addressed at the SAP note 1642340.

Regards,

Isaías

[former_member227283 · Accepted solution]

Hi Johan.

Can you please check if any logs are written in  .../SUM/sdt/tmp

If it has latest logs and error message in it, kindly share the same.

Regards,

Anil Bhandary

[Former Member · Accepted solution]

Hi Isaias,

Yes, that note seems interesting.

When looking in my netweaver system I have in the <sapinst>/<sid/J00/sec folder two files
from when the system was installed:

1) sap_system_pki_instance.pse
2) SAPSSLS.pse

For me, it looks like my system is missing the SAPSSLC.pse file.
Is this correct, and if so, how can I create it?

Br,

Johan

[Former Member · Accepted solution]

Hi Amerjit,

1) I have already updated my hostagent.
2) Yes, I did that command
3) Yes, I have restarted sapstartsrv for all instances
4) I have already tested SDEFAULT, DEFAULT and NONE for service/protectedWebMethods
    The SUM behaves differently, but I have no success in getting my sidadm user to work
5) The solution in 927637 says to add service/admin_user. I have done so for my sidadm user, but 

     that still doesnot help

Br,

Johan 

[Former Member · Accepted solution]

Hi Anil,

Look in my own reply to my initial post. Those are the errors that I am seeing in the output log files in /SUM/sdt/tmp.

Br,

Johan

[former_member227283 · Accepted solution]

Hi Johan,

Did you had a look to SAP note:

1563660 - sapcontrol, user authorization issues (SUM)

My understanding is, if SAPSSLC.pse is not able to read by sapcontrol then it should give an error as SSL***** not found and not FAIL: HTTP error, HTTP/1.1 401 Unauthorized.

Regards,

Anil Bhandary

[isaias_freitas · Accepted solution]

Hello Johan,

I do not know how you could create it from the Java-level (if it is even possible).

From OS level, you could use the sapgenpse tool.

Best regards,

Isaías

[Former Member · Accepted solution]

Hi Anil,

Yes, I have checked that note and tested setting the service/webprotectedmethods to SDEFAULT, DEFAULT and NONE. The behavior from SUM and sapcontrol is different for each selection, but it still does not work.

It seems my system is missing the SAPSSLC.pse file.

Best regards,

Johan

[Former Member · Accepted solution]

Hi Isaias,

Sorry for my low level of knowledge, but how can I create it from OS level using sapgenpse tool?

I have the login to the server, but I don't know the parameters to use for sapgenpse.

Best Regards,

Johan

[former_member227283 · Accepted solution]

Hi Johan,

Run the below command and share the output in txt file.

sapcontrol -nr 00 -host SEVA162 -user va6adm <user password> -prot NI_HTTPS -debug -function GetInstanceProperties

Regards,

Anil

[isaias_freitas · Accepted solution]

Hello Johan,

Executing the tool without any arguments will give you the tool's help .

I could not find an SAP note that would give more details about the tool's usage.

Maybe you can find this at the help.sap.com or at another SCN thread...

Best regards,

Isaías

[Former Member · Accepted solution]

Hi Anil,

I have attached the output from the sapcontrol command.

Best regards,

Johan

sapcontrol_output.txt.zip

[former_member227283 · Accepted solution]

Thanks Johan,

Output says connection is ok with credential provided.

Can you please attach the below log files.

SAPCONTROL_ACCESSCHECK_00_08.OUT

SAPCONTROL_GETPROCESSLIST_00_05.OUT

SAPCONTROL_GETPROCESSLIST_00_06.OUT

Regards,

Anil Bhandary

[Former Member · Accepted solution]

Hi Anil,

The requested files are attached.

Br,

Johan

SAPCONTROL_GETPROCESSLIST_00_05_OUT.txt.zip

SAPCONTROL_GETPROCESSLIST_00_06_OUT.txt.zip

SAPCONTROL_ACCESSCHECK_00_08_OUT.txt.zip

[former_member227283 · Accepted solution]

Hi Johan,

Please refer the SAP note:

1642340 - sapcontrol SSL usage

You are facing the issue when SAP control call parameter -prot -HTTPS which has mean has been mentioned in above note.

Regards,

Anil

[former_member227283 · Accepted solution]

Hi Johan,

Addtion to above:

debug log says your user is reading the certificate from home directory, would suggest to set the Enviornment variable SECUDIR to <sapinst>/<sid/<insta>/sec for user va6adm.

Also follow the above note provided earlier.

Regards,

Anil Bhandary

[Former Member · Accepted solution]

Hi Anil,

Thank you very much for all your answers.

Now both you and Isaias in this thread has pointed out note 1642340, which I also find as a likely cause to my problem.

When you say setting the environment variable SECUDIR, do you mean it as setting a windows environment variable on user level or should i add something to the profile files?

Also my system seem to be missing the SAPSSLC.pse file in my sec directory. Do you know how I can add this and set credentials for my va6adm user?

I am sorry about all the questions, but my knowledge on Netweaver is very limited and I am learning by doing the upgrade procedure.

Best regards,

Johan

[former_member227283 · Accepted solution]

Dear Johan,

Please follow below steps:

1. Set env on windows level.

2. Logoff and login va6adm

3. Stop SAP and restart SAP services from windows level

4. Start SAP

Then retry the SUM still there is a issue, then please share the output of below command.

sapcontrol -nr 00 -host SEVA162 -user va6adm <user password> -prot NI_HTTPS -debug -function GetInstanceProperties

Regards,

Anil

[Former Member · Accepted solution]

Hi Anil,

SECUDIR added as environment variable.

Still SUM cannot accept the va6adm user.

I attach the new output from the sapcontrol command

Br,

Johan

sapcontrol_getinstanceproperties_after_SECUDIR_env_variable_added_output.txt.zip

[former_member227283 · Accepted solution]

Dear Johan,

Again I can see from the log the locatin of SECUDIR is not correct.

SECUDIR should point to D:\usr\sap\VA6\<INSTANCE DIRECTORY>\sec

1. Set the correct SECUDIR.

2. Logoff and login va6adm

3. Rename folder D:\usr\sap\VA6\<INSTANCE DIRECTORY>\sec to sec_old

4. Create new folder sec

5. Restart SAP instance and SAP services

6. Retry SUM

Let me know the result.

Regards,

Anil Bhandary

[Former Member · Accepted solution]

Hi Anil,

Now I have corrected the SECUDIR variable and did the steps you asked.
Still SUM is failing in the same place.

The files in the D:\usr\sap\VA6\SUM\sdt\tmp folder all gives the error
"Loading Instance PSE Failed" when running the sapcontrol command with -systempki parameter.

Best regards,

Johan

[former_member227283 · Accepted solution]

Dear Johan,

Kindly follow the below SAP note without skipping any steps for solution section.

2200230 - Problems with use of system PKI

Regards,

Anil

[Former Member · Accepted solution]

Hi Anil,

The note 2200230 led me to the solution.

The problem was an old SAPCRYPTOLIB version that created the sap_system_pki_instance.pse file with wrong Windows access permission, so user <sid>adm was not even allowed to view the permissions of the file.

An upgrade of the SAPCRYPTOLIB fixed the issue and now SUM continues.

Thank you so much for your help.

Best regards,

Johan

[former_member185239]

Hi Johan,

Can you run the command below two command and paste the output.

1. sapcontrol -nr 00 -host SEVA162 -user va6adm-systempki \\SEVA162\sapmnt\VA6\SYS\profile\VA6_J00_SEVA162 -function GetProcessList

if it works , then run the below command

2. sapcontrol -nr 00 -host SEVA162 -user va6adm-systempki \\SEVA162\sapmnt\VA6\SYS\profile\VA6_J00_SEVA162 -function GetProcessList -debug

With Regards

Ashutosh Chaturvedi

[Former Member]

Hi Ashutosh,

I have attached a text-file with the output from the sapcontrol command.

Best regards,

Johan

sapcontrol_getprocesslist_output.txt.zip

[former_member185239]

Dear Johan,

Kindly set the parameter service/webprotectedmethods = DEFAULT in all the profiles(instnace profile,DEFAULT profile) of the system. including the ASCS profiles as well.

Then take a restart of the system and sapstartsrv services as well.

Then try to run the command

sapcontrol -nr 00 -host SEVA162 -user va6adm-prot NI_HTTPS -function ParameterValue SAPPROFILE

With Regards

Ashutosh Chaturvedi

[Former Member]

Hi Ashutosh,

This is the result of the SAPPROFFILE Parametervalue output.

C:\Users\va6adm>sapcontrol -nr 00 -host SEVA162 -user va6adm-prot NI_HTTPS -function ParameterValue SAPPROFILE

09.09.2016 10:50:38

ParameterValue

OK

\\SEVA162\sapmnt\VA6\SYS\profile\VA6_J00_SEVA162

Br,

Johan

[former_member185239]

Hi Johan,

Output is after adding the parameters in all the profile and after taking a restart.

if yes , then try to repeat the same phase in SUM and also the screenshot of the error which you are getting in SUM.

With Regards

Ashutosh Chaturvedi

[Former Member]

Hi Ashutosh,

Yes, the output was after the change of the profiles and doing a restart.

SUM Phase still fails in the same way as previous. Screenshot is attached.

Br,

Johan

[Former Member]

Hi Johan,

As a workaround did you tried with...

Check the option Authentication with user and password is not required

if the takes SUM ahead?

Try this option if you are sure that va6adm password is correct and you're able to login in to all the application servers successfully.

Regards

Prithviraj

[Former Member]

Hi Prithviraj,

Yes I have tried that option, but it does not help.

I am sure my password is correct and I can use it in sapcontrol commands on the application server.

Br,

Johan

[former_member185239]

Hi Johan,

You have to follow the below steps to overcome the problem which you are facing

As of SUM 1.0 SP16 with patch level 12 or higher, you can deactivate the system PKI usage. Instead, you can continue using the authentication with <SID>adm and password. Proceed as follows:

1. Stop the SAPup processes
2. Check if the file <SUM_DIR>/abap/bin/SAPup_add.par exist. If not, create it.
3. Add the following line to SAPup_add.par: /sapcontrol/systempki = OFF
4. Restart SUM again

Check the sapnote  2197897 - Central Note - Software Update Manager 1.0 SP16 [lmt_007]

Kindly let me know if you face any problem while maintaining the value

With Regards

Ashutosh Chaturvedi

[former_member185239]

Hi Johan,

Dont try the option Authentication with user and password is not required as this will create a problem in execution phase and to overcome the problem you have to implement SSL for saphostagent.

In my previous reply , you have to disable the usage of systempki and this will resolve your problem

With Regards

Ashutosh Chaturvedi

[Former Member]

Hi Ashutosh,

I tested adding the file you said, but when SUM runs it anyway uses systempki in the sapcontrol parameters.

Is the turning off systempki really for Java systems, since the file is located in the abap directory?
I have only a Java based Netweaver installation.

Best regards,

Johan

[former_member185239]

Hi Johan,

Have you stopped the SAPup process at OS level?

Let me check , few sapnotes and SUM directory.

With Regards

Ashutosh Chaturvedi

[Former Member]

Hi Johan,

Please check below sapnote

https://launchpad.support.sap.com/#/notes/2346128/E

SUM doesn't accept user/password in "Specify OS User Credentials" step

Also make sure you have an entry 'sapctrl00' in services file

Regards

Prithviraj

[former_member185239]

Hi Johan,

Kindly go through the sapnotes

2314382 - SUM stops in Phase PREP_INPUT/INSTANCELIST_PRE with error File '/profile/NO_INFO' does not exist: No such file or directory

1642340 - sapcontrol SSL usage

With Regards

Ashutosh Chaturvedi