ABAP Proxy authorization issue when sending message.

[praveen_pillai3]

Hi

We have an interface which uses ABAP proxies. This is used to send a message with attachment, but when i send the message I am getting a 401 error message which says unauthorized.

I checked all the configs on the sending side and i cant fine anythin wrong. I tried SLDCHECK and all looks fine there as well. I have done the configuration in the Integration engine on the sending side as mentioned in the BLOG - Activating ABAP Proxies.

We have 3 XI systems Dev, QA and Prod sharing the same SLD. The configs that we have on the sending system (App Sys.) is given below.

SM59

HTTP connection : SAPISU_XID

Host : XI Dev hostname Service Number 8080 (80 <sys number>)

Path Prefix : /sap/xi/engine?type=entry

USER : XIAPPLUSER

The TCP/IP connections LCRSAPRFC and SAPSLDAPI are also setup on the system which connects to our SLD.

The TCP/IP connections works fine and i am able to test it succesfully, but the HTTP connection fails with an authorization error (401) when i test it. Now the wierd thing is if I use XIAFUSER instead of appuser it works fine, but if i make a copy of XIAFUSER and try that... It fails again.. I know it sounds strange. So i was wondering if there is any setting on XI which restricts HTTP connections to a particular user??

I would really aprpeaciate if you could please give me your thought on this issue...

Cheers

Prav

[Former Member · Accepted solution]

Hi Praveen,

Just test u r hopst weather it is reachable or not in TC "SM49"--

---

>Ping--

---

> Additional Parameters(specify u r host name here)............

If the host is not reachable then u r problem is here ...........

and also check weather u r providing the right credentials or not and also check the RFC connection in "SM59"...................

Kindly make updated

Reward with ponits if helpful

Regards

Sai Ganesh

[praveen_pillai3]

Hi

Thanks for the input.

@Sai: I dont think its realted to access because as I mentioned If I use user XIAFUSER I am able to test the connection succesfully which confirm the system is able to connect.

@Manish: I have checked the password for APPLUSER and its correct. I also checked the roles and SAP_XI_APPL_SERV_USER is assigned to the user.

As I mentioned earlier XIAFUSER works... but a copy of XIAFUSER does not work... So i am not sure if there is any other setting we need to do on the XI Box.

Thanks

Prav

[manish_bhalla2]

Hi Praveen,

You could check the settings for the xi engine service in SICF (.. /sap/xi/engine ). check whether there are any logon parameters given there... there usually aren't.

Have you involved the Basis people in this problem yet?

I can't think of anything else at the moment... if I do, I will get back to you.

Regards

Manish

[manish_bhalla2]

Hi Praveen,

Have found some documentation on SAP Help that might be relevant:

<a href="http://help.sap.com/saphelp_nw04s/helpdata/en/d4/d12940cbf2195de10000000a1550b0/frameset.htm">Service Users for Message Exchange</a>

Especially read the section 'User Authorization'.

Cheers

Manish

[praveen_pillai3]

Hi Manish

Thanks for the input again.

I checked SICF on the XI system and its not set to any user.

The HTTP connection on out prod environment is working fine without any issues and its uses a user which is a copy of XIAPPLUSER. SICF in prod also does not have any user configured for service SAP\XI\Engine.

Thanks for the link, had a look at it, but It looks like these users mentioned are only available with XI7. Our server was upgraded from 3 to 7 and I am not able to find these users on the system.

I tried testing the HTTP connection in prod using a diffrent user and found its the same story there. If i use any use other than the cutom one.. it fails.. could there be any setting in the exchage profile that can affect this??

Thanks for your time and help.

Prav

[manish_bhalla2]

Hi Praveen,

It is the same story... replace PIAPPLUSER with XIAPPLUSER for older systems, or systems that have been upgraded (as opposed to a fresh install).

Will look into the Exchange profile and have athink about it too... and get back to you if anything strikes me.

Another thought... get the Basis guys to check the java authorisations attached to the roles in the Visual Administrator?

Regards

Manish

[manish_bhalla2]

Hi,

I can suggest a few things you can try (maybe you have already)...

1. Check if the password stored with XIAPPLUSER in the HTTP cpnnection is correct.

2. Check the role assigned to XIAPPLUSER (on the XI system). It should be SAP_XI_APPL_SERV_USER

3. Check if the user is locked.

Which version of XI are you using? The new PI7.0 systems sometimes have the user PIAPPLUSER rather than XIAPPLUSER.

Hope this helps.

Regards

Manish