SAP Cloud Platform Mobile Service Destination to HANA Express edition

[former_member540015]

Hi SolArchs and SAPExperts,

Is there a golden blueprint to connect SAP Cloud Platform Mobile Service DevOps (incl. Consumer Edition) to On-Premise SAP HANA 2.0 Express edition?

Let's take a following scenario:

1/ There is a MTA Application exposing its API via XSOData. It's developed and running on SAP HANA 2.0 Express edition XSA host. No Java, no ABAP in stack, only Node, CDS and OData.

2/ There is a Native iOS Mobile Application definition exposing its API to SAP Cloud Platform SDK for iOS Xcode Application.

3/ We need to establish a destination API from Native iOS Mobile app on SCP Mobile [2] to a MTA app on HANA Express host [1].

The issue I face:

1/ Destination from Native iOS Mobile app on SCP Mobile [2] to SAP HANA Developer Trial database (on HANA 1.0 Neo environment) works perfectly in full development & test scenario.

2/ My attempts to create a Destination from Native iOS Mobile app on SCP Mobile [2] to Internet enabled XSOData services from MTA app on HANA Express host [1] were fail with ping errors and raised hard exceptions from Native iOS app.

3/ The only solution I found from official documentation is to install SAP Cloud Connector into the On-Primise HANA Express network and connect SCP Mobile app via it. Not so brilliant from the TCO PoW as it's require separate (better two or four for failover) host machine, brings redundant (in my case, sometimes it's required) tunneling into landscape over HTTPS public channel.

Your global experience and guidance would be much appreciated.

Thanks,

Valery

[Jitendra_Kansal]

Hi Valery Semichev ,

For your internet enabled OData service, do you have WAS/Reverse proxy things at company firewall level? When you run this service in browser, do you see it working? What kind of authentication it require to access data?

Can you share screenshot/information how did you try pinging this internet enabled service from Mobile Services ? Did you choose Proxy Type as Internet?

Regards

JK

[former_member540015]

Hi Jitendra!

For now it is configured with simple port forwarding over NAT and this XSODATA service does available in the browser over internet, please see /$metadata screenshot below

It uses basic authentication over internet and pings via standard Mobile Service for DevOps Destinations Actions with error.

I found two other possible workarounds to handle this issue:

1/ Create this XSODATA service on XSEngine and set up an external virtual host name in global.ini or

2/ Turn into simple REST API, register on SCP as a Connection and

Both of them have own architecture, development and support limitations so I wouldn't go this way if I have another choice - 3/ SAP Cloud Connector for ex.

So I'm still looking for the golden blueprint from SAP.

[Jitendra_Kansal]

what was the error message when you pinged? I don't see it in your reply.

You can increase log level Log Settings > Proxy , change level to DEBUG and then ping.

Look into "Logs" tab if there is any more information on error

[former_member540015]

This was the ping error:

Log Settings > Proxy is new for me, thanks for this! I'll give it a try and get back to you.

[former_member540015]

Changed to DEBUG, and found only those two relevant in the Logs:

Warning on Foundation: No service instance found to serve request: //ACE/LoggingComponents

Information on Proxy: #closePool(<<my destination name>>)

[former_member540015]

Added DEBUG on Connectivity, Foundation, Security and now I got following in the logs:

Information on Connectivity: try to shut down pool

in addition to:

Information on Proxy: #closePool(<<my destination name>>)

[Jitendra_Kansal]

This "Failed to execute ping" error is mostly because of timeout connection.

Can you try this

1. Click on "Destinations" (left hand side) in mobile service cockpit

2. Select that particular destination and then click on "Edit"

3. Click Next, enter timeout as 20000

4. Next... Finish and try ping once again

What do you see then ?

[former_member540015]

Set the timeout to 20000, but nothing changed. Same "-1 ping failed" error on the screen, same "pool" errors in logs.

20000x1000 didn't change anything either..

[Jitendra_Kansal]

I am not sure if Ping is blocked at network level for the system you are pinging to.

Well, Can you try accessing the data as well? Click on that "destination test" icon displaying before Ping.

Click on "metadata URL" to see if medadata for that service is accessible

and then click "Next" to see Entity set level data

Make sure "destination URL" points to service document https://stest.hana.ondemand.com/c........./Service.xsodata

[former_member540015]

PING is enabled on my network. PORT 51049 is forwarded correctly as per portchecktool.com

Success! I can see your service on <<My External IP Address>> on port (51049) Your ISP/Router/Firewall is not blocking port 51049.

Despite this my HANA 2.0 service is not available via OData Application Destination Test, nor from the SAP Cloud Platform SDK for iOS Project setup wizard, nor from my Native iOS app that works perfectly with the similar XSODATA service hosted on SCP Neo. I mentioned this earlier. As for this particular button the message is: "Check the path provided and destination configuration, ensure that the OData service is available". The Metadata URL https://<<myFQDN>>:51049/xsodata/service.xsodata/$metadata is exactly the same that works just fine if I just copy and paste it into Chrome browser.

There are few new information/warning messages in the Technical Log though:

Information on Foundation: Called Application is not of the required type web: <<my destination name>>

Warning on Proxy: ----------Caught the exception in GWProxy Handle--------- SSL handshake with back end https://<<myFQDN>>:51049/xsodata/service.xsodata/?$format=json failed: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Information on Proxy: ODP request failed: method: GET, url: https://<<myFQDN>>:51049/xsodata/service.xsodata/?$format=json, status: -1, duration: 146 ms, exception: SSLHandshakeException=sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target.

[Jitendra_Kansal]

These Logs provide some hints , well, is it possible if you can create a dummy user/pswd and share it along with URL with me to try it from my end? I have sent you a direct message at https://messages.sap.com

[Ivan-Mirisola]

Hi Valery,

From what I could understand you are trying to consume a HXE exposed service via an Internet Destination. However, the destination service is not able to load the xsodata because it is not trusting the SSL handshake being provided by your HXE box. The following error is clear to me:

unable to find valid certification path to requested target

You should either add all CA Root certificates being provided by your HXE box in the SCP. Under the destination there is a flag called "Use default JDK truststore". Uncheck it and you will be able to upload a certificate there. If can also upload a custom trust store (jks) and then you should provide its password (useful when the certification path can root and intermediate certificates).

You can do this also using the neo command line tool. The blog is a bit old, but it should still work for a destination used by Mobile Services.

Best regards,
Ivan

[former_member540015]

Thank you for certificate management guidance, Ivan! That's worth a try.