random 401 unauthorized from Adapter Framework

[Former Member]

Hi,

I am working on PI 7.1 SP12.

We are facing an issue in our QA box, where under some load the messages are failing when trying to be sent from IE to AE for delivering to the target system.  The adapter engine is responding with "401 Unauthorized" error, however if we restart some messages they got processed successfully.  If I restart many at the same time, some are processed, many other get stuck again.

In the Java log I found many of entries like this:

LOGIN.FAILED

User: N/A

Authentication Stack: sap.com/com.sap.aii.af.ms.app*MessagingSystem

Login Module                                                               Flag        Initialize  Login      Commit     Abort      Details

1. com.sap.security.core.server.jaas.EvaluateAssertionTicketLoginModule    SUFFICIENT  ok          exception             true       Received no SAP Authentication Assertion Ticket.

2. com.sap.security.core.server.jaas.EvaluateTicketLoginModule             SUFFICIENT  ok          false                 true      

3. com.sap.engine.services.security.server.jaas.BasicPasswordLoginModule   REQUISITE   ok          exception             true       Could not verify password for user UACC.R3_DATASOURCE.PIIS_PSQ

the user itself is ok, as other attemps using the same userID work fine.

I checked the connection UMEBackendConnection, and I increased the MaxConnections and PoolSize parameters, but no effect was observed.

I suspect the system is running out of some resources (connections for example) at some point, but I couldnt find were.  Any idea what else can I check?

Thanks!!

[Former Member · Accepted solution]

We had this random 401 authentication issue on our production instance last year.

Changing the UME setting and then restarting the J2EE instance solved it for us.

ume.ldap.connection_pool.max_size 10 -> 100

[Former Member · Accepted solution]

Thanks Aaron,

we had increased the pool size and max connections, aparently what was missing was to restart the J2EE engine...

Now it seems to work.

[Former Member]

Hello Nicolas,

Can you please see if any logs are displayed in tcode SMICM ICM monitoring.

That will give you a clear picture. If there are red error messages at the time your message fails.

This issue can be a network issue with the third party system. You try to send the message but it is not picked up by third party. Please also check from their side.

Thanks

[asdasd_asdasd]

Check this:

Note 937159 - XI Adapter Engine is stuck:

...

A possible solution to solve this problem is to increase the number of application and system level threads

...

In some high load scenarios it might be required to increase the number of maximum database connections

...

Note:Increase of application threads does not necessarily solve the problems regarding the stopped message flow through the Adapter Framework. See the attached FAQ notes under which circumstances this can happen

...

[rajasekhar_reddy14]

This error nothing to with credetianls or ICM RFC connection even though error messages shows like that as per my knowledge,

When multiple messages processing from PI integration engine to Adapter engine , this error comes randomly.

Ask basis team to tune the parameteres .

[Former Member]

Hi raja,

do you know which parameters should them tune?

[baskar_gopalakrishnan2]

This is purely login credential error between integration engine and adapter engine. Database does not return http error codes. Please remember that. This is not database login error. Please check the RFC destination and see whether your login credentials are wrong. Also are you using the same adapter for other interfaces and during the high load time, the same adapter might be servicing other interfaces and so you get this type of intermittent error.

[asdasd_asdasd]

what kind of adapters are using? and which direction?

[Former Member]

it is JDBC receivers, but I dont think it is related with the adapter tipe itself.

[markangelo_dihiansan]

Hello,

Based on SAP Note 821026 - Adapter Engine messaging URL returns HTTP 401 under high load:

For releases 7.10 and above, the below mentioned parameters are set on  the RFC Destination "UMEBackendConnection" ( PI 7.1*: NWA -> Configuration Management-> Security -> Destinations and in PI 7.3: Configuration -> Security -> Destinations):
Max.Connections
Max.Wait Time in ms
When the parameters described above have been increased, but the problem  of sporadic HTTP 401 response codes under high load still exists, additional customizing is possible:
The default amount of possible external JCO clients is 100. If the  dev_jrfc.trc file in the server directory shows the error "ERROR max no  of 100 conversations exceeded" the environment variable CPIC_MAX_CONV must be increased. Also refer to note 314530.
The max value of possible gateway connections may be to low. In case  that the gateway trace shows the error "max no of cpic clients exceeded"  the setting "gw/max_sys" must be increased. Also refer to note 894100.
The error "max no of connections exceeded" in the gateway trace implies  a too low value for parameter "gw/max_conn". See note 887909.

Have you tried the other customizing options?

Hope this helps,

Mark

[Former Member]

Hi Mark,

thanks for the note, I checked now those options but they look ok, also the sympthoms explained there are not currently found in our system.