Setup connection between on prem Cloud Connetor and Trial BTP account (on demand hana)

[cysecfg]

Dear community,

I'm trying to establish a connection between an on prem SAP Cloud Connector instance and a SAP BTP trial subaccount (hosted on US region) and created with a universal ID account.

After creating the account and enabling the Cloud Foundry environment, I added an S-User to the subaccount with the assigned Cloud Connector Administrator role.

For information, there is no firewall / proxy restriction to communicate between on prem instance and SAP BTP account as this has been already configured and adjusted.

Below the error I have when trying to register my BTP subaccount in the Cloud Connector initial configuration setup page.

Could you please provide any insight on the root cause of this problem ?

Many thanks in advance.

[Ulrich_Schmidt]

Tip: instead of a screenshot of the error text, why don't you simply attach the error text itself?
That would only take a few 100 Bytes instead of 383000 Bytes, and it would even be more useful, because one can easily copy&paste words or lines out of it, put them into Google search, etc...

[Ulrich_Schmidt · Accepted solution]

"401 Unauthorized" can only be caused by something like incorrect credentials (typo in the username / password or wrong subaccount). I am not aware of any other possible error cause?!

[HAL9000 · Accepted solution]

I agree to the incorrect credentials, but in my humble opinion it cannot be a missing authorization role, because this should result in "403 Forbidden" instead.

[Ulrich_Schmidt · Accepted solution]

Yes, indeed. Deleted the role.

[cysecfg]

Cloud Connector does not support Universal-ID, and P user ID must be specified in the <subaccount_user> field when registering the SAP BTP subaccount.

This was the root cause of the unauthorized error

[cysecfg]

Hello,

I have checked the username/password to connect to my BTP trial account, and the credentials provided in the Cloud Connector 'Define Subaccount' section are correct, as I was able to successfully authenticate to the BTP cockpit using those credentials.

I have tried again with another BTP trial account and different credentials and the problem persists.

Could you please help me with this issue ?

You can find the detailed logs from the ljs_trace.log file.

Many thanks in advance.

2023-09-14 11:26:57,369 +0200#INFO#com.sap.scc.config#https-jsse-nio2-8443-exec-4# #load account configuration for 8053a67a-a186-473a-ab29-bbf45260bfe0@cf.us10.hana.ondemand.com
2023-09-14 11:26:57,407 +0200#WARN#com.sap.scc.config#https-jsse-nio2-8443-exec-4# #Cannot find host mapping configuration file /root/Tools/scc_config/cf.us10.hana.ondemand.com/8053a67a-a186-473a-ab29-bbf45260bfe0/backends.xml
2023-09-14 11:26:57,537 +0200#WARN#com.sap.scc.config#https-jsse-nio2-8443-exec-4# #Creating an sslContextProvider for account 8053a67a-a186-473a-ab29-bbf45260bfe0@cf.us10.hana.ondemand.com without SSLContext. Keystore did not contain a certificate.
2023-09-14 11:26:57,539 +0200#INFO#com.sap.scc.security#https-jsse-nio2-8443-exec-4# #Will retrieve Connectivity CA certificate from SAP Cloud Platform
2023-09-14 11:26:57,539 +0200#INFO#com.sap.scc.security#https-jsse-nio2-8443-exec-4# #Executing Http Get request to https://connectivitycertsigning.cf.us10.hana.ondemand.com:443/certificate/management/v1/trusted/ca/a...
2023-09-14 11:26:57,923 +0200#INFO#com.sap.scc.security#https-jsse-nio2-8443-exec-4# #https://connectivitycertsigning.cf.us10.hana.ondemand.com:443/certificate/management/v1/trusted/ca/account/8053a67a-a186-473a-ab29-bbf45260bfe0 Returned Http Response with code 200
2023-09-14 11:26:57,924 +0200#INFO#com.sap.scc.security#https-jsse-nio2-8443-exec-4# #Connectivity CA certificate retrieved successfully from SAP Cloud Platform
2023-09-14 11:26:58,576 +0200#INFO#com.sap.scc.security#https-jsse-nio2-8443-exec-4# #New RSA key pair was generated with key size 4096 in 651 ms
2023-09-14 11:26:58,601 +0200#INFO#com.sap.scc.security#https-jsse-nio2-8443-exec-4# #Send Certificate Signing Request for Cloud Connector certificate to SAP Cloud Platform
2023-09-14 11:26:58,601 +0200#INFO#com.sap.scc.security#https-jsse-nio2-8443-exec-4# #Executing Http Post request to https://connectivitycertsigning.cf.us10.hana.ondemand.com:443/certificate/management/v1/sign/account...
2023-09-14 11:27:01,376 +0200#INFO#com.sap.scc.security#https-jsse-nio2-8443-exec-4# #https://connectivitycertsigning.cf.us10.hana.ondemand.com:443/certificate/management/v1/sign/account/8053a67a-a186-473a-ab29-bbf45260bfe0 Returned Http Response with code 401
2023-09-14 11:27:01,376 +0200#INFO#com.sap.scc.config#https-jsse-nio2-8443-exec-4# #Stopping service channels on 8053a67a-a186-473a-ab29-bbf45260bfe0@cf.us10.hana.ondemand.com
2023-09-14 11:27:01,391 +0200#INFO#com.sap.scc#https-jsse-nio2-8443-exec-4# #An error occurred when trying to connect. See ''Log And Trace Files'' and in particular ljs_trace.log for details.
com.sap.scc.servlets.RequestFailureExecution$InvalidConfiguration: An error occurred when trying to connect. See ''Log And Trace Files'' and in particular ljs_trace.log for details.
at com.sap.scc.ui.SubaccountControl.createSubaccount(SubaccountControl.java:122)
at com.sap.scc.servlets.ConfigurationServlet.addAccount(ConfigurationServlet.java:1370)
at com.sap.scc.servlets.ConfigurationServlet.dispatch(ConfigurationServlet.java:217)
at com.sap.scc.servlets.ServletUtilities.service(ServletUtilities.java:54)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:582)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:212)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:156)
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:181)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:156)
at com.sap.scc.ui.rt.UTF8Filter.doFilter(UTF8Filter.java:22)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:181)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:156)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:167)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:609)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:130)
at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:682)
at com.sap.js.statistics.tomcat.valve.RequestTracingValve.callNextValve(RequestTracingValve.java:113)
at com.sap.js.statistics.tomcat.valve.RequestTracingValve.invoke(RequestTracingValve.java:59)
at com.sap.core.js.monitoring.tomcat.valve.RequestTracingValve.invoke(RequestTracingValve.java:27)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:617)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:932)
at org.apache.tomcat.util.net.Nio2Endpoint$SocketProcessor.doRun(Nio2Endpoint.java:1720)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at org.apache.tomcat.util.net.AbstractEndpoint.processSocket(AbstractEndpoint.java:1259)
at org.apache.tomcat.util.net.SecureNio2Channel$HandshakeWriteCompletionHandler.completed(SecureNio2Channel.java:121)
at org.apache.tomcat.util.net.SecureNio2Channel$HandshakeWriteCompletionHandler.completed(SecureNio2Channel.java:114)
at java.base/sun.nio.ch.Invoker.invokeUnchecked(Invoker.java:127)
at java.base/sun.nio.ch.Invoker.invokeDirect(Invoker.java:158)
at java.base/sun.nio.ch.UnixAsynchronousSocketChannelImpl.implWrite(UnixAsynchronousSocketChannelImpl.java:743)
at java.base/sun.nio.ch.AsynchronousSocketChannelImpl.write(AsynchronousSocketChannelImpl.java:383)
at java.base/sun.nio.ch.AsynchronousSocketChannelImpl.write(AsynchronousSocketChannelImpl.java:400)
at org.apache.tomcat.util.net.SecureNio2Channel.handshakeInternal(SecureNio2Channel.java:302)
at org.apache.tomcat.util.net.SecureNio2Channel.handshake(SecureNio2Channel.java:222)
at org.apache.tomcat.util.net.Nio2Endpoint$SocketProcessor.doRun(Nio2Endpoint.java:1697)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at org.apache.tomcat.util.net.AbstractEndpoint.processSocket(AbstractEndpoint.java:1259)
at org.apache.tomcat.util.net.SecureNio2Channel$HandshakeReadCompletionHandler.completed(SecureNio2Channel.java:104)
at org.apache.tomcat.util.net.SecureNio2Channel$HandshakeReadCompletionHandler.completed(SecureNio2Channel.java:97)
at java.base/sun.nio.ch.Invoker.invokeUnchecked(Invoker.java:127)
at java.base/sun.nio.ch.Invoker$2.run(Invoker.java:219)
at java.base/sun.nio.ch.AsynchronousChannelGroupImpl$1.run(AsynchronousChannelGroupImpl.java:112)
at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.base/java.lang.Thread.run(Thread.java:834)
Caused by: com.sap.scc.servlets.SccHandshakeException: SCC handshake failed: 401 — Unauthorized
at com.sap.scc.cert.HttpCertificateManagementService.processRequest(HttpCertificateManagementService.java:143)
at com.sap.scc.cert.HttpCertificateManagementService.executePostRequest(HttpCertificateManagementService.java:120)
at com.sap.scc.cert.HttpCertificateManagementService.signCertificateForSCC(HttpCertificateManagementService.java:79)
at com.sap.scc.ui.SubaccountControl.applyConfig(SubaccountControl.java:189)
at com.sap.scc.ui.SubaccountControl.createSubaccount(SubaccountControl.java:117)
... 50 common frames omitted