Keystore access in Java Mapping Program - user J2EE_GUEST

Question

Dear Gurus,
I have the following problem:
I need to validate the digital signature of a XML document and I'm using some examples provided by SAP as follows:
          InitialContext ctx = ctx = new InitialContext();          
          Object o = (Object) ctx.lookup("keystore");          
          KeystoreManager manager = (KeystoreManager) o;          
          KeyStore ks = manager.getKeystore("Serasa");
{/code}
But I get the error below, saying that user J2EE_GUEST is not authorized. How do I change the user who executes java mapping, because I granted permissions in Visual Admin to another user.
     at com.sap.aii.ibrun.sbeans.mapping.MappingServiceObjectImpl0_0.processFunction(MappingServiceObjectImpl0_0.java:131)
     at sun.reflect.GeneratedMethodAccessor267.invoke(Unknown Source)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:62)
     at java.lang.reflect.Method.invoke(Method.java:391)
     at com.sap.engine.services.ejb.session.stateless_sp5.ObjectStubProxyImpl.invoke(ObjectStubProxyImpl.java:187)
     at $Proxy218.processFunction(Unknown Source)
     at sun.reflect.GeneratedMethodAccessor266.invoke(Unknown Source)
     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:62)
     at java.lang.reflect.Method.invoke(Method.java:391)
     at com.sap.engine.services.rfcengine.RFCDefaultRequestHandler.call(RFCDefaultRequestHandler.java:284)
     at com.sap.engine.services.rfcengine.RFCDefaultRequestHandler.handleRequest(RFCDefaultRequestHandler.java:219)
     at com.sap.engine.services.rfcengine.RFCJCOServer$J2EEApplicationRunnable.run(RFCJCOServer.java:254)
     at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
     at java.security.AccessController.doPrivileged(AccessController.java:219)
     at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:104)
     at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:176)
Caused by: com.sap.engine.services.keystore.exceptions.BaseKeystoreException: User is not authorized to execute keystore operation[{GET_VIEW Serasa }]
     at com.sap.engine.services.keystore.impl.security.UserBasedSecurityConnector.checkUserPermission(UserBasedSecurityConnector.java:889)
     at com.sap.engine.services.keystore.impl.security.SecurityRestrictionsChecker.checkUserPermission(SecurityRestrictionsChecker.java:52)
     at com.sap.engine.services.keystore.impl.security.SecurityRestrictionsChecker.isUserAuthorized(SecurityRestrictionsChecker.java:148)
     at com.sap.engine.services.keystore.impl.security.SecurityRestrictionsChecker.checkPermission(SecurityRestrictionsChecker.java:174)
     at com.sap.engine.services.keystore.impl.ParameterChecker.checkPermission(ParameterChecker.java:35)
     at com.sap.engine.services.keystore.impl.KeystoreManagerImpl.checkPermission(KeystoreManagerImpl.java:46)
     ... 28 more
Caused by: java.security.KeyStoreException: (thread: SAPEngine_Application_Thread[impl:3]_56,view:Serasa, entry: , user: J2EE_GUEST) - checkPermissions  'getView': com.sap.engine.services.security.exceptions.BaseSecurityException: Caller not authorized.
     at com.sap.engine.services.keystore.impl.security.UserBasedSecurityConnector.checkFailed(UserBasedSecurityConnector.java:1097)
     at com.sap.engine.services.keystore.impl.security.UserBasedSecurityConnector.checkPermissions_getView(UserBasedSecurityConnector.java:773)
     at com.sap.engine.services.keystore.impl.security.UserBasedSecurityConnector.checkUserPermission(UserBasedSecurityConnector.java:823)
     ... 33 more
{/code}
Thank you very much

Answer 1

Hi Fabio,
first of all have you checked if standard functions to verify digital signature for pi adpaters would work for you?
We have used the following code to access the Keystore in a custom adapter. It accesses the keystore with the access rights of a JEE application (it has a reference to the sample adapter "sap.com/com.sap.aii.adapter.sample.ra"). Check out if it works in your mapping, too.
import java.security.Key;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.PublicKey;
import java.security.UnrecoverableKeyException;
import java.util.HashMap;
import java.util.Map;
import javax.resource.ResourceException;
import com.sap.aii.af.service.resource.SAPSecurityResources;
import com.sap.aii.security.lib.KeyStoreManager;
import com.sap.aii.security.lib.PermissionMode;
public class XIKeystoreAccessor {
    private static final XITrace TRACE = new XITrace(XIKeystoreAccessor.class.getName());
    static XIKeystoreAccessor instance = null;
    SAPSecurityResources securityResources;
    KeyStoreManager keystoreManager;
    Map<String, KeyStore> keystores = null;
    private XIKeystoreAccessor() throws ResourceException {
     final String SIGNATURE = "XIKeystoreAccessor()";
     TRACE.entering(SIGNATURE);
     keystores = new HashMap<String, KeyStore>();
     securityResources = SAPSecurityResources.getInstance();
     try {
         keystoreManager = securityResources.getKeyStoreManager(PermissionMode.SYSTEM_LEVEL,
              new String[] { "sap.com/com.sap.aii.adapter.sample.ra" });
     } catch (KeyStoreException e) {
         TRACE.catching(SIGNATURE, e);
         throw new ResourceException(e);
     TRACE.exiting(SIGNATURE);
     * Get a key from AS Java keystore
     * @param view
     * @param alias
     * @param password
     * @return
     * @throws ResourceException
    public Key getPrivateKey(String view, String alias, String password) throws ResourceException {
     final String SIGNATURE = "getPrivateKey()";
     TRACE.entering(SIGNATURE);
     KeyStore keystore = getKeystore(view);
     Key privateKey = null;
     try {
         privateKey = keystore.getKey(alias, password.toCharArray());
         if (privateKey == null) {
          throw new ResourceException("Key not found. alias=" + alias);
     } catch (KeyStoreException e) {
         TRACE.catching(SIGNATURE, e);
         throw new ResourceException(e);
     } catch (NoSuchAlgorithmException e) {
         TRACE.catching(SIGNATURE, e);
         throw new ResourceException(e);
     } catch (UnrecoverableKeyException e) {
         TRACE.catching(SIGNATURE, e);
         throw new ResourceException(e);
     TRACE.exiting(SIGNATURE);
     return privateKey;
    public PublicKey getPublicKey(String view, String alias) throws ResourceException {
     final String SIGNATURE = "getPublicKey()";
     TRACE.entering(SIGNATURE);
     KeyStore keystore = getKeystore(view);
     PublicKey publicKey = null;
     try {
         publicKey = keystore.getCertificate(alias).getPublicKey();
         if (publicKey == null) {
          throw new ResourceException("Key not found. alias=" + alias);
     } catch (KeyStoreException e) {
         TRACE.catching(SIGNATURE, e);
         throw new ResourceException(e);
     TRACE.exiting(SIGNATURE);
     return publicKey;
     * Get a keystore i.e. a view from AS Java
     * @param view
     * @return
     * @throws ResourceException
    public KeyStore getKeystore(String view) throws ResourceException {
     final String SIGNATURE = "getKeystore()";
     TRACE.entering(SIGNATURE);
     KeyStore keystore;
     try {
         if (keystores.containsKey(view) == true) {
          keystore = keystores.get(view);
         } else {
          keystore = keystoreManager.getKeyStore(view);
          if (keystore == null) {
              throw new ResourceException("Keystore not found. view=" + view);
          keystores.put(view, keystore);
         TRACE.exiting(SIGNATURE);
         return keystore;
     } catch (KeyStoreException e) {
         TRACE.catching(SIGNATURE, e);
         throw new ResourceException(e);
    static public XIKeystoreAccessor getInstance() throws ResourceException {
     if (instance == null) {
         instance = new XIKeystoreAccessor();
        return instance;