Receiver SOAP adapter SSL error - client certificate required?

Hi all,
Problem configuring SSL in XI 3.0 NW04 SP17....
I have followed the config steps from Rahul's excellent weblog at <a href="/people/rahul.nawale2/blog/2006/05/31/how-to-use-client-authentication-with-soap-adapter">How to use Client Authentication with SOAP Adapter</a> (my Basis team have done the Visual Admin steps) and am going through his example as it closely matches my requirement. So, I have a test receiver SOAP adapter sending messages to a web service URL defined for a sender SOAP adapter. My test scenario is:
Sender File -> Receiver SOAP -> Sender SOAP -> IDoc Receiver -> IDocs in R/3
The problem components are in italic and underlined above. My Receiver SOAP Adapter has the web service URL, Certificate Keystore Entry and View entered. If, in the Sender SOAP Adapter, I have an HTTP Security Level of HTTPS Without Client Authentication, the interface works fine (note that Rahul suggests you untick the User Authentication in the Receiver but with this Security Level, it seems to work with or without it).
The problem is when I set HTTPS With Client Authentication in the Sender. I then get the following error in the message monitor:
SOAP: response message contains an error XIServer/UNKNOWN/ModuleUnknownException - com.sap.aii.af.mp.module.ModuleException: java.security.AccessControlException: client certificate required caused by: java.security.AccessControlException: client certificate required at com.sap.aii.af.mp.soap.ejb.XISOAPAdapterBean.process(XISOAPAdapterBean.java:1111) at com.sap.aii.af.mp.module.ModuleLocalLocalObjectImpl3.process(ModuleLocalLocalObjectImpl3.java:103) at com.sap.aii.af.mp.ejb.ModuleProcessorBean.process(ModuleProcessorBean.java:250) at com.sap.aii.af.mp.processor.ModuleProcessorLocalLocalObjectImpl0.process(ModuleProcessorLocalLocalObjectImpl0.java:103) at com.sap.aii.af.mp.soap.web.MessageServlet.callModuleProcessor(MessageServlet.java:166) at com.sap.aii.af.mp.soap.web.MessageServlet.doPost(MessageServlet.java:421) at javax.servlet.http.HttpServlet.service(HttpServlet.java(Compiled Code)) at javax.servlet.http.HttpServlet.service(HttpServlet.java(Compiled Code)) at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java(Compiled Code)) at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java(Compiled Code)) at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java(Inlined Compiled Code)) at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java(Compiled Code)) at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java(Compiled Code)) at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java(Compiled Code)) at com.sap.engine.services.httpserver.server.Client.handle(Client.java(Inlined Compiled Code)) at com.sap.engine.services.httpserver.server.Processor.request(Processor.java(Compiled Code)) at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java(Compiled Code)) at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java(Compiled Code)) at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java(Compiled Code)) at java.security.AccessController.doPrivileged1(Native Method) at java.security.AccessController.doPrivileged(AccessController.java(Compiled Code)) at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java(Compiled Code)) at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java(Compiled Code)) Caused by: java.security.AccessControlException: client certificate required at com.sap.aii.af.mp.soap.ejb.XISOAPAdapterBean.process(XISOAPAdapterBean.java:843) ... 22 more
Has anyone got any idea what this could be caused by?
Many thanks,
Stuart Richards

Have you configured the https port with that keystore entry?
Check out these links:
http://help.sap.com/saphelp_nw2004s/helpdata/en/b0/881e3e3986f701e10000000a114084/frameset.htm
http://help.sap.com/saphelp_nw2004s/helpdata/en/5c/15f73dd0408e5be10000000a114084/frameset.htm
Regards,
Henrique.

Similar Messages

SOAP Receiver Adapter problem (client certificate required)

My Scenario is similar to described in https://www.sdn.sap.com/irj/sdn/weblogs?blog=/pub/wlg/3721. [original link is broken] [original link is broken] [original link is broken] I have two PI servers running on one machine. I am trying to post message HTTPS with Client authentication via SOAP adapter from one PI system to SOAP adapter of other PI server. I have done the following configuration.
PI Server AXD - (Client) - Receiver SOAP adapter
PI Server AXQ - (Server) - Sender SOAP Adapter.
Steps in AXD
1. I have created a certificate of AXD in the service_ssl view of key storage.
2. I have imported the AXQ public certificate in to AXD in the TrustedCAs of Key storage
Steps in AXQ
1. I have created a certificate of AXQ in the service_ssl view of key storage.
2. I have imported the AXD public certificate in to AXQ in the TrustedCAs of Key storage.
3. I have created a user in AXQ and assigned the certificate of AXD under usermangement in Security provider to this user.
4. I have added the AXD certificate under Client Authentication tab with require client certificate option checked in the SSL Provider.
5. I have assigned the user created in AXQ in the step above to the Sender Agreement.
Now when I post message from AXD with Configure Client Authentication checked (Here I have selected the certificate of AXD and view as service_ssl) I am getting the following error.
Exception caught by adapter framework: SOAP: response message contains an error XIServer/UNKNOWN/ADAPTER.JAVA_EXCEPTION - java.security.AccessControlException: client certificate required at com.sap.aii.af.mp.soap.ejb.XISOAPAdapterBean.process(XISOAPAdapterBean.java:884) at com.sap.aii.af.mp.module.ModuleLocalLocalObjectImpl0_3
Any pointer to solve this problem is highly appreciated.
Thanks
Abinash

Hi Hemant,
I have couple of questions. Why do we need to import certificate for SOAP WS-Security and from where I can get it?
As far as my scenario goes I am not using message level security.
Secondly what do you mean by TRUSTED/WebServiceSecurity? I don't see any such view inside the Key Storage. I can see a view named just WebServiceSecuity though.
Also I don't have a decentralized adapter installation rather I have two separate PI instances having their own central adapter engine.
Abinash

Error using SSL on Receiver Soap Adapter

Hi there,
I'm having some problems on connecting to a third-party application running a webservice (meaning, through Receiver Soap Adapter). The third-party appl. demands us to use a SSL connection (its url starts with https), with user authentication through certificate.
We've installed SAP Java Cryptographic toolkit and have a proper certificate configured on the KeyStorage entry, on Visual Administrator.
On Soap Adapter, I've configured HTTP Transport Protocol and have selected the "configure certificate authentication" option and selected the certificate, filled the mandatory fields (target URL and soap action) but I keep getting this error message on SXMB_MONI: "com.sap.aii.af.ra.ms.api.DeliveryException: unable to create a socket".
Is there anything else than installing SAP Java Cryptographic Toolkit to enable SSL on Soap Adapter? Is there another configurations that need to be done?
Thanks in advance,
Henrique.

Hi
can u please tell me, how u r able to resolve the problem
i am also stuck in the same error
basically i am working on SSO b/w three systems.
EP>XI>R/3
i am able to do the SSO between the EP-->XI
but when i try with EP-->XI->R/3 it is giving me error at the receiver side means receiver soap adapter is not accepting the SAP Logon Ticket.
can u please tell me what entries should be given in the certificate authentication fields.
please provide the solution.
Thanks & Regards
Rinku Gangwani

Receiver SOAP Adapter error

Hi All,
 I am getting this response error message in my receiver SOAP Adapter while invoking a synchronous webservice.
<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
- 
- <ProcessMessageResponse xmlns="http://Sleek.Integrator.Messaging" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<ProcessMessageResult>Value cannot be null. Parameter name: Request string is a null reference.</ProcessMessageResult>
</ProcessMessageResponse>
Thx in advance
Ravijeet

Hi All,
 I am still getting the same error value is null. I am not able to track what could be the cause of the error. If I am taking the message from SXMB_MONI and using it in a client tool it is successfully calling the webservice.
Do we need to explicitly mention in some configuration that content type is soap/xml. SOAP header is omitting the content type or is not specifying "soap/xml" as the content type.
I am interacting with a WAF websevice, is there any compatibilty issue with Windows Webservice and SAP XI?
Also what should I pick as the SOAP Action from this wsdl file definition
<wsdl:portType name="IMessageProcessor">
 <wsdl:operation name="ProcessMessage">
 <wsdl:input message="tns:IMessageProcessor_ProcessMessage_InputMessage" wsaw:Action="XXX.Messaging/ProcessMessage"/>
 <wsdl:output message="tns:IMessageProcessor_ProcessMessage_OutputMessage" wsaw:Action="XXX.Messaging/ProcessMessageResponse"/>
 </wsdl:operation>
 </wsdl:portType>
 <wsdl:service name="MessageProcessor">
 <wsdl:port name="BasicHttpBinding_IMessageProcessor" binding="i0:BasicHttpBinding_IMessageProcessor">
 <soap:address location="http://XXX.com/cardax/provisioningservice"/>
 </wsdl:port>
Thx in advance
Ravijeet

Error in applying security settings in Receiver SOAP Adapter

Hi,
I've used Web Services Security (Oasis standard) and the digital signature and encryption certificate in receiver SOAP adapter and the corresponding Sender Agreement, for adding digital signature and encrypting the message. While sending the message we are getting an error in the adapter engine as below. If anyone can throw light on this it'll be highly appreciated :
2008-07-18 17:00:21 Error SOAP: error occured: com.sap.aii.af.ra.ms.api.RecoverableException: java.security.PrivilegedActionException: com.sap.aii.af.security.impl.exception.MessageSecurityException: MessageSecurityException in Method: ApplyMessageLevelSecurity.run(). AccessControlException. Please check that your Code has the XiSecurityRuntimePermission.Context: com.sap.aii.af.security.impl.exception.MessageSecurityException: Exception in Method: apply( Message, CPALookupObject ). General exception, no further informations. Message: MessageSecurityContext in Method: apply( Message, CPALookupObject ). ApplyThread-Exception Message: SAXException in Method: run().; To-String: com.sap.aii.af.security.impl.exception.MessageSecurityException: SAXException in Method: run().. To-String: com.sap.aii.af.security.impl.exception.MessageSecurityException: MessageSecurityContext in Method: apply( Message, CPALookupObject ). ApplyThread-Exception Message: SAXException in Method: run().; To-String: com.sap.aii.af.security.impl.exception.MessageSecurityException: SAXException in Method: run()..
2008-07-18 17:00:21 Error Exception caught by adapter framework: java.security.PrivilegedActionException: com.sap.aii.af.security.impl.exception.MessageSecurityException: MessageSecurityException in Method: ApplyMessageLevelSecurity.run(). AccessControlException. Please check that your Code has the XiSecurityRuntimePermission.Context: com.sap.aii.af.security.impl.exception.MessageSecurityException: Exception in Method: apply( Message, CPALookupObject ). General exception, no further informations. Message: MessageSecurityContext in Method: apply( Message, CPALookupObject ). ApplyThread-Exception Message: SAXException in Method: run().; To-String: com.sap.aii
2008-07-18 17:00:21 Error Delivery of the message to the application using connection SOAP_http://sap.com/xi/XI/System failed, due to: com.sap.aii.af.ra.ms.api.RecoverableException: java.security.PrivilegedActionException: com.sap.aii.af.security.impl.exception.MessageSecurityException: MessageSecurityException in Method: ApplyMessageLevelSecurity.run(). AccessControlException. Please check that your Code has the XiSecurityRuntimePermission.Context: com.sap.aii.af.security.impl.exception.MessageSecurityException: Exception in Method: apply( Message, CPALookupObject ). General exception, no further informations. Message: MessageSecurityContext in Method: apply( Message, CPALookupObject ). ApplyThread-Exception Message: SAXExce.
Thanks,
Dipankar

hi dipanker,
check the note 856597
its usefull
regards
kummari

SOAP Adapter - HTTPS w/ client authentication -SSL termination @ dispatcher

Hi,
We have a SOAP client sending SOAP message over SSL to PI. We are using client cert for authentication, but terminating SSL at web dispatcher. In this scenario, i) do we need to configure security for XISOAPADAPTER in Visual admin on PI and ii) do we need to set HTTPS with client authentication security option in SOAp Sender communication channel?
My understanding is that since we are terminatinating SSL at web dispatcher (Server authentication happens between third-party gateway and our gateway and when web dispatcher terminates SSL, client cert for auth is passed via httpheader to PI where it is mapped to UME user with sufficient authorizations) we don't need to set the XISOAPADAPTER security (if it is end-to-end ssl we would i guess set up in V. Admin>Security provider service>clientcertloginmodule for XISOAPADAPTER) and we don't need to set the sender channel as https with client authentication ( it should just be http in SOAP sender channel).
Is my understanding correct? I will really appreciate any clues?
Thanks,
Saurabh

Hi saurabh
follow these links to SAP note
these will be helpful for you
Note 856597 - FAQ: XI 3.0 / PI 7.0 / PI 7.1 SOAP Adapter
https://websmp102.sap-ag.de/~form/handler?_APP=01100107900000000342&_EVENT=REDIR&_NNUM=856597&_NLANG=E
Note 856599 - FAQ: XI 3.0 / PI 7.0 / PI 7.1 Mail Adapter
https://websmp102.sap-ag.de/~form/handler?_APP=01100107900000000342&_EVENT=REDIR&_NNUM=856599&_NLANG=E
Note 870845 - XI 3.0 SOAP adapter SSL client certificate problem
https://websmp130.sap-ag.de/sap(bD1lbiZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=916664&nlang=EN&smpsrv=https%3a%2f%2fwebsmp102%2esap-ag%2ede
https://websmp130.sap-ag.de/sap(bD1lbiZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=870845&nlang=EN&smpsrv=https%3a%2f%2fwebsmp102%2esap-ag%2ede
regards
Sandeep
If helpful kindly reward points

Error in the Receiver SOAP Adapter

Hello Experts,
I am sending an order number by running a report on the ECC 6.0 server to a web service for publishing the information on the web site. The receiver side is configured as Receiver SOAP Adapter . I am getting the following error in the SXMB_MONI Transaction.
com.sap.engine.interfaces.messaging.api.exception.MessagingException: SOAP: response message contains an error XIAdapter/PARSING/ADAPTER.SOAP_EXCEPTION - soap fault: Not enough message parts were received for the operation.
Kindly let me know to overcome this problem.
Thanks
Best Regards
S Joshi

Hi Ramesh,
The message Iam getting in MONI is as follows:
com.sap.engine.interfaces.messaging.api.exception.MessagingException: SOAP: response message contains an error XIAdapter/PARSING/ADAPTER.SOAP_EXCEPTION - soap fault: Not enough message parts were received for the operation.
This is the response for the request that i am sending for order creation. I did checked the fields also it is same and the values of the fields too. they all are correct. Over and above this it was working fine till last week , but suddendly this week I am getting this error.
Regards

Error in Adapter engine of receiver soap adapter

Hi All,
There is one production issue i am currently facing in receiver SOAP adapter while interacting with third party web service(Asynchronous call).
Below is the description i am getting in audit logs.
Success SOAP: completed the processing
Error SOAP: response message contains an error XIAdapter/HTTP/ADAPTER.HTTP_EXCEPTION - HTTP 401 Invalid Session ID or Session Expired
Success SOAP: sending a delivery error ack ...
Success SOAP: sent a delivery error ack
Error MP: Exception caught with cause com.sap.aii.af.ra.ms.api.RecoverableException: SOAP: response message contains an error XIAdapter/HTTP/ADAPTER.HTTP_EXCEPTION - HTTP 401 Invalid Session ID or Session Expired
Error Exception caught by adapter framework: SOAP: response message contains an error XIAdapter/HTTP/ADAPTER.HTTP_EXCEPTION - HTTP 401 Invalid Session ID or Session Expired
Error Delivery of the message to the application using connection SOAP_http://sap.com/xi/XI/System failed, due to: com.sap.aii.af.ra.ms.api.RecoverableException: SOAP: response message contains an error XIAdapter/HTTP/ADAPTER.HTTP_EXCEPTION - HTTP 401 Invalid Session ID or Session Expired.
Error The message status set to NDLV.
Moreover this is a production issue and interface was running fine till last friday.
Has someone ever faced this issue ?
Please provide your valuable inputs on this.
Thanks
Anku

Hi,
Search in sdn with your error message string,you will find ton of links.
HTTP401 error occurs for many reasons.
still no solution let us know..
Regards,
Raj

Error when setting dynamically the target URL in receiver SOAP Adapter

Hi,
I'm setting dynamically (from the mapping) the target URL in the receiver SOAP adapter:
String url = "http://mosxd30:50000/XISOAPAdapter/MessageServlet?senderParty=&senderService=DUM&receiverParty=&receiverService=&interface=SI_OA_CustomInvoiceData&interfaceNamespace=urn:repsol.com:laboratory:firma";
DynamicConfiguration conf = (DynamicConfiguration) container.getTransformationParameters().get(StreamTransformationConstants.DYNAMIC_CONFIGURATION);
DynamicConfigurationKey key = DynamicConfigurationKey.create("http://sap.com/xi/XI/System/SOAP", "TServerLocation");
conf.put(key, url);
The receiver adapter fails with:
"invalid content type for SOAP: TEXT/HTML; HTTP 401 Unauthorized"
Reading weblogs, etc, the most probable cause for this is a wrong target URL, but then what I did was to set it as a fixed URL in the C.Channel, and it worked, so the URL is fine.
In the communication channel, I'm using "Configure user authentication", with a user and password, and what I think it's happening is that if I use another different URL dynamically, the channel is ignoring the user authentication settings.
Any ideas?
Thanks

I forgot to say that I've checked the SAP note "FAQ Soap adapter", and it says:
Q: I get an authorization error "401 Unauthorized" from the adapter's servlet. What went wrong?
           A: The adapter's servlet is protected by default. You must use one of the user names assigned in security role xi_adapter_soap_message for component XISOAPAdapter. Please consult the documentation for Visual Administrator to view and change the security setting.
           The user authentication of the SOAP adapter is not part of the SOAP adapter but of the web container of the J2EE engine. The default authentication setting is defined in the web.xml descriptor file of the SOAP dapter web application. This setting may be modified from Visual Administrator with some restriction. Please refer to the security documentation for the J2EE engine.
           Please note that 710 onwards there is no Visual Administrator instead the Netweaver Administrator is to be used to assign the roles to the user to access the SOAP adater servlet.The user must be assigned one of the following roles SAP_XI_IS_SERV_USER, SAP_XI_APPL_SERV_USER, SAP_XI_DEVELOPER_J2EE, SAP_XI_ADMINISTRATOR_J2EE.
The target URL is a sender soap adapter (the result of one interface is sent to another one via soap adapter), and it's this one which is complaining because of the authentication I think. But I don't know why it's ignoring the user authentication flag I'm using.

Receiver SOAP Adapter (HTTP AXIS)

Hi Experts,
I need to use receiver soap adapter to communicate with a WebService, actually it is a AXIS service i can see when i give the soap url in web browser.
my question is for axis service, does it mean i have to use HTTP AXIS in the receiver channel to request the response for web service server? Can i use HTTP only without AXIS?
when i use SoapUI to test the webservice, it works fine. But when i use receiver soap adapter with HTTP (without AXIS), it is responding with the belwo error.
<sap:Error ...>
<sap:Category>Application</sap:Category>
<sap:Code area="UNKNOWN">APPLICATION_ERROR</sap:Code>
<sap:AdditionalText>Application Fault</sap:AdditionalText>
<sap:ApplicationFaultMessage namespace="http://sap.com/xi/XI/System/Axis/sample">host name</sap:ApplicationFaultMessage>
<sap:Stack/>
</sap:Error>
Experts, please help on this, the major question is HTTP AXIS is required when target web service is an AXIS service?
Thanks in advance.
Regards,

>>my question is for axis service, does it mean i have to use HTTP AXIS in the receiver channel to request the response for web service server? Can i use HTTP only without AXIS?
You are going to consume webservice. You can use standard SOAP adapter itself to consume the webservice that is built with axis framework.
Do you have some specific user authentication procedures like SAP Assertion Tickets, username token etc and some specific encapsulation formats (MIME, DIME, MTOM),WS Reliable Messaging and so then you need SOAP Axis adapter. If you need to consume webservice with standard transport protocol (HTTP or HTTPS) and client authentication etc , our standard SOAP adapter is more than enough.
Refer this link what axis soap adapter supports

More than 10 Authentication Keys in receiver SOAP adapter

Hi
My requirement is that I need more than 10 authorization/authentication keys in the receiver SOAP adapter. Is this possible?
Advanced tab -> Use adapter-specific message attributes -> variable transport binding -> view authorization keys.
Only 10 entries are provided here. Can I extend this somehow?
Thanks!
regards Ole

Yes..
These links will help u in it
Certificate Authentication with SOAP Receiver
Certificate Authentication with SOAP Receiver

Security in Receiver SOAP Adapter (Axis Framework)

Hi Experts,
I have one requirement regarding Security in Receiver SOAP adapter
My client wants UserNameToken security while sending synchrononus messages from SAP system to third party.
Is anyone knows how to achieve this in AXIS framework(Receiver SOAP adapter) of PI 7.0 ?
Thanks in advance.
Regards
Anku

This is described in SAP Note 1039369 FAQ XI 3.0/7.0 Axis Adapter

Security settings in Receiver SOAP adapter

Hey guys
i m trying to incorporate some security features in my receiver SOAP adapter and taking help from help.sap.com,it mentions some entries in 'Security setting frame' but i cant find it even though i have checked the message security checkbox in my communication channel.
i m on SP9,is it not available in SP9?
my message protocol is XI 3.0
thanx
ahmad

Ahmad,
SOAP adapter supports SSL and Digital Certificates and you need to configure your SSL on the J2EE stack before you can use the same on your SOAP adapter.
Look into this blog to understand what needs to be done.
/people/aparna.chaganti2/blog/2007/01/23/how-xml-encryption-can-be-done-using-web-services-security-in-sap-netweaver-xi
Regards
Bhavesh

Receiver SOAP Communication Channel Error

Hi,
I am trying to post a file to a WebService but facing the below error in the communication channel :
Message processing failed. Cause: com.sap.aii.af.ra.ms.api.RecoverableException: SOAP: response message contains an error XIAdapter/PARSING/ADAPTER.SOAP_EXCEPTION - soap fault: Server was unable to process request. ---> Object variable or With block variable not set.
Has anyone encountered such an error?
Please let me know.
Regards,
Anuradha.

Hi,
First of all check the URL in your receiver SOAP adapter. The error comes from the web service server. It says that the request message is wrong.
1.fill field SOAPAction in the receiver soap adapter
2.fPlease find the related information here
http://help.sap.com/saphelp_nw2004s/helpdata/en/29/5bd93f130f9215e10000000a155106/content.htm
Please check this one also:
/people/shabarish.vijayakumar/blog/2006/03/23/rfc--xi--webservice--a-complete-walkthrough-part-1
There are multiple soap actions listed there.
Regards,
Divya

Testing a "Receiver SOAP Adapter" - Calling a remote webservice from PI

Hi ,
I am trying to call a remote webservice from PI 7.0.
The WSDL file is successfully imported to PI to create the required message types.
The "receiver SOAP adapter" is configured as the communication channel.
I would like to know the ways of testing the remote webservice from PI 7.0.
Thank you,
Panda

Hello there!
I think this link should help you
https://help.sap.com/saphelp_nwpi71/helpdata/en/46/793034608c0ad3e10000000a11466f/frameset.htm
Thanks and regards,
Caio Cagnani

Receiver SOAP adapter SSL error - client certificate required?

Similar Messages

Maybe you are looking for