Content tree

Introduction

You have configured principal propagation from SAP Cloud Platform to on-premise system, however, the principal propagation does not work, the on-premise backend system keeps sending 401 HTTP code. This wiki helps to figure out the reason and to correct the configuration.

SAP HANA Academy – SAP Cloud Platform: Security Principal Propagation

Scenario

End User tries to access an application running on SAP BTP, the user is authenticated via UAA service.

The application tries to reach an on-premise service, http://npl752:44300/sap/bc/ping?sap-client=001 with configured principal propagation.

The SAP Cloud Connector receives a SAML token from SAP Cloud Platform (Neo environment) or from Cloud Foundry environment a JWT and generates a short-lived X.509 client certificate. The conversion from SAML/JWT to X.509 certificate preserves only the principal information, no other SAML attributes will not be propagated.

The cloud connector generates a temporary client certificate for the on-premise service, which is sent in SSL_CLIENT_CERT HTTP header.

The on-premise service authenticates the HTTP request based on the temporary client certificate.

Configuration steps

The configuration is based on the SAP Cloud Connector online help Configure Principal Propagation to an ABAP System for HTTPS.

In SAP Cloud Platform the Principal Propagation is set in the HTTP destination.

In SAP Cloud Connector the Principal Type is set to X.509 Certificate for the corresponding on-premise system.

System certificate is valid

https://<cloud connector host>:8443 - Configuration ON PREMISE - System Certificate section

CA Certificate is valid

https://<cloud connector host>:8443 - Configuration ON PREMISE - CA Certificate section

Principal Propagation subject pattern is configured:

https://<cloud connector host>:8443 - Configuration ON PREMISE - Principal Propagation section

Trust with subaccount is enabled:

https://<cloud connector host>:8443 - Configuration Principal Propagation

The issuer of Cloud Connector System Certificate is imported in certificate list using STRUST transaction:

Note: the issuer of the system certificate is imported, not the system certificate itself.

Backend service is configured for client certificate authentication

The standard procedure includes the client certificate authentication (Logon with SSL Certificate) in the second position.

Maintaining Logon Procedures - Standard Logon Order

How to trace principal propagation case

To find the reason for the authentication error, ICM, SAP Cloud Connector and ABAP security components need to be traced:

ICM trace level

Set ICM trace level to 2.

• Call transaction SMICM
• Select Goto - Trace level - Set - set trace level 2

in dev_icm file the new trace level is logged:

Cloud Connector trace level

• In SAP Cloud Connector select the affected subaccount from the Subaccount list
• set Cloud Connector  loggers to All
• set Payload Trace flag.
• Keep Other Loggers on Information

ABAP security trace

Set security trace level 2 for Taskhandler, Security and ICF components.

• Call transaction SM50
• press F5 (to select all the work processes),
• press CTRL+SHIFT+F7 to set trace levels
• select Taskhandler, Security and ICF flags
• set Trace level to 2

.

SAP Note 2181120 - Tracing and troubleshooting security events in HTTP communication with the AS ABAP

or see SAP Note 495911 or use SEC_TRACE_ANALYZER

Checking the logs, follow the client certificate

When the authentication fails, open the SAP Cloud Connector log file, ljs_trace.log.

SSO Token validation

Look for the received assertion, it contains the logged in user ID on SAP Cloud Platform. In this example the login name of the user is P0123456: 

SSO Token validation - SSO token validation failed, issuer not trusted

The SSO token is validated, validation logs the following entry:

When SSO token validation fails, a similar entry is logged in ljst_trace.log file:

It happens as the IDP is not trusted by the SAP Cloud Connector, this IDP must be set a trusted IDP and must be synchronized with the affected subaccount.

In SAP Cloud Connector administration UI select the affected subaccount and perform synchronization:

When synchronization is finished this entry is logged in ljs_trace.log file with INFO severity level:

SSO Token validation - SSO token validation failed, the application is not trusted

Another reason for the validation error can be that cloud application is not trusted, the ljs_trace.log file contains a similar exception:

To enable principal propagation for cloud applications maintain the trusted applications list, see SAP Note 2616408 - Principal Propagation via SAP Cloud Connector does not work - InvalidSSOTokenException

or the online help Trust Cloud Applications in the Cloud Connector.

Creating X.509 Certificate

When SSO token has been validated, an X.509 client certificate will be generated, in ljs_trace.log file look for this entry:

To see the content, copy the X.509 certificate ("MIIFNTCCA...KK31=") into a file, client.crt and open with a certificate decoder tool or in Windows simple double click on it. 

Note this certificate is issued by the CA certificate.

X.509 certificate generation fails - IllegalStateException: No CA certificate available

To create a temporary client certificate the local CA certificate is used. When the CA certificate is not present, this message is logged in the ljs_trace.log file:

Configure the local CA Certificate, see online help page Configure a CA Certificate for Principal Propagation.

X.509 certificate generation fails - IllegalStateException: The value for the required variable CN is not available in the context

When the received SAML assertion does not contain the configured mapping attribute an IllegalStateException is thrown. For example, the CN parameter is set to ${login_name}, but the SAML assertion does not include the login name, this exception happens: 

Either the Identity Provider has to be configured to provide the login name attribute or another available SAML attribute can be configured, see the online help Configure a Subject Pattern.

X.509 certificate generation fails - IllegalStateException: The value for the required variable EMAIL is not available in the context

The reason and solution are described in SAP KBA 2584310 - java.lang.IllegalStateException: The value for the required variable EMAIL is not available in context. 

TLS Handshake

SSL/TLS Handshake - General SSLEngine problem

The SAP Cloud Connector tries to open the HTTPS connection to the backend system.

When the SSL/TLS server's issuer certificate is unknown, the SSL/TLS handshake fails:

In that case, the SSL/TLS server's issuer certificate needs to be added to the Trust Store of the cloud connector:

• in cloud connector main menu choose Configuration
• Select On Premise tab
• In Trust Store section press add button
• In popup windows select the public key of the backend system 

Client Certificate Authentication

Client Certificate is not requested

When the SSL/TLS handshake proceeds, the ICM has to request for the client certificate, in ICM log file (dev_icm) this entry is logged:

The TLS client (SAP Cloud Connector) sends the client certificate (system certificate) in case:

• TLS server requests for the client certificate during the handshake. The ICM must be configured with VLCLIENT or icm/HTTPS/verify_client profile parameters.
• TLS server offers the trusted CA certificate which issued the client certificate

When the ICM does not request for the client certificate, this entry is logged in ICM trace:

The ICM requests for client certificate with the following profile parameters:

HTTPS port configuration contains VCLIENT=1

icm/server_port_1 = PROT=HTTPS, PORT=8001, TIMEOUT=30,PROCTIMEOUT=60, VCLIENT=1

or the HTTPS port configuration does not contain VCLIENT parameter as the default value is 1:

icm/server_port_1 = PROT=HTTPS, PORT=8001, TIMEOUT=30,PROCTIMEOUT=60

The ICM process will not ask for client certificate when HTTPS port configuration contains parameter VCLIENT=0 or global ICM parameter icm/HTTPS/verify_client  is set to 0:

icm/server_port_1 = PROT=HTTPS, PORT=8001, TIMEOUT=30,PROCTIMEOUT=60,VCLIENT=0

or

icm/HTTPS/verify_client = 0

If icm/HTTPS/verify_client is set to 0, the VCLIENT=1 parameter must be added to the HTTPS port configuration:

icm/HTTPS/verify_client = 0

icm/server_port_1 = PROT=HTTPS, PORT=8001, TIMEOUT=30,PROCTIMEOUT=60, VCLIENT=1

as individual port configuration overrides the global parameter.

Client Certificate is requested but not received

Even though the ICM requests for a client certificate, the SAP Cloud Connector may not send the client certificate. The ICM logs that no client certificate has been received.

In case of client certificate authentication, the TLS server needs to offer a list of trusted CA certificates to the client. The TLS client then looks for a client certificate which is signed by one of the offered CA certificates. When no such client certificate can be found, the TLS client will not send the client certificate to ICM.

The offered CA certificates can be fetched from ICM with openssl tool:

In ICM trace similar entries are logged:

In Linux the openssl package can be used in Windows the Git for Windows includes openssl.

When the SAP Cloud Connector system certificate issuer is not included in this list, it needs to be added to the CA list with STRUST transaction, see the online help Configure an ABAP System to Trust the Cloud Connector's System Certificate.

When SAP Cloud Connector sent the client certificate, the ICM log shows the received client certificate in the SSL_CLIENT_CERT HTTP header:

Client Certificate is received but removed from SSL header

When ICM does not trust the issuer, it removes the client certificate from the HTTP header:

The icm/HTTPS/trust_client_with_issuer and icm/HTTPS/trust_client_with_subject parameters need to be set, see help page Configure Principal Propagation to an ABAP System for HTTPS,

or icm/trusted_reverse_proxy_<xx> when

SAP Note 2052899 - ICM - Multiple Trusted Reverse Proxies

is implemented

Web dispatcher configuration

If there is an SAP web dispatcher in front of the backend systems, HTTPS must be used in the communication chain to send the client certificate to the backend:

SAP cloud platform - (VPN) - SAP cloud connector - (HTTPS) - SAP Web Dispatcher - (HTTPS) - ABAP ICM

Web dispatcher terminates the TLS connection

When an SAP web dispatcher exists in front of the ABAP ICM, the SAP web dispatcher must be configured to request the client certificate and offer the CA list.

Additionally, the SAP web dispatcher must forward the client certificate to the ABAP ICM.

See Wiki pages for web dispatcher configuration:

• How to Configure SAP Web Dispatcher to Forward SSL Certificates for X.509 Authentication
• How to setup client certificate logon to AS ABAP from SAP Web Dispatcher
• SAP Web Dispatcher SSL Certificate Forwarding WebDispatcherSSLCertificateForwarding_V3.pdf

Web dispatcher does not terminate the TLS connection

In that case, the ABAP ICM needs to request for the client certificate. 

Certificate mapping 

Missing client certificate mapping

Finally, the client certificate is forwarded however the ABAP system still responds with 401 HTTP code.

Now look for the ABAP security traces, logged in dev_w* files:

 In this case, there was no mapped user for this client certificate. See the online help about how to map the user Map Short-Lived Certificates to Users.

Mapping Client Certificate ST field

When the issuer certificate contains the SP field, in CERTRULE it is displayed as ST field.

SAP Note 511919 - Trust manager: Entering complex distinguished names. 

Client Certificate CN field contains a different attribute

When not the login name, but the email attribute is expected in CN field, it can be adjusted as described in the online help Configure a Subject Pattern for Principal Propagation.

ABAP security log samples

User is locked

Step 1 - client certificate lookup

Step 2 - based on CERTRULE configuration user is found

Step 3 - user is locked

Step 4 - logon denied

See SAP Note 320991 - Error codes during logon (list)

In SU01 the lock can be seen:

Mail cannot be mapped

Step 1 - client certificate lookup

Step 2 - CN attribute mapping failed, based on the email no such user exists

In SU01 transaction the email has a different domain:

Logon With - Alias

The Common Name attribute is mapped to "alias" instead of email.

Step 1 - client certificate lookup

Step 2 - looking for a user with alias

Step 3 - alias not found

In CERTRTULE Alias is set instead of E-mail:

Logon With - User Name

The Common Name attribute is mapped to "user name" instead of email

Step 1 - client certificate lookup

Step 2 - email address mapping failed to User Name, user name length is 12 characters in ABAP:

In CERTRULE the "Logon With" value is "User Name" instead of email:

Logon successful - password login is not possible

Password login is not possible due to too many incorrect login attempts.

Step 1 - client certificate lookup

Step 2 - user found based on CERTRULE

Step 3 - user status check, password login is not possible

Step 4 - logon with client certificate is successful

See SAP Note 320991 - Error codes during logon (list)

SU01 transaction:

Account is out of validity

Logon is not possible due to account validity:

Step 1 - client certificate lookup

Step 2 - user found based on CERTRULE

Step 3 - account is out of validity

Step 4 - authentication failed

See SAP Note 320991 - Error codes during logon (list)

In SU01 transaction the validity of the account can be seen:

Links

https://blogs.sap.com/2017/06/22/how-to-guide-principal-propagation-in-an-https-scenario/

https://blogs.sap.com/2017/06/26/how-to-guide-troubleshooting-principal-propagation-icm-traces/

Maintaining Logon Procedures - Standard Logon Order