Subaccount registration error due to low disk space
The ConfgurationServlet tries to create a new subaccount, however, the subaccount configuration files cannot be created on the file system.
The ljs_trace file in <sap>/scc20/log folder contains this error:
#ERROR#com.sap.scc.rt#http-bio-8443-exec-9# #error while writing audit log java.io.IOException: There is not enough space on the disk (path C:\\SAP\\scc20\\log\\audit\\<region>.hana.ondemand.com\\<subaccount ID>\\audit-log_<subaccount ID>_YYY-MM-DD.csv, working dir C:\\SAP\\scc20) at java.io.FileOutputStream.writeBytesWithPath(Native Method) at java.io.FileOutputStream.write(FileOutputStream.java:341) at sun.nio.cs.StreamEncoder.writeBytes(StreamEncoder.java:221) at sun.nio.cs.StreamEncoder.implFlushBuffer(StreamEncoder.java:291) at sun.nio.cs.StreamEncoder.implFlush(StreamEncoder.java:295) at sun.nio.cs.StreamEncoder.flush(StreamEncoder.java:141) at java.io.OutputStreamWriter.flush(OutputStreamWriter.java:229) at java.io.BufferedWriter.flush(BufferedWriter.java:254) at com.sap.scc.audit.file.FileSystemAuditLogger.raiseEvent(FileSystemAuditLogger.java:177) at com.sap.scc.audit.file.FileSystemAuditLogger.<init>(FileSystemAuditLogger.java:86) at com.sap.scc.audit.file.FileSystemAuditLogger.<init>(FileSystemAuditLogger.java:75) at com.sap.scc.audit.AuditLoggerFactory.createAuditLogger(AuditLoggerFactory.java:24) at com.sap.scc.config.SccConfig.createNewAccount(SccConfig.java:946) at com.sap.scc.config.SccConfig.getAndCreateAccount(SccConfig.java:929) at com.sap.scc.config.SccConfig.createAccount(SccConfig.java:900) at com.sap.scc.ui.SubaccountControl.createSubaccount(SubaccountControl.java:83) at com.sap.scc.servlets.ConfigurationServlet.addAccount(ConfigurationServlet.java:1355) ... #INFO#com.sap.scc.ui#http-bio-8443-exec-9# #Subaccount already added or employed for disaster recovery com.sap.scc.servlets.RequestFailureExecution$InvalidConfiguration: Subaccount already added or employed for disaster recovery at com.sap.scc.ui.SubaccountControl.createSubaccount(SubaccountControl.java:87) at com.sap.scc.servlets.ConfigurationServlet.addAccount(ConfigurationServlet.java:1355) ... Caused by: com.sap.scc.config.SccConfigurationException: Unable to create a account configuration dir for <subaccount ID>@<region>.hana.ondemand.com[C:\\SAP\\scc20\\scc_config\\<region>.hana.ondemand.com\\<subaccount ID>] at com.sap.scc.config.AccountConfiguration.ensureAccountConfigDir(AccountConfiguration.java:115) at com.sap.scc.config.AccountConfiguration.<init>(AccountConfiguration.java:72) at com.sap.scc.config.SccConfig.createNewAccount(SccConfig.java:947) at com.sap.scc.config.SccConfig.getAndCreateAccount(SccConfig.java:929) at com.sap.scc.config.SccConfig.createAccount(SccConfig.java:900) at com.sap.scc.ui.SubaccountControl.createSubaccount(SubaccountControl.java:83)
Problem
The ConfigurationServlet cannot create the necessary configuration files on the file system due to low disk space.
Solution
Free some disk space.
Subaccount registration fails with 403 HTTP code
The ljs_trace file in <sap>/scc20/log folder contains this error:
#INFO#com.sap.scc.security#http-bio-8443-exec-1# #Executing Http Get request to https://connectivitycertsigning.cf.eu10.hana.ondemand.com:443/certificate/management/v1/trusted/ca/account/<subaccount ID>| #INFO#com.sap.scc.security#http-bio-8443-exec-1# #Returned Http Response with code 403| #WARN#com.sap.scc.rt#http-bio-8443-exec-1# #Tunnel account:///<subaccount ID> is inoperative. SccEndpoint com.sap.scc.config.TunnelSccEndpoint@5f67286e ok, and context == null| #ERROR#com.sap.scc.ui#http-bio-8443-exec-1# #SCC handshake failed: 403 — Forbidden com.sap.scc.servlets.SccHandshakeException: SCC handshake failed: 403 — Forbidden at com.sap.scc.cert.HttpCertificateManagementService.processRequest(HttpCertificateManagementService.java:137) at com.sap.scc.cert.HttpCertificateManagementService.executeGetRequest(HttpCertificateManagementService.java:91) at com.sap.scc.cert.HttpCertificateManagementService.getConnectivityAgentCA(HttpCertificateManagementService.java:62) at com.sap.scc.cert.CertificateSigningClient.getCACertificate(CertificateSigningClient.java:41) at com.sap.scc.ui.SubaccountControl.applyConfig(SubaccountControl.java:139) at com.sap.scc.ui.SubaccountControl.createSubaccount(SubaccountControl.java:96) at com.sap.scc.servlets.ConfigurationServlet.addAccount(ConfigurationServlet.java:1355) ...
Problem
The subaccount does not exist in the selected region and a wrong region is selected from the dropdown list.
For example region, Europe (Frankfurt) - AWS (cf.eu10.hana.ondemand.com) is selected however the subaccount belongs to Europe (Frankfurt) (eu2.hana.ondemand.com).
Solution
In SAP Cloud Connector subaccount registration popup, enter the region hostname manually, for example, eu2.hana.ondemand.com:
The latest cloud connector version includes the new regions.
The region list is available in the online help:
Regions and Hosts Available for the Neo Environment
Regions and API Endpoints Available for the Cloud FoundryEnvironment
How to check subaccount registration from a browser
When a subaccount is added to the cloud connector, the cloud connector fetches a certificate from the certificate signing service.
The cloud connector trace contains a similar entry, in this case, a NEO platform hanatrial region is configured:
#Executing Http Get request to https://connectivitycertsigning.hanatrial.ondemand.com:443/certificate/management/v1/trusted/ca/account/<subaccountID>
#Returned Http Response with code 200
or to a Cloud Foundry subaccount, the log entry looks like this one:
#Executing Http Get request to https://connectivitycertsigning.cf.eu10.hana.ondemand.com:443/certificate/management/v1/trusted/ca/account/aaaaaaaa-bbbb-4444-5555-666666666666
#Returned Http Response with code 200
The received certificate can be checked in a browser as well:
https://connectivitycertsigning.hanatrial.ondemand.com:443/certificate/management/v1/trusted/ca/account/<subaccountID>
How to check subaccount registration from command line
Use curl tool to check if the subaccount certificate can be reached with the known user credentials.
curl -u "userID:password" https://connectivitycertsigning.hanatrial.ondemand.com:443/certificate/management/v1/trusted/ca/account/<subaccountID>
Note, when cloud connector is connected to SAP cloud platform through a proxy, define the same in curl command:
curl --proxy "proxy:8888" --proxy-user "proxyUser:proxyPassword" -u "userID:password" https://connectivitycertsigning.hanatrial.ondemand.com:443/certificate/management/v1/trusted/ca/account/<subaccountID>
see Curl manpage.