Sap Diagnostic error report

Nitesh harjai · 2025-04-03T12:53:58+00:00

There was an error rendering this rich post.

Hi Developers,

I need your valuable inputs regarding an issue I encountered while executing the Infrastructure Diagnostic Report from my SAP S/4HANA 2022 system, which is integrated with OpenText Content Server version 24.3.

During the execution, I encountered the following errors

1) Can the Extended ECM Service be executed?
Error :- No authorization exist for Workspace functions

2) Can the OTDS Service be executed?
Error :-

SoapFaulCodeName: WebServices.Authentication.SAPTokenError SoapFaulCodeNamespace: urn:api.ecm.opentext.com Error validating SAP token [AjQxMDMBABhEAEEAQwBPAF8ATwBUADAAMgAgACAAIAACAAYxADAAMAADABBNAEQANAAgACAAIAAgACAABAAYMgAwADIANQAwADQAMAAyADEAMAA0ADkABwAEAAAAAggAAQEJAAJFAA8AAzEwMBAACE1ENCAgICAg%2FwD7MIH4BgkqhkiG9w0BBwKggeowgecCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHATGBxzCBxAIBATAaMA4xDDAK 0RAIICiAZAwMVBAEwCQYFKw4DAhoFAKBdMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTI1MDQwMjEwNDkyNVowIwYJKoZIhvcNAQkEMRYEFOmu1C2GXPFnHmITLyTZ8byVPpa3MAkGByqGSM44BAMELjAsAhRuxLt8X6hbNBMI9DbQHmVLNZAFagIUdicbX%2FzzcV4X53%2FgjfRMG1lXaDw%3D]:
Encountered exception validating SAP Token. Details: MySapEvalLogonTicketEx failed: standard error= 5, ssf error= 27 Exception

3) Can the Content Server Member Service be executed?

Error :-

SoapFaulCodeName: WebServices.Authentication.SAPTokenError SoapFaulCodeNamespace: urn:api.ecm.opentext.com Error validating SAP token [AjQxMDMBABhEAEEAQwBPAF8ATwBUADAAMgAgACAAIAACAAYxADAAMAADABBNAEQANAAgACAAIAAgACAABAAYMgAwADIANQAwADQAMAAyADEAMAA0ADkABwAEAAAAAggAAQEJAAJFAA8AAzEwMBAACE1ENCAgICAg%2FwD7MIH4BgkqhkiG9w0BBwKggeowgecCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHATGBxzCBxAIBATAaMA4xDDAK
gNVBAMTA1M0RAIICiAZAwMVBAEwCQYFKw4DAhoFAKBdMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTI1MDQwMjEwNDkyNFowIwYJKoZIhvcNAQkEMRYEFOmu1C2GXPFnHmITLyTZ8byVPpa3MAkGByqGSM44BAMELjAsAhRAEXmtiuUpQidn7F3sN5s%212xWucAIUMrS%21u2IMOWFfDEp8DNtoXDayYvQ%3D]:

Encountered exception validating SAP Token. Details: MySapEvalLogonTicketEx failed: standard error= 5, ssf error= 27 Exception

FYI :- I have successfully exported the SAP PSE to the OTDS authentication handler.

Thanks,
Nitesh

Find more posts tagged with

Comments

appuq

On error 2 the SAP PSE for the correct SAP system needs to be put there. If you want to know about this, the SAP system provides an MYSAPSSO2 cookie and the pse should be able to crack (So if in SAP your login is nharjai, the call gets intercepted by OTDS and you can increase debug so you can see the user). I had to do this before OTDS came into being at a customer

https://appukili.wordpress.com/2013/04/16/oh-my-sap/

Secondly, the authentication has two modes one is SAPSSOEXTHANDLER, which means every SAP user is present in OTDS, and they have access to the resource or older ways would be you configure a System Admin user who then impersonates the real user

nharjai in SAP exists on OTDS in some partition same user is mapped to OTCS user (you have the option of maintaining your userid in 4 different ways in OTDS, and the only criteria isthat the sap caller is able to be mapped to one of them)

So if you are not a Basis guy most likely delete the PSE that you have loaded and push it from sap.I don't know if pushing exists in otxecm or was it otas, its been sometime, but more than likely the pse is good but no corresponding otds things are correct there.

From memory, a simple OTDS checklist is

Is user in user and groups? If not, add him to some partition?

Is the user present in Resource(OTCS,OTAS,DAM etc etc) ? If not consolidate and verify user exists

Are Access Roles correct?

Can the Extended ECM Service be executed?
Error

:- No authorization exist for Workspace functions

SAP uses SOAP Create&Update workspaces and it calls the ECMlink wsdl(only a TC version exists)

http(s)://<some tomcat server>/otsapxecm/services/ECMLink so you can easily test this by putting that wsdl and even go a step further by using Postman,powershell or soapui to test it. Notethat the WSDL is hardcoded to go to a real OTCS server in its config so most likely you should see the FQDN of your OTCS server and it LAPI port there)

Nitesh harjai

The only challenge that I think of is When I go to SAP transaction /Strust and find the SYSTEM PSE the value of CN is different from the SAP System ID :-

But in this scenario I don't want to change the SAP PSE certificate from a SAP System.

Secondly , I am using the SAP SAPSSOEXTHANDLER and I have same user in OTDS present which I used to login from SAP system.
and user in OTDS lying under content server member partition.

Thanks,
Nitesh

appuq

bump up the OTDS logs send the logs to OT using a support ticket and let them fix it:)

My thought was when you execute in OTDS logs you will see cracking the MYSAPSSO2 to nithesh or something like that

if it is not even doing that you need help from OT

Nitesh harjai

Thanks @appuq i will raise ticket with Opentext and see whenever i am logging in from SAP what we will get in the otds.log file

Nitesh harjai

2) Can the OTDS Service be executed?

This is possibly the PSE certificate issue but to correct this scenario for now i have used the impersonation mechanism where every request coming from any SAP user will be map to Single user define in Authentication handler in OTDS.

3)Can the Extended ECM Service be executed?
Error

:- No authorization exist for Workspace functions.

As you said SAP uses SOAP Create&Update workspaces and it calls the ECMlink wsdl.
However, When i am calling the WSDL in browser it is giving me appropriate results with XML.

I am using https://<fqdn>/otsapxecm/services/ECMLink?wsdl however still I am getting same error when running the diagnostic report.

Thanks
Nitesh

appuq

a WSDL is just a proxy so if it comes in browser that doesn’t mean code can be executed . For an accurate test use a soapui command or postman command and see if you can create a workspace .

Nitesh harjai

Thanks let me try that and will let you know.

Nitesh harjai

Thanks @appuq The above has been resolved as authorization j_6nrl_wsc is missing from SAP user account, after providing the authorization to user account. I am able to run daignostic without any issues.