Sap Diagnostic error report

Nitesh harjai

Hi Developers,

I need your valuable inputs regarding an issue I encountered while executing the Infrastructure Diagnostic Report from my SAP S/4HANA 2022 system, which is integrated with OpenText Content Server version 24.3.

During the execution, I encountered the following errors

1) Can the Extended ECM Service be executed?
Error :- No authorization exist for Workspace functions

2) Can the OTDS Service be executed?
Error :-

SoapFaulCodeName: WebServices.Authentication.SAPTokenError   SoapFaulCodeNamespace: urn:api.ecm.opentext.com Error validating SAP token  [AjQxMDMBABhEAEEAQwBPAF8ATwBUADAAMgAgACAAIAACAAYxADAAMAADABBNAEQANAAgACAAIAAgACAABAAYMgAwADIANQAwADQAMAAyADEAMAA0ADkABwAEAAAAAggAAQEJAAJFAA8AAzEwMBAACE1ENCAgICAg%2FwD7MIH4BgkqhkiG9w0BBwKggeowgecCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHATGBxzCBxAIBATAaMA4xDDAK 0RAIICiAZAwMVBAEwCQYFKw4DAhoFAKBdMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTI1MDQwMjEwNDkyNVowIwYJKoZIhvcNAQkEMRYEFOmu1C2GXPFnHmITLyTZ8byVPpa3MAkGByqGSM44BAMELjAsAhRuxLt8X6hbNBMI9DbQHmVLNZAFagIUdicbX%2FzzcV4X53%2FgjfRMG1lXaDw%3D]: 
Encountered exception validating SAP Token. Details: MySapEvalLogonTicketEx failed: standard error= 5, ssf error= 27 Exception

3) Can the Content Server Member Service be executed?

Error :-

SoapFaulCodeName: WebServices.Authentication.SAPTokenError   SoapFaulCodeNamespace: urn:api.ecm.opentext.com Error validating SAP token                                                                                                                                                       [AjQxMDMBABhEAEEAQwBPAF8ATwBUADAAMgAgACAAIAACAAYxADAAMAADABBNAEQANAAgACAAIAAgACAABAAYMgAwADIANQAwADQAMAAyADEAMAA0ADkABwAEAAAAAggAAQEJAAJFAA8AAzEwMBAACE1ENCAgICAg%2FwD7MIH4BgkqhkiG9w0BBwKggeowgecCAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHATGBxzCBxAIBATAaMA4xDDAK 
gNVBAMTA1M0RAIICiAZAwMVBAEwCQYFKw4DAhoFAKBdMBgGCSqGSIb3DQEJAzELBgkqhkiG9w0BBwEwHAYJKoZIhvcNAQkFMQ8XDTI1MDQwMjEwNDkyNFowIwYJKoZIhvcNAQkEMRYEFOmu1C2GXPFnHmITLyTZ8byVPpa3MAkGByqGSM44BAMELjAsAhRAEXmtiuUpQidn7F3sN5s%212xWucAIUMrS%21u2IMOWFfDEp8DNtoXDayYvQ%3D]: 

Encountered exception validating SAP Token. Details: MySapEvalLogonTicketEx failed: standard error= 5, ssf error= 27 Exception

FYI :- I have successfully exported the SAP PSE to the OTDS authentication handler.

Thanks,
Nitesh

appuq

On error 2 the SAP PSE for the correct SAP system needs to be put there. If you want to know about this, the SAP system provides an MYSAPSSO2 cookie and the pse should be able to crack (So if in SAP your login is nharjai, the call gets intercepted by OTDS and you can increase debug so you can see the user). I had to do this before OTDS came into being at a customer

https://appukili.wordpress.com/2013/04/16/oh-my-sap/

Secondly, the authentication has two modes one is SAPSSOEXTHANDLER, which means every SAP user is present in OTDS, and they have access to the resource or older ways would be you configure a System Admin user who then impersonates the real user

nharjai in SAP exists on OTDS in some partition same user is mapped to OTCS user (you have the option of maintaining your userid in 4 different ways in OTDS, and the only criteria isthat the sap caller is able to be mapped to one of them)

So if you are not a Basis guy most likely delete the PSE that you have loaded and push it from sap.I don't know if pushing exists in otxecm or was it otas, its been sometime, but more than likely the pse is good but no corresponding otds things are correct there.

From memory, a simple OTDS checklist is

Is user in user and groups? If not, add him to some partition?

Is the user present in Resource(OTCS,OTAS,DAM etc etc) ? If not consolidate and verify user exists

Are Access Roles correct?

1)

 

Can the Extended ECM Service be executed?
Error

 :- No authorization exist for Workspace functions

SAP uses SOAP Create&Update workspaces and it calls the ECMlink wsdl(only a TC version exists)

http(s)://<some tomcat server>/otsapxecm/services/ECMLink so you can easily test this by putting that wsdl and even go a step further by using Postman,powershell or soapui to test it. Notethat the WSDL is hardcoded to go to a real OTCS server in its config so most likely you should see the FQDN of your OTCS server and it LAPI port there)