SAP S/4HANA integration question

[Henrique Lima]

We are trying to acquire a SAP S/4HANA endpoint on CA IDM 14.2 CP5 vApp but not having much luck.

1) We have generated the sapConnectorLigsOsgi.jar as per the doc[1] (Generated OSGi JAR, uploaded to CS UI, did "Refresh Imports" - at this point, it failed, so we restarted JCS, but the issue persisted)

2) We cannot find what folder the java.library.path is pointing to, so we could check if the JAR was there;
3) We are not using the JAVA AS certificate at this point;

Does anyone have any tips on how I can accomplish this?


[1] https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/layer7-identity-and-access-management/identity-management-and-governance-connectors/1-0/how-to-connect-to-sap-erp-or-sap-ume.html#concept.dita_617aa9a1870efa65d3f67aa90f59d4fd8c11553a_DefinethePrivilegesoftheUserthatConnectstotheEndpoint​​

------------------------------
Software Consultant
Gliat Tecnologia da Informação
São Paulo
Brazil
------------------------------

[Vincent Parziale]

Hello Henrique,

The SAP S/4HANA endpoint is not a supported connector at this time.

Thank You,
Vincent Parziale

[Henrique Lima]

Hi Vincent,
Thank you for your answer.

The tech doc[1][2] says otherwise:

Anyhow, it would be interesting to know if anyone else here encountered this same issue (which I believe there is) to help us point to the right direction.

I appreciate any help I can get on this one.
Thanks in advance.

[1] https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/layer7-identity-and-access-management/identity-manager/14-2/platform-support-matrix/connectors-and-endpoint-types.html  

[2] https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/layer7-identity-and-access-management/identity-management-and-governance-connectors/1-0/connectors/other-connectors/sap-connector.html

------------------------------
Software Consultant
Gliat Tecnologia da Informação
São Paulo
Brazil
------------------------------

[Vincent Parziale]

Hello Henrique,

Looks like the documentation team pulled a quick one on us and updated the supported connectors on the 12th. 

Make sure the Jar files were updated correctly here:
jcs/data/bundles/restore

You can try to take the SAP.jar and place it there and restart the connector and try once more. Make sure to try from the provisioning manager as you may also need to run the role definition generator for the connector to work correctly.

Thank You

[Kanakam R Rajender]

Hi Henrique,

I have few questions:

Where is your JCS (Java Connector Server) installed ? i.e. on Linux(vApp - inbuilt internal connector) (or) Windows(External connector)?
How did you create sapConnectorLibsOsgi.jar? i.e using sapjco3.dll (or) using libsapjco3.so ?

Thanks,
Rajender

[Henrique Lima]

Hi Kanakam,

These are the steps I followed:

1) I asked the customer's SAP administrator to download the SAP JCo files from the SAP website[1]
2) Then, I copied the ZIP file to the provisioning server, uncompressed. and ran sap_post_install
    The script asks for the location of both files. 
    You need to run the script from WITHIN folder /opt/CA/IdentityManager/ConnectorServer/jcs/resources/sap - the doc[2] says to run the script from the BIN folder, but the config user does not have permission to run the script there. I opened the script and saw that it was pointing to the JCS/resources/sap folder. @CA Doc team, you might want to amend that :)
3) The sapConnectorLibsOsgi.jar file is created in the same folder you ran the script. You need to get that JAR file and upload it to the Connector Server Management Console[3]
4) Now I am trying to acquire the endpoint, but not having luck.I have some other activities going on there, so I have not done what Vincent mentioned. I will do it and report back the results. 

I am using the vApp Java Connector Server - not the External Windows connector. I do not want to put another burden onto that server.

Hope this answers your question. Let me know if I can help any further.

[1] https://support.sap.com/en/product/connectors/jco.html
[2] https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/layer7-identity-and-access-management/identity-management-and-governance-connectors/1-0/connectors/other-connectors/sap-connector/acquire-sap-endpoint-in-ca-identity-manager.html
[3] https://<connectorServerIP>:20443/

​

------------------------------
Software Consultant
Gliat Tecnologia da Informação
São Paulo
Brazil
------------------------------

[Kanakam R Rajender]

Hi Henrique,

Before uploading the sapConnectorLibsOsgi.jar file to the connector server did you copy the "libsapjco3.so" file to the "jcs/native" directory ?
This needs to be done before uploading the sapConnectorLibsOsgi.jar file. If you notice the output of "sap_post_install" you will see this instruction as the last line of the output. please refer the screenshot that i have attached.

Also, I am getting the doc issue corrected with workaround i.e. "config user does not have permission to run the script there".

Let me know if you still face the issue.

Thanks,
Rajender

[Henrique Lima]

Hi,

I did not pay attention to that bit of the message, but I have now followed all tips that were mentioned in the thread - still no luck, though.

Please see attached file and my comments below:
1) [sapjco-nativefolder.png] The .so file is in the folder now.
2) [sap-ep-tasklog.png] These are all the task and resubmission logs for all my attempts, and a comment on each attempt.
3) [restore-unable.png] I cannot move the JAR file to the restore folder because the folder does not exist. When I tried to create it, it would not let me because of lack of permissions.
4) [CS-sap-bundles.png] My SAP bundles in the CS Admin UI, with comments.

Let me know if I can provide you with any further information.

Thank you all for the help.

Henrique



------------------------------
Software Consultant
Gliat Tecnologia da Informação
São Paulo
Brazil
------------------------------

[Henrique Lima]

The MD5 for the libsapjco3.so is ba52c7fd002a09359a26123d0c432b75

------------------------------
Software Consultant
Gliat Tecnologia da Informação
São Paulo
Brazil
------------------------------

[Kanakam R Rajender]

Hi Henrique,

Please restart JCS connector server in vApp. I could reproduce the issue that you are currently facing and was able to resolve after restarting the jcs. Please refer the attached screenshots.

commands to stop and start jcs are:
stop_jcs
start_jcs

Thanks,
Rajender

[Henrique Lima]

Hi Rajender,
I have stopped/started JCS on the staging ProvServer but did not have any luck.

==== Recap:
- libsapjco3.so is in jcs/native folder

- jar file uploaded to Connector Server

- RoleDefs version:

====

The results of the test is below:

Rajender, even though the doc says the SSL part is optional, do you know if this could make any difference? I asked my SAP Admin here and he does not know how to get such certificate. Can you give me any tips on how to do it? We definitely want to use SSL for this.

​

------------------------------
Software Consultant
Gliat Tecnologia da Informação
São Paulo
Brazil
------------------------------

[Kanakam R Rajender]

Hi Henrique,

Please try below steps:
Register vApp_Provisioning Server in Connector Xpress.
Expand Prov Server hostname --> im --> Domains --> 'SAP R3'
Right click on SAP R3 and select 'Set Managing CS..."
in the select connector servers dialog select the vApp_Linux_<vapphostname> and click on OK.
in vApp, restart JCS using stop_jcs and start_jcs and create SAP Endpoint.

Let me know if this resolves the issue.

Thanks,
Rajender

[Henrique Lima]

Hi Rajender,
No joy:

------------------------------
Software Consultant
Gliat Tecnologia da Informação
São Paulo
Brazil
------------------------------

[Kanakam R Rajender]

Hi Henrique,

Could you please give it a try on another test environment (in case you have) and let me know if you face the same issue.

Thanks,
Rajender

[Henrique Lima]

Hi Kanakam,
This has been performed in a brand new environment - still no joy, amazingly.

Could it be that I am not using the correct server and, thus, the connector is not understanding the response given by the server? What is the server I am supposed to use when acquiring the SAP endpoint?

------------------------------
Software Consultant
Gliat Tecnologia da Informação
São Paulo
Brazil
------------------------------

[Henrique Lima]

Hello,

I am glad to inform that I was able to acquire the SAP R3 endpoint. I am unsure of why exactly it worked out after all we have done, but this was the path we followed:

- I installed the SAP Jco files on the External Windows Connector server.
- I received a different error message even though I did NOT change the default connector handler @ ConnectorXpress (as it was still referencing the vapp CS). Part of it was showing the SAP gateway port

- I then realized that we had a firewall problem between the vApp Connector and the endpoint.
- We dealed with the firewall issue, and we were able to acquire the endpoint.

I know this sounds confusing, but that was pretty much what happened.

Thank you all for the help in this matter. 

Happy new year to all!


------------------------------
Software Consultant
Gliat Tecnologia da Informação
São Paulo
Brazil
------------------------------