How to handle DXC Network timeout and BOBJ SSO issues when using HCP-DBaaS Data Mart

[kirankola]

One of the latest feature of SAP HANA Cloud Platform is Persistence Services. The persistence service provides in-memory and relational data persistence to applications running on SAP HANA Cloud Platform. Persistence service supports the SAP HANA, SAP ASE and SAP MaxDB. When customer deals with integration aspects of HANA persistence (HCP-DBaaS) and on premise SAP BOBJ there could be some challenges. This blog address two cases that one of our customer faced during their implementation phase.

Scenario is connectivity from SAP BOBJ instance via ODBC to SAP HCP-DBaaS on HCP (SAP HANA as Data Mart). In this scenario, SAP Cloud Connector is used to establish the DB tunnel. Customers might leverage SAP HANA DXC to load data into HCP-DBaaS and intend to leverage their on premise BOBJ BI installation to run analytics on data loaded on HCP-DBaaS.

Case 1: Experience Network timeout issues when using DXC for Data Loading

Observations:

• Created connectivity between on premise BW and HCP (HANA Cloud Platform) and started loading data
• Using DXC connectivity to load the data from on premise to cloud
• Small data loads are working fine
• Experience problems while loading bigger data, around 2 million records
• Extractor is selecting and sending data to HCP, after some time it is failing by showing Communication error as shown in the below picture
• Adjusting infopackage size may not resolve the issue

Error:

Resolution:

Change the Internet Communication Manger connection timeout setting of (icm/conn_timeout) on SAP Business Warehousing system. Increase timeout value to 500 seconds.

Tracing:

SMICM > Level 3

Case 2: Issues when trying to implement the SSO between HANA Cloud Platform HCP-DBaaS & SAP BOBJ through LDAP

Observations:

For BOBJ SSO reference, customers might refer to following blogs for setting up SSO between HANA and BOBJ.

http://scn.sap.com/community/hana-in-memory/blog/2014/10/24/setup-saml-sso-from-bi-to-hana-using-sap...

http://scn.sap.com/community/hana-in-memory/blog/2013/08/01/configuring-saml-with-sap-hana-and-sap-b...

Customer Questions:

• Document refers to the on premise HANA SAP Directories, how do we achieve this when using HCP DBaaS scenario?
• Where do we upload the BO instance Certificates?

Error:

When testing using SAP BO Central Management Console, you might get following authentication error as shown in the following picture. Following error message could also be displayed if there is inconsistent white space in the Distinguished Names (DN) of the certificate provided by BO, and the SAML Provider configured in Hana (refer note: 2158914).

Connection Failed: The test of the HANA SSO ticket used to log onto the HANA DB has failed due to: [10]: authentication failed. (FWM 02133)

Resolution: 

In order to resolve this issue, we have two steps to follow. Step 1 is correcting the Service Provider name on HANA and Step 2 is to upload the BO Certificate to HCP-DBaaS.

Step 1: From the following, you can either keep it empty (a) or have correct SAML SP name (b).

a) Set the HANA SP Name (field: indexserver.ini->authentication->saml_service_provider_name) to an empty value

ALTER SYSTEM ALTER CONFIGURATION ('indexserver.ini', 'SYSTEM') SET ('authentication', 'saml_service_provider_name') = ''  WITH RECONFIGURE;

b) Set indexserver.ini->authentication->saml_service_provider_name -> spId

ALTER SYSTEM ALTER CONFIGURATION ('indexserver.ini', 'SYSTEM') SET ('authentication', 'saml_service_provider_name') = 'spId' WITH RECONFIGURE;

Following is the sample screen with service provider name as spId (I is Capital letter).

Step 2: Upload Certificate to HANA Cloud Platform Trust Manger using following steps:

a) While creating certificate file for BO instance, copy Identity Provider Base64 certificate and Save it locally in CRT format.

b)  Login to HCP-DBaaS account: https://<ACCOUNT>.ondemand.com/sap/hana/xs/admin/#/trustManager/SAPLOGON

c)  Click and Import Certificate button and browse BO instance certificate and Import the BO certificate

d.) Restart the Server

Tracing: For capturing Authentication traces, 4 simple steps to follow:

1. Set Authentication Trace using following SQL console commands in HANA Studio:

ALTER SYSTEM ALTER CONFIGURATION ('indexserver.ini', 'SYSTEM') set ('trace', 'authentication') = 'debug' with reconfigure;

ALTER SYSTEM ALTER CONFIGURATION ('xsengine.ini', 'SYSTEM') set ('trace', 'authentication') = 'debug' with reconfigure;

ALTER SYSTEM ALTER CONFIGURATION ('xsengine.ini', 'SYSTEM') set ('trace', 'xssession') = 'debug' with reconfigure;
ALTER SYSTEM ALTER CONFIGURATION ('xsengine.ini', 'SYSTEM') set ('trace', 'xsauthentication') = 'debug' with reconfigure;

2. Test Connection in SAP BO Central Management Console

3. Once the error is captured, collect all the logs

4. UNSET Authentication Trace level using following SQL Console Commands in HANA Studio:

ALTER SYSTEM ALTER CONFIGURATION ('indexserver.ini', 'SYSTEM') UNSET ('trace', 'authentication');
ALTER SYSTEM ALTER CONFIGURATION ('xsengine.ini', 'SYSTEM') UNSET ('trace', 'authentication');
ALTER SYSTEM ALTER CONFIGURATION ('xsengine.ini', 'SYSTEM') UNSET ('trace', 'xssession');
ALTER SYSTEM ALTER CONFIGURATION ('xsengine.ini', 'SYSTEM') UNSET ('trace', 'xsauthentication');