SAP S/4HANA 1709 (SP00 & FPS01) Fully-Activated Appliance: Hints & Known Issues

This blog covers latest information and known issues for the SAP S/4HANA 1709 (SP00 & FPS01) Fully-Activated Appliance. If not indicated otherwise, the issues will occur in client 100 or across all clients.

The overview blog for this appliance can be found under https://blogs.sap.com/?p=564532

Update July 2021:
This appliance will soon be revoked from SAP Cloud Appliance Library since the underlying Linux release (SLES 12) will go out of maintenance and the solution can not be ported to the more recent SLES 15.
If you are in need of the SAP S/4HANA 1709 Fully-Activated Appliance, you can still obtain the appliance image for installation on your own hardware (see SAP Note 2041140).

Overview of fixes in the appliance from 1709 SP00 to 1709 FPS01

The following issues have been fixed in the SAP S/4HANA 1709 FPS01 fully-activated appliance compared to the SP00 version.

• Cross Topics > Access via SAP Analysis, Eclipse ABAP, …
  • Needed settings have been entered
• Fiori launchpad > User Assistance not visible
  • The Web Dispatcher proxy parameters (which contained an SAP-internal proxy in SP00) have been cleansed. SAP employees: Usage from the SAP-internal CAL network requires the re-entering of SAP proxy settings.
• Fiori launchpad > Client 200/300/400 access
  • Client 100 has been removed from the RFC destination LOCAL_HTTP

Cross Topics

Initial system performance after instance creation

When you create an instance, the initial system performance will be slow, especially within the Fiori Launchpad (some minutes of response time for the logon / first tiles, potentially a time-out). Also, the first click on a Fiori tile will be significantly slower. This is due to initial caching in the system and will become faster if you continue working.  

Note to SAP administrators: SGEN has been performed to pre-compile ABAP coding.

Supported hosting providers for the SAP S/4HANA 1709 Fully Activated Appliance

Currently, Amazon Web Services (AWS), MS Azure, Google Cloud Platform (GCP) and SAP Monsoon (only SAP-internal for 1709 SP00) are supported cloud providers for the SAP S/4HANA 1709 Fully Activated Appliance.

Access via SAP Analysis for MS Office, Eclipse ABAP perspective, and other RFC-based channels (SP00 only)

When trying to open a connection from SAP Analysis for MS Office to SAP S/4HANA (using a local entry in your SAP Logon), you get the error message:

LOCATION    SAP-Gateway on host vhcals4hci.dummy.nodomain / sapgw00
ERROR       reject connection request from […]
MODULE /bas/[…]/gwr3cpic.c

Resolution

1. Open transaction SMGW > Goto > Expert Functions > External security > Maintain ACL files> > switch to tab prxyinfo
2. Add a standard line to the PRXYINFO tab as follows to allow all traffic regardless of network.:
   P SOURCE=* DEST=*
3. Save > Activate Globally

Please also ensure that the ports 3300 and 30215 are opened for your instance. These ports are open by default but you can check/change this in the instance details of your CAL instance (cal.sap.com > Instances > [Click on your instance] > Virtual Machines > Access Points)

Fiori Launchpad

The Fiori User Assistance icon (question mark icon on top right) is not visible

The reason for this could be two things:

1. Wrong proxy setting in the Web Dispatcher configuration.
   This is wrongly configured in the SAP S/4HANA 1709 SP00 fully-activated appliance, so fix this first. Resolution needs access to the Linux backend system of the appliance (via PuTTY/ssh) and takes ~10-15 minutes.
   This has been fixed in the FPS01 version of the appliance.Note to SAP employees: if you have deployed a 1709 SP00 version of the appliance in the SAP-internal CAL network, you don’t have to touch this setting, proceed directly with step 2 below.
   If you are using the 1709 FPS01 version of the appliance, you will have to re-enter the two proxy.wdf.sap.com parameters into the Web Dispatcher configuration (see below), since otherwise you won’t have access to the user assistance content.
2. Invalidated certificate for the server that contains the help content.
   If the corrected proxy setting does not take effect, apply this fix. Resolution is browser-based and takes ~5 minutes.

1. Resolution for the wrong proxy setting in Web Dispatcher

1. Log on to the Linux backend system as root. You will need PuTTY (or another SSH client) and the private key file (.pem) that was generated when you created the instance. Unless you chose to save it on your own computer, the .pem file can be downloaded from the instance details page. For details how to log on with PuTTY, see this page > How to connect to a running instance via the secure shell protocol (SSH).
2. When logged on to Linux, enter su s4hadm (to change to user s4hadm)
   
3. Enter cd /usr/sap/S4H/SYS/profile (to change to the directory with the Web Dispatcher config files)
4. Enter vi S4H_ASCS01_vhcals4hcs to open the configuration file in the vi text editor
5. Press E (to edit the file anyway, an older swap version exists as well)
6. Scroll to the end of the file where you will find the following text block:

   #Configure SAP Web Dispatcher for Context-Sensitive User Assistance
   wdisp/system_3 = SID=ABC, EXTSRV=https://cp.hana.ondemand.com:443, SRCURL=/sap/dfa/help/, PROXY=proxy.wdf.sap.corp:8080, SRCSRV=*:*, STANDARD_COOKIE_FILTER=OFF
   wdisp/system_4 = SID=DEF, EXTSRV=https://xray.hana.ondemand.com:443, PROXY=proxy.wdf.sap.corp:8080,  SRCURL=/resources/sap/dfa/help/, SRCSRV=*:*, STANDARD_COOKIE_FILTER=OFF

7. Remove the two occurrences of the PROXY= parameter, i.e. afterwards the two lines should look like this:

   wdisp/system_3 = SID=ABC, EXTSRV=https://cp.hana.ondemand.com:443, SRCURL=/sap/dfa/help/, SRCSRV=*:*, STANDARD_COOKIE_FILTER=OFF
   wdisp/system_4 = SID=DEF, EXTSRV=https://xray.hana.ondemand.com:443, SRCURL=/resources/sap/dfa/help/, SRCSRV=*:*, STANDARD_COOKIE_FILTER=OFF

8. Enter [ESC]:wq (to write the file and quit the vi editor)
9. Lastly, restart the Web Dispatcher. Log on to https://vhcals4hcs.dummy.nodomain:44301/sap/admin/public/default.html with user bpinst and password Welcome1 (for this URL to work, you need to maintain your local hosts file)
10. In Core System > Monitor > Status, choose Shutdown SAP Web Dispatcher from the drop-down menu and confirm.
11. Reload the Fiori Launchpad in your browser to check if the question mark icon with the User Assistance is visible. If not, proceed to 2.

2. Resolution for the invalidated certificate of the help content server

1. Go to  https://xray.hana.ondemand.com/xRayControls/resources/sap/dfa/help/cfg/sap with the Chrome browser (other browsers may work differently). An empty white page should appear.
2. Click the ‘lock icon’ on the left of the URL
3. Click Certificate > Valid
4. Go to Details tab
5. Click “Copy to File”
6. Select “Next”
7. Choose “Base-64 encoded X.509 (.CER)”
8. Browse for the location you want to save it (eg. C:\docs) and type in a file name (eg. ondemand.cer)
9. Save
10. Next
11. Finish
12. OK
13. Go to https://vhcals4hcs.dummy.nodomain:44301/sap/admin and login with user BPINST, password Welcome1
14. Go to Menu > SSL and Trust Configuration > PSE Management
15. From the Manage PSE pulldown menu (top of the page), select SAPSSLC.pse
16. Click on import certificate
17. Open the saved certificate (eg. “ondemand.cer”) from the saved location with notepad
18. Copy the content of the file between —–BEGIN CERTIFICATE—– and —–END CERTIFICATE—-,including those two lines
19. Paste this into the “import certificate” form and then click Import
20. Go to Menu > Core System > Monitor > Click on running drop down menu > Select  Shutdown of SAP Web Dispatcher. Confirm the warning message and select Back.
21. Refresh the Fiori launchpad page and you should see the ‘question mark icon’ with the context-sensitive Fiori help items (you might need to clear your browser cache as well).

General remark on the Fiori Web Assistant content:

If you click the help icon (question mark) directly on the Fiori launchpad homepage, you will see Guided Tours that are not applicable for the SAP S/4HANA 1709 Fully-Activated appliance, so please ignore them and use the Web Assistant on specific Fiori tiles only.

Clients 200/300/400 (or other newly created clients): WebGUI / Web Dynpro apps prompt for separate log-on or access is blocked

Symptom:

If you log on to the Fiori launchpad in a client different than 100 and try to open WebGUI / Web Dynpro apps, you are prompted with a separate log-on screen or are blocked from access with a security certificate message.

Resolution:

You need to remove client 100 from the RFC connection LOCAL_HTTP: tCode SM59 > HTTP Connection to ABAP System > LOCAL_HTTP > Logon & Security > Remove entry 100 in Client field (leave it blank) > Save.

Eclipse / HANA Studio

Message about “Secure Storage Locked” in Eclipse / HANA Studio on remote desktop

Symptom:

When you launch Eclipse on the remote desktop in SAP CAL, you get a “Secure storage locked” error in the systems view tile. Clicking on the Unlock button doesn’t have any effect, and you can not access or create a connection into the HANA database.

Resolution:

On the remote desktop, delete the folder “.eclipse” in the users directory of the logged on user (e.g. C:\Users\Administrator if you are logged on with user Administrator).
Restart HANA Studio / Eclipse afterwards.

Creating a new ABAP package fails in Eclipse

Symptom:

When you try to create a new ABAP package in the Eclipse ABAP perspective, the creation fails with error message “Execution of request “POST /sap/bc/adt/packages” failed: 404 Not Found”.

Resolution:

Implement SAP note 2574380 (might prompt you to implement another depending SAP note), or create the package via SAP GUI (tCode SE80) and access the package in Eclipse afterwards.

Sales

“Manage Customer Returns” app (scope item BKP, Advanced Customer Returns)

On the ‘Manage Customer Returns’ app, it’s not possible to select the Return Document number and to activate the ‘Determine Refund’ button. If trying to access the link ‘ Refund Determination’ from the document number, an error ‘ the request Resource not found’ is displayed.
As a workaround, you can use the app “Determine Customer Refund”.

“Display Outbound Delivery” app (scope item 1IU, Customer Consignment)

The “Output Control” button is not active.As a workaround: from the initial screen of the app, select More > Outbound Delivery > Issues Delivery Output

“Manage Debit Memo Requests” app (scope item BDQ, Invoice Correction Process with Debit Memo)

The PDF output for order type CBII Invoice Increase Req. is not possible.
Under investigation.

“Manage Credit Memo Requests” app (scope item BKL, Invoice Correction Process with Credit Memo)

No output possinle for doc type RK Invoice Correct. Request..
Under investigation.

Asset Management

“Change Maintenance Notification” app (scope item BH1, Corrective Maintenance)

On the “Change maintenance notification” app, assigning an order to a notification is not possible. As a workaround, use the app “Manage Notification List” to assign orders.