SAP DM error : ERROR_USER_IS_NOT_AUTHORIZED_IN_CLOUD_CONNECTOR

[m_ehab]

After the last SAP DM release, I got this error message while trying to read indicators through production process design:

However, the user that runs the production process is maintained in the production connector user configuration tab and has all roles as follow:

I checked the cloud connector logs and I found this messages :

Principal propagation subject pattern in cloud connector is maintained as follow :

[Ulrich_Schmidt]

PS: adding the Connectivity Service tag. They will have more knowhow about how this works on cloud side.

[Ulrich_Schmidt]

"Unable to generate authentication token for ..." looks like there is something wrong with the logon settings on application side. (The application being "SAP DM" in this case.) The "high level" view of how this works is as follows:

1. An end user logs on to the Cloud application (SAP DM), usually via HTTPS.
2. The application then forwards a SAML or JWT token for that user to the Cloud Connector (SCC).
3. The SCC converts this token to an X.509 certificate and uses that for logon to the Backend System.

The last step is the one that's failing -- either because the token is missing or because its invalid. (Unfortunately the trace is too short to see the underlying reason.)

Note: the users defined in the user configuration tab have nothing to do with this: they are used only for administrating the cloud account and the technical connections between SCC and the Cloud VM, but not for login on to backend systems!

So I would suggest:

1. Verify whether during the DM upgrade anything has changed in the logon configuration of the DM app.
2. If you can't find anything, temporarily set the "SCC Loggers" to highest level, reproduce the error once, and attach the last 2-3 pages of the ljs_trace.log. (Best in text form, not as screenshot.)
   Note: do not increase the "Other Loggers". These only create lots of trace output that is not needed for this problem.