128447 - Trusted Trusting Systems

2017-05-17

Page 1/8

128447 - Trusted/trusting systems 版本

65

Type

SAP Note

语言

英语

Master Language

德语

优先级

优先级为高的更正

Category

Program error

Release Status

发布给客户

Released On

27.09.2016

Component

BC-MID-RFC (RFC)

Please find the original document at https://launc https://launchpad.support hpad.support.sap.com/#/ .sap.com/#/notes/128447 notes/128447

Problems may occur when setting up a trust relationship (trusted/trusting (trusted/trusting system relationship) between two SAP systems and when using this relationship. The following runtime errors occur: "No authorization to log on as a trusted system (Trusted RC = #)." or "No authorization to log on as a trusted system (L-RC=A T-RC=B)" Note the following: following:

L-RC displays the output value for the logon (L as in logon). T-RC displays the output value for the trust relationship (T as in trust). You must take output values A and B for the target system (trusting ABAP system) from the text for the ABAP runtime error "CALL_FUNCTION_SINGLE_LOGIN_REJ".

No authorization to log on as a trusted system RFC, trusted, trusting, CALL_FUNCTION_SINGLE_LOGIN_REJ, CALL_FUNCTION_SINGLE_LOGIN_REJ, trust relationship

You have configured a trust relationship as described in the documentation [ http://help.sap.com/saphelp http://help.s ap.com/saphelp_nw74/helpdata _nw74/helpdata/de/48/956eb1 /de/48/956eb194cc73e9e10000 94cc73e9e10000000a42189b/co 000a42189b/co ], but encounter problems when using it.

When you set up a trust relationship between a trusted system (client C00) and a trusting system (server S00), the destination TRUSTING_SYSTEM@S00 is automatically created in system C00. This destination is required for administrative administrative tasks and must not be used or deleted in productive scenarios. scenarios. Always use transaction SM59 to set up a separate destination destination (for example: S00_TRUSTED) for the productive scenario. If you do not define any logon data in the destination S00_TRUSTED (which is used productively) on the trusted system C00 for the trusting system S00, the system will attempt to log on to the target system S00 with the user who is logged on to the system C00 (the user name corresponds to SY-UNAME, client, and language) as is the case for every RFC call. Therefore, if the client or the language of the trusting system do not correspond to those of the trusted system, you must define the client and the language in the destination. If the logon is carried out using the same user name, you must set the field "RFC_EQUSER" to Y (for YES) in the authorization object object S_RFCACL for the users in the trusting system.

© 2017 SAP SE or an SAP affiliate company. All rights reserved

2017-05-17

Page 2/8

Note the following: following:

As of SAP_BASIS Release 7.02, when establishing a trust relationship, relationship, the installation number of the calling system is used in addition to the system ID if this function is available in the calling system (that is, its SAP_BASIS release is Release 7.02 or higher). For trusted relationships that include the installation number in addition to the system ID in transaction SMT1, the trusted RFC authorizations based on the authorization authorization object S_RFCACL must be adjusted so that the field RFC_INFO contains the installation number of the calling system (that is, the trusted system). The installation number of the calling system is displayed per system in transaction SMT1. Example for releases before Release 7.02:

RFC_SYSID : C00 RFC_CLIENT: M_1 RFC_USER : ' ' RFC_EQUSER: Y (for Yes) RFC_TCODE : * RFC_INFO : * ACTVT : 16

Example for releases as of Release 7.02:

RFC_SYSID : C00 RFC_CLIENT: M_1 RFC_USER : ' ' RFC_EQUSER: Y (for Yes) RFC_TCODE : * RFC_INFO : 0120061532 (that is, installation number of the calling system) ACTVT : 16 You can also enter a user (U_2) in the destination S00_TRUSTED, which is then used when working in the trusting system S00. In this case, in the trusting system, you must set the field "RFC_EQUSER" to N (for NO) in the authorization object S_RFCACL for this user. For security reasons, you must also maintain the S_RFCACL fields RFC_CLIENT, RFC_USER, and (if required) RFC_TCODE: RFC_CLIENT: List of clients from which the logon can be carried out. RFC_USER: List of all users in the trusted system, who are allowed to use the user U_2 to log on. RFC_TCODE: List of all transactions from which calls into the trusting system can be made in the trusted system using the destination.

This prevents misuse of this destination. Example:

If the user U_1 under client M_1 in the trusted system C00 is to work under the user U_2 with client M_2 in the trusting system S00 using a trusted/trusting relationship, the user (U_2, M_2) in the system S00 must have an authorization object S_RFCACL that has the following settings: RFC_SYSID : C00 RFC_CLIENT: M_1 RFC_USER : U_1 RFC_EQUSER: N RFC_TCODE : * RFC_INFO : * ACTVT : 16


2017-05-17

Page 3/8

You can maintain the settings listed above using transaction PFCG (Role Maintenance) on the server system S00. Detailed information about role maintenance is available at: [http://help.sap.com/saphel [http://help.sap.com/saphelp_nw04/helpdat p_nw04/helpdata/en/52/6714a a/en/52/6714a9439b11d1896f0 9439b11d1896f0000e8322d00/f 000e8322d00/f When you maintain and assign the S_RFCACL authorizations, note that you should not use any generic values (such as '*') for RFC_SYSID, RFC_CLIENT, and RFC_USER. This is because all users who meet these criteria regarding RFC_CLIENT and RFC_USER can call RFC modules from the calling system without hindrance using the user who was entered in the destination S00_TRUSTED. S00_TRUSTED. The authorization for the user U_1 who was entered in the destination S00_TRUSTED can be checked in advance in the trusting system S00 using the function module AUTHORITY_CHECK_TRUSTED_SYS AUTHORITY_CHECK_TRUSTED_SYSTEM. TEM. Note:

As of SAP_BASIS Release 7.02, the parameter "LICENSE_NR" was added to the function module AUTHORITY_CHECK_TRUSTED_SYSTEM. AUTHORITY_CHECK_TRUSTED_SYSTEM. This parameter expects the installation number of the calling system if the trust relationship with a system also includes the installation number. Authorization errors that occur when using an RFC destination for which the 'Trusted Systems' indicator is set are documented with the following message: "No authorization to log on as a trusted system (Trusted RC = #)." In this case, the trusted return code # (# = 0, 1, 2, 3) has the following relevance: 0 Invalid logon data (user and client) for the trusting system. Solution: In the server system (trusting system), create the user in the relevant client. 1 The calling system is not a trusted system, or the security key for the system is invalid. Solution: Recreate the trusted system (see documentation). 2 In the trusting system, the user has no authorization that contains the authorization object S_RFCACL, or a logon was carried out using one of the protected users 'DDIC' or 'SAP*'. Solution: 'DDIC' and 'SAP*' are protected users that Cannot be used for trusted relationships. Choose a different user and assign it the suitable S_RFCACL authorizations. authorizations. 3 The time stamp of the logon data is invalid. Solution: Check the system time on the client host and on the server host and check the validity date of the logon data. The system times of both systems must be synchronized. IMPORTANT NOTE: If an RFC destination is marked as a 'trust relationship', each authorization authorization triggers a RABAX (ABAP exception). This RABAX contains a detailed error documentation. Procedure to analyze the error: Call transaction ST22 (ABAP Runtime Error) and select the required selection period. Choose the relevant entry under the user SAPSYS and the program name CALL_FUNCTION_SYSCALL_ONLY CALL_FUNCTION_SYSCALL_ONLY. . The section 'How to correct the error' provides all the information required to correct the error. Remarks: If you want to use SAProuter(s) to set up a trust relationship to a trusting system, you must manually enter the SAProuter string for the target host in the generated RFC destination "TRUSTING_SYSTEM@ "TRUSTING_SYSTEM@ ".


2017-05-17

Page 4/8

Since the generated RFC destination "TRUSTING_SYSTEM@ " is a cross-client destination, destination, the system terminates the test in transaction SMT2 and displays the following error text and short dump in the target system (trusting ABAP system):

"No authorization to log on as a trusted system (L-RC=A T-RC=0)." This error text means that the following occurred during the two-step test: The check of the trusted logon was successful (Trusted RC=0). Logging the user on to the target system in a different client failed because the authorization S_RFCACL S_RFCACL was missing for the user in the target system or because the user does not exist in the target client. Solution: Navigate to transaction SMT2 and choose an ABAP system by double-clicking. double-clicking. You can now maintain the generated RFC destination by choosing "Maintain destination". destination". When you are within the generated RFC destination, choose the "Administration" tab page and deselect the "Destination not modifiable" checkbox. By entering the SAP client in the generated RFC destination, you can correct the problem with the error text and the display of the ABAP runtime error in the trusting system. Alternatively, Alternatively, you can use transaction SMT2 to perform a one-off test between trusted and trusting ABAP systems in a joint SAP client (the Single Sign-On test in transaction SMT2 for all clients is not required). In addition, refer to Note 204039. The settings of the generated destination TRUSTING_SYSTEM@S00 TRUSTING_SYSTEM@S00 in the trusted system may be incorrect if the SAP host name contains the character '_' (such as "my_host"). This problem is solved with Support Package SAPKB46D09 (see below). For earlier releases, you can manually implement the required changes for correcting the problem as specified below. If the ABAP runtime error "CALL_FUNCTION_SINGLE_LOGIN "CALL_FUNCTION_SINGLE_LOGIN_REJ" _REJ" with the reason: "No authorization to log on as a trusted system (T-RC=1)" occurs and you are using the version levels mentioned below in the RFC Trusting ABAP system, implement the ABAP correction in Note 1579570. Basis Release Support Package Kernel patch number 46C SAPKB46C62 2570 or higher 620 SAPKB62069 359 or higher 640 SAPKB64028 359 or higher 700 SAPKB70024 285 or higher 701 SAPKB70108 117 or higher 710 SAPKB71012 231 or higher 711 SAPKB71107 117 or higher 702 SAPKB70206 68 or higher 720 SAPKB72005 68 or higher 730 SAPKB73001 68 or higher If you are not using the version levels listed above, the ABAP correction in Note 1579570 is not relevant for the problem with the trust relationship.

软件组件 © 2017 SAP SE or an SAP affiliate company. All rights reserved

2017-05-17

Page 5/8

软件组件

版本

SAP_APPL

40A - 4 0B

SAP_APPL

45A - 4 5B

SAP_APPL

46A - 4 6B

SAP_BASIS

46C - 46D

SAP_BASIS

610 - 64 640 0

SAP_BASIS

700 - 70 700 0

SAP_BASIS

710 - 73 730 0

SAP_BASIS

731 - 73 731 1

SAP_BASIS

72L - 80 803 3

更正说明软件组件

自

至

版本

更改日期

标识

SAP_BASIS

46D

4 6D

1

18.04.2001 09:36:54

00 002 6712 7

软件组件

发布

支持包

SAP_BASIS

46D

SAPKB46D09

SAP_BASIS

720

SAPKB72003

支持包

该文档参考 SAP Note/知识库文章

标题

986707

No authorization to log on as a trusted system (RC=1)

88346

Changing the RFC destination if IP changes are made

827573

Security Guide: Catch Weight Management

797056

Connection to other system could not be established


2017-05-17

Page 6/8

753688

SEM-BCS 3.2/3.5: Activation of SAP delivery example

748434

New BRSPACE function "dbcreate" - recreate database

736226

SEM-BCS 400: Activation of the SAP delivery exa mple

700659

Security Guide: mySAP Supply Chain Management

670968

Handheld 3.0 SP17 - Sales and Service

654223


644610

Analysis of transport problems - info.

637429

Remote SAP EASY ACCESS and trusted/trusting relationship

622708


598198


557132

CC-TOPIC: Remote client copy

52959

sapms..., sapdp.., sapgw.. unknown (or not found)

496286

Security concept extended for CATT and eCATT

414352

User menu and Trusted RFC

399704

Calling SAP transactions from within the BEx Browser

24853

CC-INFO: Client copy, functionality

1704968

MDG_TR: Analysis of transport problems - information

1579570

Problem with trust relationship after using HMAC

1550323

Offer POWL: OBN navigation to display promotion in erp

1498973

Renewing trust relationships to a system

1491645

Unauthenticated system access via RFC or HTTP

1413474

Settings of a DMZ system for the PLM Web User Interface

138498

Single Sign-On Solutions

131387

No authorization to log on as a trusted system

1167901

Trusted-Trusting instead of destination with password

116787


1136070

RCX:Execute RCXEM Transactions From ERP System


2017-05-17

Page 7/8

该文档被参考 SAP Note/知识库文章

标题

748434

New BRSPACE function "dbcreate" - recreate database

138498

Single Sign-On Solutions

1550323

Offer POWL: OBN navigation to display promotion in erp

2088292

Offer POWL: OBN navigation to navigate to PPO from NWBC

1579570

Problem with trust relationship after using HMAC

1498973

Renewing trust relationships to a system

1704968

MDG_TR: Analysis of transport problems - information

1413474

Settings of a DMZ system for the PLM Web User Interface

986707

No authorization to log on as a trusted system (RC=1)

131387

No authorization to log on as a trusted system

1167901

Trusted-Trusting instead of destination with password

1136070

RCX:Execute RCXEM Transactions From ERP System

88346

Changing the RFC destination if IP changes are made

644610

Analysis of transport problems - info.

827573

Security Guide: Catch Weight Management

557132


797056

Connection to other system could not be established

700659

Security Guide: mySAP Supply Chain Management

753688

SEM-BCS 3.2/3.5: Activation of SAP delivery example

736226

SEM-BCS 400: Activation of the SAP delivery exa mple

496286

Security concept extended for CATT and eCATT

670968


654223


637429

Remote SAP EASY ACCESS and trusted/trusting relationship

622708


399704

Calling SAP transactions from within the BEx Browser

613061

Solution Manager: 'No authorization for function group '


2017-05-17

Page 8/8

598198


116787


24853

CC-INFO: Client copy, functionality

414352

User menu and Trusted RFC

52959

sapms..., sapdp.., sapgw.. unknown (or not found)

Terms of use | Copyright | Trademark | Legal Disclosure | Privacy


128447 - Trusted Trusting Systems

Recommend Documents