'Name or password is incorrect' error logging into SAP accounts created by the SAP AFX Connector in RSA Identity Governance & Lifecycle

[#1]

Article Number

000036217

Applies To

RSA Product Set: Identity Governance & Lifecycle 
RSA Version/Condition: 7.0.2

Issue

Users receive the following error when logging into SAP accounts created by the RSA Identity Governance & Lifecycle SAP AFX Connector and are unable to login:
 

Name or password is incorrect (repeat logon)

Example:

1. On the Create an Account tab of the SAP AFX connector, the SAP account to be created is configured with a default password.

Image description
 

2. The SAP account is created using the SAP AFX Test Connector Capabilities.

Image description
 

3. Note the account was successfully created.

Image description
 

4. The SAP user attempts to login to the new SAP account using the SAP account credentials (default password) specified by the SAP AFX connector. Despite using the correct password, the user gets the following error:

Name or password is incorrect (repeat logon)

 

Image description

Cause

The Create an Account capability of the SAP AFX connector does not generate a working password to log in to SAP because the password is not decrypted before executing Create an Account. 

This is a known issue reported in engineering ticket ACM-79568.

Resolution

This issue is resolved in the following RSA Identity Governance & Lifecycle patches:

• RSA Identity Governance & Lifecycle 7.0.2 P05
• RSA Identity Governance & Lifecycle 7.1.0

Workaround

The steps below can be used as a workaround for the SAP AFX Connector to generate the decrypted password during SAP account creation:

1. Export the SAP connector template and make a copy as a backup. To export,
   1. Navigate to AFX > Export. 
   2. Select SAP from the Connector Templates
2. Using the downloaded SAP Connector template zip, make the following changes:
   1. Unzip it. 
   2. Navigate to <directory with the unzipped folder>/SAP/TRANSPORT_TYPE
   3. Open the SAP-transport.xml file and locate the string <field name="BAPIPWD" sapDesc="New password">.
   4. Modify its value as follows:
      1. The original field value for BAPIPWD on SAP-transport.xml is:

<structure name="PASSWORD">
     <field name="BAPIPWD" sapDesc="New password">#[header:Password]</field>
</structure>

2. The new field value for BAPIPWD on SAP-transport.xml should be:

<structure name="PASSWORD">
     <field name="BAPIPWD" sapDesc="New password">#[groovy:com.aveksa.AFX.server.runtime.esb.core.AfxPropertyMgr.getInstance().getPropertyValue(message, 'Password')]</field>
</structure>

5. Zip the <UnzippedFolder> again.
6. Import it back into the system.  To import,
   1. Navigate to AFX > Import. 
   2. Choose the recently zipped file from your local folder.

3. Create a new SAP connector. To create,
   1. Navigate to AFX > Connectors > Create Connector
4. Execute the Create an Account command. To execute the command,
   1. Navigate to  AFX > Connectors.
   2. Choose the newly created SAP connector  > Capabilities tab > select Create an Account capability.
5. Test by logging into the new SAP account just created using the credentials supplied by the SAP AFX connector.

 You should be able to successfully log in and no longer receive the message that the name or password is incorrect.