Skip to main content

Troubleshooting

Password fails

If a password reset fails:

  • Verify that the PSYNCH_USER role has been configured correctly.

  • Assign the PSYNCH_USER role manually to a test account and then perform a password reset from Bravura Security Fabric for that user.

  • Check that the RFC rights SUSO and SYST have been granted to the PSYNCH_USER role.

User cannot be added to a group

If a user cannot be added to a group, ensure that the SAP target administrator credential has the S_USER_AGR authorization configured in the SAP system being targeted as well as in CUA if used.

Testing connectivity issues when running auto-discovery

If you encounter issues listing users:

  • Set the target system address parameter for Engage RFC trace logging to 3.

  • A resulting trace log file will be in the following format: rfc<pid>_<thread>.trc. The location of this log file will be noted by the agtsapnw.exe connector in the Bravura Security Fabric log file.

  • If you see the following in the logs for agtsapnw:

    • agtsapnw.exe [10836,8956] Warning: RfcInvoke failed [[Error while calling BAPI_USER_GETLIST], RC code [13:R], error detail: [RFC_INVALID_HANDLE: An invalid handle 'RFC_FUNCTION_HANDLE' was passed to the API call]]

  • In the trace log file you may also see that an exception occurred for something like this:

    • RfcGetFunctionDesc(BAPI_USER_GETLIST) via handle 2028524486592 (SID=DR1) returned 0000000000000000 2024-03-15 20:24:01.836266 [01388] << RfcGetFunctionDesc returned RFC_ABAP_RUNTIME_FAILURE RFC_ERROR_INFO.key: RFC_NO_AUTHORITY RFC_ERROR_INFO.message: No RFC authorization for function module DDIF_FIELDINFO_GET.

  • This will indicate that when RfcGetFunctionDesc is called for BAPI_USER_GETLIST, that the SAP administrative user does not have the RFC authorization for the function module DDIF_FIELDINFO_GET.

RFC Trace File

The agtsapnw connector provides the Engage RFC trace logging target system address configuration option to allow for enabling RFC trace diagnostics and logging.

By default this is set to 0 which means that logging is turned off. This option can be set to the following log levels:

0

off

1

brief

2

verbose

3

full

When logging is enabled, a log file is created in the <Program Files path>\Bravura Security\Bravura Security Fabric\Logs\<instance> directory in the following format: rfc<PID>_<THREAD>.trc, where <PID> and <THREAD> are the initial rfc connect.

The log file contains various information such as:

  • Initial RFC options (parameters) passed into the connect.

  • Any errors, warnings, etc such as for example, authorization issues.

  • RFC calls that are made, for example:

    2024-03-02 02:13:46.582751 [39084] >> RfcGetFunctionDesc

    RfcGetFunctionDesc(BAPI_USER_GET_DETAIL) via handle 2133721882624

  • Table or row information passed back from RFC function calls, for example:

    BAPI_USER_GET_DETAIL

Testing connectivity issues without agtsapnw

When testing connectivity issues, it is often useful to remove the agent as a root cause. The NetWeaver RFC SDK provides the startrfc utility that can provide a useful way to troubleshooting integration or connectivity issues.

To use the startrfc utility, complete the following:

  1. Ensure the NetWeaver RFC SDK is installed .

  2. Open a command prompt and navigate to the NWRFC SDK bin directory:

    C:\Program Files\SAP\nwrfc< version >\nwrfcsdk\bin

  3. Execute startrfc with the "-i" option. This connects to the target system and displays the system information. Specify the <host>, <user>, <password>, <sysnr> and <client> values. The -t <trace> option also leaves a trace file to help troubleshoot more detailed diagnostics. See the full command line usage and example below.

    See the RFC Trace File section for more details on diagnosing integration issues using trace files.

Usage

 startrfc.exe -h <hostname> -u <adminid> -p <adminpw> -s <sysnr> -c <client> [-i] [-t <level>]

For example:

 C:\> startrfc.exe -h mysap.acme.com -u "SAPADM" -p '<SAP-Password>' -s 00 -c 001 -i -t 1
 SAP System ID: ACME
 SAP System Number: 00
 Partner Host: mysap
 Own Host: JOHNDOE
 Partner System Release: 731
 Partner Kernel Release: 722
 Own Release: 753
 Partner Codepage: 4103
 Own Codepage: 4103
 User: SAPADM
 Client: 001
 Language: E

sapnwrfc.dll not found

Note

This section is only applicable for the agtsapnw connector.

The agtsapnw SAP Server connector will return the follow error with and newer when testing credentials or listing:

Unable to resolve DLL dependency [[sapnwrfc.dll] was not found]

The SAP Server connector is missing the necessary dependencies to connect to the SAP instance.

See both Setting up the NW RFC (Netweaver RFC) SDK {SAP Server} and Testing connectivity issues without agtsapnw for more information to troubleshoot this issue.

librfc32.dll not found

Note

This section is only applicable for the agtsap connector.

The SAP Server connector(agtsap) will return the follow error with SAP GUI clients 7.5 and newer when testing credentials or listing:

Failed: Unable to resolve DLL dependency [[LIBRFC32.dll] was not found].

The SAP GUI Client 7.5+ self contains the LIBRFC32.dll in the product installer folder and no long copies it to the Windows\System32 or Windows\Syswow64 directories.

To resolve the problem, copy the C:\Program Files (x86)\SAP\FrontEnd\SAPgui\librfc32.dll to C:\Windows\System32 and C:\Windows\Syswow64

The agtsap connector should be able to operate within normal define functional parameters.

External links

The RFC library has changed in the 7.5 SAPGUI. See SAP note 2417687 .

Any custom application that uses librfc32.dll should take this into consideration, and use the new sapnwrfc.dll. There is code change involved for custom applications that use this dll. For detailed information, see SAP Note 2256415 .

In this section: