Invalid confidential channel(FWB 00032)

[Former Member]

Hi,

We are having an issue with BOBJ analysis while giving the credentials it shows an error like "invalid confidential channel" intermittently.

However we are using the correct password and user-id even though some users are effecting while login into BOBJ,even I faced the same.

Could you please let me know why issue occurring intermittently.

Appreciated for quick response.

[BasicTek · Accepted solution]

This error is typically a session problem between the web application (tomcat) and CMS. It can occur during many actions and is often seen when authenticating. Typically if you check the CMC you will see that authentication completed correctly (session created) but the error was received anyway. The most effective way to resolve this is to restart tomcat, or more often stop tomcat, delete the work directory (for the application(s) receiving errors) and then start tomcat again. It is unknown if the issue is actually caused by tomcat (non SAP issue) or an SAP product bug that can be fixed. I don't believe that any fixes have been issues that resolve the error for all occasions.

Regards,

Tim

[former_member197671 · Accepted solution]

I was told by support Friday it was actually resolved in 4.1 sp3 for Business Objects. They have a SAP note stating to add -FIPS to your SIA cmd line properties to resolve. We attempted that in March and this error has surfaced again. They are logging as a bug with an ADAPT.

[BasicTek · Accepted solution]

Are you saying this issue is being raised again?

Previously there were 2 KBA referencing an ADAPT for 4.1 base (not SP3)

But I think the issue has been reported post 4.1 base

Regards,

Tim

[former_member197671 · Accepted solution]

Yes, Sorry I should have been clear, I am actually on 4.0 SP7 wanting to go to 4.1 SP3 but I am trying to get support to verify that it is indeed resolved in 4.1 Sp3. They had told us previously that it was a bug & scheduled for 4.1 base and then we heard SP2, now SP3.

I have another post on here.. and someone posted yesterday that the adapt for the bug was not on the list as resolved for 4.1 Sp3, "I did not see this ADAPT as resolved in the Fixed issues of SP3 nor Patch 1 for SP3 - therefore i wont believe that this has been fixed." So that is why I am questioning support again. Will let you know what they say.

[BasicTek · Accepted solution]

OK well I did some searching and found 2 ADAPTs saying it was fixed in 4.1 (base not SP3) and 3 ADAPTs saying it was fixed in 4.0 base. There may be another in BI 4.1 SP3 but I haven't found it yet. If you have a KBA or note # to reference for this other than KBAs 1737852, 1869921, and 1887273 please let me know. Thanks!

If not then I'd assume the issue is fixed in 4.1 until anyone reports differently.

[former_member197671 · Accepted solution]

Well I can tell you 1887273 is not true, as we are on 4.0 Sp7 and still have the issues. 1869921, that's the adapt I was given with our problem ticket and was told it was resolved in 4.1 SP2.

Still waiting on response with confirmation it is in fact resolved in 4.1 Sp2- forward. Will let you know once I hear.

[BasicTek · Accepted solution]

1887273 is a different problem due to the APS only so it only occurs when refreshing BICS reports, the security channel is just 1 of many possible errors/symptoms. The fix in there will only affect the APS not BI Launchpad and CMC. The invalid confidential channel in the 3 KBA's I mentioned is a session problem that seems to only occur if there is a clustered CMS (but it may also occur in single CMS servers). It also can be fixed usually by restarting tomcat, or restarting tomcat and deleting the work directory, or worse case redeploying tomcat. To me that issue (the one in question) is being caused by tomcat and I'm not sure if the ADAPTs raised will actually resolve. The fact that ADAPTs were raised on both 4.0 and 4.1 with fixes seems to indicate something is still missing. 

Regards,

Tim

[former_member197671 · Accepted solution]

FYI: SAP notes 1869921 & 1737852- Were updated to state this is resolved in 4.1 SP3. That was the result from my case.

[BasicTek · Accepted solution]

Thanks for the update Jenny, now the ADAPT referenced on both KBA's still shows this was fixed in 4.1 base (The original release) not SP3.

Nevermind I found the engineer. I'll track it down.

And Manna I understand your link, but apparently there was a code fix needed to resolve this and I can't find it, That's what I'm concerned with going forward, so we know where to look if the problem arises again.

Regards,

Tim

[former_member215165 · Accepted solution]

Hello Jenny,

We are on BO 4.1 SP3 and facing this issue intermittently.

You have mentioned that SAP suggested an SAP note stating to add -FIPS to your SIA cmd line properties to resolve.Can you provide the Note number?

Also you have updated : "SAP notes 1869921 & 1737852- Were updated to state this is resolved in 4.1 SP3. That was the result from my case".

However, when I am trying to search Note 1869921, it says 'Document not released"

Were you able to view the note earlier ?

Appreciate your reply.

Thanks

[former_member197671 · Accepted solution]

Interesting, Yes I was able to view it earlier. We have not yet upgraded so I am not exactly sure. Have you read through Tim's comments? We exchanged a few emails back in June and last comment was that he was going to clean up some of the documentation because in the version I am in there was actually a few different issues but he suspected what I was seeing was resolved in 4.1 base. That might be why you can not view it now.

Tim, Any additional comments you can add?

[BasicTek · Accepted solution]

I think we're going to need a customer that can reproduce the issue on one of the patches where it is supposed to be resolved. I verified both notes are set to release to customer. I think it's something in the tomcat cache that causes the issue and that has been a sure way to clean it out. If the issue occurs more often and you cannot resolve with clearing the tomcat cache, or disabling FIPS then I'd recommend raising a case with deployment or admin to investigate further.

Regards,

Tim

[Former Member · Accepted solution]

we're intermittently experiencing this issue on 4.1 SP3 environment.

Tomcat: 7.0.53

Apache: 2.4.6

JDK: java7 update60

[Former Member]

Just fyi that we just faced this issue (between WRC -> (weblogic) -> BO4.1SP5 in cluster)

Therefore, it appears this issue still exist in 4.1 SP5 (no fixpack)

[BasicTek]

This issue has never been reproduced in house or escalated to development so there are no expected fixes. The best work around has been deleting the web/app's cached folder (I'm not even sure weblogic has one) So we need a customer with a reproducible issue to raise this someday. The KBA's has very few hits so it doesn't seem to be a big issue or widespread. Only certain customers are affected and it seems to go away for most by clearing their cache.

Regards,

Tim

[manna_das]

Hello,

u can check the following link, might help u to understand the error:

Invalid confidential channel. (FWB 00032)

KR,

MD

[BasicTek]

There was an issue that was fixed regarding FIPS security, but to all those still receiving the problem it seems to be something wrong with the tomcat deployment. The best option is stop tomcat, delete the work directory and see if the issue returns, another option would be completely redeploying tomcat. This problem does not affect many customers based on the KBA views.

If you cannot resolve then opening a case for further investigation will be needed.

Regards,

Tim

[BasicTek]

KBA 2090818 has been created to log more information about this issue. If you have this issue try the solution s in that case noting which ones are more effective. It's likely there are more than 1 issue resulting in this error message so gathering as much information as possible will be very helpful going forward.

Regards,

Tim

[former_member197671]

Thanks Tim, I noticed that the note states it has never been reproduced in house but many have experienced it within this thread? Are their active tickets that you are aware of trying to create still? We are in the process of moving to 4.1 SP3, in our testing we have not experienced it yet.

[BasicTek]

If we build a test server inside SAP this error has never occurred, that's why it states never reproduced. The issue that was already fixed was reproduced, but looking at the traffic of the existing KBA's I think there is more than 1 cause, until we start isolating these other causes they will be a mystery.

I created the KBA because the only issue ever documented was the one fixed on 4.0 SP3 and I know we have seen this error on many version since.  So we need to gather data on the existing issues.

There are only a handful of cases created on this issue so it seems to be very sporadic

Regards,

Tim

[Former Member]

Hi Tim,

We are also experiencing the same issue . BO server is clustered with two nodes and  on BI4.1 SP2 Patch 2 .

Issue is occurring with users account and as well as with admin account . if user try to login continuously  for more than three four times then login works . i have checked KBA 2090818 and tried to restarting Tomcat and it resolves issue temporary  . we have experienced this issue couple of times and currently  monitoring the server .

we are planning to upgrade our system to SP4 , so my question is if this issue is resolved in Sp4 or not ?

Thanks for the help!!

Regards,

Balvinder Singh

[BasicTek]

We do not know all the causes of the issue, it seems the most common fix is deleting the tomcat work directory (so bad tomcat caching) but of what I do not know, until someone digs in and identifies the root cause no one can say. There are NO outstanding bugs so there are no known fixes for the issue set to roll out anytime soon.

Regards,

Tim

[former_member197671]

Tim, Anyway we could talk.. We are starting to see this behavior again and we just migrated to 4.1 Sp3. We saw it the other day and attempted just bouncing tomcat but we are seeing it again. We use BigIP so we are load balanced. Let me know what tracing you want on. FYI: We removed 4.0 completely from our boxes.

[BasicTek]

There have been some updates to the KBA's, deleting the tomcat work directory is the best solution, no customer has come back to me after doing that. If there is an issue to raise it's handled between deployment (bi-bip-dep) and admin (bi-bip-adm) as it's a session issue between tomcat and CMS

Best course of action if you have the issue reproducible is to get an admin or deploy engineer to trace and escalate the issue to development. 

[filipe_zeuch]

Hi Chunna,

Have you tried to restart your CMS service on your instance?

Regards,

Filipe

[TammyPowlas]

There are a lot of SAP notes on this one.

Please check this one and check your BI4x version:

http://service.sap.com/sap/support/notes/1737852

[Former Member]

Thanks for your fast reply Tammy

[Former Member]

Hi Tammy,

The Note which explains the issue about 'Invalid confidential channel' for BI launch pad but not for the BOBJ analysis..

Can you please help me to understand in depth.

[TammyPowlas]

I don't know the depth of it as I haven't seen this error.

You could take a look at the logs under Analysis > settings > support settings and that might give you some hints/tips

[Former Member]

Hi Tammy,

I could not find any log files under the path can you please help me in any other way to check further.

[TammyPowlas]

Unfortunately this is the extent I can help.

If no one else replies, please consider opening a ticket/incident with SAP Support.