2971034 - Adding Subaccount in SAP Cloud Connector Fails with Error 417 "An authorization problem occurred when downloading the configuration"

In the SAP Cloud Platform (SAP CP) Cloud Connector, when adding the subaccount associated with your SAP Analytics Cloud (SAC) system (tenant), the following error occurs:

• 417 An authorization problem occurred when downloading the configuration. Check the spelling of the subaccount name, user, and password. See ''Log And Trace Files'' and in particular ljs_trace.log for details. Consult SAP note 2461997 for possible remedies.

In the Cloud Connector trace log (ljs_trace.log) file, the following error occurs:

2020-09-18 14:34:18,148 +0800#ERROR#com.sap.scc.ui#http-bio-8443-exec-4#          #SCC handshake failed: 401 — Unauthorized

com.sap.scc.servlets.SccHandshakeException: SCC handshake failed: 401 — Unauthorized

    at com.sap.scc.cert.HttpCertificateManagementService.processRequest(HttpCertificateManagementService.java:140)

    at com.sap.scc.cert.HttpCertificateManagementService.executePostRequest(HttpCertificateManagementService.java:118)

    at com.sap.scc.cert.HttpCertificateManagementService.signCertificateForSCC(HttpCertificateManagementService.java:78)

    at com.sap.scc.ui.SubaccountControl.applyConfig(SubaccountControl.java:149)

    at com.sap.scc.ui.SubaccountControl.createSubaccount(SubaccountControl.java:102)

    at com.sap.scc.servlets.ConfigurationServlet.addAccount(ConfigurationServlet.java:1410)

    at com.sap.scc.servlets.ConfigurationServlet.dispatch(ConfigurationServlet.java:183)

    at com.sap.scc.servlets.ServletUtilities.service(ServletUtilities.java:42)

    at javax.servlet.http.HttpServlet.service(HttpServlet.java:848)

    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)

    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)

    at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)

    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)

    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)

    at com.sap.scc.ui.rt.UTF8Filter.doFilter(UTF8Filter.java:23)

    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)

    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)

    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219)

    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:110)

    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:604)

    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:165)

    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:104)

    at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:1025)

    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)

    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:452)

    at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1201)

    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:654)

    at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:319)

    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)

    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)

    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)

    at java.lang.Thread.run(Thread.java:836)

• SAP Analytics Cloud (on AliCloud CN40 landscape)
• SAP Cloud Connector
• SAP Connectivity service

1. In SAC, you registered an SAP Cloud Platform Account via this URL: https://awmtxn6rh.accounts.sapcloud.cn/ui/public/showRegisterForm?spName=awmtxn6rh.accounts.ondemand.com
2. You added the Cloud Platform user in SAC -> System -> Administration -> Datasource Configuration page, and you already obtained the subaccount ID and region host information 
3. In Cloud Connector, you clicked on the "Add Subaccount" button, entered the correct region host and subaccount ID, as well as your Cloud Platform user email and password
4. The error message pops up

Two-Factor Authentication is not enabled for your SAP Cloud Platform account

Enable Two-Factor Authentication (2FA / MFA) for your Cloud Platform account:

1. Go to https://awmtxn6rh.accounts.sapcloud.cn/, and log in with your email and password
2. Scroll down to the "Two-Factor Authentication" section, and click "Activate" 
3. Follow the on-screen instructions to activate 2FA, you need to scan the barcode on your cellphone using the SAP Authenticator app, or another compatible app such as Google Authenticator, and then enter the one-time passcode to complete the configuration

After 2FA / MFA is activated, add the subaccount by following the steps below:

1. Go to the "Add Subaccount" window again, enter the same region host, subaccount ID, and subaccount user email as before
2. In the Password box, type in your password, and generate the one-time passcode using the authenticator app on your phone, and then append it to the password
• For example, if your password is "aaabbb", and the one-time passcode is "123456", you need to type "aaabbb123456" in the password box.
• Note: If you have already logged in to https://awmtxn6rh.accounts.sapcloud.cn/ from the Cloud Connector machine, and have an active 2FA session, you may not require the additional OTP password to be appended to the password, so please try your password without the OTP, in this case, eg. aaabbb
  
  
3. Now you should be able to add the subaccount successfully.

• 2569847 - Where can you find SAC user assistance (help) to use, configure, and operate it more effectively?
• Have a question? Ask it here and let our amazing SAP community help! Or reply and share your knowledge!
• 2487011 - What information do I need to provide when opening an case for SAP Analytics Cloud?
• 2511489 - Troubleshooting performance issues in SAP Analytics Cloud
• Search for SAP Analytics Cloud content using Google or Bing:
• https://www.google.ca/search?q=site%3Ahttps%3A%2F%2Fapps.support.sap.com+SAP+Analytics+Cloud
• https://www.bing.com/search?q=site%3Ahttps%3A%2F%2Fapps.support.sap.com+SAP+Analytics+Cloud
• Note: Add relevant text or warning/error messages to the text search field to filter results.
• SAP Analytics Cloud Connection Guide
• Getting Started with SAP Analytics Cloud Expert Community page
• SAP Analytics Cloud Get More Help and SAP Support
• Need More Help? Contact Support or visit the solution finder today!

Your feedback is important to help us improve our knowledge base.

SAP Cloud for Planning, sc4p, c4p, cforp, cloudforplanning, Cloud for Analytics, Cloud4Analytics, CloudforAnalytics, Cloud 4 Planning, BOC, SAPBusinessObjectsCloud, BusinessObjectsCloud, BOBJcloud, BOCloud., SAC, SAP AC, Cloud-Analytics, CloudAnalytics, SAPCloudAnalytics,Error, Issue, System, Data, User, Unable, Access, Connection, Sac, Cloud, Connector, sapanalyticscloud, sap analytical cloud, sap analytical cloud, SAC, scp, account, link, SAP Cloud Platform, alicloud, alibaba cloud, greater, china, gcn, gcr, alicloud, alibaba, cloud, cn40, cloud foundry, cf-cn40, cloud connector, scc, sub, account, 417, error, issue, failed, credentials, cannot, can't, unable, not working, import, upload, data, SAP Cloud for Planning, sc4p, c4p, cforp, cloudforplanning, Cloud for Analytics, Cloud4Analytics, CloudforAnalytics, Cloud 4 Planning, BOC, SAPBusinessObjectsCloud, BusinessObjectsCloud, BOBJcloud, BOCloud., SAC, SAP AC, Cloud-Analytics, CloudAnalytics, SAPCloudAnalytics,Error, Issue, System, Data, User, Unable, Access, Connection, Sac, Connector, Live, Acquisition, Up, Set, setup, Model, BW, Connect, Story, Tenant, Import, Failed, Using, Working, SAML, SSO, sapanalyticscloud, sap analytical cloud, sap analytical cloud, SAC, sap analyst cloud, connected, failure, stopped, sap analyst cloud, https://hcs.cloud.sap, https://hanacloudservices.cloud.sap, https://cloudanalytics.accounts.ondemand.com, https://hanacloudservices-us.accounts.ondemand.com, https://www.sap.com, https://help.sap.com, predictive analytics (analysis), data analysis (analytics) tools, analytics tools, sap analytics cloud, data literacy, advanced analytics, data democratization, analytics software, real time analytics, self service analytics, advanced data analytics, analytics as a service, analytics cloud / cloud analytics, saas analytics, cloud bi, enterprise planning, cloud data analytics, cloud based analytics, analytics cloud platform, modern analytics, real time analysis, cloud analytics solution(s), what is sap analytics cloud, cloud analytics tools, analytics in the cloud, cloud analytics software , KBA , LOD-ANA-AQU , Import Data Connections (Acquiring Data) , BC-MID-SCC , SAP Cloud Connector On-Demand/On-Premise Connectivity , Problem