3222388 - How to check the correct user for setup between SAC tenant and Cloud Connector?

It is known that access to the BTP Cockpit of the SAC subaccount is not possible as it is managed by SAP. However, a communication user can be set in the SAC UI to connect to the SAC subaccount, and this user can be utilized to establish a connection between the Cloud Connector and SAC.

The following symptoms have been encountered:

• Symptom 1:
  The SAC subaccount was added successfully to Cloud Connector A several days ago,but attempts to add the same subaccount to Cloud Connector B using the exact same communication User ID and Password today have failed. (The Location ID has been specified.)
• Symptom 2:
  Updating the SAC subaccount certificate has failed, despite confidence that the same User ID and Password were previously used to add this subaccount.

Images and data taken from SAP internal systems and demo environments. Any similarity to production data is purely coincidental. 

• SAP Cloud Connector.
• SAP Analytics Cloud (Enterprise).

• Add subaccount in Cloud Connector as per Managing Subaccounts.
• Update subaccount certificate as per Update the Certificate for a Subaccount.

Incorrect communication user is used to setup connection.

• From SAC perspective:
  Due to a limitation in the SAC UI, only one communication user can be set in the SAC UI. However, all SAC administrators have permission to access the SAC UI and change the communication user ID, which is used to connect to the SAC subaccount.
• From Cloud Connector perspective:
  After the Cloud Connector connection is established, the subaccount user credential is not needed until the next year when the subaccount certificate requires updating. This is because the Cloud Connector validates the user only at the time of initially adding the subaccount and when updating the subaccount certificate. 
  As Cloud Connector product design, subaccount certificate valid period is 1 year, so it needs to be renewed annually.

Example:

If user <xxx> is set in the SAC UI as the communication user and maintained in Cloud Connector A, and a colleague later sets up the same subaccount in Cloud Connector B, then changing the communication user to <yyy> in the SAC UI to update the certificate in Cloud Connector A could cause issues. The colleague, unaware of this change, would still be using user <xxx> and may fail to update the subaccount certificate for Cloud Connector B.

It is always recommended to check the communication user in the SAC UI as described in the procedure for Installing the SAPCP Cloud Connector (Procedure 1.) and maintain the credentials accordingly for subaccount setup or certificate update in the Cloud Connector.

Note: We suggest that if you have changed the communication user in SAC UI, it's better to notify other administrators who would use this user account information in other Cloud Connector to avoid subaccount user validation issue.

• Managing Subaccounts
  
• Update the Certificate for a Subaccount
  
• Installing the SAPCP Cloud Connector

update, subaccount certificate, Cloud Connector, password, user, SAC, UI, create, subaccount, 1 year, communication user, SAC subaccount, , KBA , LOD-ANA-ADM , SAC Administration , BC-MID-SCC , SAP Cloud Connector On-Demand/On-Premise Connectivity , Problem