3474524 - Client Certificate authentication failing in EC to Workforce integration

You wish to set up client certificate-based authentication in the following CPI packages:
Packaged Integration - SF EC to WFS
Packaged Integration SF EC to WFS - Custom Mapping

However, the set up fails with 401 errors similar to the following:
401
'401: Unauthorized'
HTTP response '401: Unauthorized' when communicating with [CPI tenant URL]
401: Unauthorized. error in Packaged Integration - WFS to SF EC Payroll

Image/data in this KBA is from SAP internal systems, sample data, or demo systems. Any resemblance to real data is purely coincidental.

Packaged Integration - SF EC to WFS
Packaged Integration SF EC to WFS - Custom Mapping

Known error

As a long term solution, you may wish to look at the possibility of leveraging the partner-delivered solution for the integration with Workforce software, as the use cases delivered would fit the requirement of a certificate based authentication (and other custom uses). For more information, please refer to:

SAP SuccessFactors Employee Central integration with SAP Time and Attendance Management by WorkForce Software
https://api.sap.com/package/SAPSuccessFactorsEmployeeCentralIntegrationwithWorkForceSoftwareSuite/integrationflow
SAP Time and Attendance Management by WorkForce Software integration with SAP SuccessFactors Employee Central Payroll
https://api.sap.com/package/WFStoSFECPayrollIntegration/integrationflow
SAP SuccessFactors Employee Central to SAP Time and Attendance Management by WorkForce Software Integration Extension
https://api.sap.com/package/SAPSuccessFactorsEmployeeCentraltoWorkForceSoftwareSuiteIntegrationExtension/integrationflow
Communities blog:
https://blogs.sap.com/2023/08/31/more-functionality-with-the-improved-sap-btp-integrations-on-sap-time-and-attendance-by-workforce-software/

As a shorter term solution, please follow these steps:

1. Check flow execution time in Monitor Message Processing (CPI):

2. Check the system log in Monitor System Log for same timeline (in this case sep 26 for reference) for Log Type as Trace Log 

3. Check in the trace log for this error: “The client certificate is not configured in a service key of a Process Integration Runtime service instance. Client certificate:”

• If this log is present, copy the client certificate (can be found just below this log).
• Compare this certificate with the one which is added as a service key corresponding to the service instance in the cockpit.
• If there is a difference, kindly reconfigure the set up again with the correct certificate.

Can be downloaded from Manage Keystore.
Note: Remove all the new lines from the certificate, the complete certificate should be in one single line.



4. Redeploy the iflow and check the status again.

1. Client Certificate Authentication (Inbound), Cloud Foundry Environment | SAP Help Portal
https://help.sap.com/docs/cloud-integration/sap-cloud-integration/client-certificate-authentication-inbound-cloud-foundry-environment
2. Cloud Integration on CF – How to Setup Secure HTTP Inbound Connection with Client Certificates | SAP Blogs 
https://blogs.sap.com/2019/08/14/cloud-integration-on-cf-how-to-setup-secure-http-inbound-connection-with-client-certificates/
3. Creating Service Instance and Service Key for Inbound Authentication | SAP Help Portal 
https://help.sap.com/docs/cloud-integration/sap-cloud-integration/creating-service-instance-and-service-key-for-inbound-authentication
4. SAP SuccessFactors Employee Central integration with SAP Time and Attendance Management by WorkForce Software
https://api.sap.com/package/SAPSuccessFactorsEmployeeCentralIntegrationwithWorkForceSoftwareSuite/integrationflow
5. SAP Time and Attendance Management by WorkForce Software integration with SAP SuccessFactors Employee Central Payroll
https://api.sap.com/package/WFStoSFECPayrollIntegration/integrationflow
6. SAP SuccessFactors Employee Central to SAP Time and Attendance Management by WorkForce Software Integration Extension
https://api.sap.com/package/SAPSuccessFactorsEmployeeCentraltoWorkForceSoftwareSuiteIntegrationExtension/integrationflow
7. Communities' blog:
https://blogs.sap.com/2023/08/31/more-functionality-with-the-improved-sap-btp-integrations-on-sap-time-and-attendance-by-workforce-software/

SF EC to WFS, WFS, workforce, Solex, Packaged Integration - SF EC to WFS, Packaged Integration SF EC to WFS - Custom Mapping, "org.apache.cxf.interceptor.Fault: Could not send Message., cause: org.apache.cxf.transport.http.HTTPException: HTTP response '401: Unauthorized' when communicating with", Could not send Message., cause: org.apache.cxf.transport.http.HTTPException: HTTP response '401: Unauthorized. error in Packaged Integration - WFS to SF EC Payroll, 401, HTTP response '401: Unauthorized. error in Packaged Integration - WFS to SF EC Payroll, client certificate, basic authentication, authentication, certificate authentication, certificate-based , KBA , LOD-SF-INT-CPI-TPI , Standard SF to 3rd Party Integration using CPI , LOD-SF-INT , Integrations , How To