Symptom
An issue arises when attempting to run or schedule a report in SAP SuccessFactors Learning, with "Remote File" selected as the Report Destination. The error message displayed is: "org.apache.commons.vfs2.FileSystemException: Could not connect to SFTP server at [SFTP URL] Caused by: com.jcraft.jsch.JSchAlgoNegoFailException: Algorithm negotiation fail[...]".
Environment
SAP SuccessFactors Learning
Reproducing the Issue
- Navigate to Learning Administration > Reports >
- Select a report >
- Run or schedule the report, selecting "Remote File" as the Report Destination.
Cause
This issue has been identified as related to an outdated security algorithm.
Resolution
To resolve this issue, please contact your vendor (the destination SFTP server) and request them to update their SFTP to the latest version that supports secure algorithms.
The newest implementation of the SFTP Adapter uses the JSch library version 0.1.53. Please update the SFTP Adapter and PGP component to the latest patch according to SAP Note 2337525, which outlines the upgrade to JSch version 0.1.53.
The SFTP adapter now supports the following key exchange methods:
- ecdh-sha2-nistp256
- ecdh-sha2-nistp384
- ecdh-sha2-nistp521
- diffie-hellman-group14-sha1
- diffie-hellman-group-exchange-sha256
- diffie-hellman-group-exchange-sha1
- diffie-hellman-group1-sha1
The SFTP adapter now supports the following encryption algorithms (ciphers):
- aes128-ctr
- aes128-cbc
- 3des-ctr
- 3des-cbc
- blowfish-cbc
- aes192-ctr
- aes192-cbc
- aes256-ctr
- aes256-cbc
The SFTP adapter now supports the following message authentication code (mac) algorithms:
- hmac-md5
- hmac-sha1
- hmac-sha2-256
- hmac-sha1-96
- hmac-md5-96
Important Notes:
- The SFTP adapter only supports ZLIB compression. If the SFTP server uses any other compression, the SFTP adapter will not be able to connect. The solution is to disable compression on the SFTP server. There is no workaround.
- To implement ZLIB compression, please refer to SAP Note 2638660, which provides support for ZLIB compression in the SFTP adapter.
- To trace the handshake between the SFTP server and the SFTP adapter, you can use custom XPI Inspector traces as described in KBA 2172012, which outlines the XPI Inspector log locations for B2B adapters and modules.
See Also
Refer to KBA 2579806 - "Could not connect to SFTP server" error for Remote File Report Job.
Keywords
learning, successfactors, report, SFTP, Remote File, Report Job, FileSystemException, Algorithm negotiation fail, server_host_key, Could not connect to SFTP server, com.jcraft.jsch.JSchAlgoNegoFailException , KBA , LOD-SF-LMS-REP , Reporting Data , LOD-SF-LMS , Learning Management System , Problem