SAP Note 816861 - Migrating entries in the secure storage

Version: 10

Validity: Valid Since 14.02.2007

Symptom

This note is only relevant for systems with the software component SAP_BASIS in Release 6.20 or later releases.

o In an application, you receive error message SECSTORE031 ("System-dependent data changed") when you access the secure storage.

o SAP has supplied you with a new license and a migration key for the secure storage.

Other terms

SECSTORE, RSECADMIN, SECSTORE031, SECSTORE 031, license, installation Number

Reason and Prerequisites

The secure storage is an ABAP-kernel function for storing encoded data. The function is used by applications in the SAP system in order to securely store access data for external systems.

The installation number of the system and the system ID are used when creating the key for the secure storage. If one or more of these values changes, the data in the secure storage can no longer be read.

Under certain circumstances, you can migrate the data. You need the migration key to be able to carry out the migration.

Solution

Check whether it is necessary to carry out a migration.

If you were not directed to this note after error message SECSTORE 031 appeared, check whether there are actually entries that have to be migrated.

Use Transaction SECSTORE (SAP_BASIS Release 7.00 or higher) or report SECSTORE_CLEANUP (SAP_BASIS Release 6.40 or lower) to do this. Execute the transaction (report) without further restrictions, and check the result.

If you do not find an entry with error message SECSTORE 031, a migration is not necessary.

Receipt of the migration key.

If the change of the installation number is caused by importing a new license, SAP automatically generates the migration keys and sends it with the mail for the new license.

Alternatively, the migration key can be generated in SAP Service Marketplace.

You can find this application in SAP Support Portal under "Keys & Requests --> Migration Keys --> Secure Storage Migration".

After you log on, you can select the old and new installation numbers assigned to your user, and can generate the migration key.

If the old installation number and the new installation number are assigned to different customer numbers, and these customers are not linked to each other by the corporate group functions, you cannot create the migration key as described above.

Proceed as described in Note 1027439.

Executing the migration

o SAP_BASIS prior to Release 6.20

Entries in the secure storage cannot be migrated.

o SAP_BASIS Release 6.20/6.40

It is only possible to migrate entries if you use Kernel 6.20 Patch number 1347 or Kernel 6.40 Patch number 3 or higher.

The migration is carried out in report SECSTORE_CLEANUP, the current version of which is provided in Note 520039.

Start the report, enter the text "MIGR" on the selection screen in the command field, and press Enter.

Fill the following input fields that appear: "Old system name", "Old installation number" and "SAP release key" and choose "Execute".

o SAP_BASIS Release 7.00 or higher

Start Transaction SECSTORE and switch to the "System data changed" tab.

Fill the following input fields that appear: "Old system name", "Old installation number" and "SAP release key" and choose "Execute".

o Entries that cannot be migrated

If, in the secure storage, there are still entries that cannot be saved, you must re-enter the data saved in these entries if they are still required by the application components.

o SAP_BASIS Release 7.00 or higher

In Transaction SECSTORE, use the "Maintain Entry" function to navigate from the incorrect entry to the maintenance application of the corresponding application components (this function is not available for all entries) and there re-enter the data saved in the secure storage (generally passwords).

o SAP_BASIS prior to Release 7.00

The secure storage cannot provide any help regarding which application created the entry and how you can re-enter the data.

In both cases, in the secure storage in Transaction SECSTORE (report SECSTORE_CLEANUP), you can delete entries that are no longer required or that have become unusable

The Note is release-independent