How To Fix WSS029 - Message replay detected

SAP Error Message - Details

• Message type: E = Error

• Message class: WSS - Web Services Security

• Message number: 029

• Message text: Message replay detected

What causes this issue?

A message protected by an XML Signature was resent.

System Response

The system issues an error message and will not allow you to continue with this transaction until the error is resolved.

How to fix this error?

The request received by the system (i.e. a consumer request or provider
response) was protected by an XML Signature to ensure the integrity of
the message.
The system stores the signature values of the XML Signature to prevent
replay attacks within a short timeframe, and checks if such a signature
has been sent before.
The received message contained a signature value it had received before,
indicating a message replay.

Procedure for System Administrators

Contact the communication partner to check how this situation could
occur.

Error message extract from SAP system. Copyright SAP SE.

Smart SAP Assistant

• What is the cause and solution for SAP error message WSS029 - Message replay detected ?

  SAP Error Message:
  
  WSS029 - Message replay detected
  
  Cause:
  The error WSS029 - Message replay detected occurs in SAP Web Services Security (WS-Security) scenarios when the system detects that a SOAP message has been replayed. This means the same message (or a message with the same unique identifier or timestamp) has been received more than once, which is considered a security risk.
  This typically happens because:
  
  The SOAP message contains a Timestamp and/or Nonce that has already been processed.
  The system maintains a cache or replay detection mechanism to prevent replay attacks.
  The client or an intermediate system is resending the same message (intentionally or unintentionally).
  Clock skew or incorrect timestamp settings causing the system to think the message is a replay.
  
  
  Explanation:
  In WS-Security, replay attacks are prevented by checking unique identifiers such as:
  
  Timestamps (Created and Expires)
  Nonces (random unique values)
  Message IDs
  
  If a message with the same timestamp and nonce is received again within the validity period, SAP flags it as a replay.
  
  Solution:
  
  
  Check Client Behavior:
  
  Ensure the client is not resending the same SOAP message multiple times.
  If retries are needed, the client should generate new timestamps and nonces for each request.
  
  
  
  Synchronize Clocks:
  
  Make sure the system clocks of the client and SAP server are synchronized (e.g., via NTP).
  Large clock skew can cause valid messages to be rejected or considered replayed.
  
  
  
  Adjust Replay Detection Settings:
  
  In SAP NetWeaver, replay detection is controlled by parameters in the WS-Security configuration.
  You can adjust the Replay Detection Time Window to allow a larger time frame if needed.
  Alternatively, if replay detection is not required for your scenario (not recommended for production), it can be disabled.
  
  
  
  Clear Replay Cache:
  
  Sometimes the replay cache might be full or corrupted.
  Restarting the SAP system or clearing the replay cache can help.
  
  
  
  Check for Middleware or Proxy Issues:
  
  If there is a proxy or middleware between client and SAP, ensure it is not caching and resending messages.
  
  
  
  
  Related Information:
  
  SAP Note: Check SAP Notes related to WS-Security and replay detection for your SAP NetWeaver version.
  Transaction: Use transaction STRUST to manage certificates and WS-Security settings.
  Configuration: WS-Security settings are maintained in the SOAMANAGER transaction.
  SAP Help: Refer to SAP Help Portal documentation on WS-Security and replay attack prevention.
  Logs: Check the SAP system logs and traces (e.g., via transaction SMICM, ST22, or SRT_UTIL) for more details on the error.
  
  
  Summary:
  
  
  
  Aspect
  Details
  
  
  
  
  Cause
  Duplicate SOAP message detected due to replay attack prevention (same timestamp/nonce).
  
  
  Solution
  Ensure unique timestamps/nonces, synchronize clocks, adjust replay detection settings.
  
  
  Related Info
  SOAMANAGER config, STRUST certificates, SAP Notes on WS-Security replay detection.
  
  
  
  
  If you provide more context (e.g., SAP system version, scenario), I can help with more specific instructions.