I’ll provide you with a comprehensive solution addressing SFTP folder permissions, service account configuration, and the differences between automated and manual uploads.
1. SFTP Folder Permissions Configuration:
First, verify and correct the folder-level permissions for your BOM sync directory:
Navigate to Integration Setup > SFTP Configuration > Folder Permissions. For the /inbound/bom folder, ensure these settings:
- Folder Path: /inbound/bom
- Permission Type: Explicit (not inherited)
- User/Group: svc_bom_sync (assign directly to user, not just group)
- Permissions: Read, Write, Create, Delete
- Apply to Subfolders: Yes
- Session Type: Both Interactive and Non-Interactive
The key issue is the “Session Type” setting. BY 2022.2 introduced granular control over interactive (manual) versus non-interactive (automated) sessions. Your folder permissions must explicitly allow Non-Interactive access for automated jobs.
Click Edit on the /inbound/bom folder permissions, then:
- Remove the group-level permission (Integration_Users)
- Add user-level permission specifically for svc_bom_sync
- Check both “Interactive Access” and “Non-Interactive Access” boxes
- Set Permission Level to “Full Control”
- Save and apply changes
Why user-level instead of group-level? Group permissions in BY 2022.2 default to Interactive-only for security. User-level permissions allow you to explicitly grant Non-Interactive access.
2. Service Account Configuration:
The service account requires multiple configuration updates after credential rotation:
A. SSH Key Registration:
Go to Integration Setup > SFTP Configuration > User Management > svc_bom_sync:
- Remove the old public key
- Add new public key (paste the full key content, not just fingerprint)
- Key Type: RSA 2048-bit minimum (4096-bit recommended)
- Key Format: OpenSSH format (starts with “ssh-rsa”)
- Save and test key validation
B. Role Assignment:
Navigate to User Management > Service Accounts > svc_bom_sync > Roles tab. Ensure these roles are assigned:
- IntegrationUser (base role for SFTP access)
- AutomatedFileTransfer (required for non-interactive sessions)
- ManufacturingDataImport (required for BOM file processing)
Critically, the AutomatedFileTransfer role is often removed during credential rotation as a security measure. You must explicitly re-assign it:
- Click “Assign Roles” button
- Search for “AutomatedFileTransfer”
- Select and assign
- Set Effective Date to current date
- Leave Expiration Date blank (or set per your security policy)
- Save changes
C. Authentication Method Configuration:
In the service account settings, configure authentication preferences:
- Primary Auth Method: Public Key Only
- Allow Password Fallback: No
- Require Client Certificate: No (unless you use mutual TLS)
- Session Timeout: 3600 seconds (1 hour)
- Max Concurrent Sessions: 5
3. Automated vs Manual Upload Differences:
BY 2022.2 treats these session types differently for security:
Interactive (Manual) Sessions:
- Authenticated via SSH key or password
- Subject to group-level permissions
- Logged as user-initiated actions
- No rate limiting
- Can access any folder with group permissions
Non-Interactive (Automated) Sessions:
- Require explicit AutomatedFileTransfer role
- Subject to user-level permissions only (group permissions ignored)
- Logged as system-initiated actions
- Subject to rate limiting (100 files/hour by default)
- Can only access folders with explicit non-interactive permission
- Require specific connection parameters
To configure your ERP’s automated job for non-interactive sessions:
// Pseudocode - SFTP client configuration for automated access:
1. Set connection mode to "batch" or "non-interactive"
2. Use public key authentication exclusively (disable password)
3. Set SSH options: StrictHostKeyChecking=yes
4. Configure connection timeout: 30 seconds
5. Set file transfer mode: binary
6. Enable connection pooling for multiple files
// See documentation: SFTP Integration Guide Section 5.2
Verification Steps:
-
Test manual upload:
sftp -i /path/to/new_key svc_bom_sync@sftp.luminate.blueyonder.com
cd /inbound/bom
put test_file.xml
-
Test automated upload from ERP:
- Trigger the scheduled BOM sync job
- Monitor SFTP logs: Integration Setup > SFTP Configuration > Session Logs
- Verify “Session Type: Non-Interactive” in logs
- Confirm successful file transfer
-
Check processing:
- Navigate to Manufacturing Planning > Data Import > BOM Import Status
- Verify the uploaded file appears in processing queue
- Confirm successful import into manufacturing planning
Common Issues and Solutions:
-
Issue: “Permission denied” persists after role assignment
Solution: Service account changes require a 5-minute propagation period. Wait and retry.
-
Issue: File uploads succeed but don’t process
Solution: Check file naming convention. BY expects format: BOM_YYYYMMDD_HHMMSS.xml
-
Issue: Intermittent failures
Solution: Configure connection retry in ERP (3 attempts with 30-second delay)
-
Issue: Rate limiting errors
Solution: Contact BY support to increase file upload quota for your service account
Security Best Practices:
- Use 4096-bit RSA keys for service accounts
- Rotate credentials every 90 days per compliance requirements
- Document the full credential rotation procedure including role re-assignment
- Implement monitoring for failed automated uploads (alert after 2 consecutive failures)
- Use separate service accounts for different integration types (don’t share svc_bom_sync for other file transfers)
Monitoring and Alerts:
Set up monitoring for the BOM sync integration:
- Alert on SFTP authentication failures (3+ in 1 hour)
- Alert on permission denied errors
- Alert on missing BOM files (expected daily at specific time)
- Track file processing time (alert if >30 minutes)
After implementing these changes, your automated BOM sync should work reliably. The key points are: user-level folder permissions with non-interactive access, AutomatedFileTransfer role assignment, and proper SSH key configuration. Test thoroughly before resuming production use.