Role mapping between Portal and Back end systems

I am new to SAP EP.
I just want to know how the mapping between portal and back end system happens.
Scenario : There is a role in ECC system...say FI India. Now there is a request by the FI team that they want to access this role from Portal. In this case, please tell me how the security team will do it. Because I guess, it has to be done by the security team.

Hi,
Usually the role from backend is uploaded to portal then it will be seen as Group and we need to assign our portal roles to this group. Please refer [this|http://help.sap.com/saphelp_nw73/helpdata/en/d6/7859ec80df46738e23ccb4f4c8c502/content.htm].
Regards,
Samir

Similar Messages

Relationship between Portal and back-end roles in business package

Hi all,
I wonder how technically works on the backend system when I install a BP for SAP EP. Let's say for example that I installed on the portal the business package for SRM. I will have on the Portal some roles configured (buyer, supplier, invoice manager, etc), and some iviews in them organized by pages and workest.
How can I see the relations with those roles and the roles on the SRM backend system? And then: if I modify a standard role on the Portal, adding new functionalites (iviews), I do update the backend role? We are going to implement SSO, and users will be the same on Portal and backend system. But that also means I need to assign users to backend roles on the backend system, isn't it?
I would be glad to you if someone can provide me also a link to a document explaining the relationshipe between backend roles management and portal roles management.
Thanks a lot,
Valentina

To add.. no, you will not update a backend SRM role if you update an iView on the Portal. The Backend roles will always be assigned to the user via PFCG and do not change automatically with the Portal roles.
This help document might help you understand the concept better (Look at the Permissions vs Authorisations section):
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/c605c690-0201-0010-e8b5-94677245a46b
Hope this helps. I am sure SAP/SDN library has many such documents that you can read through.
Sudha
Message was edited by:
Sudha Mohan

Setting up SSO between EP and back-end SAP systems

Can anybody give me some insight about setting up SSO between EP and back-end SAP systems. If possible some links to write up would be great.
Thanu

Hi,
This link gives you a detailed information on setting up SSO : http://help.sap.com/saphelp_nw04/helpdata/en/89/6eb8deaf2f11d5993700508b6b8b11/frameset.htm
Some How-guides:
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/e676ec90-0201-0010-cfa3-90b7c1291903
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/77378b3d-0b01-0010-ffa5-c6941e286c43
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/80fbc690-0201-0010-1aba-93d5c8232b4a
Regards,
Sunil

How can I get connection between VC and back end ABAP system

Hi, I'm developing the kits in the VC platform, and I need to access the back end system designed by ABAP. For example, the system provides some public functions(not web services), and I hope when I click the "search" button, the VC front can call the remote functions and get the data from the back end system. In addition to that, the most important is I must keep the connection real-time. How can I do it?

Thanks for your help. At present, my VC version is 7.1.4 which isn't installed in the portal server but in local machine, and I'm new in the VC. What I want is when I click the "search" button(in the properties pannel), I can get the data from the remote server. I know the VC 6 provides similar functions, but the current version doesn't. Could you explain the details of how to get and keep the connection between them? Thanks so much.

EP 7.0 and Back End System Connection + Management

Hello All,
I am trying o configure certain Backend system with my Portal System in our landscape. Actually I want to implement a scenario where i can manage all the system via my Portal itself. My backend systems are ECC 5.0 , Solution Manager 3.2 SR1, R/3 4.7 SR1, BW 3.5 & CRM 4.0.
Till now I have configured the SSO between the Portal and the target system. But Now I am confused with how to proceed further for achieving this scenario.
Please help me ...
Thanking you in advacnce ...
Regards,
Premkishan Chourasia

Hi Premkishan,
Check this weblogs
Quick Guide for setting up SSO between EP and R/3
Connecting SAP systems to Enterprise portal with SSO.
You have mentioned that SSO configuration between portal and backend system is done. So you are almost done with CRM part.
You can download the ESS/MSS package from SDN and import into your portal.
This you can get it from SDN. Click on downloads from the top level navigation in sdn. A page is displayed. Click portal content portfolio. In the right hand side panel you click on list of packages. From there choose your correct ESS and MSS package and Keyword search option enter that and search. You will get the downloads.
Check these urls
https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/docs/library/uuid/21eb036a-0a01-0010-25a3-b2224432640a
Configuring The Business Package For Employee Self Service (ESS)-mySAP ERP 2004
Configuring ESS in SAP Enterprise Portal 6.0
https://www.sdn.sap.com/irj/sdn/developerareas/contentportfolio
ESS & MSS
Regards
Arun

Creation of System Alias between Portal and E Sourcing System

Hi Team,
I would like to create a System Alias between SAP Portal 7.4 and E Sourcing System 10.0. I would like to know during the creation of System Object which template i need to take (is it http System or R/3 System using Load Balancing).
If it is a HTTP System, I am getting ""Could not find Connector Factory value: null"".
Could you please help me in knowing what could be the issue.
Pls. Note: E Sourcing is a Java based SAP System.

Hi Sankar,
Please go through the below SAP Note and see if that helps.
711769 - SSO between SAP Java Software Products
BR,
Anurag

Inconsistency between Bex and Back end

Hello, I have a query about bex issue. I have few fields in my DSO/Cube which has data showing correctly in the back end but in Bex it shows partial of those values. like if i have something like this:
ZField
000000000000000000008
It shows correct in DSO table but in Bex it only shows the zeros. do you know why and how to get this to show the whole field value?
Thanks.
By the way this is a characteristic and not keyfigure.

Hi Vekant,
If you have not did any speecific thing at query level then value should be shown correctly.
Please try this once and check.
Create new test query on your data target drag and droup your charecteristic.please execute your test query and see if you are able to see the correct value.
try this.
Regards,
Ganesh Bothe

Vendor Replication and Different Back-end Systems

Hello,
Currently, we have vendor replication were the vendor number from the back-end is used in SRM-EBP. Now, we want add another back-end but there are vendor number conflicts. Is there a way to configure it so that the new back-end replicaition generates new numbers in SRM-EBP?
Honestly, there should be a cleansing and alignment of vendor numbers between the two back-end systems. However, that is big task that the organization doea not want to take on at this time.
Has anyone encounter this issue and how did you resolve it?
Regards, Dean.
Edited by: Dean Hinson on Feb 3, 2010 3:26 PM

Hi,
You can find option "If R/3 number assignment is not possible: Internal number assignment" in the bottom of BBPGETDV transaction screen.
Regards,
Masa

Authentication with UME separation of front end and back end

My webdynpro project has 2 application. One for Admin one for Rating.
Is it possible to create a java class at Webdynpro level and share it between the 2 applications?
Why the need?
Created a custom class (lets called it CommonEJB), to point to the right pages and set of UI controls after the initial login with UME. This class utilizes the IWDClientUser.getSAPUset() method to get IUser object.
If it is not possible to create a java class at Webdynpro, then this ejb will need to be deployed to the backend.
Putting it at the backend is not good as security wise, its always better to separate the authentication between front and back end.
Any ideas/solutions?
thanks

s0003358504
au-?Krup
LDAP
==============================================
Computer Associates Int'l [eTrust Directory]
Critical Path [CP Directory Server (CP DS)]
Microsoft [Windows 2000 Active Directory Server]
Microsoft [Windows 2003 Server - Active Directory]
Netscape Communications [Netscape Directory Server]
Novell [DirXML Driver for User Management]
Novell [Novell DirXML Driver for SAP HR/PA]
Novell [Novell eDirectory]
Oracle Deutschland [Oracle Internet Directory (OID)]
Siemens [DirX Directory Server]
Siemens [DirX Extranet Edition]
Sun Microsystems [Sun Java System Directory Server]
     Test Objectives
     Testing Scope
     Test Approach
     Test Environment
     Test Data
     Entry / Exit Criteria
     Risks
     Schedule and Resources
     SIT Deliverables
     Test Planning Source Documents
Well, i wish to create a java class that can separate the view areas depending on their login.
lets say you're a manager, u can see certain views. and if you're a supervisor u see another. This is achieved using the java class with information from getSAPUser() position. After retrieving the position, using the java class will programmatically assigned the appropriate views, buttons, tabs etc.
so this class need to in front end, and not back end. problem is we have 2 application.
if the class is created front end in one application can it be shared with another.

Users mapping between EP and ABAP system

Hello
I'd like to ask for some guidance in my quest
Current situation looks like this:
I've configured UME in AS Java to work with LDAP as read only data source. Then I've configured SPNego to run SSO - It works, users from MS AD can log into portal.
Now I have application in WD which authorizes via EP/AD - works fine.
And next step is users mapping between AD and ABAP backend (serving some BAPI's for WD app)
I've found a bunch of help pages starting from
http://help.sap.com/saphelp_nwce711/helpdata/en/0b/d82c4142aef623e10000000a155106/frameset.htm
But somehow it's quite complicated to achieve this mapping. I've tried to set RFC destinations logon type to user mapping but without succes.
Can anyone point me to some more clear example or give path to configure this scenario? Is there a way of configuring this with NWA or some XML file editing is required?
Any help will be appreciated.
BTW: whole environment is in version 7.11
Best regards
Maciej

There is no equivalent to SPNEGO on the ABAP side.
If your goal is to propagate the user, then possible options are:
-> Wait for SAML 2.0 or invest now in a SAML 1.0 provider.
-> Use the same kerberos ticket for the EP as what your ABAP system will accept: route = SNC and 3rd party libraries.
-> Issue SAP logon tickets for the ABAP system from the EP, and use these in your WDA.
Another option is to expose the service with saved logon data in the ICF. If the service is just a wrapper for the BAPI, then you can also consider using trusted RFC between the service and the backend, but this might not be acceptable for your service.
I have only done experimental stuff with this and some of the above is not released yet. Also consider the consequences, even if it "does work"...
Cheers,
Julius

SSO between Portal and Nakia.....problem with SSO... library not found..

Hi Sdn's and Nakisa tehnical experts,
We have a Portal environment 7.02 , a Nakisa environment 3.0 (CE) and and HR backend environment 701 (604).
We are busy setting up SSO between Portal and Nakisa via the, URL iview for the Org chart (http://<host>:<port>OrgChart/default.jsp).
We have done as indicated in wiki:
http://wiki.sdn.sap.com/wiki/display/ERPHCM/SAPSSOAuthenticationwithverify.pseusingSAPSSOEXT
We are however stil having issues with the SSO and in the cds.log the following is being displayed:
++01 Aug 2011 13:11:42 ERROR com.nakisa.Logger - com.mysap.sso.SSO2Ticket : Could not load library: sapsecu.dll - java.lang.Exception: MySapInitialize failed: rc= 14null++
++01 Aug 2011 13:11:42 ERROR com.nakisa.Logger - com.nakisa.framework.login.Credentials_SapSso : java.lang.Exception: MySapEvalLogonTicketEx failed: standard error= 9, ssf error= 0++
++01 Aug 2011 13:11:42 ERROR com.nakisa.Logger - com.nakisa.framework.login.Credentials_SapSso : Internal error (9) - No SSF error (0)++
Can someone indicate what I am doing wrong?
Regards Dries

Hi Luke,
thanks a lot for your help so far.
I have created a root/XML folder under the diretory, and the path is now as follows:
K:\usr\sap\NKP\J14\j2ee\cluster\apps\Nakisa\OrgChart\servlet_jsp\OrgChart\root\.system\Admin_Config\__000__Sasol_DEV_LIVE\.delta\root\XML
It seems like it finds the verify.pse, but not the library, sapsecu.dll.
My credentials.xml file is as follows:
<credentials>
<assembly name="SapSso"/>
<info>
    <item name="PseFilePath">XML\verify.pse</item>
    <item name="SsfLibFilePath">XML\sapsecu.dll</item>
    <item name="PsePassword"></item>
    <item name="WindowsPlatform">64</item>
    <item name="TicketFile"></item>
    <item name="Base64decode">true</item>
   </info>
</credentials>
I however stilll get the following in the cds.log
15 Aug 2011 13:59:53 INFO com.nakisa.Logger - Tenant ID: 000
15 Aug 2011 13:59:55 INFO com.nakisa.Logger - LoginSettingsObject Load: 1719
15 Aug 2011 13:59:55 INFO com.nakisa.Logger - com.nakisa.framework.login.Main : LogIn : Credential provider SapSso
15 Aug 2011 13:59:55 INFO com.nakisa.Logger - com.nakisa.framework.login.Credentials_SapSso : Using cert: K:\usr\sap\NKP\J14\j2ee\cluster\apps\Nakisa\OrgChart\servlet_jsp\OrgChart\root\XML\verify.pse
15 Aug 2011 13:59:55 INFO com.nakisa.Logger - com.nakisa.framework.login.Credentials_SapSso : Ticket is: AjExMDAgAA9wb3J0YWw6eXNzZWxhZ2OIABNiYXNpY2F1dGhlbnRpY2F0aW9uAQAIWVNTRUxBR0MCAAMwMDADAANEUDkEAAwyMDExMDgxNTExNDcFAAQAAAAICgAIWVNTRUxBR0P%2FAQQwggEABgkqhkiG9w0BBwKggfIwge8CAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHATGBzzCBzAIBATAiMB0xDDAKBgNVBAMTA0RQOTENMAsGA1UECxMESjJFRQIBADAJBgUrDgMCGgUAoF0wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTEwODE1MTE0NzIwWjAjBgkqhkiG9w0BCQQxFgQUK13ubzFiQrY4H%2FLRk2ysyvPSvccwCQYHKoZIzjgEAwQuMCwCFF1W9d!tAjLvP8dnb1bs4XghaHSBAhQ9kd9N!bJubUWITtkzU!za96lxNg%3D%3D
15 Aug 2011 13:59:55 INFO com.nakisa.Logger - com.nakisa.framework.login.Credentials_SapSso : Version of SAPSSOEXT: SAPSSOEXT 4
15 Aug 2011 13:59:55 INFO com.nakisa.Logger - com.nakisa.framework.login.Credentials_SapSso : SCUE LIB base path is:
15 Aug 2011 13:59:55 ERROR com.nakisa.Logger - com.mysap.sso.SSO2Ticket : Could not load library: sapsecu.dll - java.lang.Exception: MySapInitialize failed: rc= 14null
15 Aug 2011 13:59:55 ERROR com.nakisa.Logger - com.nakisa.framework.login.Credentials_SapSso : java.lang.Exception: MySapEvalLogonTicketEx failed: standard error= 9, ssf error= 0
15 Aug 2011 13:59:55 ERROR com.nakisa.Logger - com.nakisa.framework.login.Credentials_SapSso : Internal error (9) - No SSF error (0)
15 Aug 2011 13:59:55 INFO com.nakisa.Logger - com.nakisa.framework.login.Main : LogIn : User to authenticate null
15 Aug 2011 13:59:55 INFO com.nakisa.Logger - com.nakisa.framework.login.Main : LogIn : Authentication provider SapSso
15 Aug 2011 14:00:00 INFO com.nakisa.Logger - com.nakisa.framework.login.Main : LogIn : User authenticated null
15 Aug 2011 14:00:00 INFO com.nakisa.Logger - com.nakisa.framework.login.Main : LogIn : Authentication row is {SapSsoTicket=AjExMDAgAA9wb3J0YWw6eXNzZWxhZ2OIABNiYXNpY2F1dGhlbnRpY2F0aW9uAQAIWVNTRUxBR0MCAAMwMDADAANEUDkEAAwyMDExMDgxNTExNDcFAAQAAAAICgAIWVNTRUxBR0P%2FAQQwggEABgkqhkiG9w0BBwKggfIwge8CAQExCzAJBgUrDgMCGgUAMAsGCSqGSIb3DQEHATGBzzCBzAIBATAiMB0xDDAKBgNVBAMTA0RQOTENMAsGA1UECxMESjJFRQIBADAJBgUrDgMCGgUAoF0wGAYJKoZIhvcNAQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTEwODE1MTE0NzIwWjAjBgkqhkiG9w0BCQQxFgQUK13ubzFiQrY4H%2FLRk2ysyvPSvccwCQYHKoZIzjgEAwQuMCwCFF1W9d!tAjLvP8dnb1bs4XghaHSBAhQ9kd9N!bJubUWITtkzU!za96lxNg%3D%3D}
15 Aug 2011 14:00:00 INFO com.nakisa.Logger - com.nakisa.framework.login.Main : LogIn : User population provider is Database
15 Aug 2011 14:00:00 INFO com.nakisa.Logger - FunctionRunner : ensurePool : Current pool size:0
15 Aug 2011 14:00:00 INFO com.nakisa.Logger - FunctionRunner : ensurePool : Current pool size:0
15 Aug 2011 14:00:00 INFO com.nakisa.Logger - FunctionRunner.executeFunctionDirect: /NAKISA/RFC_REPORT took: 266ms
15 Aug 2011 14:00:00 INFO com.nakisa.Logger - BAPI_SAP_OTFProcessor_Report : WhereClause : ( (Userid is null) or (Userid='') ); Table : (SAP_UserPopulation); Dataelement : (UserPopulationInfo)
15 Aug 2011 14:00:00 INFO com.nakisa.Logger - com.nakisa.framework.login.Main : LogIn : User populated
15 Aug 2011 14:00:00 INFO com.nakisa.Logger - com.nakisa.framework.login.Main : LogIn : Role mapping provider is: SAP
15 Aug 2011 14:00:00 ERROR com.nakisa.Logger - SAPRoleMapping_SAP.MapRoles() : while trying to invoke the method java.lang.String.toUpperCase() of an object loaded from local variable 'value'
15 Aug 2011 14:00:00 INFO com.nakisa.Logger - com.nakisa.framework.login.Main : LogIn : Login process finished with errors
Any ideas? Should I maybe hardcode the location in the credentials.xml?
Kind regards
Dries Yssel

Client Copy back-end system

Hi Guys,
We have made a client copy of the back-end system of SRM (SRM 5.0). Only the back-end and not SRM has been copied.
After replication all the master- and customizing data again to SRM from the 'new' back-end I have found an issue with updating the suppliers.
It seems that I can not remove old business partners from SRM with BUPA_TEST_DELETE if these are used already in SC's. However the new copy of the back-end system has completely different suppliers we need to use in SRM. This causes for an inconsistency with the supplier numbers, as we want to keep the R/3 numbers in SRM.
Does anyone has a good idea how to proceed? That is, how can I remove the business partners (suppliers) in SRM which were used before the client copy of R/3, so that I will be able to completely get all the relevant 'new' vendors from the R/3 system after the client copy.
When I execute BUPA_TEST_DELETE it will end up in error saying the suppliers can not be removed. Do I need to archive all the old documents (SC & PO) before I can remove all vendors in SRM, or is there a way to force the removal of all the business partners from before the back-end client copy?
Thx.
Skander

Hi,
I already figured out how to solve the issue.
For anyone who wants to know how to:
-First clear the vendor groups in the vendor hierarchy; do not renove the root node
-Then run BBPGETVD which will get you the new vendors from the back-end; for me only role LF for suppliers.
-Then run BBPUPDVD which will update all the fields for the old business partner numbers in SRM which were used in documents, and replicated from the old back-end system.
In my case I had to play a litlebit with the setting 'only creditors', to update BP numbers which were not suppliers in the new back-end.
After performing these steps everything should be fine.
So it's perfectly possible to make a client copy of only the back-end system without copying SRM (in the classic scenario that is).
Rgds,
Skander

Different ways to establish SSO between Portal and ADP

Hi,
We are implementing payroll with the help of ADP.
Please let me know different ways of establishing SSO between portal and ADP
Thanks
Bala Duvvuri

You may a few issues. SSO with logon tickets is based on accessing web sites in the same domain. So, if the portal is on http://ourportal.company.com, then the web site being accessed needs to have a URL like http://adphosted.company.com. Is the ADP system accessible by a DNS alias that is within company.com? If so, you're OK. If not, then there will be problems.
The other SSO method is user mapping, but the security implications are not good...

Connection between Portal and MDM

Hi all
Can anybody help me on how to establish the connection between portal and MDM with step by step procedure.
i am new to this combination .
before i worked with portal but not worked with MDM .
Regards
Suresh babu

Hello Suresh,
As of my knowledge MDM IViews have the advantage to ful fil your neeed to provide connectivity moreover,that they are not complex in structure and are therefore not restricted by any underlying schema structure. As opposed to regular iViews in other systems which are embedded into the pages on which they appear, MDM iViews are more generic and granular in nature enabling their placement on a page to be more adaptable.
The SAP Enterprise Portal (SAP EP) offers templates for creating the iViews. The following are some examples of these templates available at the link:
[http://help.sap.com/saphelp_mdm550/helpdata/en/45/c9f8cac2124ebee10000000a11466f/content.htm]
Procedure:
       1.      Create a new page using the page wizard.
       2.      To see the iViews you created on the new page, you need to link them to the page. Right-click each of the iViews that you created and from the context menu, select Add iView to Page → Delta Link
       3.      Double-click the new page you created and select:
Page Content to view a list of the iViews that have been linked to this page
Page Layout to view the layout currently assigned to this page. The iViews can be rearranged using the drag&drop function.
       4.      The visual structure of a page can be changed with the Page Layout function. Select Define Layout to reset the layout of the page.
       5.      Select Preview to view the page showing how the iViews have been arranged. The preview simulates what an end user sees at runtime.
Detailed pictorial presentation available at:
[http://help.sap.com/saphelp_mdm550/helpdata/en/45/c8e2fa5f0c2e97e10000000a155369/content.htm]
Hope you will find it helpful.
Regards,
Krutarth

Error : No valid R/3 Back-end system

Hi CRM gurus,
I'm trying to connect SAP CRM 5.0 to SAP ECC 5.0.
When I launch trx R3AS for downloading the first object of the list coming from Best Practise (DNL_CUST_ACGRPB), I am getting the above error: "No valid R/3 Back-end system."
Now the point is that RFCs work smoothly, administration console as well and R/3 view CRMRFCPAR was filled correctly.
Where is the problem? I'm looking into, but without results.
Any suggestions in this issue will be rewarded.
Regards,
AndreA

Many thanks Praveen,
I have carried out all the checks in the tables and it seems that everything is fine!.
Creating a RFC Destication for CRM in R/3
Maintain Table CRMRFCPAR and CRMCONSUM?
In Table CRMPAROLTP, Parameter "crm release" should set to your CRM version ( ex 500 for crm 5.0)
Maintain table TBE11, APPI should be NDI(new dimension integration),A yes
I don't really know where the error could lay.
Andrea

Role mapping between Portal and Back end systems

Similar Messages

Maybe you are looking for