About EP(on UNIX) UME integration with LDAP

Hello guys,
We want that UME use LDAP(read-only) as data source .
Our EP installed on UNIX , LDAP on Windows.
Connection data
Server Name:    sapsso
Server Port:      389
User:               p106658 (an administrator user)
Password:        ******
User Path : ou=test,c=us,o=gnpjvc
Group Path: ou=test,c=us,o=gnpjvc
We fill the data reference document on help websit :Configuring the UME to Use an LDAP Directory as Data Source   .
But test connection always failed.
Is there any solution?
Thank you!
Louis

Hi,
check your JDK version, some SUN version (>1.4.2_13) won't work with Kerberos. Start with SAP Note 968191 to gain more information.
For checking the Java JDK parameters and recommendations / bugs, take a look at these Notes:
716604    for the Sun JDK (Windows, Linux, Solaris)
716926    for the HP JDK (HP-UX)
716927    for the IBM JDK (AIX)
1234382   for the IBM JDK IT4J (IBM i, iSeries, OS/400)
717376    for the IBM JDK Classic (IBM i, iSeries, OS/400)
746299    for the IBM JDK (Linux for zSeries)
810008    for the IBM JDK (Linux on POWER)
861215    for the IBM JDK (Linux on AMD64/EM64T)
br,
Tobias

Similar Messages

Forte integration with LDAP

Hi.
Has anyone successfully integrated with LDAP using the C library from
LDAP SDK?
Currently I'm facing a problem when I tried to generate the C++ wrapper
for the C library. The compiler is unable to resolved the data type of
some data structs. This is because the definition for these structs are
not defined in any of the include files provided. According to the LDAP
SDK doc, this is because the fields for those data structs are not
intended to be accessible to the clients.
That is why in my wrapper project, I defined these struct, each has the
property Opaque = TRUE.
The following is the error message:
BEGIN FILE
Working directory is d:\forte\tmp\cg13\pc_nt\ldapsrch
Processing BOM file: LDAPSrch.bom
Microsoft (R) 32-bit C/C++ Optimizing Compiler Version 11.00.7022 for
80x86
Copyright (C) Microsoft Corp 1984-1997. All rights reserved.
LDAPSrch.cc
LDAPSrch.cc(70) : error C2027: use of undefined type 'BerElement'
LDAPSrch.cc(127) : error C2027: use of undefined type 'LDAP'
LDAPSrch.cc(184) : error C2027: use of undefined type 'LDAPMessage'
LDAPSrch.cc(203) : error C2733: second C linkage of overloaded function
'ldap_init' not allowed
LDAPSrch.cc(204) : error C2733: second C linkage of overloaded function
'ldap_simple_bind_s' not allowed
LDAPSrch.cc(205) : error C2733: second C linkage of overloaded function
'ldap_perror' not allowed
LDAPSrch.cc(206) : error C2733: second C linkage of overloaded function
'ldap_search_s' not allowed
LDAPSrch.cc(207) : error C2733: second C linkage of overloaded function
'ldap_first_entry' not allowed
LDAPSrch.cc(208) : error C2733: second C linkage of overloaded function
'ldap_next_entry' not allowed
LDAPSrch.cc(209) : error C2733: second C linkage of overloaded function
'ldap_get_dn' not allowed
LDAPSrch.cc(210) : error C2733: second C linkage of overloaded function
'ldap_first_attribute' not allowed
LDAPSrch.cc(211) : error C2733: second C linkage of overloaded function
'ldap_next_attribute' not allowed
LDAPSrch.cc(212) : error C2733: second C linkage of overloaded function
'ldap_get_values' not allowed
LDAPSrch.cc(213) : error C2373: 'ldap_value_free' : redefinition;
different
type modifiers
LDAPSrch.cc(214) : error C2733: second C linkage of overloaded function
'ldap_ber_free' not allowed
LDAPSrch.cc(215) : error C2733: second C linkage of overloaded function
'ldap_msgfree' not allowed
LDAPSrch.cc(216) : error C2373: 'ldap_memfree' : redefinition; different
type modifiers
LDAPSrch.cc(217) : error C2733: second C linkage of overloaded function
'ldap_unbind' not allowed
cl /W3 /Gf /GX /MD /c /Ob1 /vmg /DSTRICT /DWIN32 /D__WIN32__
/DLIBOO_DLL
WIN32_LEAN_AND_MEAN /Id
:\forte\install\inc\cmn /Id:\forte\install\inc\os
/Id:\forte\install\inc\ds
/Id:\forte\install\inc\handles /Id:\forte :\forte\LdapAPIs\include
/FoLDAPSrch.obj /Tp LDAPSrch.cc
So, please advise on how should I proceed.
Thanks in advance.
from: suen
To unsubscribe, email '[email protected]' with
'unsubscribe forte-users' as the body of the message.
Searchable thread archive <URL:http://pinehurst.sageit.com/listarchive/>

Hi Anoop,
To adapt an SAP Workflow, you can create a configuration. In this configuration you can redefine values for steps of the workflow definition. These values are evaluated at runtime instead of the values originally defined.
You can configure the following step types:
Activity
User decision
Document from template
Wait
Moreover,Features
You can set the following data individually in the step definition of the configurable step types:
1)Responsible agents
2)Excluded agents
3)Message recipient for completion
4)Priority
5)Requested start
6)Indicator denoting whether the step is included in the    workflow log
7)Activation of a latest end, a latest start, or a requested end with the reaction Send mail
This URL privides info about various workflow codes http://help.sap.com/erp2005_ehp_02/helpdata/en/9b/572614f6ca11d1952e0000e82dec10/content.htm
Regds,
Krutarth
·        Reference date/time for latest end, latest start, and requested end
·        Message recipient for missed deadline
·        Information about the work item display

Problem about BIEE Integration with LDAP

Hello,
I have a problem in OBIEE11.1.1.6
I do BI EE 11g Security Integration with OPENLDAP follow below link,
http://www.rittmanmead.com/2010/11/oracle-bi-ee-11g-security-integration-with-microsoft-active-directory/
It works well using user that store in OPENLDAP ,
now I want to realize this function,
that user roles store in external db table,then get roles by init block,
but I faced a problem, If I use session system variable 'WEBGROUPS' to get some value in db,when user login BIEE,it can get values of 'WEBGROUPS'
but If I use session system variable 'ROLES' ,when user login BIEE,it can't get values of 'ROLES' that store in db,
the value will always show 'BIConsume;Authenticated User',It is default value in OBIEE11.1.1.6,
so I doubt way I can't user variable 'ROLES' to get value???
init block lik follow,
SQL: select T.att1,T.att2 FROM USER_ACCESS T
T.att1 is for variable 'WEBGROUPS'
T.att2 is for variable 'ROLES'
the value of 'WEBGROUPS' is correct.
but 'ROLES' not got the values that stored in db.
anyone know???
thank you in advance!

VITAS wrote:
that user roles store in external db table,then get roles by init block,
but I faced a problem, If I use session system variable 'WEBGROUPS' to get some value in db,when user login BIEE,it can get values of 'WEBGROUPS'
but If I use session system variable 'ROLES' ,when user login BIEE,it can't get values of 'ROLES' that store in db,
the value will always show 'BIConsume;Authenticated User',It is default value in OBIEE11.1.1.6,
so I doubt way I can't user variable 'ROLES' to get value???
init block lik follow,
Go to Enterprise Manager and create the ROLES named the same as the one you named in DB values. Now you should see them magically appear when you click on My account > Roles and Catalog Groups. :)
SQL: select T.att1,T.att2 FROM USER_ACCESS T
T.att1 is for variable 'WEBGROUPS'
T.att2 is for variable 'ROLES'
the value of 'WEBGROUPS' is correct.
but 'ROLES' not got the values that stored in db.Hope you did you enable Row Wise Init here ?
Let us know. Mark if helps.!
Thanks,
SVS

NAC integration with LDAP

Is possible this integration?. The idea is that the agent will do authentication with LDAP directly

Hi Anoop,
To adapt an SAP Workflow, you can create a configuration. In this configuration you can redefine values for steps of the workflow definition. These values are evaluated at runtime instead of the values originally defined.
You can configure the following step types:
Activity
User decision
Document from template
Wait
Moreover,Features
You can set the following data individually in the step definition of the configurable step types:
1)Responsible agents
2)Excluded agents
3)Message recipient for completion
4)Priority
5)Requested start
6)Indicator denoting whether the step is included in the    workflow log
7)Activation of a latest end, a latest start, or a requested end with the reaction Send mail
This URL privides info about various workflow codes http://help.sap.com/erp2005_ehp_02/helpdata/en/9b/572614f6ca11d1952e0000e82dec10/content.htm
Regds,
Krutarth
·        Reference date/time for latest end, latest start, and requested end
·        Message recipient for missed deadline
·        Information about the work item display

CUP (AE) integrated with LDAP

Hi GRC Guys,
I had a question about the integration between CUP (AE) and LDAP.
I know that with LDAP as the detail user source and Manager as the standard approver, AE will automatically find the manager and route the approval flow to this person. However my request is can we use this LDAP integration to automatically find the manager's manager, or more freely any person within the organization? Do we need to use some CAD to realize this?
Thanks.
Benny Ren From Deloitte GRC Team

Dear Alpesh,
Many thanks for your reply.
Since LDAP is not able to achieve my goal, can HR system do that?
I have very little information about the integration between HR system and CUP (AE). Can you shed me some light on where to find that?
Best Regards,
Benny Ren

4402 Integration with LDAP

I need to integrate 4402 Controller with Active Directory.
If I have two distinguished names, can I use two OU like:
OU=HQ,OU=Branch1,DC=DC1,DC=com
Is it OK???
shall I use spaces between the patrs?
Please any useful points I should consider them?

Thank you,
I already have the configuration guide,
but this is the first time that I need to do the configuration between the LDAP and controller. and I did not find information about many things like:
how to got the distinguished names?
if I have more than one distinguished name, how I should deal with this issue?
what about EAP configuration? Is there any recommended EAP with LDAP??

WLC integration with LDAP

Hi all and thank you in advance for any you help/advice you might be able to offer....
I'm having problems getting a WLC (7.0.220.0) working using LDAP (Windows 2008). This evening, in an effort to troubleshoot the problem further, I have configured the customer's ASA to use LDAP too and run a test....as you can see below, the test works flawlessly (on the ASA).
aaa-server LDAP_TEST protocol ldap
aaa-server LDAP_TEST host x.x.x.x
server-port 389
ldap-base-dn OU=Users,OU=IT Dept (South),DC=yyy,DC=co,DC=zzz
ldap-scope subtree
ldap-login-password *
ldap-login-dn CN=ldap,OU=Users,OU=IT Dept (South),DC=yyy,DC=co,DC=zzz
server-type microsoft
ASA/act# test aaa-server authentication LDAP_TEST host x.x.x.x username ldap password password
INFO: Attempting Authentication test to IP address <x.x.x.x> (timeout: 12 seconds)
INFO: Authentication Successful
ASA/act#
Now, my understanding is that the ASA only supports PAP (clear text) as Authentication method when communicating to an LDAP server....while on the Controller, I am using EAP-FAST....so my understanding would be that only EAP-FAST/GTC or EAP-FAST/MSCHAPv2 (IF the LDAP server is setup to return a clear text password) are supported.
On the Controller, I am using the very same settings as I have used on the ASA (for the LDAP server configuration). However, users are still unable to Authenticate....they Associate, but do not Authenticate. The clients are all Windows 7 and are setup to use the in-built Cisco EAP-FAST as Authentication method. We are not using certificates.
The thing is that I'm pretty sure that both the Windows 7 clients and the Controller are setup correctly but, as I said, the clients are still unable to authenticate.
I guess that my questions are these:
- on the client side, you can setup the laptops to use "Any method" as authentication method...but how does this exactly work? do they try both EAP-GTC and EAP-MSCHAPv2 (i.e. if it can't authenticate through EAP-GTC will then try EAP-MSCHAPv2?)
- is it better to hardcode the clients to use EAP-GTC or EAP-MSCHAPv2 (instead of default "Any method")....when working on an LDAP environment
- how can I check that the MS 2008 server is indeed setup to "return a clear text password" if using EAP-FAST/MSCHAPv2 (and I do realize that this is probably a question for a Microsoft forum)
- how can I check the the LDAP server is configured to support EAP-GTC and/or EAP-MSCHAPv2??
Thanks again.

This is not an acceptable answer. Steve, do you work for Cisco, or are you commenting on personal experience & knowledge?
I have had a working RADIUS configuration for 2 years+ of an ASA 5510 for authentication of AnyConnect SSL & IPSEC VPN clients with AD, and a WLC 2106 for authentication of WPA2-Enterprise w/802.1x certificates with AD. Both were configured to communication to the same RADIUS server that is a Windows Server 2003 DC with IAS/RADIUS and a CA installed. During the planning for installing a new Windows Server 2008 R2 DC, I decided to attempt to remove my reliance on RADIUS since authenticating directly with LDAP is becoming more common. I was successfully able to configure our ASA to do direct LDAP queries to AD, but similar to "superduperlopez" and "rschwenderman", I have been unable to configure the WLC the same way.
I feel like the following line in Cisco's documentation is unsatisfactory: "For example, Microsoft Active Directory is not supported because it does not return a clear-text password."
I would take this to mean that the ASA is working correctly due to either:
A) The ASA is accepting clear-text passwords from AD, and AD is configured to pass clear-text passwords, or
B) The ASA is not accepting clear-text passwords from AD, and AD is not configured to pass clear-text passwords
Now this would lead me to the following:
A) Cisco has not properly updated the WLC documentation to instruct users how to correctly configured the WLC to do backend LDAP queries, or
B) Cisco has not implemented the technology changes that were made in the ASA to the WLC
This frustrates the average network admin, as it is seen by us as "If the ASA can do it, why can't the WLC". Also, don't get this confused with any "client" issues, as all that is being asked for is the WLC to using a different backend "authentication" server while not modifying the client side at all. The concept of "Local EAP" seems to fit, but doesn't work.
I would really appreciate someone giving some insight on this topic, as there are three customers on this forum post that have had the same problem withing the last 2 months.
The previous posters, and myself, are not looking for someone to retype the documentation, but rather explain how it is working on one of Cisco's security products, but not the other.

SAP IDM Integration with LDAP VS Rest.

Hi,
I'm looking for an best approach through I can integrate my custom application with SAP IDM 7.2. I have read couple of article and found IDM is based on VDS and allow LDAP as well as Restful web services.
Would like to know the best approach.
Here what I want to achieve:
1. Dynamic Schema detection for User, Role and Employee
2. Get all User List and there corresponding Role.
3. Password Reset/Set/Change
Thanks
Shital

Hi Nits,
This guide presents the official SAP Connectors for IdM. SAP and 3rd-party.
It seems that are no official connector for ADOBE CQ and HYBRIS.
But you can build you own connector. (JDBC, WebServices, LDAP)
Using the same concept as the SAP Standard connectors, Folders (Aplication Actions, Plugins) HOOK Tasks.
It will depended in what integration layer this solutions offer.

Queries about PS module and subsequent integration with MM, SD and PP

Hello Experts,
Am posting the query for the first time so hope you all will excuse if something is not correct. Here is a scenario that I am working on:
- The customer is a project engineering company wanting to use PS (but without networks - ONLY WBS)
- We copy the neutral material BOM to create a project BOM
- We create a multi-item sales order with a/c assignment to different assembly groups from the project structure for deliveries and billing
- Project COST planning (V002 and V000) is carried out
- Material stock must be valuated
Following are the scenarios for commitment and actual costs:
1. Direct procurement:
Process: Material purchased with a PR generated from SO item --> PO --> GR --> IR
Query: I am guessing that commitment will be generated through PO creation for WBS. What about actual? What type of cost element should be assigned to the G/L being affected during GR so that I can get some actual against the WBS?
2. Procure to produce:
Process:
Common Purchase: Material purchased through a normal PO (without a/c assignment to WBS) for common unrestricted stock.
Project purchase: Material purchased through project PO (with a/c assignment to WBS - resulting in commitment generation) and special project stock at the time of GR
Both materials (from common and project PO) shall be used for production of an assembly which is being produced using a production order which is assigned to the WBS element.
Query:
How and when would I be getting the commitment / actual effects here?
- Is any commitment generated when I create a production order?
- Is any actual cost posted when I issue raw material to this production order?
- What if the raw material being issued to production order was not purchased using this WBS? Is the actual cost still loaded on this WBS?
- What happens when I confirm the production order to generate FG stock?
What should I be careful about when defining this scenario and what type of cost elements should I be using?
3. Procure - Produce - Sale
Process: In certain cases, material procured for common stock is issued for project production,
Material produced for one WBS/Project gets issued for another.
Query: How does SAP react in this case about the entire commitments and actual cost postings?
I know there are too many queries but I hope you all understand that it is a project-engineering-manufacturing company so on one side the commitment-actual costs are important to be assigned to right project-WBS. At the same time, they also want to have the flexibility in their production activities.
Awaiting eagerly for all possible help.

Link farming is not allowed on this forum. Hence, i would not be able to post any links here. Just to get you started type "SAP Help" in Google. Open the 1st link and under Frequently used click on "ERP Central Components". Then under SAP ERP Central Component 6.0 click on "English". This will take you to a new window. Here, again click on "SAP ERP Central Component". Then click on Logistics - Project System.
You can find all the relevant topics listed here. Go through each one of them and revert with specific queries.

WLC integration with LDAP to authenticate domain users without Radius

Dear All,
I have a WLC 4404 with LWAPs, the customer has a microsoft LDAP and all users are joined to the domain and he wants the users to be authenticated against their domain accounts and this should be done automatically so that when users login to windows they are also authenticated and joined the WLAN.
so how we can do that with the simplest way, without Radius server using only the LDAP and wwithout envolving any certificates.
also i need to know when i add LDAP server to the WLC, how can i know that this LDAP is properly inegrated with the WLC ?
thanks and BR

Hi,
I have followed the following document to make users authenticate against their AD domain accounts:
http://www.cisco.com/en/US/products/ps6366/products_configuration_example09186a008093f1b9.shtml
the device and the root of PKI certificates for the WLC were generated and installed successfully on the WLC, and now we are in the client (end user) part starting from the section "Generating a device certificate for the client" page 17, which as per the document to be done from the client PC using the client domain account, which consequently means this process is to be repeated for each end user separately, so my question is there any way to generate some sort of general certificate for all clients to be pushed through group policy to all client instead of making it PC by PC ?

ACS 4.2 Appliance integration with LDAP

Hi,
I would like to ask some question from the expert here.
1. I'm building 802.1x infra for my customer.
2. We are using ACS SE version 4.2
3. We have successfully integrate the ACS with AD using Remote Agent.
4. Using will authenticate using PEAP MS-CHAP v2.
5. However, my customer dont want to use Remote Agent (RA) because the want the ACS talk to the external database directly.
6. Their argument is, if they bought other Radius appliance for this project, the appliance should have the same function in order to authenticate the user.
7. What are needed to complete this requirement?
I saw in this table http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.2/user/guide/Overvw.html#wp857274 the LDAP does not support PEAP MS-Chap v2.
Can any expert give opinion on this issue?

Despite various efforts a few years back, LDAP vendors could not be persuaded to implement an MSCHAP interface - which is technically possible.
That said ACS also has its Windows External Authenticator that will do MSCHAP just fine to a Windows AD Server (via a different interface).
The old LEAP protocol was mschap inside EAP. EAP-FAST can also do mschap too.
The key is not use the LDAP authenticator in ACS. If you really must use it, you'll have to make sure you use EAP-GTC inside your PEAP/FAST tunnel

Third Party Application Integration with Oracle EBS Without any middleware

Hi,
Please give suggestions about the Third Party Application Integration with Oracle EBS
Without any middleware. Can we achieve this?
Thank you,
Muhammad Nasir
Edited by: User129 on Feb 4, 2013 3:45 AM

Muhammad,
You may get better response in Oracle EBS forum -
General EBS Discussion
Regards,
Anuj

Crystal Report Server 2008 integration with java application

Hi All,
Any of you having complete document about Crystal Report Server 2008 integration with java application....like source code and what are all the jar files needed? Or tell me that the implementation is same as Crystal Report Server XI R2?
Thanks

Have you looked at the BusinessObjects Enterprise XI 3.x Java Developer Guide?
[http://www.sdn.sap.com/irj/boc/sdklibrary]
Sincerely,
Ted Ueda

Automatic upload of roles from ECC to portal (UME with LDAP)

Hi experts,
This thread reopen the question asked on the following message : automatic upload of roles from BI to portal
However, it concerns this time "UME with LDAP".
Problematic :
SAP Library 04s tells us that is not yet possible to automate role replication (or role assigment replication) from ABAP Based back-end to Netweaver Portal. Only manual process for initial upload is possible.
Source = http://help.sap.com/saphelp_nw04s/helpdata/en/41/5e4d40ecf00272e10000000a155106/frameset.htm
Questions :
1 - Did anyone ever try to implement such an automatic tool ?
2 - What if I'm not able to write on the Active Directory ? I am still able, at least, to automate role assignment replication from ABAP Based back-end to Netweaver Portal (ie. UME with LDAP) ? Directly from SAP R/3 to EP through UME, without passing through Active Directory since the group field is not maintained in AD.
Many thanks for your inputs
Alexis MARTIN

Hello,
As I did not read the previous thread I don't know what exactly you are trying to achieve, but I can tell you about what we have done - as far as it is not too late yet.
We use the portal with integration to a BI system. In the ABAP stack we have lots of roles with menu items for hundreds of reports. We want the users to see these roles in the portal.
First we have used the role migration tool of the portal to upload these roles. There is a Java API for executing role uploads from code. You need to create a webservice in the java stack to call this api, and can call the webservice from ABAP.
However it is just a question of time and role size until this will not work at all. Standard role migration is more or less crap, stability is a problem. It also creates a lot of logs in the PCD and thus fills the database with trash. (After a few OSS messages there is now a program for deleting logs + you can turn of logging.) Also upload of larger roles takes up to an hour, and you alwasy have the problem that your portal roles are not up to date during the day.
When I got completely fed up, I have implemented an own navigation connector. When you log on to the portal it will connect to the ABAP stack via RFC, load the role, and generate the portal menu from it. It uses caching, but on every logon it checks whether the role has been updated in ABAP since the last time it was loaded. It is up to date, faster then PCD navigation, and you need absoluetely no periodical synching at all. I cant even understand why this is not offered by SAP per standard!
Drawback is that it will of course only work for the menu items, and only menu items with an "URL-type" are supported. I'm prettry sure however that it would be possible to implement a few other types as well.
Let me know if you are interested in the solution, I can give you a few additional details: oliverDOTsvisztATwienerbergerDOTcom
Oliver

ACS With ldap Unix

Hi, I'm in a project security information and I'm think integration ACS software with ldap hosts in Unix machine: Samba
it's works??
there is a version trial of the ACS ? any version 4.2, 5.1 etc..
thank

Try this
ACS 4.2
http://www.cisco.com/cgi-bin/Software/Tablebuild/doftp.pl?ftpfile=cisco/crypto/3DES/ciscosecure/acs/win/90-dayeval/eval-ACS-4.2.0.124-SW.zip&app=Tablebuild&status=showC2A%3E
ACS 4.1
http://www.cisco.com/cgi-bin/tablebuild.pl/acs-win-eval
ACS 5.1
https://supportforums.cisco.com/thread/2024417

About EP(on UNIX) UME integration with LDAP

Similar Messages

Maybe you are looking for