Active Directory as readonly UME except of user's password

Question

Hi there,
we would like to configure the portal-datasource to connect to the active directory read-only. However, (LDAP) users must be able to change there passwords. How could the xml file look like.
We checked out http://help.sap.com/saphelp_nw70/helpdata/de/46/07a02c920f4f0fe10000000a114a6b/frameset.htm, but this doesn't work. Here the portal tries to create ldap users and fails as no mandatory fields are writeable.
Also we tried to dsitriubte the active directory in one writeable and one readable. However according to help.sap.com (http://help.sap.com/saphelp_nw70/helpdata/en/4e/4d0d40c04af72ee10000000a1550b0/frameset.htm) it is not possible to assign users from one source to groups of another.
Does anybody know a solution or a hint?
Thanks a lot and regards
Stephan

Answer 1

Hi Michael,
thanks for your help. We finally solved the issue using the "homefor"-approach:
<dataSources>
    <dataSource id="PRIVATE_DATASOURCE"
                className="com.sap.security.core.persistence.datasource.imp.DataBasePersistence"
                isReadonly="false"
                isPrimary="true">
        <homeFor>
            <principals>
                    <principal type="group"/>
                  <principal type="account">
                          <nameSpace name="$serviceUser$">
                              <attribute name="SERVICEUSER_ATTRIBUTE">
                                   <values>
                                        <value>IS_SERVICEUSER</value>
                                   </values>
                              </attribute>
                          </nameSpace>
                    </principal>
                    <principal type="user">
                         <nameSpace name="$serviceUser$">
                              <attribute name="SERVICEUSER_ATTRIBUTE">
                                   <values>
                                        <value>IS_SERVICEUSER</value>
                                    </values>
                              </attribute>
                         </nameSpace>
                    </principal>
                <principal type="team" />
                <principal type="ROOT" />
                <principal type="OOOO" />
            </principals>
        </homeFor>
        <notHomeFor/>
        <responsibleFor>
            <principals>
                 <principal type="group"/>
                 <principal type="user"/>
                 <principal type="account"/>
                <principal type="team"/>
                <principal type="ROOT" />
                <principal type="OOOO" />
            </principals>
        </responsibleFor>
        <notResponsibleFor/>
        <attributeMapping />
        <privateSection/>
    </dataSource>
    <dataSource id="CORP_LDAP"
         className="com.sap.security.core.persistence.datasource.imp.LDAPPersistence"
         isReadonly="false"
         isPrimary="true">
         <homeFor>
              <principal type="account"/>
              <principal type="user"/>
         </homeFor>
         <notHomeFor>
              <principal type="user">
                   <nameSpace name="$serviceUser$">
                        <attribute name="SERVICEUSER_ATTRIBUTE">
                             <values>
                                  <value>IS_SERVICEUSER</value>
                             </values>
                        </attribute>
                   </nameSpace>
              </principal>
              <principal type="account">
                   <nameSpace name="$serviceUser$">
                        <attribute name="SERVICEUSER_ATTRIBUTE">
                             <values>
                                  <value>IS_SERVICEUSER</value>
                             </values>
                        </attribute>
                   </nameSpace>
               </principal>
          </notHomeFor>
         <responsibleFor>
Thanks and regards
Stephan