Connect EP UME to 2 ABAP

When our Basis install BI, they also install the EP. The UME is currently connected to BI. Can I connect the same UME to ECC?

No, but you could setup ABAP CUA between the two ABAP systems and point UME to the CUA central client.

Similar Messages

Connect J2ee UME to WAS ABAP and WAS ABAP to LDAP and Role sharing

Hi,
We have a requirement of using the same roles in ABAP and Portal, and also that Both can authenticate to LDAP server.
the first Question is, can we use the roles in R/3 connecting the Portal UME to the WAS ABAP for authentication?
the second Question is, if we connect J2EE UME to the WAS ABAP and the WAS ABAP to the LDAP then the Portal will be geting the user authentication from LDAP as well?
Thanx in Advanced!!
Gerardo J
Message was edited by: Gerardo Jiménez

Gerardo,
Kindly check blog
Portal UME data store and various options (Opinions needed!)
There are also presentations on that topic on sdn.
James

User mapping certificate in UME (J2EE) with ABAP system as Backend (SNC)

I hope someone can help me with the user mapping concept (X.509 V3 certificates) for both "worlds" (ABAP and JAVA Stack).
I know how to install and configure certificate based (X.509) login to SAP ABAP and SAP JAVA (J2EE) Stack (--> enable encryption for communication and Single Sign On).
Situation:
We have a ready installed and configured X.509 certificate authentication environment for the ABAP world (between SAP GUI and SAP Server System)
and the user mapping was configured in the ABAP System (SU01). As the users are using certificates, the passwords are deactivated on the ABAP System.
Now if you want to integrate a JAVA (J2EE) Sytem and you want to configure the UME to the ABAP System (as Backend), you have an administrative effort problem with the user mapping (X.509) in the UME configuration.
1.) It is possible to assign manually the user public key to every user --> But to much effort
2.) As the user does not have a password (deactivated in the ABAP system), the way to combine the automatic mapping with a user login does not work.
3.) In the distinguished name of the user certificate there is no information about the SAP username itself
--> you are not able to use any information of the DN to bind a user in the Login Module configuration.
Now my question:
Is it possible to use the sncname information from the ABAP System (still configured and available) for the UME configuration?
As i know, it is possible to write an own Login Module. Does anybody has a customized Login module for this issue?
At the end the best solution would be to enable the same user mapping mechanism on the JAVA world as on the ABAP world. --> Mapping the Distinguished Name to the SAP User

We have developed a login module which is working with Kerberos auth, not x.509 auth, but still solves a very similar problem to the problem you are describing. As you know, when SNC is used to logon to ABAP stack, the SNC name of the user is mapped onto a SAP user via entries in the USRACL table. Our mapping login module takes the authenticated user principal name from the shared state and uses this to lookup the entry in USRACL table on ABAP stack, and from this it will know which SAP user to use, and can update shared state with this info so that CreateTicketLoginModule will created an SSO2 ticekt for the mapped SAP user id.
This means that mapping of users externally authetnicated identity onto SAP user/client can be managed in one place, e.g in ABAP stack using USRACL table entires and su01 t-code etc.
I know it is not exactly what you wanted, since you are looking to use x.509 certifiates instead of Kerberos authentication, but I thought it was worth sharing so that you know the concept has already been implemeneted many times. Many of our customers use this login module when they have our product, for the same reasons that you have stated.
Thanks,
Tim

How to call UME API from ABAP?

Hello all,
I want to call the UME API using ABAP to change portal users from backend system.
Is this possible without JAVA development? How?
Thanks for your help,
Regards,
Guido Knapp

Hi,
Refer this link you wil get some idea
http://help.sap.com/saphelp_nw04/helpdata/en/e0/3820a37edeec45a91dd6e45fba15b8/frameset.htm
Regards,
Senthil K.

UME change from ABAP to other ABAP system

>Hi, 
 
I have a java-only system names QAJ which is mapped to our Solution Manager system for UME (please don't ask why!). 
 
I want to change UME to ABAP system QAS. 
 
So, I go to NWA -> Administration -> Identity Management . 
 
Under the ABAP system tab, I change necessary info such as servername, user SAPJSF, password and client to my QAS system. I then click on TEST connection which works well. I am asked to restart cluster to activate changes. 
 
So, I restart QAJ... and it fails to start. in file std_server.out 
 
Service com.sap.security.core.ume.service started. (32515 ms). 
Sep 1, 2009 9:21:55 AM ...xt.<init>(UserContextSpi, Properties) [SAPEngine_System_Thread[impl:5]_23] Fatal: Can not instantiate UserContext with given properties. 
service security ================= ERROR ================= 
Core service security failed. J2EE Engine cannot be started. 
com.sap.engine.services.security.exceptions.SecurityServiceException: Unexpected exception: 
 at com.sap.engine.services.security.SecurityServerFrame.start(SecurityServerFrame.java:194) 
 at com.sap.engine.core.service630.container.ServiceRunner.startApplicationServiceFrame(ServiceRunner.java:214) 
 at com.sap.engine.core.service630.container.ServiceRunner.run(ServiceRunner.java:144) 
 at com.sap.engine.frame.core.thread.Task.run(Task.java:64) 
 at com.sap.engine.core.thread.impl5.SingleThread.execute(SingleThread.java:83) 
 at com.sap.engine.core.thread.impl5.SingleThread.run(SingleThread.java:156) 
Caused by: com.sap.engine.services.security.exceptions.BaseSecurityException: No active userstore is set. 
 at com.sap.engine.services.security.server.UserStoreFactoryImpl.getActiveUserStore(UserStoreFactoryImpl.java:80) 
 at com.sap.engine.services.security.server.jaas.LoginModuleHelperImpl.update(LoginModuleHelperImpl.java:405) 
 at com.sap.engine.services.security.server.jaas.LoginModuleHelperImpl.<init>(LoginModuleHelperImpl.java:84) 
 at com.sap.engine.services.security.server.SecurityContextImpl.<init>(SecurityContextImpl.java:58) 
 at com.sap.engine.services.security.SecurityServerFrame.start(SecurityServerFrame.java:147) 
 ... 5 more 
 
 
com.sap.engine.services.security.exceptions.SecurityServiceException: Unexpected exception: 
 at com.sap.engine.services.security.SecurityServerFrame.start(SecurityServerFrame.java:194) 
 at com.sap.engine.core.service630.container.ServiceRunner.startApplicationServiceFrame(ServiceRunner.java:214) 
 at com.sap.engine.core.service630.container.ServiceRunner.run(ServiceRunner.java:144) 
 at com.sap.engine.frame.core.thread.Task.run(Task.java:64) 
 at com.sap.engine.core.thread.impl5.SingleThread.execute(SingleThread.java:83) 
 at com.sap.engine.core.thread.impl5.SingleThread.run(SingleThread.java:156) 
Caused by: com.sap.engine.services.security.exceptions.BaseSecurityException: No active userstore is set. 
 at com.sap.engine.services.security.server.UserStoreFactoryImpl.getActiveUserStore(UserStoreFactoryImpl.java:80) 
 at com.sap.engine.services.security.server.jaas.LoginModuleHelperImpl.update(LoginModuleHelperImpl.java:405) 
 at com.sap.engine.services.security.server.jaas.LoginModuleHelperImpl.<init>(LoginModuleHelperImpl.java:84) 
 at com.sap.engine.services.security.server.SecurityContextImpl.<init>(SecurityContextImpl.java:58) 
 at com.sap.engine.services.security.SecurityServerFrame.start(SecurityServerFrame.java:147) 
 ... 5 more 
 
[Framework -> criticalShutdown] Core service security failed. J2EE Engine cannot be started. 
Sep 1, 2009 9:21:55 AM com.sap.engine.core.Framework [SAPEngine_System_Thread[impl:5]_23] Fatal: Critical shutdown was invoked. Reason is: Core service security failed. J2EE Engine cannot be started. 
 
 
 
Ok, so something is wrong in my entries even if test connection works fine. 
 
Becasue JAVA stack does not start anymore, I need to go to configtool. Everything that I changed is active, I can see everything. Still, I do not know which parameters is causing all this. 
 
Anybody know where to go from here? 
 
Thanks! 

I found the problem.
in configtool, in parameter ume.login.guest_user.uniqueids, value was set to J2EE_GST_QAJ.
user J2EE_GST_QAJ did not exist in ABAP system QAS. I created it as a service user and gave it role SAP_J2EE_GUEST.
I also increased values for ume.r3.connection..master.poolmaxsize and ume.r3.connection..master.poolmaxwait
after Java stack restart, system works fine again.
thanks to everyone that took time to read my question. Hopefully, someone with the same problem will find a possible solution.

How to create user in UME when using ABAP as datasource

hi, everyone
We are using ABAP as EP user datasource, when create user in EP, it says "Current user has user creation permissions in the UME, but cannot create users in the back-end system (data source). The original and possibly untranslated message was: "No active writeable datasource found for user creation, check your Persistence Configuration."
But we can not create in UME neither, anyone know how to do this?
Lee

Hi,
Solution would be to disconnect the UME from ABAP and reboot the portal, create the user in UME, and revert back to the UME/ABAP connection again... but this is not supported:
Changing Data Source
Once you have chosen this data source configuration, you cannot change to any other data source configuration. For details, see SAP Note 718383.
Source: http://help.sap.com/saphelp_nw70ehp1/helpdata/en/45/af3ac012d32e78e10000000a155369/frameset.htm
Ask the autorisation team of the ABAP stack that is connected to you UME to create the user for you is the only solution.
Cheers,
Benjamin

RFC Connection Error during Web AS ABAP Database Instance

I keep getting RFC Connection error installing the database instance. The following are the pertinent logs:
INFO 2007-05-09 20:10:04
Working directory changed to C:\Program Files\sapinst_instdir\NW04\SYSTEM\ABAP\MSS\UC\DB.
INFO 2007-05-09 20:10:04
Output of C:\usr\sap\X22\SYS\exe\run\r3trans.exe -u 1 -i "C:\Program Files\sapinst_instdir\NW04\SYSTEM\ABAP\MSS\UC\DB\mssprocs640.dat" is written to the logfile r3trans.exe.log.
INFO 2007-05-09 20:10:22
Execution of the command "C:\usr\sap\X22\SYS\exe\run\r3trans.exe -u 1 -i "C:\Program Files\sapinst_instdir\NW04\SYSTEM\ABAP\MSS\UC\DB\mssprocs640.dat"" finished with return code 0. Output: This is C:\usr\sap\X22\SYS\exe\run\r3trans.exe version 6.13 (release 640 - 03.06.05 - 17:04:00).unicode enabled versionC:\usr\sap\X22\SYS\exe\run\r3trans.exe finished (0000).
INFO 2007-05-09 20:12:23
RFC parameter CLIENT set to value 000.
INFO 2007-05-09 20:12:23
RFC parameter USER set to value DDIC.
INFO 2007-05-09 20:12:23
RFC parameter LCHECK set to value 1.
INFO 2007-05-09 20:12:23
RFC parameter PCS set to value 1.
INFO 2007-05-09 20:12:23
RFC parameter LANG set to value EN.
INFO 2007-05-09 20:12:23
RFC parameter ASHOST set to value cix22.
INFO 2007-05-09 20:12:23
RFC parameter SYSNR set to value 00.
INFO 2007-05-09 20:12:23
RFC connection information checked successfully.
ERROR 2007-05-09 20:12:24
FRF-00007 Unable to open RFC connection.
I tried the following fixes spread across different threads in this Expert Forums:
1. Someone said network problem. I rebooted, restarted the install and even redo it.
2. Another suggestion was to use caps on the password. Didnt work.
3. One suggestion was to update the keydb.xml file. However, I could find such property name:
search for the table t_SAPComponent_SAPSystemLogon_SHARED
then look for <fld name="pPW">, <properties>,
<property name ="GUIENG_USER_INPUT" and set the value
"GUINEG_TRUE" to "GUIENG_FALSE".
4. I even used the ddic password 19920706 which is supposed to be the default.
5. Restarted the instance and applied all the fixes above.
Does anyone know what is going on base on the logs above? Thanks.

try moving all your install disk onto local file system then rerun the install. That might work....

DB Connection failed in Netweaver 2004s ABAP

When I try to start Netweaver 2004s ABAP, I am getting error message as "DB Connection failed". I have used the system for two days and executed transaction 'sgen'. Now the disp+work is getting started and stopped immediately. Please give me a solution to rectify the error.
with love and prayers,
siby syriac

Is there a way to set the new ABAP editor for BSP?
i assume that you mean the ABAP code in the event handlers in BSP.
i am using SAP GUI patch level 15 and for activating new ABAP editor from SE80 use the following menu path
utilities->ABAP editor-> editor
choose front-end editor (new) tadio button.
Regards
Raja

Database connection to SQL server using ABAP program

Hi all,
What do we need to enter in the con_env feild of dbcon table for connecting to the SQL databse
I have entered the following string dbname=SAP_DB user=sap password=sap host=145.17.60.87 port=1433
Is it correct ?
DATA: tbr(50) type c.
EXEC SQL.
CONNECT TO 'SQLDB'
ENDEXEC.
IF SY-SUBRC NE 0.
message s000(zf) with 'Imposible conectar a SQLDB'.
ENDIF.
EXEC SQL.
SET CONNECTION 'SQLDB'
ENDEXEC.
EXEC SQL PERFORMING LOOP_OUTPUT.
SELECT T_DES
INTO :tbr
FROM data_table
ENDEXEC.
FORM LOOP_OUTPUT.
write: / tbr.
ENDFORM.
where data_table is the database table name
also i think i will have to create a table in ABAP dictionary with the same structure as data_table but that table will start from 'Z'.
kindly help

Hi Sunil,
I am working on this same problem. What was the solution you used?
Thanks
Shane

UME to CUA(ABAP) user data replication for custim attribute.

Hi All,
We have planned that Users will be created in portal and from there user data will flow to CUA(ABAP) and from CUA it will flow to r3,BW,CRM ..etc .
I have configured the UME(portal) so that when ever I create user in Portal it flows to CUA (ABAP). In CUA when I assign a system (system name - the abap system in which CUA should transport the user data) to the user ,user data flows in respective system (R3) ie user gets created in that system (r3 or BW depending on the assigned system name) .
UME ---> CUA --- > r3 or bw or CRM etc
Now I want to automate the process .I want to assign the system name to the user in UME itself (not in CUA).I have created a custom attribute system in CUA .
Now problem is how to map UME custom attribute of system to CUA (ABAP) user attribute system . Also please let me know which XML file (data source) I should modify.
Regards,
Gyan

Hi Gyan,
We have installed NW'04 SP14 with both ABAP and JAVA stacks on this system. We are using datasourceConfiguration_abap.xml as our J2EE
UME setting. We have found that when we create any user in client 000 from CUA that user is then create in UME. We have three clients in this development system. When we create users from CUA from the other clients in this ABAP system the users do not come into the Java UME. We do not want to create the users in client 000. What is your Java UME setting and how can we get the users in the other clients push to UME.
Regards,
Anthony
Message was edited by: Anthony Bright

UME security vs ABAP security object level

We installed Virsa Compliance Calibrator & Access Enforcer and trying to configure security in UME to control user access so that besides action level security, we need further restriction on for example, Functional Area, cost center & department access. Does UME have lower level authorization restriction capabilities similar to that of ABAP authorization object level security? If not, how can we utilize ABAP Virsa security objects to control JAVA front end access?
Your advice is much appreciated.
Thanks,

I'm not aware of a way to limit requestor access (you can request anything visible); however, you can provide direction by populating an attribute field (i.e. company) with valid company values for each role. When a requestor searches for a role, if they filter by the appropriate company, they will only see valid roles for the request. I did, however, point the request authentification towards a 'fake LDAP'. This prevents individuals without specific UME credentials from submitting a request.
However, you can restrict approvers using a custom approver/determinator. In my case, I wanted to use a combination of "role" and "usergroup" to determine approver, rather than use one approver set for all requests. I have implemented and confirmed this works. The unfortunate side affect, is that you have to maintain a seperate file for this custom A/D (which you have to refer to /append for any request for role approver information).

SAP R/3 connection with XI using an ABAP Proxy

Have to develop an ABAP program which will communicate with XI using an ABAP Proxy.

Hi,
you can check these links for help,
To generate abap proxies.
/people/sravya.talanki2/blog/2006/07/28/smarter-approach-for-coding-abap-proxies
/people/bhanu.thirumala/blog/2006/02/07/abap-proxy--xml-to-abap-transformation
Smarter Approach for coding ABAP Proxies
/people/sravya.talanki2/blog/2006/07/28/smarter-approach-for-coding-abap-proxies
Regards,
Samson Rodrigues.

Portal UME in ABAP asking user mapping???

Hi all,
I've decided to configure portal UME beeing the ABAP UME in backend system. I Can create users in portal and SU01 and i can logon in both systems with the same user. Now i've a system to connect the MSS/ESS iviews and portal asks me for user credentials in R/3, why ? It is the same user !! Have I to configure anything more?
Thanks for replys,
Best Regards,
Pedro Rodrigues.

Hi Pedro,
To my knowledge ESS/MSS iViews are connecting ICM server on ABAP side and, thus, BSP iViews (at least, some of them). To avoid requests for user credentials from ICM server you need to configure SSo between your J2EE (where Portal is installed) and ABAP systems.
Here is the link that might be helpful for you:
http://help.sap.com/saphelp_erp2005/helpdata/en/89/6eb8e7af2f11d5993700508b6b8b11/frameset.htm
Also you can search in the SDN Weblogs for steps on how to configure SSO.
Regards,
Mike

LDAP UME for ABAP + JAVA SYSTEM

Hi,
I am using NW 7 SP 15 with both ABAP + JAVA stack. The UME is set to ABAP by default during installation.
Can we change that to LDAP datasource?
Under System Configuration -> UME Configuration -> Data Sources (TAB) -> in Data Source dropdown box -> there is only ONE option available "ABAP SYSTEM" and no other option is present.
Any suggestion?
Regards
Deb

Ups! Obviously a later change from ABAP to some other UME indeed is not supported by SAP. But this means not, that you cannot use LDAP or JAVA from the very beginning.
Did you not have the option to choose another UME data source for the Java Add-In during the installation process? (this may make sense, because the installation sequence for double stacks is always 1. ABAP stack 2. Java stack).
If not, then indeed LDAP as the primary UME data source is not supported for double stack installations.
If yes, you only have the chance to re-install your system.
In every case you can install 2 separate instances and connect them later. 1 ABAP instance with UME of course ABAP and 1 Java instance with UME LDAP or Java DB.
But before doing that and if I were you I would open a CSN at SMP and ask the software vendor ...
Regards,
Volker

Connecting EP to an ABAP+Java datasource

Hi,
I am a SAP newbie.
I have EP on a standalone Java (I implemented the EP using rapid installer), and right now, it is using the file dataSourceConfiguration_database_only.xml as its datasource configuration. I want to change the datasource to an existing ABAP system. However, this existing ABAP system has a ASJava-Addin (BW was installed on this ABAP). If I want to use different users for each of the two Java systems, how should I deal with the communication, administrator, and guest users on both of the J2EE engines? (ie. Do I need to change the admin and guest usernames (ie. j2ee_admin) for the portal to avoid conflicting with that of the Java-Addin for the ABAP? How do I change the j2ee adminstrator username btw? And if I were to change it, do I need to change it in other places as well, such as in the connection factories of the default JMS provider?)
Thanks for all your help, this is quite urgent, and points will be awarded
Charles

Hi Charles,
<<1>>
We are having the same problem for other users(for normal uses),since some of the portal users are already existing in the ABAP System.When we try to login on to the portal server using one User ID which is already existing on both the ABAP System and Portal System then we will get "User authentication Failed" message.
The same error message is being displayed for those portal users which are included in the J2EE Administrators Group and are in the ABAP System.So i think, this exception may arise in your case also.In our landscape, unfortunately the Portal System is stand alone java(administrator) and backend system is stand alone ABAP system.Just create another user and add this user in the Administrator group before doing this configuration.
<<2>>
While doing this configuration, it is mandatory to mention a system user and password for the communication between UME and the ABAP Stack.In the case of dual stack installation this user will be created automatically during the installation time.For dual stack installations this system user is SAPJSF by default with SAP_BC_JSF_COMMUNICATION_RO role.In your case this user will be there. But if the ABAP System is a stand alone system, then we will have to manually create the user and assign the role.(either SAP_BC_JSF_COMMUNICATION or SAP_BC_JSF_COMMUNICATION_RO).The naming convention for the user is SAPJSF__<SAPSID_of_AS_Java>.
The first role will give the read/write capability to the system user and the second role can only give read permission.When the AS Java starts, the UME checks the roles assigned to the system user and if it finds no roles or only the role SAP_BC_JSF_COMMUNICATION_RO, the UME switches to read-only access for users located in the ABAP system.
Just refer this link also
http://help.sap.com/saphelp_nw04s/helpdata/en/49/9dd53f779c4e21e10000000a15
50b0/content.htm
If you are changing the role for your system user in the ABAP system, then it is recommended to restart the J2EE server (UME).
If your system user has the read/write permission on UME, then u can create/modify/delete the users both from the Portal and ABAP stack.But the modification to the particular Portal user(already there) will be going to Java Stack(UME - Portal server) and the modification to the ABAP user will be going to the ABAP Stack(Dual Stack Server.). But all the new users created from both the portal and ABAP(dual stack) sever will only be going to ABAP Stack(Dual Stack).Just keep this thing in your mind.
<<In the SAP Library, they recommand the SAP_BC_JSF_COMMUNICATION_RO role, but didn't give reasons for it.
>>
If we assign the SAP_BC_JSF_COMMUNICATION role to the system user, then we can change the UME data from both the Java System and from the ABAP system.In that case conflicts can arise.Inorder to keep the data consistency it is recommended to assign this read only role to the system user. Even in the case of dual stack installations, by default for the system user(SAPJSF) only this read-only role is present.
<<
understand that if I use user mapping for SSO, I can delete either one of the identical users from the portal or the backend as I will be m
>>
The main thing you have to keep in your mind is, for SSO using logon-ticket, in normal case (without this configuration), the user names in both the systems (Portal and R/3) should be same.
For example , If the Portal User ID = testuser , then R/3 user name should be testuser.For one portal user, if there is no identical R/3 name , then SSO using logon ticket will not work. In this case you will have to use SSO using User ID/Password Mapping.In this case your portal user can only access those back end objects(like RFC) on which your mapped user has got authorization.I think this part is clear to you.
Then after this configuration(UME as ABAP Datasource), if the same userid is existing in both portal and ABAP system, you can see 2 identical users while doing a user search in portal .(one portal user and one abap user) ,provided u have logged on to portal using another user with User Admin. If you try to login on to portal using this ID, then you will get 'User Authentication Failed' error message,since the same user is both in portal and ABAP.So your this scenario wont make any sense.. Right?...
If the user ID is coming from the ABAP system, then in the portal you will have to enter the ABAP user name and password to login on to the portal.This time, this user will acts as the portal user and the back end user is already there. So SSO using logon-ticket would works here. Hope you got it!!!!!...
If you have very large number of portal users, then it is better to go for SSO using logon-ticket rather than SSO using User/Password, since you will have to do the User mapping for all the users.You will have to change the Mapping details in the portal once we change the ABAP user's password.This is a very bad approach.SSO using logon-ticket is a one time configuration. So this is the best option for you...
I could also improve my knowledge on this after answering your question.I have also gone through so many help links to find out best answers to your doubts..ha ha..
From the help,
Existing users in the AS Java database remain in the database after you configure the AS ABAP as the data source. When you log on to the AS Java, the UME searches both data sources simultaneously. Before you configure UME to use the AS ABAP as the data source, make sure the AS ABAP user management does not include any users with the same logon ID as users in the AS Java database. The UME refuses to authenticate any user with a nonunique logon ID.
http://help.sap.com/saphelp_nw04s/helpdata/en/9e/fdcf3d4f902d10e10000000a114084/content.htm
Regards,
Kishor Gopinathan

Connect EP UME to 2 ABAP

Similar Messages

Maybe you are looking for