Connecting EP to an ABAP+Java datasource

Question

Hi,
I am a SAP newbie.
I have EP on a standalone Java (I implemented the EP using rapid installer), and right now, it is using the file dataSourceConfiguration_database_only.xml as its datasource configuration.  I want to change the datasource to an existing ABAP system.  However, this existing ABAP system has a ASJava-Addin (BW was installed on this ABAP).  If I want to use different users for each of the two Java systems, how should I deal with the communication, administrator, and guest users on both of the J2EE engines? (ie. Do I need to change the admin and guest usernames (ie. j2ee_admin) for the portal to avoid conflicting with that of the Java-Addin for the ABAP?  How do I change the j2ee adminstrator username btw?  And if I were to change it, do I need to change it in other places as well, such as in the connection factories of the default JMS provider?)
Thanks for all your help, this is quite urgent, and points will be awarded
Charles

Answer 1

Hi Charles,
<<1>>
We are having the same problem for other users(for normal uses),since some of the portal users are already existing in the ABAP System.When we try to login on to the portal server using one User ID which is already existing on both the ABAP System and Portal System then we will get "User authentication Failed" message.
The same error message is being displayed for those portal users which are included in the J2EE Administrators Group and are in the ABAP System.So i think, this exception may arise in your case also.In our landscape, unfortunately the Portal System is stand alone java(administrator) and backend system is stand alone ABAP  system.Just create another user and add this user in the Administrator group before doing this configuration.
<<2>>
While doing this configuration, it is mandatory to mention a system user and password for the communication between UME and the ABAP Stack.In the case of dual stack installation this user will be created automatically during the installation time.For dual stack installations this system user is SAPJSF by default with SAP_BC_JSF_COMMUNICATION_RO role.In your case this user will be there. But if the ABAP System is a stand alone system, then we will have to manually create the user and assign the role.(either SAP_BC_JSF_COMMUNICATION or SAP_BC_JSF_COMMUNICATION_RO).The naming convention for the user is SAPJSF__<SAPSID_of_AS_Java>.
The first role will give the read/write capability to the system user and the second role can only give read permission.When the AS Java starts, the UME checks the roles assigned to the system user and if it finds no roles or only the role SAP_BC_JSF_COMMUNICATION_RO, the UME switches to read-only access for users located in the ABAP system.
Just refer this link also
http://help.sap.com/saphelp_nw04s/helpdata/en/49/9dd53f779c4e21e10000000a15
50b0/content.htm
If you are changing the role for your system user in the ABAP system, then it is recommended to restart the J2EE server (UME).
If your system user has the read/write permission on UME, then u can create/modify/delete the users both from the Portal and ABAP stack.<b>But the modification to the particular Portal user(already there) will be going to Java Stack(UME - Portal server) and the modification to the ABAP user will be going to the ABAP Stack(Dual Stack Server.). But all the new users created from both the portal and ABAP(dual stack) sever will only be going to ABAP Stack(Dual Stack).Just keep this thing in your mind.</b>
<<In the SAP Library, they recommand the SAP_BC_JSF_COMMUNICATION_RO role, but didn't give reasons for it.
>>
If we assign the SAP_BC_JSF_COMMUNICATION role to the system user, then we can change the UME data from both the Java System and from the ABAP system.In that case conflicts can arise.Inorder to keep the data consistency it is recommended to assign this read only role to the system user. Even in the case of dual stack installations, by default for the system user(SAPJSF) only this read-only role is present.
<<
understand that if I use user mapping for SSO, I can delete either one of the identical users from the portal or the backend as I will be m
>>
The main thing you have to keep in your mind is, for SSO using logon-ticket, in normal case (without this configuration), the user names in both the systems (Portal and R/3) should be same.
For example , If the Portal User ID = testuser , then R/3 user name should be testuser.For one portal user, if there is no identical R/3  name , then SSO using logon ticket will not work. In this case you will have to use SSO using User ID/Password Mapping.In this case your portal user can only access those back end objects(like RFC) on which your mapped user has got authorization.I think this part is clear to you.
Then after this configuration(UME as ABAP Datasource), if the same userid is existing in both portal and ABAP system, you can see 2 identical users while doing a user search in portal .(one portal user and one abap user) ,provided u have logged on to portal using another user with User Admin. If you try to login on to portal using this ID, then you will get 'User Authentication Failed' error message,since the same user is both in portal and ABAP.So your this scenario wont make any sense.. Right?...
If the user ID is coming from the ABAP system, then in the portal you will have to enter the ABAP user name and password to login on to the portal.This time, this user will acts as the portal user and the back end user is already there. So SSO using logon-ticket would works here. Hope you got it!!!!!...
If you have very large number of portal users, then it is better to go for SSO using logon-ticket rather than SSO using User/Password, since you will have to do the User mapping for all the users.You will have to change the Mapping details in the portal once we change the ABAP user's password.This is a very bad approach.SSO using logon-ticket is a one time configuration. So this is the best option for you...
  I could also improve my knowledge on this after answering your question.I have also gone through so many help links to find out  best answers to your doubts..ha ha..
From the help,
<i>Existing users in the AS Java database remain in the database after you configure the AS ABAP as the data source. When you log on to the AS Java, the UME searches both data sources simultaneously. Before you configure UME to use the AS ABAP as the data source, make sure the AS ABAP user management does not include any users with the same logon ID as users in the AS Java database. <b>The UME refuses to authenticate any user with a nonunique logon ID</b>.</i>
http://help.sap.com/saphelp_nw04s/helpdata/en/9e/fdcf3d4f902d10e10000000a114084/content.htm
Regards,
Kishor Gopinathan