Download MDM roles from repository

Hi,
How do I download roles from MDM repostories with their respective functions and tables and fields into an spread sheet.
Rakesh

Are you SQL savvy? Take a look at the database schema MDM creates (on Oracle/SQL Server - whatever you've used).
In the schema named "YourRepository_M000", look for the set of tables starting with A2i_CM_ROLE...
It's pretty easy to generate a simple report of Roles vs Users. You'll need get a a little more creative to get those to show role details (function/table/field), but the data is all right there.
Here's a start...
SELECT r.rolename, r.description "Role Description", u.username, u.fullname, u.description "User Description", u.useremails
FROM YourRepositoryName_M000.A2i_CM_ROLES r, YourRepositoryName_M000.A2i_CM_USERS u, YourRepositoryName_M000.A2i_CM_USER_ROLES ur
WHERE r.roleid = ur.roleid
AND u.userid = ur.userid
ORDER BY 1, 2

Similar Messages

Problem while loading security information (users/roles) from repository

Iview have stopped connecting to our MDM, All repositories, all IViews Very strange
Here is what I see in the logs.... Any ideas? Please if you have seen this before only
Marty
com.sap.mdm.extension.MetadataException: Problem while loading security information (users/roles) from repository 'PORTAL_CUSTOMERS'
at com.sap.mdm.extension.MetadataManager.loadRoleCache(MetadataManager.java:559)
at com.sap.mdm.extension.MetadataManager.internalGetRoleSet(MetadataManager.java:502)
at com.sap.mdm.extension.MetadataManager.getRoleSet(MetadataManager.java:471)
at com.sap.mdm.extension.MetadataManager.createMetadataKey(MetadataManager.java:464)
at com.sap.mdm.extension.MetadataManager.getRepositorySchema(MetadataManager.java:197)
at com.sap.mdm.uwl.MdmUwlConnector.createUserSessionContext(MdmUwlConnector.java:1463)
at com.sap.mdm.uwl.MdmUwlConnector.new_retrieveItems(MdmUwlConnector.java:546)
at com.sap.mdm.uwl.MdmUwlConnector.getItems(MdmUwlConnector.java:129)
Caused by: com.sap.mdm.commands.CommandException: com.sap.mdm.net.ConnectionException: java.io.IOException: Unexpected socket read. Result is -1.
at com.sap.mdm.security.commands.GetUserListCommand.execute(GetUserListCommand.java:72)
at com.sap.mdm.extension.MetadataManager.loadRoleCache(MetadataManager.java:526)
Caused by: com.sap.mdm.net.ConnectionException: java.io.IOException: Unexpected socket read. Result is -1.
at com.sap.mdm.internal.protocol.manual.AbstractProtocolCommand.execute(AbstractProtocolCommand.java:102)
at com.sap.mdm.security.commands.GetUserListCommand.execute(GetUserListCommand.java:69)
at com.sap.mdm.internal.net.DataSocket.receiveData(DataSocket.java:62)
at com.sap.mdm.internal.net.ConnectionImpl.readInt(ConnectionImpl.java:497)
at com.sap.mdm.internal.net.ConnectionImpl.readInt(ConnectionImpl.java:490)
at com.sap.mdm.internal.net.ConnectionImpl.nextMessage(ConnectionImpl.java:629)
at com.sap.mdm.internal.net.ConnectionImpl.receiveMessage(ConnectionImpl.java:572)
at com.sap.mdm.internal.net.ConnectionImpl.send(ConnectionImpl.java:233)
at com.sap.mdm.internal.protocol.manual.AbstractProtocolCommand.execute(AbstractProtocolCommand.java:99)
com.sap.mdm.commands.CommandException: com.sap.mdm.net.ConnectionException: java.net.SocketException: There is no process to read data written to a pipe.

Early this month we upgraded the MDM server to:
MDM Server version: 5.5.63.57
And the portal components:
MDM 5.5 SP06 Technology Patch 3 (Build 5.5.63.57)
MDM 5.5 SP06 Application Patch 3 (Build 5.5.63.57)
MDM 5.5 SP06 Java API Patch 3 (Build 5.5.63.57)
However the issue just began 2 days ago?
We started intgrating MDM Workflow with UWL and assigned Roles and Iviews to the Universal Worklist Configuration
It seems the Iviews work for a while and then after some time everything gives up? Very confounding
And yes we are using standard Iviews (search, Result and detail)
Thanks
Edited by: Marty Monroe on Oct 31, 2008 3:07 PM

How can download the roles from one system and upload them into another ??

Do anyone have the solution ..... ......it very important.

Hi,
Visit [Role Maintenance Functions|http://help.sap.com/saphelp_nw04/helpdata/en/e4/15e48efd6c11d296430000e82de14a/content.htm] in section Download/Upload.
To avoid inconsistencies, all roles from which a role is derived are also downloaded. When you download composite roles, all the roles which they contain are also downloaded.
When you upload a role, all role data, including authorization data is uploaded from a file into the SAP system. The user assignments for the role and the generated profiles for the role are exceptions in this case. You must therefore regenerate the authorization profiles after the upload.
Mass Download:
Save several roles on the PC.
You can choose on the selection screen whether you:
Also want to transport the single roles contained in the selected composite roles (Customizing switch ADD_COMPOSITE_ROLES in table SSM_CUST)
Also want to transport the generated profiles for all single roles (PROFILE_TRANSPORT in table PRGN_CUST)
You can define the default setting for both options using the value in the Customizing switch. If you explicitly set a switch to NO, the option in question on the selection screen is not active. Otherwise, it is active.
Regards,
Srilatha.

Download/Upload roles in PFCG

Hi,
We have a system where in 300 client, CUA is configured. I'm trying to import some roles from another client 800 to 300. In SCUA(300), 800 is not the child system. We require some roles exactly in 300 from 800. I downloaded a role from 800 and uploaded in 300 and generated the profile. But when I'm trying to assign an user to it prompts to save the role first. When clicked save it's prompts this role doen't exist. I tried to assign the role in SU01 too, it shows the same error. Is it not possible to downlaod and upload any role from another client to a client where CUA is configured?
Kindly suggest.
Regards,
Avinash

Hi Avinesh
Kindly check the field distributor parameters on your role in client 800?(before downloading) refer the SCN link point number 7
CUA Configuration steps
BR
SS

My Mac mini won't recognize photo library in itunes so I can download pics from library and free up space in memory, I was able to download camera role but not photo library that takes up more space.

My Mac mini won't recognize iphone 4 photo library in itunes so I can download pics from library and free up space in memory, I was able to download camera role but not photo library that takes up more space. Help thanks

The photo sync is one-way: Computer to phone. Photos synced to your phone will have to be extracted from your phone using third-party software, if you want them on your computer, as Apple makes no provision to do so. Since you're using a Mac, you can use this:
http://www.ecamm.com/mac/phoneview/

Downloading an undefined role from CPPM to Controller

Requirement:
In order to provide per-user level access, user roles can be created when a user has been successfully authenticated.During the configuration of a remote access policy, administrator can define a role that should be assigned to the user after successful authentication. If the Role is not defined in the Controller, Role can not be mapped to the User hence we need a solution where we can download a relevant Role from the server.
Solution:
In RADIUS authentication, when Server (CPPM) successfully authenticates a user, the user is assigned a role ( role name) by the Server (CPPM) and if the role is not defined on the controller, the role attributes can also be automatically downloaded from CPPM.
This feature supports roles obtained by the following authentication methods:
802.1x (wireless and wired users)
MAC authentication
Captive Portal
CPPM does not perform any error checking to confirm accuracy of the role definition (policy mapped to the Role). Controller will validate the Policy before downloading.
Configuration:
How to enable :
1. Navigate to the Configuration > Security > Authentication > AAA Profiles.
2. Select an AAA profile.
3. Check the Download Role from CPPM check box to enable role download.
Providing CPPM credentials:
It is mandatory ( From CPPM 6.4 ) to specify CPPM credentials for downloading the Role
Configuring CPPM :
A Role can be defined and mapped trough an Enforcement profile as shown bellow.
We should select “ Aruba Downloadable Role Enforcement” from Template dropdown list.
Add Aruba controller IP in the Device list ( First create a group, Ex “My_Devices” and add the IP address to that group)
Defining and mapping the Policy to the Role :
Define a policy ( ACL) by selecting type of ACL (Stateless ACL/Session ACL/Ethertype)
Add the policy to the Role ( Ex Test_policy)
Add the VLAN and CP profile as per the requirement.
Summary of Enforcement Profile :
Define and Enforcement Policy :
A policy/ Rules required to pickup this Enforcement profile,
Create a new enforcement policy and define a condition for picking the Profile
Defining a Service :
Finally we have to define a Service to handle this Authentication
Define a service by selecting an appropriate template ( Ex Aruba 802.1x Wireless/ Aruba 802.1x Wired/Aruba Guest etc..)
Select desired type of Auth types ( EAP-PEAP, MSCHAP V2 etc..)
Select the Enforcement profile
Verification
Testing :
On successful Authentication, CPPM will push the Role along with the policy to the Controller as shown below.
Role is being downloaded to the Controller :
Role is downloaded and a policy is created :

Requirement:
In order to provide per-user level access, user roles can be created when a user has been successfully authenticated.During the configuration of a remote access policy, administrator can define a role that should be assigned to the user after successful authentication. If the Role is not defined in the Controller, Role can not be mapped to the User hence we need a solution where we can download a relevant Role from the server.
Solution:
In RADIUS authentication, when Server (CPPM) successfully authenticates a user, the user is assigned a role ( role name) by the Server (CPPM) and if the role is not defined on the controller, the role attributes can also be automatically downloaded from CPPM.
This feature supports roles obtained by the following authentication methods:
802.1x (wireless and wired users)
MAC authentication
Captive Portal
CPPM does not perform any error checking to confirm accuracy of the role definition (policy mapped to the Role). Controller will validate the Policy before downloading.
Configuration:
How to enable :
1. Navigate to the Configuration > Security > Authentication > AAA Profiles.
2. Select an AAA profile.
3. Check the Download Role from CPPM check box to enable role download.
Providing CPPM credentials:
It is mandatory ( From CPPM 6.4 ) to specify CPPM credentials for downloading the Role
Configuring CPPM :
A Role can be defined and mapped trough an Enforcement profile as shown bellow.
We should select “ Aruba Downloadable Role Enforcement” from Template dropdown list.
Add Aruba controller IP in the Device list ( First create a group, Ex “My_Devices” and add the IP address to that group)
Defining and mapping the Policy to the Role :
Define a policy ( ACL) by selecting type of ACL (Stateless ACL/Session ACL/Ethertype)
Add the policy to the Role ( Ex Test_policy)
Add the VLAN and CP profile as per the requirement.
Summary of Enforcement Profile :
Define and Enforcement Policy :
A policy/ Rules required to pickup this Enforcement profile,
Create a new enforcement policy and define a condition for picking the Profile
Defining a Service :
Finally we have to define a Service to handle this Authentication
Define a service by selecting an appropriate template ( Ex Aruba 802.1x Wireless/ Aruba 802.1x Wired/Aruba Guest etc..)
Select desired type of Auth types ( EAP-PEAP, MSCHAP V2 etc..)
Select the Enforcement profile
Verification
Testing :
On successful Authentication, CPPM will push the Role along with the policy to the Controller as shown below.
Role is being downloaded to the Controller :
Role is downloaded and a policy is created :

Link to download SCA file from service market place for MDM adapter

Hello All,
Can anybody give me the link to download the SCA file for MDM adapter from service market place.
Regards,
Loveena

https://websmp108.sap-ag.de/swdc -> search for all categories
use the search term MDM adapter and you will find the required Hits ...

Error in starting MDM Server from MDM Console

Hi,
I have installed SAP MDM 5.5 SP05 on Windows 2003 Server.
When i try to start the MDM Server (i.e. MDM Service) from the MDM console it gives me the following error:
<i>Error Starting apmdmd(MDM Server): The machine 'apmdmd' is not Windows-based. The MDM server cannot be started from this application; please use CLIX on the machine instead. </i>
But if i start the MDM Service manually and then mount the server, it works fine.
Kindly help.
Regards,
Chintan Sheth

It sounds to me like a problem potentially with either the permissions of the Windows user or perhaps a software firewall. The Console uses a low-level Windows API function to determine if the target machine on which MDS is installed is Windows-based. This function may be blocked by some OS or firewall-level setting. This may be the case even if you are able to use the same client machine to connect to the target machine via the Service Control Manager and start MDS from there.
I would like to help with this problem, but I need to know a few more things:
When the problem occurs, is the Console running on the same Windows machine as MDS?
You mentioned Windows 2003 Server... when you run the Console on this machine, are you logged in as an Administrator of the machine? And do you still get the error when you attempt to start MDS from within the Console?
Once MDS is started, and you mount it within the Console, are you having any other problems, such as logging in to a repository, or viewing logs?
Is there a firewall installed on the machine or machines that the software is installed on? We may have to review the settings of the firewall, or try temporarily disabling it (on both ends, or at least on the machine running MDS), to see if the problem goes away -- then we'll know the problem is with the firewall settings.
CLIX is a fine workaround if you can use it, but clearly this problem needs to be rectified.
-cleo

Software Updates ADR Issue: "Failed to download the update from the internet. Error = 5"

"Failed to download the update from internet. Error = 5"
The above is the error I am getting when running any ADR. The error is quite clear software updates are failing to download and Error = 5 being a permissions error its clear that the downloads are failing due to incorrect permissions applied to the download
path.
Here is the last bit of my ruleengine.log, everything above is the same except for the update trying to be downloaded of course:
Failed to download the update from internet. Error = 5
SMS_RULE_ENGINE 6/26/2014 9:21:59 AM
5148 (0x141C)
Failed to download ContentID 16860969 for UpdateID 16857152. Error code = 5
SMS_RULE_ENGINE 6/26/2014 9:21:59 AM
5148 (0x141C)
Downloading contents (count = 1) for UpdateID 16857255
SMS_RULE_ENGINE 6/26/2014 9:21:59 AM
5148 (0x141C)
List of update content(s) which match the content rule criteria = {16861141}
SMS_RULE_ENGINE 6/26/2014 9:21:59 AM
5148 (0x141C)
Downloading content with ID 16861141 in the package
SMS_RULE_ENGINE 6/26/2014 9:21:59 AM
5148 (0x141C)
Failed to download the update from internet. Error = 5
SMS_RULE_ENGINE 6/26/2014 9:22:00 AM
5148 (0x141C)
Failed to download ContentID 16861141 for UpdateID 16857255. Error code = 5
SMS_RULE_ENGINE 6/26/2014 9:22:00 AM
5148 (0x141C)
Failed to download any update SMS_RULE_ENGINE
6/26/2014 9:22:00 AM 5148 (0x141C)
Failed to download update contents. SMS_RULE_ENGINE
6/26/2014 9:22:00 AM 5148 (0x141C)
No new update was added to the package. Package "SCP0008A" would not be updated.
SMS_RULE_ENGINE 6/26/2014 9:22:00 AM
5148 (0x141C)
Failed to run the DownloadAction for the AutoDeployment.
SMS_RULE_ENGINE 6/26/2014 9:22:00 AM
5148 (0x141C)
STATMSG: ID=8706 SEV=E LEV=M SOURCE="SMS Server" COMP="SMS_RULE_ENGINE" SYS=SCCM-MPS.DSCICORP.COM SITE=SCP PID=2376 TID=5148 GMTDATE=Thu Jun 26 13:22:00.164 2014 ISTR0="SMS Rule Engine" ISTR1="Failed to download one or more
content files" ISTR2="" ISTR3="" ISTR4="" ISTR5="" ISTR6="" ISTR7="" ISTR8="" ISTR9="" NUMATTRS=0
SMS_RULE_ENGINE 6/26/2014 9:22:00 AM
5148 (0x141C)
Enforcing Create Deployment Action SMS_RULE_ENGINE
6/26/2014 9:22:00 AM 5148 (0x141C)
Create Deployment Rule Action XML is: <DeploymentCreationActionXML xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><CollectionId>SCP00055</CollectionId><IncludeSub>true</IncludeSub><Utc>false</Utc><Duration>0</Duration><DurationUnits>Hours</DurationUnits><AvailableDeltaDuration>0</AvailableDeltaDuration><AvailableDeltaDurationUnits>Hours</AvailableDeltaDurationUnits><SuppressServers>Checked</SuppressServers><SuppressWorkstations>Unchecked</SuppressWorkstations><PersistOnWriteFilterDevices>Unchecked</PersistOnWriteFilterDevices><AllowRestart>true</AllowRestart><DisableMomAlert>false</DisableMomAlert><GenerateMomAlert>false</GenerateMomAlert><UseRemoteDP>true</UseRemoteDP><UseUnprotectedDP>true</UseUnprotectedDP><UseBranchCache>true</UseBranchCache><EnableDeployment>true</EnableDeployment><EnableWakeOnLan>true</EnableWakeOnLan><AllowDownloadOutSW>false</AllowDownloadOutSW><AllowInstallOutSW>true</AllowInstallOutSW><EnableAlert>true</EnableAlert><AlertThresholdPercentage>90</AlertThresholdPercentage><AlertDuration>7</AlertDuration><AlertDurationUnits>Days</AlertDurationUnits><EnableNAPEnforcement>false</EnableNAPEnforcement><UserNotificationOption>DisplaySoftwareCenterOnly</UserNotificationOption><LimitStateMessageVerbosity>false</LimitStateMessageVerbosity><StateMessageVerbosity>10</StateMessageVerbosity><AllowWUMU>true</AllowWUMU><AllowUseMeteredNetwork>true</AllowUseMeteredNetwork></DeploymentCreationActionXML>
SMS_RULE_ENGINE 6/26/2014 9:22:00 AM
5148 (0x141C)
Rule XML is: <AutoDeploymentRule xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><DeploymentName>Test ADR</DeploymentName><DeploymentDescription>Test ADR</DeploymentDescription><LocaleId>1033</LocaleId><UseSameDeployment>false</UseSameDeployment><EnableAfterCreate>true</EnableAfterCreate><NoEULAUpdates>false</NoEULAUpdates><AlignWithSyncSchedule>false</AlignWithSyncSchedule><ScopeIDs><ScopeID>SMS00UNA</ScopeID></ScopeIDs></AutoDeploymentRule>
SMS_RULE_ENGINE 6/26/2014 9:22:00 AM
5148 (0x141C)
Criteria Filter Result XML is: <AutoDeploymentRule xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"><DeploymentName>Test ADR</DeploymentName><DeploymentDescription>Test
ADR</DeploymentDescription><LocaleId>1033</LocaleId><UseSameDeployment>false</UseSameDeployment><EnableAfterCreate>true</EnableAfterCreate><NoEULAUpdates>false</NoEULAUpdates><AlignWithSyncSchedule>false</AlignWithSyncSchedule><ScopeIDs><ScopeID>SMS00UNA</ScopeID></ScopeIDs></AutoDeploymentRule>
SMS_RULE_ENGINE 6/26/2014 9:22:00 AM
5148 (0x141C)
Parsing Deployment Action XML...
SMS_RULE_ENGINE 6/26/2014 9:22:00 AM
5148 (0x141C)
Parsing Rule XML... SMS_RULE_ENGINE
6/26/2014 9:22:00 AM 5148 (0x141C)
Could not find element DeploymentId SMS_RULE_ENGINE
6/26/2014 9:22:00 AM 5148 (0x141C)
Could not find element UpdateGroupId SMS_RULE_ENGINE
6/26/2014 9:22:00 AM 5148 (0x141C)
Could not find element UpdateGroupName SMS_RULE_ENGINE
6/26/2014 9:22:00 AM 5148 (0x141C)
SQL is: select cis.CI_ID from vCI_ConfigurationItems cis join vProvisionedCIs pci on cis.CI_ID = pci.CI_ID where cis.CI_ID in (16793068, 16793070, 16793441, 16793445, 16793531, 16793686, 16793688, 16794597, 16794600, 16794602, 16794604, 16795443,
16795445, 16795709, 16795711, 16796210, 16796222, 16796292, 16796298, 16799495, 16799503, 16799602, 16799700, 16799703, 16799705, 16799712, 16799718, 16800300, 16800302, 16800367, 16800369, 16800371, 16800375, 16801224, 16801227, 16801237, 16801239, 16801287,
16801289, 16801559, 16801566, 16801996, 16802034, 16802839, 16802841, 16803306, 16803310, 16803420, 16803422, 16806477, 16806479, 16809354, 16809360, 16809393, 16809397, 16809774, 16809786, 16809792, 16813338, 16813348, 16813636, 16813638, 16814948, 16814950,
16815151, 16815153, 16817088, 16817102, 16817108, 16817398, 16817400, 16818677, 16818691, 16825397, 16840448, 16840458, 16840460, 16840462, 16840690, 16840700, 16840702, 16840710, 16840824, 16840826, 16842640, 16842641, 16842802, 16842803, 16842841, 16842870,
16842871, 16842896, 16842917, 16843017, 16843042, 16843049, 16843051, 16845981, 16846404, 16846751, 16846757, 16848017, 16848021, 16848664, 16848687, 16849383, 16849385, 16852506, 16852514, 16852516, 16855484, 16857102, 16857151, 16857152, 16857255) order
by cis.CI_ID SMS_RULE_ENGINE
6/26/2014 9:22:00 AM 5148 (0x141C)
0 of 115 updates are downloaded and will be added to the Deployment.
SMS_RULE_ENGINE 6/26/2014 9:22:00 AM
5148 (0x141C)
The rule resulted in no updates being found. Skip deployment creation or update...
SMS_RULE_ENGINE 6/26/2014 9:22:00 AM
5148 (0x141C)
CRuleHandler: Enforcing Actions for Rule 16777228 failed!
SMS_RULE_ENGINE 6/26/2014 9:22:00 AM
5148 (0x141C)
CRuleHandler: ResetRulesAndCleanUp() SMS_RULE_ENGINE
6/26/2014 9:22:00 AM 5148 (0x141C)
Updated Failure Information for Rule: 16777228
SMS_RULE_ENGINE 6/26/2014 9:22:00 AM
5148 (0x141C)
CRuleHandler: Deleting Rule 16777228 SMS_RULE_ENGINE
6/26/2014 9:22:00 AM 5148 (0x141C)
Found notification file C:\Program Files\Microsoft Configuration Manager\inboxes\RuleEngine.box\16777228.RUL
SMS_RULE_ENGINE 6/26/2014 9:22:10 AM
5148 (0x141C)
RuleSchedulerThred: Change in Rules Object Signalled.
SMS_RULE_ENGINE 6/26/2014 9:22:10 AM
5228 (0x146C)
Refreshed ScheduleList instance for Rule (16777228) from schedule string () with next occurence (12/31/1969 7:00:00 PM)
SMS_RULE_ENGINE 6/26/2014 9:22:10 AM
5228 (0x146C)
FindNextEventTime found next event for RuleID 0 as :1/1/2038 12:00:00 AM
SMS_RULE_ENGINE 6/26/2014 9:22:10 AM
5228 (0x146C)
RuleEngine: Got next rule execution time successfully. Next event is in 12369097 minutes
SMS_RULE_ENGINE 6/26/2014 9:22:10 AM
5228 (0x146C)
Sleeping for 15 minutes SMS_RULE_ENGINE
6/26/2014 9:22:10 AM 5228 (0x146C)
Also, I do not have a patchdownloader.log anywhere, Ive checked all aforementioned locations from various sources and it just simply does not exist on my SCCM server. Here is my setup:
Server1: Primary server with all roles installed locally except the site database is on its own server. WSUS is installed locally here and DB is stored here.
Server2: SQL DB for Primary site DB
Server3: Secondary remote site running MP, DP, SUP. DB is SQL Express local.
So the SUP role was installed successfully on both server1 first and server 2 second with the site servers accounts. The SUP Synchronizes successfully and I can see a large list of updates available for use but not downloaded of course. I have set WSUS option
to store updates locally and have plenty of space at the target destination.
So here is my issue, I have been working on this issue for the better part of a week and understand the error code from the ruleengine.log to be a permissions issue. I have also proved this out but creating a test ADR with minimal updates and applied NTFS perms
to the target path for Modify with the everyone group (testing purposes only). The updates downloaded successfully. So this puts me right back to where I was, knowing its a permissions issue but not understanding what permissions are needed. Let me explain
further.
The best way to start is to show what perms I have to the target location for downloads/wsus/sup anything:
Path: \\Server1\UpdatesAndDefinitions (permissions being applied to the UpdatesAndDefinitions root folder)
SCCMAdmin (account used for most SCCM tasks except for NA) / Modify / Share and NTFS
Server1$ (primary site server) / Modify / NTFS
Everyone / read and execute / NTFS and Share
There are other system generated perms but the above three are the important ones. So hence my confusion I know that the SCCMAdmin account or the Server its self has to be accessing the target directory so why is it failing with a permissions issue?
My next step was to enable Auditing on the target path. Doing so revealed just what I thought and through me into further frustration:
A network share object was accessed.
Subject:
Security ID:
SYSTEM
Account Name:
SCCM-MPS$
Account Domain:
DSCI
Logon ID:
0x3e7
Network Information:
Source Address:
fe80::306a:8827:8672:3ba5
Source Port:
50329
Share Name: \\*\UpdatesAndDefinitions
A handle to an object was requested.
Subject:
Security ID:
DSCI\sccmadmin
Account Name:
sccmadmin
Account Domain:
DSCI
Logon ID:
0xad903c
Object:
Object Server:
Security
Object Type:
File
Object Name:
F:\UpdatesAndDefinitions
Handle ID:
0xf5c
Process Information:
Process ID:
0x10cc
Process Name:
C:\Windows\explorer.exe
Access Request Information:
Transaction ID:
{00000000-0000-0000-0000-000000000000}
Accesses:
READ_CONTROL
ReadAttributes
Access Mask:
0x20080
Privileges Used for Access Check:
Restricted SID Count:
0
Now I may not be the best I traversing through the mess of audit entry's and translating them, but from what I can see the two accounts that have the proper share and ntsf perms ive listed above are indeed the ones accessing the target location and the audit
code is success. I filter for failures and found no audits for failures whatsoever yet my downloads still fail religiously, unless of course I open myself up with the everyone group.
So next... I tried adding in the Network Service account with proper permissions, the Local Service Account, my user account, and all no go's.
Next... I remove the SUP roles from SCCM checked the logs for deinstall confirmations, and reinstalled these roles. No Go!
If anyone can assist I would be in your debt and very grateful.
Oh last note, but very important note I'm running SCCM 2012 SP1 CU4
Thanks,
Michael
MichaelSpaulding

I just tested with the everyone group further; I added everyone with modify for ntfs and just read only for share and downloads failed!
I then changed the share perms for everyone to change and the ntfs to read/execute and poof downloads complete! Obviously change share perms for everyone leaves me open which Id like to prevent, so finding what account is being used is crucial.
I have already tried adding all of the SCCM accounts I use and the servers themselves as change perms to share and ntfs and have not had any luck.
MichaelSpaulding

Error while uploading roles from quality to production

Dear friends,
I have to upload roles from quality to production.
I have downloaded it from qualtiy but while uploading to production it is giving me an error "File does not contain valid data".
Can anybody tell me what could be the problem and how to resolve it.
Thanks in advance
regards
Nirgun

HI matore,
the best way is to transport the roles from DEV to QA and then to production as julius suggested
are you trying for mass down load are single role
Mass download
go to PFCG >> utilities>> Mass download>> select all the roles which you want to move it to production
and execute save it on desktop
now go to production system>> go to PFCG>>in menu click on roles>>click on upload>>select the file which is saved in desktop and click ok
mass generation of roles
in the menu click on utilities>>mass generation>>give the role names with you have uploaded and click on execute select all click on genetate button
download a single role
go to PFCG>>in the menu click on role>>click on down load and save it on desktop
now go to production system>> go to PFCG>>in menu click on roles>>click on upload>>select the file and click ok
now you needs to manully generate the role
do the user comparison
hope this helps
thanks
kishore

System Error While Deleting Software Component from Repository

Hi,
I have deleted datatypes,Interface types,Message types,Interface Mapping & Message Mapping also.
When im deleting Software Component from Repository,
I m getting the following System Error.
[-9402]:System Error:AK Unexpected Strategy information.
and im not able to delete.
Plz Suggest me.
Sree Ram.

hi stree ram...
u can get tth note directly form SAP service or go to transaction 'snote'....
and ther u can import it from the menu bar thers a option of download/upload....just put in the note no.
regards...
vishal
P.S : assign pts if answer found helpful

Integrate GRC 10.1 with CUA and how to import roles from CUA & Child systems into GRC for provisioning

Hello,
I am trying to integrate CUA into our GRC 10.1 system through the below steps and so far I have completed the below steps following SAP Notes 1680108 and 1616121:
1. Connected CUABOX to GRCBOX like a plug-in system.
2. Updated CUA Global System and CUA Model Distribution in Maintain CUA settings under User Provisioning.
3. Next I am trying to import the roles from CUA(CUABOX) into GRC(GRCBOX) to be able to provision roles in CUA Child Systems(ECCBOX).
After reading few discussions in SCN, I have figured that we have to download a template in Role Import and populate it accordingly to upload the CUA child system roles into GRC system for provisioning in CUA Child Systems.
Unfortunately, this template has multiple fields and I am unable to determine the fields that should be populated as CUA Global System and CUA Child System to import into GRC. Also, when we upload CUA Child System Roles template what selections should be made in Role Import window.
Any help in this regard is very helpful.
Thank you,
Pawan

Hi Alessandro,
I have "Create user if does not exist" setting checked for both change action and assign role action and also have CUA enabled. Here is the list of steps that I am performing:
1. Create an access request for new account, T-CUA_CHILD and select a role from a child system ECC Z_ECC_ROLE_IN_CHILD_SYSTEM.
2. Approvals provided to assign the ECC role.
3. I see the following in GRFNMW_DBGMONITOR_WD.
           Auto provisioning activity at end of request at Path GRAC_DEFAULT_PATH and Stage              GRAC_SECURITY
               New User:T-CUA_CHILD created in System(s): ECC (created without role assignments)
               T-CUA_CHILD User does not exist in target system CUA
GRC created an account without role assignment in ECC but also throwed me an error that the user does not exist in CUA.
However, if I select roles from both CUA and ECC it creates the account in both systems with the selected role assignments.
So I am wondering if there is way to provide CUA access to users by default for new account requests types. I have tried setting up default roles for CUA but it does not assign the roles by default until I select the CUA system.
Thank you for your help!
Pawan

Running 5.5 U2e and VUM will no longer download software packages from patch source?

We had a vSphere 5.5 cluster configured for us by a 3rd-party through Dell as part of our purchase agreement. We are running vCenter Server 5.5 U2e on Windows 2012 R2 as a physical host. It does run Update Manager. In my most recent check today, Update Manager will scan a host and report patches that are needed. In this case we're at 5.5.0 Build 2456374 on our ESXi hosts. Update Manager detects 5 missing patches. After I put the host in maintenance mode, I remediate, select the patch group, and proceed through the screens. It starts its process and goes from 0% to 16% to 25% then sits there for about 1–3 minutes, then goes to 90%, 91%, and errors out saying:
"Cannot download software packages from patch source. Check the events and the Update Manager log for download details."
Multiple strange things:
This server was updating just fine a few months back when some previous patches were released.
It can see the internet just fine. No firewall issues.
Our failover site on the same network, but in a different location in the city is able to update just fine. Same hardware, network, and software versions.
Any ideas on where to look or what to try? I had gone ahead and update from vCenter Server 5.5 U2b to U2e (along with a VUM reinstall) hoping that would fix it, but it did not. Any help would be greatly appreciated, because we're not VMware experts and thought everything was set up correctly by the vendor. We were given a small amount of knowledge transfer, but nothing that would allow us to troubleshoot this.
The Update Manager config listed in vCenter Server points to just three sources, that look to be the default from hostupdate.vmware.com and vapp-updates.vmware.com. None of the settings have been changed from the initial install and configuration that were working at one point in the last few months (when I last patched the hosts to 2456374).
Looking through the vmware-vum-server-log4cpp.log I see these failures:
[2015-05-06 16:17:33:039 'JobDispatcher' 6068 DEBUG] [JobDispatcher, 405] The number of tasks: 11
[2015-05-06 16:17:38:642 'DownloadMgr' 2448 DEBUG] [downloadMgr, 545] Url: https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/esx/vmw/vib20/esx-base/VMware_bootbank_esx-base_5.5.0-2.62.2702864.vib, Download destination: C:/ProgramData/VMware/VMware Update Manager/Data/hostupdate/vmw/vib20/esx-base/VMware_bootbank_esx-base_5.5.0-2.62.2702864.vib
[2015-05-06 16:17:38:642 'DownloadMgr' 2448 DEBUG] [downloadMgr, 396] Inserted download job {45798736} to queue
[2015-05-06 16:17:38:642 'DownloadMgr' 2448 DEBUG] [downloadMgr, 416] Current download count: 0
[2015-05-06 16:17:38:642 'DownloadMgr' 2448 DEBUG] [downloadMgr, 432] Current download count: 1
[2015-05-06 16:17:38:642 'DownloadMgr' 2448 DEBUG] [downloadMgr, 438] Adding download job {45798736} to scheduler
[2015-05-06 16:17:38:642 'DownloadMgr' 2448 DEBUG] [downloadMgr, 458] Waiting for download job {45798736} to finish...
[2015-05-06 16:17:38:643 'DownloadMgr' 6364 INFO] [downloadMgr, 593] Executing download job {45798736}, url=https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/esx/vmw/vib20/esx-base/VMware_bootbank_esx-base_5.5.0-2.62.2702864.vib
[2015-05-06 16:17:38:644 'httpDownload' 6364 INFO] [httpDownload, 556] Downloading https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/esx/vmw/vib20/esx-base/VMware_bootbank_esx-base_5.5.0-2.62.2702864.vib
[2015-05-06 16:17:39:501 'httpDownload' 6364 INFO] [httpDownload, 791] Status code: 404
[2015-05-06 16:17:39:501 'httpDownload' 6364 ERROR] [httpDownload, 827] Error retrieving document 'https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/esx/vmw/vib20/esx-base/VMware_bootbank_esx-base_5.5.0-2.62.2702864.vib'. Status code: 404
[2015-05-06 16:17:39:502 'httpDownload' 6364 WARN] [httpDownload, 420] Download https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/esx/vmw/vib20/esx-base/VMware_bootbank_esx-base_5.5.0-2.62.2702864.vib failed: Error retrieving document 'https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/esx/vmw/vib20/esx-base/VMware_bootbank_esx-base_5.5.0-2.62.2702864.vib'. Status code: 404
[2015-05-06 16:17:39:502 'httpDownload' 6364 ERROR] [httpDownload, 435] Reached retry download limit
[2015-05-06 16:17:39:503 'DownloadMgr' 6364 ERROR] [downloadMgr, 618] Executing download job {45798736} throws error: Reached retry download limit
[2015-05-06 16:17:39:503 'DownloadMgr' 6364 ERROR] [downloadMgr, 705] Download failed for url: https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/esx/vmw/vib20/esx-base/VMware_bootbank_esx-base_5.5.0-2.62.2702864.vib
[2015-05-06 16:17:39:503 'DownloadMgr' 6364 INFO] [downloadMgr, 567] Download job {45798736} finished, bytes downloaded = 0
[2015-05-06 16:17:39:503 'DownloadMgr' 2448 DEBUG] [downloadMgr, 464] Download job {45798736} finished
[2015-05-06 16:17:39:503 'DownloadMgr' 2448 DEBUG] [downloadMgr, 477] Removing download job {45798736} in queue
[2015-05-06 16:17:39:503 'DownloadMgr' 2448 DEBUG] [downloadMgr, 496] Current download count: 0
[2015-05-06 16:17:39:504 'HostUpdateDepotManager' 2448 ERROR] [vibDownloaderImpl, 402] Error downloading vib file from https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/esx/vmw/vib20/esx-base/VMware_bootbank_esx-base_5.5.0-2.62.2702864.vib Error:downloading file: https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/esx/vmw/vib20/esx-base/VMware_bootbank_esx-base_5.5.0-2.62.2702864.vib failed, 0 bytes downloaded.
[2015-05-06 16:17:39:504 'HostUpdateDepotManager' 2448 ERROR] [vibDownloaderImpl, 418] Downloading file failed for: https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/esx/vmw/vib20/esx-base/VMware_bootbank_esx-base_5.5.0-2.62.2702864.vib
[2015-05-06 16:17:39:504 'HostUpdateDepotManager' 2448 WARN] [vibDownloaderImpl, 440] Failed to download 1 VIBs:
https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/esx/vmw/vib20/esx-base/VMware_bootbank_esx-base_5.5.0-2.62.2702864.vib,
[2015-05-06 16:17:39:504 'HostUpdateDepotManager' 2448 ERROR] [patchDepotManager, 466] Failed to download the vibs: https://hostupdate.vmware.com/software/VUM/PRODUCTION/main/esx/vmw/vib20/esx-base/VMware_bootbank_esx-base_5.5.0-2.62.2702864.vib
[2015-05-06 16:17:39:504 'HostUpdateDepotManager' 2448 ERROR] [installController, 349] Install on host: <HOST FQDN REMOVED>(Entity: host-16) failed. Error: Failed to download Vibs
[2015-05-06 16:17:39:548 'SingleHostRemediateTask.SingleHostRemediateTask{29}' 2448 ERROR] [singleHostRemediateTask, 492] Remediation error: Failed to download Vibs
[2015-05-06 16:17:39:571 'VciTaskBase.VciClusterJobDispatcherTask{25}' 2448 INFO] [vciClusterJobSchedulerTask, 613] Remediation failed due to non mmode failure

Well, apparently this patch / vib was pulled after release, based on issues with "VMware NSX for vSphere 6.x or Cisco Nexus 1000v" as seen in KB2116370: VMware KB: After upgrading to VMware ESXi 5.5 Patch Release ESXi550-201504002, virtual machines using VMware NSX for…
Ok, that's cool. But here's my question then. Why is Update Manager still reporting that it's an available patch for our ESXi hosts? I'm new to this and am just trying to get an understanding to avoid confusion like this in the future.
[UPDATE]
Looks like this was the problem. VMwareCares Twitter account confirmed that Update Manager needed a new repository query to grab the new metadata. After rescanning the ESXi host again, the number of available patches dropped from 5 to 1. I'm now successfully patching the ESXi hosts through Update Manager once again. Crisis avoided.

RFC call - RfcClientException: functiontemplate from repository was null

Hi all,
We are attempting to retrieve data from the ABAP stack of XI via the RFC adapter. However the call to the RFC is returning the following error:
<SAP:Error xmlns:SAP="http://sap.com/xi/XI/Message/30" xmlns:SOAP="http://schemas.xmlsoap.org/soap/envelope/" SOAP:mustUnderstand="1">
<SAP:Category>XIAdapterFramework</SAP:Category>
<SAP:Code area="MESSAGE">GENERAL</SAP:Code>
<SAP:P1 />
<SAP:P2 />
<SAP:P3 />
<SAP:P4 />
<SAP:AdditionalText>com.sap.aii.af.ra.ms.api.DeliveryException: error while processing message to remote system:com.sap.aii.af.rfc.core.client.RfcClientException: functiontemplate from repository was <null></SAP:AdditionalText>
<SAP:ApplicationFaultMessage namespace="" />
<SAP:Stack />
<SAP:Retry>M</SAP:Retry>
</SAP:Error>
I have already come across SAP note 730870 but it didn't help.
Any suggestion?
Many thanks,
Aldo

Hi all,
I have found the problem.
The mapping to the RFC request was not creating the correct namespace prefix in the root xml element.
I have downloaded the file rfcnormalizer.jar from SAP note 730870 and used it in my interface mapping. It solved the problem.
Regards,
Aldo

Error connecting MDM system from XI through Java proxies-standard component

Dear Friends
We are trying to connect to the MDM system from XI through Java proxies(i.e standard components),in relation to that we have done the following:
1)registered the interfaces
a)http://XIserver:port/ProxyServer/register?ns=http://sap.com/xi/GDSConsole&interface=GDS_Data_Import_In&bean=localejbs/sap.com/GDS/DataImport&method=gDSDataImportIn
b)http://XIserver:port/ProxyServer/register?ns=http://sap
.com/xi/GDSConsole&interface=GDS_DP_In&bean=localejbs/sap.com/GDS/Dat
aPoolIn&method=gDSDPIn
2)Deployed the ears within Build10.zip, i.e
a)GDS_1.0.6.1_Build10.ear and
b)GDS_ExternalValidations_1.0.6.1_build10.ear
3)set the sap.application.global.properties file inside the GDS_1.0.6.1_Build10.ear
as follows:
SAP application properties
#!Path to GDS folder containing the configuration files
ConfigurationFilesLocation=/usr/sap/P70/DVEBMGS00/j2ee/cluster/server0/apps/sap.com/GDS
#!External validation modules (EJB names) delimited by semicolon character.
ExternalValidationModules=ExternalValidations_EJBs
#!IP or server name of MDM server
MDM.server=172.18.139.200
#!MDM repository port as appears in MDM console
MDM.port=2000
#!MDM repository name as appears in MDM console
MDM.repositoryName=GDS_1
#!version of MDM server and connector
MDM.version=5.5.42.103
#? secure=true
#! MDM Admin user password
MDM.AdminPassword=
#!Data pool name - should match a remote system defined in MDM console
DestinationDataPoolName=
#!Data pool 13 digits GLN
DestinationDataPoolGln=
#!Provider 13 digits GLN
ProviderGln=
#!Provider time zone e.g. EST
ProviderTimeZone=
#!Data pool schema URL
SchemaLocation=
#!Message Timeout
MessageTimeout=10
#!Backend import client system - should match a remote system defined in MDM console.
ImportData.ClientSystem.Name=R3
!# The format that dates will appear in the UI
#Available date formats:      MM/dd/yyyy
#                     dd/MM/yyyy
#                     MM-dd-yyyy
#                     dd-MM-yyyy
#                     dd-MMM-yyyy
#                     dd/MMM/yyyy
#                     MMM dd, yyyy
Where MM=1-12, MMM=Jan,Feb,Mar,etc.
Note: Extreme caution should be taken when choosing to use month names,
#          since different regional settings on the client and server machines
#          will cause dates to be uninterpretable.
#          It is strongly advised to use numeric month format, eg. MM-dd-yyyy, etc.
DateFormat=dd/MM/yyyy
DEBUG.SaveIncomingMessagesToFile=false
#!defines if incoming message will be saved in arc folder
DEBUG.ImportData.SaveArchive=false
#!defines if outgoing message will be saved
DEBUG.SaveOutgoingMessagesToFile=false
But still we are getting errors as:
a)com.sap.aii.af.ra.ms.api.MessagingException: com.sap.mdm.gds.proxy.dataimport.GDSConsole_Message_Exception: : com.sap.aii.proxy.xiruntime.core.ApplicationFaultException: com.sap.mdm.gds.proxy.dataimport.GDSConsole_Message_Exception
inside SXMB_MONI
when we trigger an Idoc and try to send the data inside the MDM GDS system.
and
b)Failed to send message,reason:Exception on method gDSDPOut
when we try to register something,even after the data is validated by the system.
Can anybody help??
It is of urgent requirement.
Edited by: Arjun Ghose on Jul 15, 2008 4:36 PM

Hi ,
   I found a document which says that MDM4J is the legacy API and is considered deprecated .The MDM Java API is the new one .I have both of them in the java build path . I am not sure if this is that cause of the problem .
Now I had a look at the javadoc for the new API but I am not able to locate the class to obtain a connection to the MDM server from a custom application being built in Netweaver Developer Studio . Can someone help me out with the same ?What would be the code to obtain the connection to the MDM server with the new JAVA API ?
Regards
DeepaK Singh

Download MDM roles from repository

Similar Messages

Maybe you are looking for