Getting domain and role profiles

i have access to the user profile and the application profile via the public API but i also need to have access to the domain profile ( i need to get some attributes at the domain level ) and found no way of doing that in the public API?
is there a way to do that via the API or do i need to create my own methods to access the ldap directory and retrieve the information?

Sreekanth, step 2 of the role has priority over the access profile.

Similar Messages

Critical Action and Role/Profile Analysis

Hi,
I want to know the purpose of the Batch Risk Analysis back ground job "Critical Action and Role/Profile Analysis" in RAR 5.3.
I'm assuming that I need not run this job if I do not want the critical roles/profiles like SAP_ALL to be analysed which were defined to be critical in rule architect.
Please let me know if there is any other purpose to run the BG job "Critical Action and Role/Profile Analysis".
Thank you,
Partha

Hello Partha,
You got this right. It will analyze the defined critical actions/roles/profiles.
Regards, Varun

Critical Action and Role/Profile Analysis job in not running in GRC 5.3

Hi Team,
I am working for a client where GRC 5.3 is installed( support pack 4 and patch 1).
The installation is complete and also the post processing is done.
We have scheduled a periodic ( weekly ) incremental background job for Critical Action and Role/Profile.
Following are the parameter setting used:
Task: Risk Analysis -Batch
Batch Mode : Incremental
First time it run successfully on 28th June'09 and it is completed with spool also. But next time it is supposed to run on 4th of July'09 . But it does not. And since then it is in same state.
I am not able to find any reason that why it is behaving this way where other incremental jobs are running successfully.
It will be helpfull if any one can guide me providing the solution.
Regards,
Kakali

Hi Varun,
I go to the Job History Button. It shows the following data only :
2009-06-28 00:00:59 Done Job Completed successfully
2009-06-27 23:45:00 Started RAR_PE1CLNT100_Critical Action and Role/Profile Analysis started :threadid: 0
Under the Last Run Colomn it shows 28th June ( Status -completed)
Under Next Run Date it is showing 4th July
Follwoing are the list of Updates available From SP05
When executing the critical roles/profile jobs in background, a message
"error while executing the Job: null" comes up. ---( this one is for which come under Informer Tab)
Background job spools are not available after upgrade from 5.2 to 5.3.
Critical action and critical role/profile analysis cannot be run in
background by system. --- ( But in my case It ran for once )
Selection parameters (System, User and User Group) have been provided for
"Critical Action and Role/Profile Analysis" in Configuration->Background
Job->Schedule Job. --- ( it means it run usually)
Critical Actions report in detail view shows no results after executing the
Risk Analysis Job in the background. The same report shows data when
executed in the foreground. ( this one is for which come under Informer Tab )
When there is only one periodic job configured in RAR, this job fails to
start after the first time in the specified time. ( this is not true, becoz there other periodic jobs running successfuly)
Unable to run Informer - audit reports - critical role and profiles with
logical systems. ( this is again under Informer Tab )
I had gone through this earlier also, but not able to match any update with my problem. If if have any other suggestion you can provide me the same.
Is there any way to check for job log so that I can check what is the problem. View Log option is also greyed out as we have sap logger set up as a default logger Parameter. I have made it enable just to check but there is nothing.
Please Guide.
Regards,
Kakali

Fully Qualified Domain Names (FQDN) error - How to get domain and extension

I have created a Web Dynpro ABAP application. On executing it, I get Fully Qualified Domain Names (FQDN) error. I have host name of my server.
I do not know domain name and extension name of my server. How can I detect it?
I want to know in Windows XP and Windows 7.
Please help me asap.

Hello,
Right click on the my computer and click properties and then go to the tab computer name .
there you will have full computer name and this should have your host name as well as the domain name.
to check the domain name click on change a new popup will open ther domain will be metntioned.
IF nothing is ther in the domain then add just .(dot) at the end of the computer name .
and save it and then put the same name in the ICM/host_name_full parameter in rz11 and try .
thanks
sarbjeet
Edited by: sarbjeet singh on Jan 23, 2011 10:26 AM

Get user and user-roles in form based authentication

How do I get user and roles associated with the user in my bean for "form based authentication".
regards,
nirvan.

HttpServletRequest#getUserPrincipal().
This has nothing to do with JSF. Form based authentication is part of Servlet spec.
In JSF you can get the HttpServletRequest by ExternalContext#getRequest().

Domain vs role?

Hi,
Just wondering what's the difference between domain and role. When do you create a new domain, and when do you add a new role instead?
Thanks,
Yi

Domains are completely separate from one another. They don't share any profile information. They can have different authentication schemes, administrators, etc.
A role within a domain shares everything that has been defined at the domain level with all other roles in the same domain.
Use a separate domain when the user population is completely different or when you need to have separate administrators. Note that the administration overhead of separate domains is higher that than of seperate roles in the one domain.
Stephen

Creatkion of customized profiles and roles

Dear Experts,
Im new to SAP and SDN.
My requirement is that i need to create a new profile for technical people
as z_tech_role giving access to transactions as SE38,S71,smartforms etc.
Similarly a functional one needs to be developed as z_func_role access to Se16,
solar01,solar02 ,va01,ad other VA transactions.
The same for a workflow profile.
Can you please provide me with steps how i need to create this profile and how to attach roles in it to the profile.
Thanks in advance

Hi,
There is one forum for SAP Security, you've to post this message in that forum to get quick and exact reply..
Anyways, please follow the help.sap link above povided already.
Somebasic concepts:
1. Tcodes are assigned to Roles.
2. When Roles are generated, they create profiles.
3. Roles are assigned to Users. (profiles are not directly assigned, except few like sap_all, sap_new etc)
So what you can do, create a role z_tech_role in PFCG and add transaction SE38,S71.. etc.then maintain authorizations, generate the role. and then go to user tab, add the users whom you want to be assigned with the new role z_tech_role. (role assignement can also be done in SU01, roles tab)
Thanks,
Debasis.

Difference between profile and role

Can any explain me the difference between profile and role.
I was given a user Id on ABAP stack of XI.
My profile: SAP_ALL
I was not assigned any roles.
I am not sure if I need different roles or this profile
would serve the purpose.
-Naveen.

Hi Naveen,
Adding to Gus points a few more inputs.
Profiles were the menas of assiging authorizations to users until 4.0 Versions.
Later to the same it was upgraded to the concept of Roles. The crux always remains the same.
Be it a profile or a role, it contains the Auth Object and the respective values.
But in present scenario, you can get confused by the profiles that are assignable to Users.
IN short the following points can be helpful.
1. The profiles like SAP_ALL;SAP_NEW,S_SPO_ALL etc are standard Profiles delivered by SAP which when assigned to a user in his profile in SU01 would get all the related authorizations.
( You must be lucky to have SAP_ALL assigned to ur ID by ur basis guy)
2. A role is created by assigning a few transactions to this role and when this role is generated, it generates a PROFILE. But this profile is a system generated one and cannot be ever assigned to any user. These profiles can be sorted out as they have the standard naming like T-XXXXXXXX where they are the numbers and it can never be assigned to any user.
3. Note prior to 4.0 its all Profiles that are assigned to users and later to the same came the concept of Roles and hence this change.
Hope the answer is helpful in making u undersand a few inputs form my side.
FYI:
Method to create a role can be checked out from the link below.
http://help.sap.com/saphelp_bw21c/helpdata/en/52/6714b6439b11d1896f0000e8322d00/frameset.htm
Br,
Sri
Award points if answer is helpful.

Getting Error The trust relationship between the primary domain and the trusted domain failed in SharePoint 2010

Hi,
SharePoint 2010 Backup has been taken from production and restored through Semantic Tool in one of the server.The wepapplication of which the backup was taken is working fine.
But the problem is that the SharePoint is not working correctly.We cannot create any new webapplication ,cannot navigate to the ServiceApplications.aspx page it shows error.Even the Search and UserProfile Services of the existing Web Application is not working.Checking
the SharePoint Logs I found out the below exception
11/30/2011 12:14:53.78 WebAnalyticsService.exe (0x06D4)        0x2D24 SharePoint Foundation         Database
8u1d High    Flushing connection pool 'Data Source=urasvr139;Initial Catalog=SharePoint_Config;Integrated Security=True;Enlist=False;Connect Timeout=15'
11/30/2011 12:14:53.78 WebAnalyticsService.exe (0x06D4)        0x2D24 SharePoint Foundation         Topology
2myf Medium Enabling the configuration filesystem and memory caches.
11/30/2011 12:14:53.79 WebAnalyticsService.exe (0x06D4)        0x12AC SharePoint Foundation         Database
8u1d High    Flushing connection pool 'Data Source=urasvr139;Initial Catalog=SharePoint_Config;Integrated Security=True;Enlist=False;Connect Timeout=15'
11/30/2011 12:14:53.79 WebAnalyticsService.exe (0x06D4)        0x12AC SharePoint Foundation         Topology
2myf Medium Enabling the configuration filesystem and memory caches.
11/30/2011 12:14:55.54 mssearch.exe (0x0864)                   0x2B24 SharePoint Server Search      Propagation Manager
fo2s Medium [3b3-c-0 An] aborting all propagation tasks and propagation-owned transactions after waiting 300 seconds (0 indexes) [indexpropagator.cxx:1607] d:\office\source\search\native\ytrip\tripoli\propagation\indexpropagator.cxx
11/30/2011 12:14:55.99 OWSTIMER.EXE (0x1DF4)                   0x1994 SharePoint Foundation         Topology
75dz High    The SPPersistedObject with
Name User Profile Service Application, Id 9577a6aa-33ec-498e-b198-56651b53bf27, Parent 13e1ef7d-40c2-4bcb-906c-a080866ca9bd failed to initialize with the following error: System.SystemException: The trust relationship between the primary domain and the trusted
domain failed.       at System.Security.Principal.SecurityIdentifier.TranslateToNTAccounts(IdentityReferenceCollection sourceSids, Boolean& someFailed)     at System.Security.Principal.SecurityIdentifier.Translate(IdentityReferenceCollection
sourceSids, Type targetType, Boolean forceSuccess)     at System.Security.Principal.SecurityIdentifier.Translate(Type targetType)     at Microsoft.SharePoint.Administration.SPAce`1.get_PrincipalName()
at Microsoft.SharePoint.Administration.SPAcl`1.Add(String princip...
11/30/2011 12:14:55.99* OWSTIMER.EXE (0x1DF4)                   0x1994 SharePoint Foundation         Topology
75dz High    ...alName, String displayName, Byte[] securityIdentifier, T grantRightsMask, T denyRightsMask)     at Microsoft.SharePoint.Administration.SPAcl`1..ctor(String persistedAcl)
at Microsoft.SharePoint.Administration.SPServiceApplication.OnDeserialization()     at Microsoft.SharePoint.Administration.SPIisWebServiceApplication.OnDeserialization()     at Microsoft.SharePoint.Administration.SPPersistedObject.Initialize(ISPPersistedStoreProvider
persistedStoreProvider, Guid id, Guid parentId, String name, SPObjectStatus status, Int64 version, XmlDocument state)
11/30/2011 12:14:56.00 OWSTIMER.EXE (0x1DF4)                   0x1994 SharePoint Foundation         Topology
8xqx High    Exception in RefreshCache. Exception message :The trust relationship between the primary domain and the trusted domain failed.
11/30/2011 12:14:56.00 OWSTIMER.EXE (0x1DF4)                   0x1994 SharePoint Foundation         Timer
2n2p Monitorable The following error occured while trying to initialize the timer: System.SystemException: The trust relationship between the primary domain and the trusted domain failed.       at System.Security.Principal.SecurityIdentifier.TranslateToNTAccounts(IdentityReferenceCollection
sourceSids, Boolean& someFailed)     at System.Security.Principal.SecurityIdentifier.Translate(IdentityReferenceCollection sourceSids, Type targetType, Boolean forceSuccess)     at System.Security.Principal.SecurityIdentifier.Translate(Type
targetType)     at Microsoft.SharePoint.Administration.SPAce`1.get_PrincipalName()     at Microsoft.SharePoint.Administration.SPAcl`1.Add(String principalName, String displayName, Byte[] securityIdentifier, T grantRightsMask,
T denyRightsMask)     at Microsoft.SharePoint.Administrati...
11/30/2011 12:14:56.00* OWSTIMER.EXE (0x1DF4)                   0x1994 SharePoint Foundation         Timer
2n2p Monitorable ...on.SPAcl`1..ctor(String persistedAcl)     at Microsoft.SharePoint.Administration.SPServiceApplication.OnDeserialization()     at Microsoft.SharePoint.Administration.SPIisWebServiceApplication.OnDeserialization()
at Microsoft.SharePoint.Administration.SPPersistedObject.Initialize(ISPPersistedStoreProvider persistedStoreProvider, Guid id, Guid parentId, String name, SPObjectStatus status, Int64 version, XmlDocument state)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.GetObject(Guid
id, Guid parentId, Guid type, String name, SPObjectStatus status, Byte[] versionBuffer, String xml)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.GetObject(SqlDataReader dr)     at Microsoft.SharePoint.Administration.SPConfigurationDatabase.RefreshCache(Int64
currentVe...
Please guide me on the above issue ,this will be of great help
Thanks.

I have same error. Verified for trust , ports , cleaned up cache.. nothing has helped.
The problem is caused by User profile Synch Service:
UserProfileProperty_WCFLogging :: ProfilePropertyService.GetProfileProperties Exception: System.SystemException:
The trust relationship between the primary domain and the trusted domain failed.       at System.Security.Principal.SecurityIdentifier.TranslateToNTAccounts(IdentityReferenceCollection sourceSids,
Boolean& someFailed)     at System.Security.Principal.SecurityIdentifier.Translate(IdentityReferenceCollection sourceSids, Type targetType, Boolean forceSuccess)     at System.Security.Principal.SecurityIdentifier.Translate(Type
targetType)     at Microsoft.SharePoint.Administration.SPAce`1.get_PrincipalName()     at Microsoft.SharePoint.Administration.SPAcl`1.Add(String principalName, String displayName, SPIdentifierType identifierType, Byte[]
identifier, T grantRightsMask, T denyRigh...
08/23/2014 13:00:20.96*        w3wp.exe (0x2204)
        0x293C        SharePoint Portal Server              User Profiles
        eh0u        Unexpected        ...tsMask)     at Microsoft.SharePoint.Administration.SPAcl`1..ctor(String persistedAcl)
at Microsoft.Office.Server.Administration.UserProfileApplication.get_SerializedAdministratorAcl()     at Microsoft.Office.Server.Administration.UserProfileApplication.GetProperties()     at Microsoft.Office.Server.UserProfiles.ProfilePropertyService.GetProfileProperties()
Please let me know if you any solution found for this?
Regards,
Kunal

Analysis Authorization (Role, Profile and Direct Assignments)

Analysis Authorization Question:
1) In BW 3.x environment, customers have used Role Maintenance Process to assign proper object level security and then assign to the users.
2) Most of the places R/3 security team takes over support/administration function of BI Security and they continue to use Role method to assign Reporting Authorizations as per the process defined in BW 3.x system.
3) Customer sometime have 100 + Roles to have 3.X Reporting Authorizations. This is Managed, assigned, approved using role concept.

Migration Options:
1) New Analysis Authorization makes process of Role Maintenance like "hierarchy authorizations" of BW 3.x. You have to create Value in other transactions and assign them in Role as a pointer or link object. With Analysis Authorization concept, Actual value of the Object Assigned Like Company code 1100 not visible in Role Maintenance PFCG transactions. It is only visible in Transaction code RSECADMIN.
2) Analysis Migration Tool - RSEC_MIGRATION does not update ROLES. It creates or changes PROFILES.
3) Profiles are assigned to the users and Roles does not reflect any Impact by Analysis Authorization migration.
Questions
a) This means customer need to update all the roles by hand. If they want to use Roles to manage the assignment of the Security to users. Migration Tool does not update Roles, it only updates PROFILES.
b) Does any one use direct assignment to Users? It is good business practice?
c) Is Profiles recommended method of Authorization Maintenance?
d) Can we run migration tool to create Analysis Authorizations, but not assign to the users as a Profile. But stop at creating Analysis Authorizations. If Customer wants to use Roles maintenance process then, they can do not have delete profile assignments from all users before updating Roles using Analysis Authorizations.
Just want to check how other folks have done migration that can be supported going forward.
Pankaj Gupta

Hey Pankaj,
In general, assigning the analysis authorization directly to user makes a lot of sense for granular levels of authorization. For example, if you had 3,000 users, 3,000 specific authorization combinations, and 3,000 roles, using roles is a lot of additional overhead. If you had 12 roles and 3,000 users, your role concept makes a lot of sense.
Therefore, the recommendation is that it varies on what makes the most sense logically. Authorization groups can be created to group analysis authorizations and combine them. Also, you have the ability to generate analysis authorizations using the Content Datastores for this. That is an option as well.
RSEC_MIGRATION does use profiles as you've stated. If you want, there would be manual work to convert to roles afterwards. In case you haven't seen Marc's presentation on security, it's pretty good and covers how to generate authorizations from the datastore.
https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/docs/media/uuid/ac7d7c27-0a01-0010-d5a9-9cb9ddcb6bce

Background job fails for BDC profile creation and role assignment

Hi Experts,
I have created a BDC Function module for Tcode 'PFCG' for profile creation and role assignment, and called this FM in my zprogram. the problem is that when i run this program in foreground it executes succesfully, but if i schedule it in background it fails throwing error in job log 'Role 'Z...' does not contain any active authorizations'. But i have created one more program to create authorization objects which runs before this zprogram.I have also checked the authorization object in 'RSECADMIN', it reflects active. I dont understand whats happening exactly when it runs background.
Below is the process of job
 1. ZMIS_AUTH_OBJECT_CREATE
 Variant : auth-create
 2. ZMIS_AUTH_ASSIGN_TO_ROLE
 Variant : auth-assign
The problem is in second program, runs in foreground but fails in background.
Code which i have written in my second program
***BDC for Profile creation and assignment to Roles
 CALL FUNCTION 'ZROLE'
 EXPORTING
 ctu = 'X'
 mode = p_mode
 UPDATE = 'L'
* GROUP =
* USER =
* KEEP =
* HOLDDATE =
 nodata = '/'
 agr_name_neu_001 = wa_role-role_name
 text_002 = wa_role-desc
 text_003 = wa_role-desc
 text_004 = wa_role-desc
 value_01_005 = 'T-ML330881'
 h_fval_low_01_006 = wa_role-auth
 profn_007 = lv_profile
 ptext_008 = lv_text1
* IMPORTING
* SUBRC =
 TABLES
 messtab = temp_message.
***Generation of Profile created
CALL FUNCTION 'PRGN_AUTO_GENERATE_PROFILE_NEW'
 EXPORTING
 activity_group = wa_role-role_name
* PROFILE_NAME =
* PROFILE_TEXT =
 no_dialog = ' '
 rebuild_auth_data = ''
 org_levels_with_star = ' '
 fill_empty_fields_with_star = 'X'
 template = ' '
 check_profgen_tables = 'X'
 generate_profile = 'X'
 authority_check_pfcg = 'X'
 EXCEPTIONS
 activity_group_does_not_exist = 1
 activity_group_enqueued = 2
 profile_name_exists = 3
 profile_not_in_namespace = 4
 no_auth_for_prof_creation = 5
 no_auth_for_role_change = 6
 no_auth_for_auth_maint = 7
 no_auth_for_gen = 8
 no_auths = 9
 open_auths = 10
 too_many_auths = 11
 profgen_tables_not_updated = 12
 error_when_generating_profile = 13
 OTHERS = 14 .
Experts please help me out its very urgent. your help is appreciated and rewarded. Thanking you in advance.
Regards,
Chetan

Hi Praveen,
Yeah definately, my requirement is that I have to access of some BI reports to certain users, so contract data will be downlaoded from ECC on application server, need to read that file from application server and for the each contract i ahould create a authorization object, role creation and assigning of role to the user and profile generation and activation.
To achieve this i have written two programs
1) ZMIS_AUTH_OBJECT_CREATE- This program will create the Authorization Object using BDC and Role creation Using the BAPI
"" Creation of Authorization Object
CALL FUNCTION 'ZAUTHOBJ'
 EXPORTING
 ctu = 'X'
 mode = p_mode
 UPDATE = 'L'
* GROUP =
* USER =
* KEEP =
* HOLDDATE =
 nodata = '/'
 g_authname_001 = 'ZDUMMY_MIS'
 g_targetauth_002 = wa_tab-auth
 g_authtxt_003 = wa_tab-short_desc
 g_authtxtmd_004 = wa_tab-med_desc
 marked_04_005 = 'X'
 g_authtxt_006 = wa_tab-short_desc
 g_authtxtmd_007 = wa_tab-med_desc
 tctiobjnm_04_008 = 'ZBUS_UNIT'
 g_authtxt_009 = wa_tab-short_desc
 g_authtxtmd_010 = wa_tab-med_desc
 marked_05_011 = ''
 opt_01_012 = 'EQ'
 low_01_013 = wa_tab-bu
 g_authtxt_014 = wa_tab-short_desc
 g_authtxtmd_015 = wa_tab-med_desc
 marked_04_016 = 'X'
 g_authtxt_017 = wa_tab-short_desc
 g_authtxtmd_018 = wa_tab-med_desc
 tctiobjnm_04_019 = 'ZCONTRCT'
 g_authtxt_020 = wa_tab-short_desc
 g_authtxtmd_021 = wa_tab-med_desc
 marked_05_022 = ''
 opt_01_023 = 'EQ'
 low_01_024 = lv_contract
 g_authtxt_025 = wa_tab-short_desc
 g_authtxtmd_026 = wa_tab-med_desc
 g_authtxt_027 = wa_tab-short_desc
 g_authtxtmd_028 = wa_tab-med_desc
 g_authname_029 = wa_tab-auth
* IMPORTING
* SUBRC =
 TABLES
 messtab = temp_message.
"" Creation of role
LOOP AT it_role INTO wa_role.
 CLEAR wa_text.
 wa_text-text = wa_role-desc.
 wa_text-langu = 'E'.
 APPEND wa_text TO it_text.
 wa_jobrole-agr_name = wa_role-role_name.
 wa_parentrole-agr_name = 'ZM_CT_DUMMY_MIS'.
 wa_method-usmethod = 'CHANGE'.
 CALL FUNCTION 'ZBAPI_JOBROLE_CLONE'
 EXPORTING
 jobrole = wa_jobrole
 parent = wa_parentrole
 method = wa_method
 TABLES
* RETURN =
 shorttext = it_text
* LONGTEXT =
* MENU_NODES =
* MENU_TEXTS =.
 ENDLOOP.
2) ZMIS_AUTH_ASSIGN_TO_ROLE - This program will generate the profile created assign it to the role.
""*BDC for Profile creation and assignment to Roles
 CALL FUNCTION 'ZROLE'
 EXPORTING
 ctu = 'X'
 mode = p_mode
 UPDATE = 'L'
* GROUP =
* USER =
* KEEP =
* HOLDDATE =
 nodata = '/'
 agr_name_neu_001 = wa_role-role_name
 text_002 = wa_role-desc
 text_003 = wa_role-desc
 text_004 = wa_role-desc
 value_01_005 = 'T-ML330881'
 h_fval_low_01_006 = wa_role-auth
 profn_007 = lv_profile
 ptext_008 = lv_text1
* IMPORTING
* SUBRC =
 TABLES
 messtab = temp_message .
 COMMIT WORK AND WAIT.
""*Generation of Profile created
LOOP AT it_role INTO wa_role.
 CALL FUNCTION 'PRGN_AUTO_GENERATE_PROFILE_NEW'
 EXPORTING
 activity_group = wa_role-role_name
* PROFILE_NAME =
* PROFILE_TEXT =
 no_dialog = ' '
 rebuild_auth_data = ''
 org_levels_with_star = ' '
 fill_empty_fields_with_star = 'X'
 template = ' '
 check_profgen_tables = 'X'
 generate_profile = 'X'
 authority_check_pfcg = 'X'
 EXCEPTIONS
 activity_group_does_not_exist = 1
 activity_group_enqueued = 2
 profile_name_exists = 3
 profile_not_in_namespace = 4
 no_auth_for_prof_creation = 5
 no_auth_for_role_change = 6
 no_auth_for_auth_maint = 7
 no_auth_for_gen = 8
 no_auths = 9
 open_auths = 10
 too_many_auths = 11
 profgen_tables_not_updated = 12
 error_when_generating_profile = 13
 OTHERS = 14
 IF sy-subrc <> 0.
 MESSAGE ID sy-msgid TYPE sy-msgty NUMBER sy-msgno
 WITH sy-msgv1 sy-msgv2 sy-msgv3 sy-msgv4.
 ENDIF.
ENDLOOP.
For creating authorization objects, role & profile i have created one dummy auth, dummy role & dummy profile respectively.
i have created dummy objects to copy the roles from dummy object and assign the same to new Auth obj, role & profile.
Let me know what needs to be done. because these both the programs run perfectly in foreground, but fails in background.
Regards,
Chetan

What are the roles/profiles required in solman and satilite system.....

Hi All,
What are the list of roles/profiles (for SOLMAN and Satellite system) required to create logical instance etc... for monitoring and tasks.
Regards.
kumar

Hello Kumar,
please have a look at the Configuration Guide for SolMan on the SAP Marketplace. ALso for information on required documentation, see SAP Note 1088980.
Best regards,
Annett

Trying to understand "User/Role/Profile Synchronization" and Batch Analysis

Hello,
Im trying to understand what exactly and from which tables these jobs are copying to which tables in CC. I have a understanding that these jobs are moving also deleted roles from backend. This is causing unnecessary delay to long lasting job.
I would appreasite if some one could explain the logic behind these jobs. What the fullsync and incremental is reading ? What kind of changes are causing a role/user/profile to be included to the full and incremental jobs?
How the incremental analysis logic is built ?
br Janne

Janne,
In my current implementation we are going for an offline risk analysis due to the heteregoneus system landscape of our client (several SAP and non SAP systems and several SAP systems under 4.6C). Eventhough within our approach we don't perfrom the backend synchronization (we use CC data extractor to pull data from backend into CC) hope the following info could hel you:
The tables such jobs you mention access to, are all the SAP backend system tables related with users, roles, profiles, action and permissions. If you check the data mapping appendix of the "user and configuration guide for 5.2" you will see all the data that CC retrieves. For instance, in order to extract user info (UserID, FName, LName, Email, Phone, Email, Department) tables USR21, USR02, ADRP, ADR6 and ADCP must be accessed.
In terms of CC tables:
VIRSA_CC_SYSUSR >> UserIDs and Systems ID relationship
VIRSA_CC_GENOBJ >> User, Role and Profile master data
VIRSA_CC_GENACT >> User-action, role-action and profile-action data
VIRSA_CC_GENPRM >> User-permission, role-permission and profile-permission
VIRSA_CC_SAPOBJ >> Action-permission
VIRSA_CC_OBJTEXT >> Objects descripcions (ACT, PRM, FLD, VAL, ORG)
Hope this helps.
Regards,
Imanol

RDS - .local domain and external users. Best way to get rid of SSL warnings

I am evaluating MS RDS as a possible solution for a VDI implementation at the college I work for. When we setup our AD years ago we set it up as a .local domain. I am running into issues with the .local machine name on the connection broker for
external users. I know for internal domain systems we can setup the self signed .local cert as a trusted root cert to bypass the self signed untrusted warning but for the bulk of our users which will be using systems external to our domain they
will get the SSL warning about the self signed certificate when they try to connect to a remote app or a desktop.
Initially I thought if I setup a local AD CA that we could setup a trust relationship with the SSL cert. After further reading I believe that this would only work for systems internal to our domain and we would still have the issue with external devices.
The other option would be to tell our users to click the box to never display the warning message again and to go on or to add the self signed cert to their trusted list. Of course when ever you ask the user to do something there will be issues. We
have also found that in our testing that we can not seem to connect via the web portal with a macbook. We get an error that there is a problem with the trust relationship with the server after we login and click on an app or a desktop to connect. We
have been able to connect with iOS devices.
We could of course rename the .local domain to a .edu domain which would permit us to use our wildcard certificate but that is a major undertaking that we don't want to cross at the moment. I think I might have some up with a solution and wanted to
bounce the idea off of those on this forum.
If we setup a second domain on campus that is not a .local. Join the non internet facing RDS systems to this new domain that would have a SSL cert that was trusted and then setup a full trust relationship between the two domains such that users and
systems in one domain could communicate with the systems in the other domain would that remove the certificate warnings for external users?

Hi AKlein,
Initially I thought if I setup a local AD CA that we could setup a trust relationship with the SSL cert. After further reading I believe that this would only work for systems internal to our domain and we would
still have the issue with external devices.
Just add the root CA certificate of the internal CA into Trusted Root Certification Authorities store on external clients manually (or through group policy if there is an external domain), then SSL certificate warning would be gone.
We could of course rename the .local domain to a .edu domain which would permit us to use our wildcard certificate but that is a major undertaking that we don't want to cross at the moment.
Yes, renaming domain is not recommended due to its complexity.
If we setup a second domain on campus that is not a .local. Join the non internet facing RDS systems to this new domain that would have a SSL cert that was trusted and then setup a full trust relationship between
the two domains such that users and systems in one domain could communicate with the systems in the other domain would that remove the certificate warnings for external users?
If you are setting up a new domain with two way trust, then root CA certificate of the internal CA still needs to be distributed manually (or through group policy). If you are setting up a child domain, then enterprise CA would be trusted within the same
forest.
As long as there are enough external users and devices to manage, an external private network exists and extra domain management tasks are acceptable, then setting up a new domain is a good choice since domain provides secure boundary.
Or, you could just create a new site from the other network location, which saves you from creating a new domain, new users and trust.
Best Regards,
Amy
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact
[email protected]

Duplicate profiles and Roles

Hi,
I created a few profiles with special roles and metadata fields in my ucm.
I did all the work in my computer and now i want to change the machine(computer) and i don't want to loose all my work.
Are there any ideas how to duplicate all my profiles and roles(my configuration) to another computer??
NOTE: I just want to duplicate my custom environment of the ucm.
Eran z

For this purpose you have Administration -> Comfig Migration Admin (Configuration Migration Utility).
http://download.oracle.com/docs/cd/E17904_01/doc.1111/e10792/c06_migration.htm#CHDBIJAJ
Regards,
Boris

Getting domain and role profiles

Similar Messages

Maybe you are looking for