Issuing Multiple MYSAPSSO2 tickets for Multiple Domains

Hi,
I am having a problem understanding the SAP documentation on how to go about issuing SAP login tickets in multiple domains. In the documentation it states that in order to do so, you require either a IRJ or the SAP ISAPI Web Filter installed in on a server in the target Domain. I have now setup the IIS_SSO.dll ISAPI filter in the domain I require the SSO ticket to be issued in however when I make a request to that webserver I do not see the MYSAPSSO2 cookie being created in my browser, I do see in the ISAPI logs that the request has been filtered and the portal username extracted and set to the configured HTTP Header, but no new Cookie created in the DOMAIN.
Can anyone help? Has anyone done something like this before?
Basically I have a portal in the domain <b>myportal.subdomain.domain.com</b> and an ITS in the domain <b>myits.domain.com</b>. With this configuration the MYSAPSSO2 cookie is not sent to the ITS server as it is in a Super Domain. So what I want is to configure the portal to issue a Cookie in the super domain (domain.com) rather then subdomain.domain.com. I thought I could do this with the parameter login.ticket_recieving_hosts in the usermanagment.properties file (EP5) and the IIS ISAPI filter to SSO (IIS_SSO.dll) configured on a website in the super domain (domain.com).
Any help would be greatly appriciated.
Simon.

I believe we had to set the domain relax level (ume.logon.security.relax_domain.level) but needed to make sure this was secure since it changes the domain scope of cookies that are valid for the system.
See the following:
http://scn.sap.com/thread/1534863
http://help.sap.com/saphelp_nw70ehp3/helpdata/en/5e/473d4124b08739e10000000a1550b0/frameset.htm
Hope this helps.

Similar Messages

DNS for Multiple Domains

I am trying to figure out the proper configuration for DNS that will support multiple domains. I have DSN working now for just one domain.
My XServe has a static IP connected directly to cable modem and is the master nameserver. I also have an Ubuntu server with static IP connected directly to cable modem that is the secondary (slave) nameserver.
On the XServe, I currently have a primary zone created for domain1.com. with:
* an A record for domain.com. (Fully Qualified) and the same static IP as the XServe
* an A record for ns1 (not fully qualified) and the same static IP as the XServe
* Aliases for ftp, www and mail (not fully qualified) mapped to destination ns1.domain1.com. (Fully Qualified)
Nameservers under the Primary Zone is ns1.domain1.com. and Mail Exchangers is ns1.domain1.com. with a priority of 10.
The reverse zone is getting created appropriately for me as far as I can tell. I am able to access www.domain1.com just fine as well as mail and ftp.
Now I want to add a new domain2.com to this master nameserver. I know that I will need a new Primary Zone for domain2.com. to be recognized and to setup it's aliases?
Can I use the same static IP or do I have to have a unique static IP?
Can I use the ns1.domain1.com. nameserver or does the new domain2.com need new nameservers?
Does domain2.com have it's own A records?
Does the mail exchangers need to be different for domain2.com?
It seems like all the documentation and information that I can find are just for configuring one domain and not so much for multiple domains. Any help would be greatly appreciated.
Spotted Dog

Don't think of subsequent domains as being any different from the first domain.
For every domain you need to provide certain information, including a list of the hostnames within that domain. There is no relationship between 'www' in domain1.com and 'www' in domain2.com (unless you point them to the same address, but that's a different issue).
Any host record in the zone can either be an A record (where you specify an IP address) or a CNAME (where you specify another hostname that it maps to).
In the case of your web server handling both domains you could set 'www.domain2.com' as an A record with the appropriate IP address, or you could set it as a CNAME with a value of 'www.domain1.com.' (essentially saying 'www.domain2.com has the same IP address of www.domain1.com, so go find that address').
It's also possible to use cross-domain records for things like name servers and mail servers - in other words you can set your MX record for domain2.com to mail.domain1.com (essentially saying that domain2.com's email is handled by mail.domain1.com).
Can I use the same static IP or do I have to have a unique static IP?
That's not a question for DNS. What you're defining are the hostnames in that domain. If you have one server (e.g. a web server) that can handle multiple domains (e.g. one apache server handling web traffic for both domain1.com and domain2.com) then, sure, you can use the same IP address for both.
If, on the other hand, you have specific services that cannot be multi-hosted (e.g. HTTPS) then you will need different IP addresses.
Can I use the ns1.domain1.com. nameserver or does the new domain2.com need new nameservers?
Sure, it's entirely possible to use domain1.com's name servers for domain2.com.
Does domain2.com have it's own A records?
It can do, or not, as you choose. If you're running www.domain2.com on the same server as www.domain1.com then you could use a CNAME record to point www.domain2.com to www.domain1.com.,or you could set an A record with the same IP address.
The result would be the same, but the CNAME has the advantage that if your IP address changes you only need to change your DNS in one place (www.domain1.com) and all the other addresses would automatically follow.
Does the mail exchangers need to be different for domain2.com?
Not at all, if your mail server is configured to handle mail for both domains it's entirely possible to specify mail.domain1.com as the MX record for domain2.com.

Facing issue while provisioning to AD which is in multiple domain in single forest

Hi All,
I am facing issue while user provisioning to AD which is in multiple domain in single forest.I can Synchronize the OU and Groups from Global Catalog i.e. root domain,but unable to Synchronize OU and Groups from child domains.Following is depict of my domain.
Root -------   example.com
         |_______doamin1.example.com
         |_______doamin2.example.com
         |_______domain3.example.com
My global catalog is example.com where I have configure my connector.Following is the snippets of it.
Parameter
Value
ADLDSPort
BDCHostNames
Configuration Lookup
Lookup.Configuration.ActiveDirectory.Trusted
Connector Server Name
Active Directory Connector Server
Container
DC=example,DC=com
DirectoryAdminName
DWPTEST\adm
DirectoryAdminPassword
DomainName
example.com
IsADLDS
no
LDAPHostName
GlobalCatalog server name -> where my root domain is present
SyncDomainController
SyncGlobalCatalogServer
GlobalCatalog server name -> where my root domain is present
UseSSL
no
Above configuration I am using to Synch my OU and Groups using scheduler Job.Following changes I have made in connector configuration.
1. Set the value of the SearchChildDomains entry to yes in one of the following lookup definitions:
For trusted source reconciliation: Lookup.Configuration.ActiveDirectory.Trusted
For target resource reconciliation: Lookup.Configuration.ActiveDirectory
2. Specify the name of the domain controller that is hosting the Global Catalog Server as the value of the SyncGlobalCatalogServer IT resource parameter.
For provisioning purpose I am trying to find following configuration which is mentioned in connector document,but unable to locate it.
In the connector, the referral chasing option is set to All, which means that all referrals are chased when any referral is provided by the domain controller
Thanks in advance.
Regards,
Nitin Natekar

Hi All,
Thanks all for the reply.I was not getting an error,but once I changed the connector configuration,It started working. I Kept the LDAPHostName parameter blank in connector configuration.
Thanks all for reply
Regards,
Nitin Natekar

Mailman v3 implementation of support for multiple domains

Mailman has evolved to support listserve names for multiple domains (think VH for listserves). At what point can we see Apple roll this kind of management into the existing product? It would be fabulous to give VH clients the ability to have their own 'branded' listserve experience rather than one with our default domains
Server Group -- please update Mailman when more pressing bug fixes are out of your way. Thank you!

Alex,
Thanks. I know that it can be done via the CLI, but once again we see where alterations done in the CLI will immediately require abandoning the SA as an admin tool. We're trying to encourage Apple to not create this paradox, or rather, to evolve the GUI admin toolset. I was recently at a Leopard Server tour seminar where the field engineer and I discussed this very feature. His comment to me was essentially 'many of the tools in the Server are based on open source projects, so you can simply download the latest update, compile it and configure it for the server ... but you won't be able to use the admin tools we provide." He's accurate, and if I was the only one admin'ing my machines, that might be a temporary solution to this particular small issue. But it immediately brings to mind the reflex question of 'so why did I buy Leopard server?
This is a matter of Apple needing to provide sufficient resources to the Server group to grow the product. Whether that means some new hiring, or not pulling engineers off for other product lines, or a different management paradigm. We shouldn't purchase a server product that is touted as an enterprise-class solution when it may only have a bare framework for the offered toolsets. If growing the toolset to match what is already offered in the open source world (for that particular product) requires abandoning the server tools, then there's a bit of a vision problem with the Server product.
Sorry, -- I didn't mean to get on a soap box. You and I are here to learn and help others. I know you aren't part of Apple any more than I am. I do hope Apple engineers are given some time to peruse this board and mine it for ideas, or gauge the effectiveness of their solutions based on the questions and solutions posed here.
With Mailman 3 so far along in development (VH support was added in October), is Apple culling the very best from it for their user base (and adjusting the SA toolset accordingly)?

Configure portal to issue ticket (MYSAPPSSO2 cookie) for "higher" domain

Hello all,
we have an EP 7.00 (SP 22) which can be accessed using the following (faked) fully qualified URL:
https://host.sd1.sd2.mycompany.de:[HTTPS-port]/irj/portal
When logging on to the portal with username and password, the portal issues a logon ticket. In the browser, I can see the MYSAPSSO2 cookie and it is for the following domain:
.sd1.sd2.mycompany.de
From the portal, we call some BI report applications, which run on WebFocus. The WebFocus server is in the following domain:
.sd3.sd4.mycompany.de
Single sign-on does not work. It only works, if we modify the domain of the MYSAPSSO2 cookie (this we achieved with a firefox-addon) and "cut off" the two subdomains .sd3.sd4
My question: is it possible, to configure the portal in such a way, that the MYSAPSSO2 cookie is issued for domain
.mycompany.de ?
I have read some hints on domain relaxing. But I am not sure, if setting the parameter ume.logon.security.relax_domain.level would help us. If I understood it correctly, we would need to set the value to 3.
Best regards,
Philipp Hinnah

Hi Philipp,
yes, relax_domain is the correct parameter. By the way - use the search function in SDN and you will find a lot of threads around this issue. And also you would have found the answer.
Anja

Exchange setup for multiple domains

We are planning to deploy Exchange server 2013, We have two companies and would like to create Email box for both the companies with same name.
Example : [email protected], [email protected]
We would like to have separte email boxes for the both companies. Please suggest us accordingly.

That should be simple enough. Exchange can handle having multiple domains for sending / receiving and users can have multiple mailboxes configured in Outlook. The name field in Exchange doesn't need to be unique (the account name does obviously), so for
instance there's no issue having "Fred Bloggs" <[email protected]> and "Fred Bloggs" <[email protected]> both setup.
In a way the trickier part is setting it up in Outlook since different versions react differently. If you're using Outlook 2013 it should be quite straight forward. As you can see here
http://technet.microsoft.com/en-us/library/ee815819.aspx the manual setup is easy enough for multiple exchange mailboxes, though auto mapping should work as well. If you're in a network AD
environment (eg connecting using your local password), then realistically you'll want one mailbox to be primary which is associated to your network login, and then that login to have full access and send as permissions on the second mailbox.
You may also need to deploy a reg key change to enable saving sent items from the second mailbox into that mailboxes sent items folder rather then the primary mailboxes (assuming you want to keep messages two and from both domains separate and in their own
mailboxes). The reg key is listed here
http://support.microsoft.com/kb/2843677 and is definitely needed in Outlook 2007 and 2010 but I'm not sure if it's still an issue if you're using Outlook 2013.

Autodiscover and outlook anywhere for multiple domains

Hello
I have exchange 2010 SP3 environment which is currently in production. We have multiple domain names added to accepted domain and it’s working fine.
I have two different public IP Address for MX (SMTP ) and OWA.
following DNS records are created with ISP DNS Servers. Below find the example.
MX Records
Smtp.abc.com (10.1.202.10) (SMTP /MX)
Smtp.zxc.com (10.1.202.10) (SMTP /MX)- new domain
Smtp.qwe.com (10.1.202.10) (SMTP /MX) - new domain
OWA and Autodiscover
Mail.abc.com (10.1.202.2) (owa)
Autodiscover.abc.com (10.1.202.2)
Currently outlook anywhere and outlook autodiscover working for (mail.abc.com) domain without having any issues. All the other domain are failing errors when I’m testing the Remote connectivity Analyzer. When I’m trying configure the outlook
profile it’s not resolving the domain name.
OWA working for domain they also using the same url to access the OWA (https://Mail.abc.com/owa)
Any idea how to resolve this issue.
Aucsna

Hi,
Agree with Ed, generally, all names autodicover.SMTPAddressSuffix should be added in the certificate and Public DNS entries.
Alternatively, you can refer to the following article to simplify the namespace in certificate:
http://www.msexchange.org/articles-tutorials/exchange-server-2010/mobility-client-access/using-autodiscover-large-numbers-accepted-domains-part1.html
Note: Microsoft is providing this information as a convenience to you. The sites are not controlled by Microsoft. Microsoft cannot make any representations regarding the quality, safety, or suitability of any software or information found there. Please make
sure that you completely understand the risk before retrieving any suggestions from the above link.
Thanks,
Angela Shi
TechNet Community Support

Exchange 2013: how to set up multiple domain for OWA and ECP

Exchange 2013 on Windows 2012R2
Currently we have set this up using the guide below:
http://mouzzamh.wordpress.com/2013/02/04/accessing-owa-from-multiple-domain-url/
We can access OWA and ECP using the internal IP address/owa or ECP but when we use the URL it fails.
We gave it an external IP address as well just to check if it will externally since the external DNS are pointing to the correct records: same issue it only works on IP address/owa or /ecp
We were able to follow the guide from start to finish including the certs..
The only difference on the guide and our exchange IIS environment for the new website is when he mentioned "Under IIS Settings / ISAPI and CGI Restrictions" we only have "ISAPI filters"...." ISAPI and CGI Restrictions" is only
applicable to the default and backend website..
Also, when the guide points to the path, should it be the new website path?
Or maybe to avoid confusion, can anyone guide me on how to do it or any other guide that helped you if ever you had the same issue as mine?
Thanks.

Hi,
Please run the following to check your OWA virtual directories for all web sites:
Get-OWAVirtualDirectory | FL Identity,*URL*,path
Personal suggestion, please consider to deploy another new CAS server. Then we can configure different OWA URLs in different servers. And pointed mail.domain.com and webmail.domain.com to two CAS servers respectively.
Regards,
Winnie Liang
TechNet Community Support

Understanding Lync 2013 Deployment for Single forest multiple domain Infrastructure

Hello Everyone,
I have an issue in understanding a deployment scenario of Lync 2013 Enterprise edition.
We have a single forest multiple domain infra.
My My question here is, while AD prep, do we need to run Domainprep on every domain in the forest.
Thanks!
Thank You!!! BR, Ammi.

Hi Ammi,
To prepare Active Directory Domain Services for your Lync Server 2013 deployment, you must perform three steps in a specific sequence.
1.
Preparing the Active Directory schema in Lync Server 2013
Extends the Active Directory schema by adding new classes and attributes that are used by Lync Server.
Run once for each forest in your deployment where Lync Server will be deployed.
2. Preparing the forest for Lync Server 2013
Creates global settings and universal groups that are used by Lync Server.
Run once for each forest in your deployment where Lync Server will be deployed.
3. Preparing domains for Lync Server 2013
Adds permissions on objects to be used by members of universal groups.
Run once per user domain or server domain.
Hope it can be helpful.
Best regards,
Eric

Multiple Certs for multiple domains on one server

Is it possible with WLS6 and WLCS3.5 to serve up multiple domains with their own certificates?
i.e. https://www.foo.com and https://www.bar.com on the same box.

Hi,
for one WebLogic Server you can only specify one certificate. So to achieve
this you will have
to use different WLS instances for your domains - which is possible on the
same box.
Kind Regards
Maria Salzberger
Developer Relations Engineer
BEA Support
Mike Berger schrieb in Nachricht <3c21f5c3$[email protected]>...
Is it possible with WLS6 and WLCS3.5 to serve up multiple domains withtheir own certificates?
i.e. https://www.foo.com and https://www.bar.com on the same box.

Multiple objects, multiple domains, for-loops the problem?

Hi,
I've based a small amount of Powershell code off the code I've found here: http://halfloaded.com/blog/powershell-using-posh-to-search-across-multiple-domains-in-forest/
Ideally what I'm aiming for is for it to find the current forest, enumerate the domains, and then for each domain to search for a specific user. If it finds the user it should then do something, for now just clear a value extensionAttribute8.
What I suspect is happening is it finds the users but then tries to modify them while attached to the current domain, which is child1.
Domain structure:
- Root
- child1
- child2
cls
$objForest = [System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()
$DomainList = @($objForest.Domains | Select-Object Name)
$Domains = $DomainList | foreach {$_.Name}
foreach($Domain in ($Domains))
$ADsPath = [ADSI]"LDAP://$Domain"
$objSearcher = New-Object System.DirectoryServices.DirectorySearcher($ADsPath)
$objSearcher.Filter = "SamAccountName=testuser"
$objSearcher.SearchScope = "Subtree"
$colResults = $objSearcher.FindAll()
foreach ($objResult in $colResults)
$userDomain = $objResult.GetDirectoryEntry()
Set-ADUser $userDomain.DistinguishedName[0] -clear extensionAttribute8
It errors with
Set-ADUser : Cannot find an object with identity: 'CN=testuser,CN=Users,DC=root,DC=company,DC=co,DC=uk' under: 'DC=child1,DC=root,DC=company,DC=co,DC=uk'.
At line:17 char:9
+ Set-ADUser $userDomain.DistinguishedName[0] -clear extensionAttribute8
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (CN=testuser,C...pny,DC=co,DC=uk:ADUser) [Set-ADUser], ADIdentityNotFoundException
+ FullyQualifiedErrorId : Cannot find an object with identity: 'CN=testuser,CN=Users,DC=root,DC=company,DC=co,DC=uk' under: 'DC=child1,DC=root,DC=company,DC=co,DC=uk'.,Microsoft.ActiveDirectory.Management.Comman
ds.SetADUser
Set-ADUser : Cannot find an object with identity: 'CN=testuser,CN=Users,DC=child2,DC=root,DC=company,DC=co,DC=uk' under: 'DC=child1,DC=root,DC=company,DC=co,DC=uk'.
At line:17 char:9
+ Set-ADUser $userDomain.DistinguishedName[0] -clear extensionAttribute8
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (CN=dttestuser,C...ita,DC=co,DC=uk:ADUser) [Set-ADUser], ADIdentityNotFoundException
+ FullyQualifiedErrorId : Cannot find an object with identity: 'CN=dttestuser,CN=Users,DC=its,DC=ad,DC=capita,DC=co,DC=uk' under: 'DC=central,DC=ad,DC=capita,DC=co,DC=uk'.,Microsoft.ActiveDirectory.Management
.Commands.SetADUser
Please help!

cls
Import-Module ActiveDirectory
Foreach ($Domain in (Get-ADForest).Domains)
#Performing Search Operation per Domain
$Objects = Get-ADObject -LDAPFilter "SamAccountName=dttestuser" -Server $Domain -Properties extensionAttribute8
Foreach ($Object in $Objects)
Set-ADUser $Object -clear extensionAttribute8
If anyone could tell me why removing the loop:
Foreach ($Object in $Objects)
And saying
Set-ADUser $Objects -clear extensionAttribute8
Errors I'd be interested. $objects only finds 1 object so having the loop makes no sense but it does seem to stop it error'ing!

Multiple domains for vpn

Hi,
Is it possible to tied multiple varied AD domains ( like abc.com, ab.com) within single ssl vpn box setup.
this is using an ASA 5540 with Version 8.0(4).
Thanks in advance!

See the following:
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00808c3c45.
shtml
*Perform Multi-Domain Searches (Optional) *
*Optional.* The ASA currently does not support the LDAP referal
mechanism for multi-domain searches (Cisco bug ID CSCsj32153).
Multi-domain searches are supported with the AD in Global Catalog Server
mode. In order to perform multi-domain searches, setup up the AD server
for Global Catalog Server mode, usually with the these key parameters
for the LDAP server entry in the ASA. The key is to use an
ldap-name-attribute that must be unique across the directory tree.
server-port 3268
ldap-scope subtree
ldap-naming-attribute userPrincipalName
If global catalog server is not an option for you, you can always create two seperate SSL tunnel-groups and two seperate LDAP aaa-server groups and this would also allow you to do two AD domains (but the drawback is that you would have to inform the user which group they should select)
-heather

Multiple domains for tracker.js

I'm using the personalization functionality of CQ 5.4, which appears to force a request for http://localhost:4502/libs/wcm/stats/tracker.js when pages load. According to the docs at http://dev.day.com/docs/en/cq/5-4/deploying/configuring_cq.html#OSGi Configuration in the Repository , I should be able to override this URL by adding some nodes to /apps/projectName. However, my tests seem to show that doing so for one project affects all sites on the server. In production, the client has a number of domains all running on one CQ instance.
1) Is there a way to remove this request altogether without modifying any JSPs in the /libs folder, or inheriting/overriding them?
2) Is there a way to support multiple domains?
The best solution I've come up with so far is creating a generic domain like cq-tracking.clientName.com, and having all sites use that.

See the following:
http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00808c3c45.
shtml
*Perform Multi-Domain Searches (Optional) *
*Optional.* The ASA currently does not support the LDAP referal
mechanism for multi-domain searches (Cisco bug ID CSCsj32153).
Multi-domain searches are supported with the AD in Global Catalog Server
mode. In order to perform multi-domain searches, setup up the AD server
for Global Catalog Server mode, usually with the these key parameters
for the LDAP server entry in the ASA. The key is to use an
ldap-name-attribute that must be unique across the directory tree.
server-port 3268
ldap-scope subtree
ldap-naming-attribute userPrincipalName
If global catalog server is not an option for you, you can always create two seperate SSL tunnel-groups and two seperate LDAP aaa-server groups and this would also allow you to do two AD domains (but the drawback is that you would have to inform the user which group they should select)
-heather

Creating multiple web sites for separate domain names

Is it possible to create a different web site using a different web address in IWeb 06? A friend asked me to make a web site for them....can/how do I publish it to a different address?
Thanks for the help!

Welcome to the Apple Discussions. The best way is to have a separate domain name for each site you want to manage. When you publish the sites each will have a separate URL. It will be:
http://web.mac.com/your .Mac account name/the site folder name/index.html
I use iWebSites to manage multiple sites.. It lets me create multiple sites and multiple domain files.
This lets me edit several sites and only republish the one I want.
OT

Multiple domain names for iWeb on .mac account

I've managed to get the iWeb site I created uploaded onto a domain name i created (eg www.abc123.com). I had to change the domain name on my .mac account. The thing is it only allows you to enter 1 domain name. Now I have purchased 3 domain names, one for myself, one for my business and one for my mothers business. Is there a way round this because at the moment I can't get round it. Thanks.

Hi Ben,
If using .Mac hosting and other hostings as well you can have multiple domains pointed to different sites so that each site will have yourdomain.com. However on .Mac you can have only one CNAME, the other personal domains should be WebForward or WebForward with cloaking.
- WebForward: after you typed yourdomain.com in the browser you get forwarded to web.mac.com/username/ and web.mac.com/username/ will display in the browser
- WebForward with Cloaking (also called masking): after you typed yourdomain.com in the browser yourdomain.com will display in the browser and don't change while people browse through your website
- CNAME yourdomain.com will display instead of web.mac.com/username/ and while browsing through your website it will look like yourdomain.com/sitename/nameofpagepeoplelookatnow.html
If you're using Godaddy this is how to setup WebForwarding
http://help.godaddy.com/article.php?articleid=422&topicid=
and this is masking/cloaking
http://help.godaddy.com/article.php?articleid=424&topic_id=165&progid=GoDaddy
Regards,
Cédric

Issuing Multiple MYSAPSSO2 tickets for Multiple Domains

Similar Messages

Maybe you are looking for