LDAP map group

Hello,
I'm trying to configure Novell eDirectory v 8.7 on BO XI R3.1 Windows platform and successfully configure the secLdap plugin.
However when I tried to map Mapped LDAP Member Groups by adding the LDAP group (by cn or dn) , I always get the following error:
The secLdap plugin failed to get the dn for the group group_name
Could anyone please help?

Thanks for your reply.
Yes we did download Softerra LDAP Browser 2.6 and successfully connect to our LDAP server.
I'm using exactly the same format in the CMC, and keep failed.
Is there any log file generated during the connection process to figure out where the failing lies?
>> then it's likely an issue with the LDAP attributes.
Do you mean the syntax?
I was entering the cn like : cn=bogroup,ou=groups,o=fsid
tried to remove the 'ou' and 'o' or even the group name only with no success.
Restarted the CMS as well as Windows server itself , same thing.

Similar Messages

LDAP Authentication Failed :user is not a member in any of the mapped group

Hi,
I tried to set up the LDAP Authentication but I failed.
LDAP Server Configuration Summary seems to be well filled.
I managed to add a Mapped LDAP member Group: This group appears correctly in the Group list.
But itu2019s impossible to create a User. Although this user is a member of the mapped group (checked with LDAP Brower) , an error message is displayed when I tried to create it (There was an error while writing data back to the server: Creation of the user User cannot complete because the user is not a member in any of the mapped groups)
LDAP Hosts: ldapserverip:389
LDAP Server Type: Custom
Base LDAP Distinguished Name: dc=vds,dc=enterprise
LDAP Server Administration Distinguished Name: CN=myAdminUser,OU=System Accounts,OU=ZZ Group Global,ou=domain1,dc=vds,dc=enterprise
LDAP Referral Distinguished Name:
Maximum Referral Hops: 0
SSL Type: Basic (no SSL)
Single Sign On Type: None
CMS Log :
trace message: LDAP: No such attribute: supportedControl, assuming no ranging support.
trace message: LDAP: LdapQueryForEntries: QUERY base: dc=vds, dc=enterprise, scope: 2, filter: (samaccountname=KR50162), attribute: dn objectclass
trace message: LDAP: LdapQueryForEntries: QUERY result: 0 took 2453 ms
trace message: LDAP: LdapQueryForEntries() QUERY number of entries returned: 1
trace message: GetParents from plugin for cn=huh\,chen, ou=accounts, ou=users, ou=domain1, dc=vds, dc=enterprise.
trace message: LDAP: De-activating query cache
trace message: LDAP: LdapQueryForEntries: QUERY base: , scope: 0, filter: (objectClass=*), attribute: supportedControl
trace message: LDAP: LdapQueryForEntries: QUERY result: 0 took 0 ms
trace message: LDAP: LdapQueryForEntries() QUERY number of entries returned: 0
trace message: LDAP: query for DSE root returned 89
trace message: LdapQueryForEntries: incr. retries to 1
trace message: LDAP: Updating the graph
trace message: LDAP: Starting Graph Update...
trace message: LDAP: LdapQueryForEntries: QUERY base: , scope: 0, filter: (objectClass=*), attribute: supportedControl
trace message: LDAP: LdapQueryForEntries: QUERY result: 0 took 0 ms
trace message: LDAP: LdapQueryForEntries() QUERY number of entries returned: 0
trace message: LDAP: query for DSE root returned 89
trace message: LdapQueryForEntries: incr. retries to 1
trace message: LDAP: LdapQueryForEntries: QUERY base: , scope: 0, filter: (objectClass=*), attribute: supportedControl
trace message: LDAP: LdapQueryForEntries: QUERY result: 0 took 0 ms
trace message: LDAP: LdapQueryForEntries() QUERY number of entries returned: 1
assert failure: (.\ldap_wrapper.cpp:3066). (pSetAttributes : no message).
trace message: LDAP: No such attribute: supportedControl, assuming no ranging support.
trace message: LDAP: LdapQueryForEntries: QUERY base: dc=enterprise, scope: 2, filter: (&(cn=gp-asia)(objectclass=group)(member=cn=huh
, chen, ou=accounts, ou=users, ou=domain1, dc=vds, dc=enterprise)), attribute: objectclass
trace message: LDAP: LdapQueryForEntries: QUERY base: , scope: 0, filter: (objectClass=*), attribute: supportedControl
trace message: LDAP: LdapQueryForEntries: QUERY result: 0 took 0 ms
trace message: LDAP: LdapQueryForEntries() QUERY number of entries returned: 1
assert failure: (.\ldap_wrapper.cpp:3066). (pSetAttributes : no message).
trace message: LDAP: No such attribute: supportedControl, assuming no ranging support.
trace message: LDAP: LdapQueryForEntries: QUERY base: dc=enterprise, scope: 2, filter: (cn=gp-asia), attribute: member objectclass samaccountname cn
trace message: LDAP: LdapQueryForEntries: QUERY result: 0 took 3109 ms
trace message: LDAP: LdapQueryForEntries() QUERY number of entries returned: 0
trace message: LDAP: query for DSE root returned 0
trace message: Failed to commit user 'KR50162'. Reason: user is not a member in any of the mapped groups.
trace message: [UID=0;USID=0;ID=79243] Update object in database failed
trace message: Commit failed.+
Can you please help?
Joffrey

Please do this after you verify all permission settings for all the groups the account is associated with. Also, make sure you check the NTFS folder permissions before doing this as well.
Since the same result happens on multiple computers, it is not the profile.
I am recommending you delete the AD account (or rename to backup the account).
It will not effect the users Exchange account, but you will need to link it back to the new AD user account.
You can also delete her profile just to remove it, for the "just in case" scenario.
Don't forget to mark the post that solved your issue as "Answered." By marking the Answer you are enabling users with similar issues to find what helped you. Lewis Renwick - IT Professional

How to only synchronize one specific LDAP user group with SAP?

Hi,
Hopefully this is the correct forum to post this in. I want to have continuous one-way synchronization of users from my LDAP server to my SAP central system. I've started configure in SAP using transaction SM59 and LDAP. Can I somewhere set that only one specific LDAP user group shall be transferred to SAP (they do not need to be assigned to any specific group, profile, role in SAP) - or should this be done on the LDAP server side (or is it at all possible)?
Correct me if I'm wrong, but the User Group field in the report RSLDAPSYNC_USER only concerns SAP user groups right? This would therefore not be sufficient since I want to select the users to synchronize based on user groups in the directory.
Thanks, Oscar

We've used a repository constant to specify the LDAP filter for reading users / groups from the LDAP target.
E.g. LDAP_FILTER_USERS (&(objectCategory=person)(objectClass=user))
Then we also have a constant for the LDAP_STARTING_POINT
For our AD Group Initial Load we filter according to these settings:
LDAP_FILTER_GROUPS = (objectclass=group)
LDAP_STARTING_POINT_GROUPS = ou=IDMManagedGroups,ou=Groups,dc=cfstest,dc=le,dc=ac,dc=uk
The above example only reads AD groups starting at the specified OU
Then in a Job From LDAP Pass the LDAP URL looks like this:
LDAP://%$rep.LDAP_HOST%:%$rep.LDAP_PORT%/%$rep.LDAP_STARTING_POINT_GROUPS%?*?SUB?%$rep.LDAP_FILTER_GROUPS%
I hope this helps
Paul

Value Mapping Group in PI 7.1

Hi All,
In PI 7.1 Integration Directory there is one section as "Value Mapping Group".I suppose that it is used if and only if value mapping is used.But I am not using any kind of value mapping so can I skip that section?
Thanks in advance.

Hi Abhishek,
THanks for the reply.
I have another query. it is as follows:
Actually I am having the Process Order coming in the source with 5 to 6 relevant fields.Out of these Process Order fields Status is one of the fields.Based on the the StatuS field the BAPIs will be called at the receiver.So can I skip Integrated Configurations as I am imposing the condition on the data in the payload(Source Structure) as Integrated configuration will not be helpful in my scenerio.?
Or shall I skip Sender Agreement ,Receiver Agreement?
Thanks in advance.

External ldap mapping & portal 6.2

Hello
To my knowledge external ldap mapping is not supported in portal 6.0 & portal 6.1, my question is it implemented in portal 6.2 ?! , If not is there any workaround that can solve this issue and considered as a professtional solution !

Yes, you can do authentication against your existing
external LDAP and dynamicaly create user profiles
in your local LDAP(which can be physically on a different box)
The "professtional name" for this configuration is:
LDAP "profile server" with "external authentication" LDAP.
Cheers,
Alex :-)
PS: After "Sun Forum Accounts Update" I couldn't login to this forum and at SUN
no one cares - they just ignore my mails. "Thanks a lot" for supporting free comunity!
(Check my old profile at http://swforum.sun.com/jive/profile.jspa?userID=3455)
OK. I have now a new account and I will try to help you out here...
-------------------------------------------------------------------------

XI30 - Value Mapping Group ?

Hi,
Inside XI, I need to create several conversions.
I want to use a "Value Mapping" and not a "FixValue".
I succeed with a simple test with a value mapping...
But as I need to create about 30 value mappings, I need to know exactly what is a "value mapping group" in order to integrate it correctly?
Example of conversion table: UnitMeasurement (like table T006B of R/3)
Source | Target
 Unit1 | U1
 Unit2 | U2
 ... | ...
 Unitn | Un
Currently inside XI30, I have created this value mapping:
Source Agency: BS_PC (Business System for PC)
Source Scheme: UnitMeasurement
Target Agency: BS_R3 (Business System for R/3)
Target Scheme: UnitMeasurement
Source Value | Target value | Group name
 Unit1 | U1 |
 Unit2 | U2 |
 ... | ... |
 Unitn | Un |
Thanks.

A Value Mapping Group helps you to keep values of different systems together and it is useful, when you want to maintain values for three or more business systems.
Example: You have three business systems A B C and have different values for Company Code in each system
A B C
0001 T100 A-01
0002 T200 A-02
0003 T300 A-03
Now you can maintain the values as pair of agencies:
A B Group Name
0001 T100 T100
0002 T200 T200
0003 T300 T300
And you can maintain the values belonging to the same group:
A 0001
B T100
C A-01
You need not maintain values for groups, so leave it empty, when you have only two different columns of values.
Regards
Stefan

How to retrieve members of ldap dynamic groups?

Hi,
Can any one provide me the java-code snippet for listing the members(users) of a LDAP-dynamic group?
Regards.

How is this different from [your previous question|http://forums.sun.com/thread.jspa?threadID=5434523&messageID=10965220#10965220]? If it is the same queston, then please stay in the same thread.

LDAP admin group.

Hi,
I am using Weblogic version 6 with sp1.
When setting up a LDAP realm for authentication, are you forced to
define your users in a LDAP "admin" static group so that the members
will be listed in the console and authentication will work? I could not
get the security web example to work until I did this? I was trying to
get it to use a different group but could not get the console to list
the members and authentication would always fail.
Is there some configuration--other than the respective LDAP realm--that
has to be done to tell Weblogic to authenticate to a "user" defined LDAP
static group besides "admin".
Thanks for your time,
David R. Graves

I think I found the answer I am looking for.
Has anyone had any trouble with Weblogic working with static LDAP groups
that contain underscores in the name? Example: The_User. Weblogic seems
to have a problem with a group named this way. If I use Theuser, then
the console and authentication will work okay.
- David R. Graves
David Graves wrote:
Hi,
I am using Weblogic version 6 with sp1.
When setting up a LDAP realm for authentication, are you forced to
define your users in a LDAP "admin" static group so that the members
will be listed in the console and authentication will work? I could
not get the security web example to work until I did this? I was
trying to get it to use a different group but could not get the
console to list the members and authentication would always fail.
Is there some configuration--other than the respective LDAP
realm--that has to be done to tell Weblogic to authenticate to a
"user" defined LDAP static group besides "admin".
Thanks for your time,
David R. Graves

ADAggregationManager::GetNestedParents() -- Mapped group not found in graph

Hi,
I am new to Crystal Reoprts.
We are getting errors in the same package. Users are getting authenticated OK, but we are unable to retrieve their privileges, Crystal Reports (V2.5) should be displayed based on AD groups they belong to.
CMS logs show,
[Wed May 28 15:20:45 2014]
2288
5256
assert failure: (Y:\authentication\WindowsADAuthen\ADAggregationManager.cpp:1143). (0 : WINAD: ADAggregationManager::GetNestedParents() -- Mapped group not found in graph!).
[Wed May 28 15:20:45 2014]
2288
5216
assert failure: (Y:\authentication\WindowsADAuthen\ADAggregationManager.cpp:1143). (0 : WINAD: ADAggregationManager::GetNestedParents() -- Mapped group not found in graph!).
[Wed May 28 15:20:45 2014]
2288
5256
assert failure: (Y:\authentication\WindowsADAuthen\ADAggregationManager.cpp:1143). (0 : WINAD: ADAggregationManager::GetNestedParents() -- Mapped group not found in graph!).
Any help really appreciated.

That helps a bit more. CE 10 is end of life a long time ago.
You can get the SDK help files for current versions from here:
help.sap.com
I don't believe the API's have changed for this part so use the SDK helpfile for more info.
You may be able to find examples here:
Crystal Reports for .NET SDK Samples - Business Intelligence (BusinessObjects) - SCN Wiki
Don

Understanding LDAP Security Groups - Need assistance...

Hi,
Can someone walk me through a simple step-by-step outline of how to adjust LDAP security groups so that they work properly with report objects and folders. I've added a number of LDAP groups to our server and see the user accounts in them but am having difficulty understanding how to apply these groups to the right folders and have access behave correctly. As an example I have a couple groups where a few users are in LDAP under MKTDEPT and others are under SYSUSR. A few users are in both. I want to give MKTDEPT view rights to a folder whereas SYSUSR gets schedule rights. I'm having an issue with teh Everyone group in that I have to set it to at least 'view' for anyone to see anything. This is even though the MKTDEPT and SYSUSER user security is set lower. So what's the best approach to get this to work right? Any steps or documents that could help me out would be terrific.
Thanks,
Dom

Dominic,
Most of the information you need is in the Administration Guide.
That said, here's how I would do it:
Lets say MKTDEPT has users A,B,C,D,E and SYSUSER has users B,C,D,H,J. Lets call the folder you want to assign rights to as (rather unimaginatively) FolderA.
For FolderA, set the following rights.
Everyone Group --> No Access
MKTDEPT --> View
SYSUSER --> Schedule
The problem now is dealing with users that belong to both group. For this, I would create a new (Enterprise) group called MKTSYS and add the common users to that group. This group would get Schedule rights to FolderA.
Also, as a practice, it is best to create Enterprise copies of your LDAP groups (especially since you have users that can belong to multiple LDAP groups). So, you would have
*MKTDEPTENT which contains users in the MKTDEPT LDAP group.
SYSUSERENT which contains users in the SYSUSER LDAP group.*
I would then add these groups to the list of groups with access to FolderA.
So, the list of groups with access to FolderA would be:
Everyone
MKTDEPTENT
SYSUSERENT
MKTSYS
and the rights would be:
Everyone Group --> No Access
MKTDEPTENT --> View
SYSUSERENT --> Schedule
MKTSYS --> Schedule
Please note that the Everyone Group does not need to have View access. That said, the Everyone Group does need to be in the access list for FolderA.
Also, while this method of replicating LDAP group structure in BO creates additional administrative work, I am of the opinion that it is a small price to pay to prevent unauthorized access.
Hope this helps,
Srinivas

Where are mapping groups stored?

Hi all,
when I create a new mapping group in the DITA options menu, in which file is it stored?
I need to tranfer a mapping group to other computers. Also I found that I cannot edit or delete individual entries in the mappung group (the button "edit" is always greyed out) and hope to be able to do so directly in the corresponding file.
Robert

HI Robert...
You should find what you need in ..
%appdata%\Adobe\FrameMaker\<ver>\ditafm.ini
Cheers,
...scott

ACS Mapping Group @ Trust-Tree (Domain Trust)

Dears,
Could ACS mapping group @ AD Domain trust??
I install abc.com / qqq.com and trust other!
My ACS install in abc.com domain, but I cannot get qqq.com user information?
^ ^
消息编辑者为：mr.marslin

The Database Group Mapping feature in the External User Databases section enables you to associate unknown users with a CiscoSecure ACS group for assigning authorization profiles. For external user databases from which CiscoSecure ACS can derive group information, you can associate the group memberships defined for the users in the external user database to specific CiscoSecure ACS groups
http://www.cisco.com/en/US/products/sw/secursw/ps2086/products_user_guide_chapter09186a0080205a4f.html#wp712817

Server App not seeing external LDAP users & groups

I have a clean 10.8.2 + Server install set up with our standard external LDAP directory (Novell's eDirectory in our case) configuration that is known to support Lion & Mountain Lion client LDAP authentication. With this same configuration on OS X 10.8.2 Server both Directory Utility and WGM can see all the LDAP users and groups as expected.
When I look for the external users & groups in the LDAP domain under the Server App "Accounts" heading I cannot see any entries in either users or groups lists. Should I be able to or is this a Server App quirk?
I can add individual LDAP users to a local group and enable access to individual services. How can I give access to services to all LDAP users without having to build & maintain a massive "All LDAP Users" local group?
Is there a published list of required LDAP attributes for users & groups for Mountain Lion Server? I suspect there are new requirements over and above those for 10.6 server but I have failed to find a good reference. I've noticed I get different behaviours for LDAP templates that includes a mapping for GeneratedUID to one which does not for example.
This is all so much more opaque than our superbly reliable Snow Leopard servers!
TIA

Ok, and again:
You want to see Users and Groups , which are stored in an third Party directory service like OpenLDAP, in your Server.app? This is what you have to do:
Connect the third party ldap to your server
Have all your external LDAP entries made so you can see them in the Workgroup Manager and are able to Login with them
When you see your LDAP-entry in the Directory Manager, change it from "From Server" to "RFC2307"
Edit the entry, add the following mapping to it:GeneratedUUID maps to apple-generateduuid
To your group and user entries in the external LDAP add the follwing attribute:apple-generateduuid gets the value taken from the output of "uuidgen"
Feel lucky
And there ist ist; now you are able to use The accounts taken from an external LDAP.

LDAP user group

I have configured the LDAP to connect to the AD. I can see the required Roles in the "Roles to Map" Tab on LDAP user Configuration.
I am able to import the Users.
I am able to see the groups in the SAP xMII Menu -> Portal Services -> Navigation tab and also in SAP xMII Menu -> Security Services -> System Security.
But when i assign pages to the Roles and Login with the Users under the Role. The Navigation menu doesnt show the pages linked to the role. When i tried accessing the property using http://<server name>/Lighthammer/PropertyAccessServlet?Mode=List, It shows that the user doesnt belong to any roles(blank space in place of roles).
However, when i try to check the same using LDAP queries (Select Roles for User & Select Role by Distinguished Name) it shows that the user belongs to the group to which i assigned the pages in the SAP xMII Menu -> Portal Services -> Navigation Menu.
Does it have something to do with the Role mapping in the LDAP user configuration? I havent assigned any of the groups(including the one i want) to any of the default xMII roles.
I also tried assigning all the roles to all the services in xMII. It still shows that the user doesnt belong to any group. Manually if i assign to any group through SAP xMII Menu ->Security manager ->Roles ->Admin, it works fine. But, as the imported groups are not listed in the security manager I cannot manually assign these users to the groups(also i cannot do this for all the users, even if it was possible)
Any ideas?

I tried assigning the user to the Everyone group and also checked the Logs. Below are the results:
cmsseclogin.log
2007-11-28 17:12:04,097 [login] IP 64.240.152.5 - Successful login for user a0000, service url http://phixmiiqas01.sbs.int/Lighthammer/
2007-11-28 17:12:04,534 [login] IP 10.144.18.63 - Ticket has been validated for user a0000
cmssecurity.log
2007-11-28 17:12:04,472 [ServletExec: request: time=1196287924456, uri=/LHSecurity/validate] WARN Validate - Proxy URL requested [http://phixmiiqas01.sbs.int], is not a authorized proxy
no luck so far!!

Configure SAP LDAP mapping for MS-ASD

Hello,
I 'm configuring an LDAP connector from my MS-AD to my SAP-4.7 ABAP system so the user account from the MS environment gets synchronized with my SAP system.
I have configured the connection and created some mapping already but I have still some questions about the settings:
1. With the report I'm able to synchronize an MS_AD account with my SAP environment. For the first test I only add one account name so all other existing accounts are not changed. When the MS-AD account not exists on SAP the account is created like the mapping. I have also the option in this report to delete the user account from the SAP system when the account doesn't exist any more in the MD-AD. How could I prevent that some special user accounts on the SAP system are note deleted even when they are not available in the MS-AD?
2. With the mapping function MAP_SPLIT_CHAR a variable by a certain character into two ore more SAP fields like telephone number and telephone extension. Is it possible to split the content of a variable by a fixed amount of characters?
For example the user location is written like ABC.XZZ
ABC is the building number and X is the floor number and ZZ is the chamber.
3. With the mapping function MAP_conc_CHAR I'm able to combine to MS-AD fields into one SAP filed. Is it possible to combine a constant value with a field from MS-AD?
4. I'm able to insert multiple parameters or user roles by using the function MAP_CONSTANT. I add one attribute and the constant values as parameters. For a couple of parameters I have to insert a MS-AD field. How could I combine inserting constant parameters with some MS-AD fileds
Example
The Parameters CAC and BUK are fixed to the company code. But the parameter PER must be set to the employee number. This value I get from the MS-AD .
5. For the Employee mapping to SAP-HR I have also to configure the Stucture and fields. Does any one have an overview of structure names and field names from the employee structure? It couldn't be asked with the F4 option which could be user with the user mapping.
Manny thanks in advanced for the answers.
Kind regards,
Richard Meijn

Hi,
1.
create a user group for the special users and another user group for "real" users. Restrict the synchronization report to the second user group.
2.
You can write your own mapping functions. You will need a developer key in your system and some ABAP knowledge. Create your functions with SE80 or SE37. It is easy to create a function
3.
The same: create your own mapping function.
4.
It might be possible to fill the different parameters from different AD values depending on the parameter name. Use the ABAP statement "CASE". But there is no such function. You have to write it by yourself.
But think about what you really want to do. Do you want to invent an Identity Management? There are already a lot of tools. The SAP answer "SAP Netweaver Identity Management" was already mentioned.
Regards
Rainer

LDAP map group

Similar Messages

Maybe you are looking for