Mapping UME Roles to J2EE Engine Security Roles

Hi all,
is there a way to map the roles defined in UME which are used in a Web Dynpro application to those declared as part of an EJB descriptor?
Any help is highly appreciated.
Regards,
Sebastian

Hi Sebastian,
yes, it is possible to do such mapping. And here how it works:
1. define security roles in the ejb-jar.xml within the <security-role>. For example:
<security-role>
     <role-name>test</role-name>
</security-role>
2. then you map the roles those roles to server security roles using the <security-role-map> tag of the ejb-j2ee-engine.xml descriptor.
<security-permission>
   <security-role-map>
      <role-name>test</role-name>
      <server-role-name>myUMErole</server-role-name>
   </security-role-map>
</security-permission>
the myUMErole must be defined in the UME!
Does this answer your question?

Similar Messages

Access UME from another J2EE engine

Hi,
I use a webdynpro application in a webdynpro iview, but the application is deployed to another server than the portal. It works so far, but I have to access the UME to read out informations about roles. But I can only access the UME of the server where I deployed the application, however I need to access the UME of the portal. How can I access the UME of the portal server, it is even possible?
Regards
Roman

Roman,
     The 2 solutions came to my mind are
     1. deploying your application on the server which has your portal running on it. This ultimately not favourable to your case.
     2. Creating a webservice for the UME data and deploying onto server that has portal running on it. consuming this webservice in your
         webdynpro application and deploying on any other server of your choice.
may not be of much help for you but some ideas....
Kiran
Edited by: kiran pichika on Apr 23, 2008 8:21 PM

End User Roles Tab: Link to security roles on ECC?

Hi-
There is a configurable value in the End User Roles tab where you can populate Roles. However when you select the values they only pull in roles loaded on the SolMan system. How can I access roles in target systems, so they can be mapped to my process hierarchy?

Hi
what do u mean by target systems... satellites systems.......i think you are confused somehow
this tab is used for learning map user roles
check this out and read it completely
http://help.sap.com/saphelp_sm32/helpdata/en/ee/4344ed87a24d8da937c565bf572408/frameset.htm
Learning map use
You want to send the learning map to a group of users with the same business role, e.g. to all accountants in your company, or to the purchasing department. You copy existing business roles in the Solution Manager, or create new ones.
Hpoe it clarifies ur doubt
regards
prakhar

Problem mapping LoginModule roles to ejb security roles

I have "successfully" managed to implement the DBSystemLoginModule. When I run my application I successfully authenticate to the database, the login module successfully retrieves the users roles from the database and adds them to the subject:
PassiveCallbackHandler cbh = new PassiveCallbackHandler(username, password);
LoginContext lc = new LoginContext("current-workspace-app", cbh);
lc.login();
I then perform a lookup on a bean using the same user:
Hashtable env = new Hashtable();
env.put(Context.INITIAL_CONTEXT_FACTORY, "oracle.j2ee.rmi.RMIInitialContextFactory");
env.put("java.naming.security.principal",username);
env.put("java.naming.security.credentials",password);
env.put("java.naming.provider.url", "ormi://localhost:23891/current-workspace-app");
Context ic = new InitialContext(env);
final SessionEJBHome sessionEJBHome =
(SessionEJBHome) PortableRemoteObject.narrow( ic.lookup( "SessionEJB" ), SessionEJBHome.class );
Finally, I create an instance of the bean and call a method of this bean.
SessionEJB sessionEJB;
sessionEJB = sessionEJBHome.create( );
sessionEJB.testMe( );
I am expecting (hoping) that the roles retrieved from the database by the login module may be used to authenticate the ejb methods. i.e. if (in ejb-jar.xml) the method "testMe" has a method-permission with role-name of "ABC" then this method may only be accessed if the user is a member of the "ABC" role retrieved from the database by the login module. However I get the message:
"username is not allowed to call this EJB method"
When I add a security-role-mapping in orion-ejb-jar.xml mapping the role "ABC" to the group "ABC" (and impliesALL="true") then the method is called successfully. However, if I add a security-role-mapping mapping the role "DEF" to the group "DEF" (which the user is not a member of) the ejb method is (wrongly) called successfully (with implies all="false" the method always fails). In other words there seems to be no mapping of the roles retrieved by the login module to the ejb security roles.
Can anyone please enlighten me on how I can achieve the mapping of the ejb security roles to the roles obtained from the login module.
Thanks
PS I have this problem with JDeveloper 10.1.3 (Developer Preview 10.1.3.0.2.223 and Early Access 10.1.3.0.3.3412)

Hi Sebastian,
yes, it is possible to do such mapping. And here how it works:
1. define security roles in the ejb-jar.xml within the <security-role>. For example:
<security-role>
     <role-name>test</role-name>
</security-role>
2. then you map the roles those roles to server security roles using the <security-role-map> tag of the ejb-j2ee-engine.xml descriptor.
<security-permission>
   <security-role-map>
      <role-name>test</role-name>
      <server-role-name>myUMErole</server-role-name>
   </security-role-map>
</security-permission>
the myUMErole must be defined in the UME!
Does this answer your question?

Mapping security roles to other roles

I found the security newsgroup and posted the question there under the same topic. Kindly respond there.
Message was edited by:
jheinone

Hi Sebastian,
yes, it is possible to do such mapping. And here how it works:
1. define security roles in the ejb-jar.xml within the <security-role>. For example:
<security-role>
     <role-name>test</role-name>
</security-role>
2. then you map the roles those roles to server security roles using the <security-role-map> tag of the ejb-j2ee-engine.xml descriptor.
<security-permission>
   <security-role-map>
      <role-name>test</role-name>
      <server-role-name>myUMErole</server-role-name>
   </security-role-map>
</security-permission>
the myUMErole must be defined in the UME!
Does this answer your question?

Error :Authorization check for caller assignment to J2EE security role whil

Hi Experts,
i m working as a portal resource .
after the deployment of standered Sap e-rec package .
i m getting some error. i have assigned the recruiter role to one test user.
Now i m getting two issue:
1)All the services are appearing in Detailed Navigation Pannel but not in Portal content area..
2) I m able to see few iview for the test user but those are also in detailed navigation view.
And few ivews are giving following error :
i)Internal error
ii)error 2011-12-19 07:59:57:315 ACCESS.ERROR: Authorization check for caller assignment to J2EE security role [sap.com/com.sap.lcr*sld : LcrInstanceWriterNR] referencing J2EE security role [SAP-J2EE-Engine : administrators].
/System/Security/Audit/J2EE com.sap.engine.services.security.roles.audit n/a EP-DEV-KRT Server 0 0_97989
Full Message Text
ACCESS.ERROR: Authorization check for caller assignment to J2EE security role [sap.com/com.sap.lcr*sld : LcrInstanceWriterNR] referencing J2EE security role [SAP-J2EE-Engine : administrators].
please suggest what can be done or what is pending from my side.

Prajakta2602 wrote:
Hi Experts,
>
> the previous issue got solved..
> it was due to servies pack miss match and applying notes
> the Basis guy checked the SLD logs and accordingly found that the base components J2EECORE and JTECHS required paching as per
> notes 1445294 and 1175239 were applied.
> now the issue is:
>
>
> After implemetation and i assigning the standerd sap roles
> 1)Recruiter Administrator
> 2)Recruiter
> to the test user .
> but for few iview it is showing error as in
> 1) you are not a authorized user
> 2) internal error
>
> please help experts.
>
> i m working on portal side have i to assign any role to that test user..
>
>
> Thnaks & Regards,
> Prajakta
You can run a quick check using the below steps:
1. Check in backend whether there is any authorisation errors... you may use transactions SU53 or ST22 for any ABAP errors
2. Also check in NWA -> log viewer -> last 24 hours log for the particular user to see any java related issues.
Regards,
Mahesh

How Does The security-role Mapping Work?

          I am studying the security part of the deployment descriptor. I am confused about
          how the mapping works.
          Suppose we have
          <security-role>
          <role-name>manager</role-name>
          </security-role>
          and
          <security-role-ref>
          <role-name>FOO</role-name>
          <role-link>manager</role-link>
          </security-role-ref>
          My first question is when a client of the servlet supplies a name for authentication,
          the name supplied should be FOO or can be, say, John Smith?
          Then, according to the Servlet Specification, a security role is a logical grouping
          of users defined by the Application Developer
          or Assembler. When the application is deployed, roles are mapped by a Deployer
          to principals or groups in the runtime environment.
          My second question is how deployer maps the role, say, manager, to principals
          or groups in the runtime environment?
          Thanks in advance.


          Thanks a lot, Udit.
          "Udit Singh" <[email protected]> wrote:
          >
          >Hello,
          >The role-name is mapped to principals or gruops based on the security-role-assignment
          >entrires in weblogic.xml. Let us say you have a role-name FOO and you
          >want to
          >assing this role to users John and Mark. You need to make this entry
          >in weblogic.xml-
          ><security_role_assignment>
          > <role-name>FOO</role-name>
          > <principal-name>John</principal-name>
          > <principal-name>Mark</principal-name>
          > </security_role_assignment>
          >
          >so now actually the user need to supply John or Mark as user name at
          >the time
          >of authentication . Hope it helps.
          >
          >Udit
          >
          >
          >"[email protected]" entrance wrote:
          >>
          >>I am studying the security part of the deployment descriptor. I am confused
          >>about
          >>how the mapping works.
          >>Suppose we have
          >><security-role>
          >><role-name>manager</role-name>
          >></security-role>
          >>
          >>and
          >>
          >><security-role-ref>
          >><role-name>FOO</role-name>
          >><role-link>manager</role-link>
          >></security-role-ref>
          >>
          >>My first question is when a client of the servlet supplies a name for
          >>authentication,
          >>the name supplied should be FOO or can be, say, John Smith?
          >>
          >>Then, according to the Servlet Specification, a security role is a logical
          >>grouping
          >>of users defined by the Application Developer
          >>or Assembler. When the application is deployed, roles are mapped by
          >a
          >>Deployer
          >>to principals or groups in the runtime environment.
          >>
          >>My second question is how deployer maps the role, say, manager, to principals
          >>or groups in the runtime environment?
          >>
          >>Thanks in advance.
          >>
          >>
          >>
          >

Using weblogic security roles in authentication: weblogic 9

Hi All,
I am trying to create a simple application which uses declarative authorization configured in web.xml. I use the simple form based authentication. While trying to deploy my application, I get the error:
weblogic.management.DeploymentException: [HTTP:101168]The security-role-assignment references an invalid security-role: LTVORole.
But I have defined the role LTVORole in weblogic using the administrator console.
below are the details of what I have done:
Web.xml:
========
<?xml version='1.0' encoding='UTF-8'?>
<j2ee:web-app xmlns:j2ee="http://java.sun.com/xml/ns/j2ee">
<j2ee:welcome-file-list>
    <j2ee:welcome-file>login.jsp</j2ee:welcome-file>
    <j2ee:welcome-file>index.html</j2ee:welcome-file>
    <j2ee:welcome-file>index.htm</j2ee:welcome-file>
</j2ee:welcome-file-list>
<j2ee:login-config>
    <j2ee:auth-method>FORM</j2ee:auth-method>
    <j2ee:form-login-config>
      <j2ee:form-login-page>/login.jsp</j2ee:form-login-page>
      <j2ee:form-error-page>/error.jsp</j2ee:form-error-page>
    </j2ee:form-login-config>
</j2ee:login-config>
<security-constraint>
<display-name>checkAccountConstraint</display-name>
<web-resource-collection>
<web-resource-name>checkAccountCollection</web-resource-name>
        <url-pattern>test.jsp</url-pattern>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
        <role-name>LTVORole</role-name>
</auth-constraint>
</security-constraint>
</j2ee:web-app>Weblogic.xml
===========
<?xml version="1.0" encoding="UTF-8"?>
<ns:weblogic-web-app xmlns:ns="http://www.bea.com/ns/weblogic/90">
<security-role-assignment>
    <role-name>LTVORole</role-name>
   <externally-defined/>
</security-role-assignment>
</ns:weblogic-web-app>I have created the role in weblogic in the menu
security realms > myrealm > roles and policies > Global Roles > roles > LTVORole
Is it the right way to define a role?
Please help me find where I am going wrong.
Thanking you all in advance,
Gireesh

Hi All,
I am trying to create a simple application which uses declarative authorization configured in web.xml. I use the simple form based authentication. While trying to deploy my application, I get the error:
weblogic.management.DeploymentException: [HTTP:101168]The security-role-assignment references an invalid security-role: LTVORole.
But I have defined the role LTVORole in weblogic using the administrator console.
below are the details of what I have done:
Web.xml:
========
<?xml version='1.0' encoding='UTF-8'?>
<j2ee:web-app xmlns:j2ee="http://java.sun.com/xml/ns/j2ee">
<j2ee:welcome-file-list>
    <j2ee:welcome-file>login.jsp</j2ee:welcome-file>
    <j2ee:welcome-file>index.html</j2ee:welcome-file>
    <j2ee:welcome-file>index.htm</j2ee:welcome-file>
</j2ee:welcome-file-list>
<j2ee:login-config>
    <j2ee:auth-method>FORM</j2ee:auth-method>
    <j2ee:form-login-config>
      <j2ee:form-login-page>/login.jsp</j2ee:form-login-page>
      <j2ee:form-error-page>/error.jsp</j2ee:form-error-page>
    </j2ee:form-login-config>
</j2ee:login-config>
<security-constraint>
<display-name>checkAccountConstraint</display-name>
<web-resource-collection>
<web-resource-name>checkAccountCollection</web-resource-name>
        <url-pattern>test.jsp</url-pattern>
        <http-method>GET</http-method>
        <http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
        <role-name>LTVORole</role-name>
</auth-constraint>
</security-constraint>
</j2ee:web-app>Weblogic.xml
===========
<?xml version="1.0" encoding="UTF-8"?>
<ns:weblogic-web-app xmlns:ns="http://www.bea.com/ns/weblogic/90">
<security-role-assignment>
    <role-name>LTVORole</role-name>
   <externally-defined/>
</security-role-assignment>
</ns:weblogic-web-app>I have created the role in weblogic in the menu
security realms > myrealm > roles and policies > Global Roles > roles > LTVORole
Is it the right way to define a role?
Please help me find where I am going wrong.
Thanking you all in advance,
Gireesh

Why security-role-assignment is required ?

Hi all.
We develop EJB application which uses:
* declarative security using <method-permission> in ejb-jar.xml
* our own RoleMapper SSP, which take mapping data from DB
(our Mapper doesn't use weblogic-ejb-jar.xml at all)
When I deploy my app without <security-role-assignment>
in weblogic-ejb-jar.xml I receive the deployment exception:
<quote>
The security-role MY_ROLE, defined in ejb-jar.xml,
is not correctly mapped to a security principal.
Make sure the security-role has a corresponding
security-role-assignment element in the
weblogic-ejb-jar.xml descriptor.
</quote>
Yes, this is absolutely correct --
I didn't define the mapping in *.xml advisedly,
because of it is defined in DB and my own Mapper
retrieves data required for role mapping from DB,
not from descriptor *.xml
Questions are:
==============
1. why <security-role-assignment> is so strictly required ? :(
2. is it possible to use declarative security with own RoleMapper ?
3. if `yes` then how to get rid of the exception ?
I have one workaround:
to add to weblogic-ejb-jar.xml fake mapping for
each EJB role used in ejb-jar.xml:
<security-role-assignment>
<role-name>MY_ROLE</role-name>
<principal-name>FaKe_Blah_bLAH</principal-name>
</security-role-assignment>
In this case all works fine,
but workaround smells very very bad :(
Thanks in advance.
Best regards,
Eugene Voytitsky

Hello,
could you provide addition information on the server version and the facets installed in the dynamic web and EAR project ?
thanks
Raj

Unable to assign all security roles to a user with a new custom security role

Dear All,
Happy New Year.!
I have a query regarding the assignment of Security Roles to new users in CRM. Normally we assign the security roles to new users via an Admin user who has 'System Administrator' security role assigned to him/her. This works perfectly fine, and we can assign
any desired security role to the new user.
However, in our case, we need to delegate the user creation rights to some of the client partners. We do not want to give them access to all the Administration functions; hence we created a new Security Role, lets say 'Support User Role'. We have provided
'Create', 'Append', 'Append To', and 'Assign' rights on 'User' entity for this new security role. With this security role, we are able to create new users now, but we are only able to assign 'Agent' security role, not any other security roles.
For example, if user 'x' has Security Role defined as 'Support User Role'. If 'x' tries to add a new user 'y', then 'x' is only able to assign 'Agent' security role to 'y', but not any other security role. As per business requirement, 'x' should be able
to assign some other security roles, including 'Support User Role', to new user 'y'.
I believe that there is something missing in Security Role configuration, which is causing the above problem. We compared both 'Support User Role' and 'System Administrator' security roles, but not able to figure out which minimum rights we can provide to
'Support User Role' so that users with this security role can only add new users (with any security role), and that they are not having access on any other Administration features as well.
Appreciate any help that you can provide on the above issue.
Thanks in anticipation.

Hi,
Can you check if you have organization level Read access for Securitity Role and Organization level Assign access for Security role.
Refer:-
http://www.magnetismsolutions.com/blog/paulnieuwelaar/2013/04/22/permissions-required-to-manage-roles-in-dynamics-crm-2011
Hope this helps!!!
Thanks,
Prasad
Make sure to "Vote as Helpful" and "Mark As Answer",if you get answer of your question

Issue with generating a security role in program CRMD_UI_ROLE_PREPARE

Hello -
We have recently upgrade from CRM 2007 from CRM 4.0. We are working with the Business Roles and generating the security role from the business role using CRMD_UI_ROLE_PREPARE. We first create a simple test Business Role, a Z* copying from TPM_ROLE. Then we generated the security using CRMD_UI_ROLE_PREPARE. This was fine. Now was have copied a Business Role from TPM_ROLE that is one we want to use. We have created our own Z* Nav Bar and Role Config Key. This is working fine, but now when we try to generate using CRMD_UI_ROLE_PREPARE, the txt file is not generated, though there are no errors in the log. We can still generate the security role from our simple test. We have looked on line, and read the article in CRM Expert in June on Business Roles, but have not found the solution yet. Has anyone run into this?
thanks
   George

This is how I used this program:
A. Generate required authorization objects
1.     T-Code: SA38
2.     Enter report CRMD_UI_ROLE_PREPARE and choose Execute.
3.     Select your Business Role.
4.     Choose language EN.
5.     Choose Execute.
Result: A file is created for each Business Role and saved on your computer in the SAP working directory. If you are working with Microsoft Windows XP, this file is saved in C:\Documents and Settings\<User ID>\SapWorkDir\.
B. Assign authorization objects
1.     T-Code: PFCG
2.     Enter your Role and choose Change.
3.     On the Menu tab choose Import from file and upload the file previously created.
4.     Choose Save.
Then adapt the authorizations if needed and choose Generate.
Stephanie.

Need Security Roles Material

Hi Guys,
Can anybody tell how to create & maintain security roles in SAP BW & security role administration in Business Objects 3.x.
Some material with screen shots describing step by step process of creation & maitainence will be helpful.
Thanks,
yogitha

Hi,
Some links which can help you in giving some idea.
http://help.sap.com/bp_bw370/documentation/Authorization_BW_Proj.pdf
http://www.sap.com/germany/about/company/revis/pdf/DS_Leitfaden_BW_en.pdf
http://www.mariewagener.de/files/active/0/Sicherheitsleitfaden_SAP_BW.pdf
http://aninda-gupta.com/sapsecuritypages/topics/sap-bw-security/
Hope it helps

Webdynpro application errors with SLD,J2EE Engine - JCOs probelem

Hi,
I have developed a small webdynpro application
1. Passing 2 values to RFC
2. Getting result contents from RFC and displayed in a table.
I am getting following errors:
u2022     SLD is not accessible. Check SLD Data Supplier service settings.
u2022     Insufficient permissions for getting SLD access information. You can add permissions for your application via the SLD service in the 'Visual Administrator'.
u2022     ACCESS.ERROR: Authorization check for caller assignment to J2EE security role [SAP-J2EE-Engine : administrators].
u2022     application [webdynpro/dispatcher] Processing HTTP request to servlet [dispatcher] finished with error.
The error is: com.sap.tc.webdynpro.clientserver.session.CloseResponseException: An attempt to write after the stream had been closed.
Exception id: [0002559A6FCB0077000000A0000CF0E8000460EC9406F721]
u2022     application [webdynpro/dispatcher] Processing HTTP request to servlet [dispatcher] finished with error. The error is: com.sap.tc.webdynpro.clientserver.session.CloseResponseException: An attempt to write after the stream had been closed.
at
Please suggest me.

Hi Kiran,
You need configure SLD and JCo destinations in your j2ee engine..
Check this [article |https://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/c0c1d495-048e-2b10-babd-924a136f56b5] to create the SLD and JCo destinations.
regards,
Siva

Map security roles to group within LDAP using external 3rd Party LDAP

I'm haveing a problem mapping my logical role defined in my web.xml to a role within Active Directory. I'm currently authenticating using Active Directory succsfully, however after the user is authenticated I get a message from the OC4J container that my role can not be found. Can you map a logical role to group within Active Directory? Below are details about my configuration.
Any help would be greatly appreciated.
Log.xml log entry that confirms webtA is communicating successfully with AD.
SG_TEXT>JAAS-LDAPLoginModule: authenticating user wmgraham</MSG_TEXT>
</PAYLOAD>
</MESSAGE>
<MESSAGE>
<HEADER>
</CORRELATION_DATA>
<PAYLOAD>
<MSG_TEXT>JAAS-LDAPLoginModule: DN for user wmgraham is cn=wmgraham,ou=endusers,ou=itod,ou=endusers,ou=div20,ou=hq,dc=fbinet,dc=fbi</MSG_TEXT>
</PAYLOAD>
</MESSAGE>
<MESSAGE>
<HEADER>
Error reported in the log
<MESSAGE>
<HEADER>
<TSTZ_ORIGINATING>2008-08-27T11:38:05.991-04:00</TSTZ_ORIGINATING>
<COMPONENT_ID>j2ee</COMPONENT_ID>
<MSG_TYPE TYPE="TRACE"></MSG_TYPE>
<MSG_LEVEL>16</MSG_LEVEL>
<HOST_ID>F2287032-W</HOST_ID>
<HOST_NWADDR>30.30.16.14</HOST_NWADDR>
<MODULE_ID>security</MODULE_ID>
<THREAD_ID>14</THREAD_ID>
<USER_ID>wmgraham</USER_ID>
</HEADER>
<CORRELATION_DATA>
<EXEC_CONTEXT_ID><UNIQUE_ID>30.30.16.14:59560:1219851485804:6</UNIQUE_ID><SEQ>0</SEQ></EXEC_CONTEXT_ID>
</CORRELATION_DATA>
<PAYLOAD>
<MSG_TEXT>for group=[JAZNGroupAdaptor: webta] there's no matching role found.</MSG_TEXT>
</PAYLOAD>
</MESSAGE>
Web.xml Logical Role definition
<security-constraint>
<web-resource-collection>
<web-resource-name>allpages</web-resource-name>
<url-pattern>/servlet/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>WEBTA_J2EE_USER</role-name>
</auth-constraint>
</security-constraint>
<security-role>
<role-name>WEBTA_J2EE_USER</role-name>
</security-role>
Orion-web.xml This file maps the logical role defined in webxml to a group within Active Directory.
<security-role-mapping name="WEBTA_J2EE_USER">
<group name="webta"/> <-- Group defined in AD -->
</security-role-mapping>

What is the name of the group in AD (provide the DN) that you want to map the j2ee logical role WEBTA_J2EE_USER? What are the group search base and group mapping attribute?
When wmgraham logs into the app, the 3rd party ldap login module will attempt to query for the groups wmgraham is a member of - this is done using the group search base configuration for the provider.
In this example, the DN is "cn=wmgraham,ou=endusers,ou=itod,ou=endusers,ou=div20,ou=hq,dc=fbinet,dc=fbi" and likely user search base is set to "ou=endusers,ou=itod,ou=endusers,ou=div20,ou=hq,dc=fbinet,dc=fbi".
Assuming group search base is (say) "ou=groups,ou=itod,ou=endusers,ou=div20,ou=hq,dc=fbinet,dc=fbi" and and group mapping attr is "cn", then the role mapping you mention should work for group DN "cn=webta,ou=groups,ou=itod,ou=endusers,ou=div20,ou=hq,dc=fbinet,dc=fbi"

How do I map declared security role to an actual operational one?

Hello,
Suppose I have created few security roles at the ejb-jar.xml file of my J2EE application using:
<security-role>
<role-name> managers <role-name>
</security-role>
Our portal is connected to our LDAP server so the WAS contains all the groups it has over there.
My question is: How do I actualy map the security role I declared at the deployment descriptor (manager) to an actual group in our organization?

Hi Roy,
Are you familiar with thishttp://help.sap.com/saphelp_nw04/helpdata/en/1a/733e401b21e801e10000000a155106/frameset.htm ?
Best regards, Maksim Rashchynski.

Mapping UME Roles to J2EE Engine Security Roles

Similar Messages

Maybe you are looking for