Multiple LDAP data sources in EP7.0 SP14

Hello,
I am new to a site that uses portal and SSO between portal and AD LDAP. The portal version is EP7.0 SP14. The datasource is configured with 'datasourceConfiguration_ads_readonly_db_with_krb5.xml'. User path is OU=Users,OU=Finance,DC=io,DC=network and Group Path is OU=Groups,OU=Finance,DC=io,DC=network. The flag to use the Unique ID is also set to 'samaccountname'. The problem is that we also have users in OU=Admins,OU=Finance,DC=io,DC=network and OU=Managers,OU=Finance,DC=io,DC=network in the same AD LDAP that are not visible to the portal but we would like them to be?
It did appear to work if I changed the User Path to OU=Finance,DC=io,DC=network but I can not find any SAP document that supports doing this?
I have seen the document 'Configure multiple LDAP data sources for the UME' with the following link https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/e1959b90-0201-0010-849c-d2b1d574768b however this specifies EP6 so I'm not sure if it is still relevant?
Also somebody did warn me with "If you change the xml file it will remove all current user mappings to the portal, all the groups mapped to roles will be lost and you will have to set them up again". Is this true?
Am I supposed to be using the SPNego Wizard as described in SAP Note 994791?
And possibly the following links for configuring and testing the SPNego...
Configuring and troubleshooting SPNego -- Part 1
Configuring and troubleshooting SPNego -- Part 2
Any guidance towards the best approach to solve our problem would be greatly appreciated.
Thanks,
Dave

Hi Dave,
It did appear to work if I changed the User Path to OU=Finance,DC=io,DC=network but I can not find any SAP document that supports doing this?
OK, I am not an LDAP expert, but if you just want to change your entry point in the structure, I do not see how this would be a problem. I do not know what kind of statement you would expect in the SAP documentation allowing this. Maybe this will answer your question: [Organization of Users and Groups in LDAP Directory|http://help.sap.com/saphelp_nw04s/helpdata/en/09/c5ee407552742ae10000000a155106/frameset.htm]
I have seen the document 'Configure multiple LDAP data sources for the UME' with the following ... however this specifies EP6 so I'm not sure if it is still relevant?
This function has not changed much since EP6, only the administration tools.
Also somebody did warn me with "If you change the xml file it will remove all current user mappings to the portal, all the groups mapped to roles will be lost and you will have to set them up again". Is this true?
It depends on how you change the XML file, but it does not sound like you need to do this, just the configuration of the connection to the LDAP, that is, higher in the structure.
Am I supposed to be using the SPNego Wizard as described in SAP Note 994791?
Only if you want to use SPNego for SSO.
-Michael

Similar Messages

Multiple Target Data Sources

JDeveloper v11.1.1.2
Is it possible to set multiple Target Data Source iterators in the edit tree binding dialog?

Hi Ananda
Thank You very much for your reply!
B) Yes same data is required in both the applications, but not completely same format or structure. E.g. Siebel is the Customer Hub for the client. All the customer data are required to be migrated to multiple applications (say Oracle EBS & Oracle BRM) after verification process, which happens end of the day. What I require is, the ODI interface should pull data from Siebel once & upload those to both Oracle EBS & Oracle BRM simultaneously as per the mapping rules defined for them. Basically I wanted to avoid hitting Seibel applications twice for pulling Customer data by creating two separate interfaces. Is it possible by using ODI???
C) Please take same customer scenario in B. Customer is inserted to Oracle EBS & Oracle BRM using two different interfaces executed sequentially in a package. I want to maintain atomicity. i.e. Either Customer to be created in both or none of the applications. If that particular customer failed in 1st interface, it should try in 2nd interface. Also if it get failed 2nd interface, it should rollback in 1st interface. Can this be achieved in ODI?
Hope, the above would clear my query.
Thank You Again
Priyadarshi

Design Studio 1.3 : one large generic Data Source or multiple smaller Data Sources

Dear all,
In DS 1.3, is it still a best practice to have one large generic Data Source ? Or is having multiple smaller Data Sources a better solution ?
Minimizing the number of Data Sources remains a golden rule, but what is the best solution :
One large generic Data Source : and using setDataSource
or
Multiple smaller Data Sources : and using Load in Script and Background Processing
Many thanks for sharing your ideas,
Hans

It depends on your application and how much the data is pulling in and how you want to present that to the user/consumer of the application.
At TechEd Las Vegas last year, SAP showed a 9 dashboards (3 per row) with background processing for each row.

Data source in EP7

Hi all gurus!
We are trying to use Solution Manager as data source for logon in our EP7 but we can't get the settings right. We have used an existing installation as a "template" but it doesn't work and it might be because the other portal is of version 6.
They are able to keep the config file dataSourceConfiguration_databese_only.xml and still see and use the tab "SAP System". Here they enter the data for their Solution Manager system and test it. They then go to config tool and change the file to dataSourceConfiguration_r3.xml, restart the server and everything work.
To begin with, we can't se the tab "SAP System" at all but if we choose "ABAP System" in the drop down list "Data Source" (wich by the way doesn't contain a r3-alternative) a tab named "ABAP System" appears. Here we enter the data for Solution Manager but the test fails. So here is my first question:
Is the template ABAP ok to use with SolMan?
In the instructions from the other company, and which you saw above, it says that data source shall be database only and that you change to ...r3.xml in configtool. We tried that also, we chose "ABAP System", made the settings and then changed to ...r3.xml in configtool but the server won't start then. So, two more questions:
Are the test fool proof? Since we disregarded the fact that the test failed and went on to configtool...
Is the ...r3.xml a "valid" template to use in our version (was 7.0), since the server didn't start properly?
And the last question:
The user in SolMan that is used for the connection, of what type should he be? Service, Communication Data or something else or is without relevance? And what groups and roles should be added to him?
Can anybody give some advice with this information?
Best regards
Benny

The username isn't important, but if you add the SID at the end it means you can change the password for the SAPJSF user for a particular portal without affecting the other users.
Anyway, to your problem.
No tests are foolproof - if the test fails but the portal starts that is OK for me! When you select ABAP as the type, it will change automatiaclly to dataSourceConfiguration_abap.xml - leave this as is.
Have you followed the instructions in <a href="http://help.sap.com/saphelp_nw04s/helpdata/en/49/9dd53f779c4e21e10000000a1550b0/frameset.htm">this link</a>? It is reasonably well documented.
Cheers

Problem with multiple XML data sources

Hi there,
I have a template (i'm using XML publisher). I need to use 2 different XML data files in the same template, but i couldn't find any way of doing so. Can somebody help me with this issue please? You obviously cannot load 2 XML Data sources in the same template.
Thanks and Regards,
Luke

Is your xml stored some where,
then
Create datatemplate and use the xml as datasource.
You can create it using the following sysntax
<dataTemplate name="Employee" description="L" version="1.0">
<dataQuery>
<xml name="xml_emp" expressionPath=".//ROW">
<url method="GET" realm="" username="" password="">
file:///C:/dept_employee.xml</url>
</xml>
<xml name="xml_dept" expressionPath=".//ROW">
<url method="GET" realm="" username="" password="">
file:///C:/dept.xml</url>
</xml>
</dataQuery>
<dataStructure>
<group name="EMP" source="empxml">
<element name="NAME" value="ENAME"/>
your element here
</group>
<group name="DEPT" source="xm_DEPTl">
<element name="DNAME" value="DPTNAME"/>
your element from 2nd xml here
</group>
</dataStructure>
</dataTemplate>
Now your two xml source will become single source for the report.

DPS6 LDAP data source monitoring

I'd like DPS 6 to detect when a directory server is unable no open a new connection (when it has no more file descriptors available for example).
After some tests, it seems like the different kind of data source monitoring in DPS 6 always use the same connections to test the directory, while according to the reference guide, DPS 6 should, if configured to do so,
periodically establish dedicated connections ?
Is this a known bug ? If not, any way to detect such problems on the directory with DPS 6 ?

DPS uses the same (dedicated) connection to monitor ds health to be able to detect (quick) ds restart. In such situation, pre opened connection in the connection pools may become invalid even when 2 subsequent ds checks are OK. A restart is detected by using the same connections for monitoring.
DPS reuses a new connection for monitoring when there is a suspicion of problem only, that is , after the proxy failed to establish a new connection to the ds. When everything looks OK, the same connection is reused and there is no parameter to control this behaviour

XMLdatasets: How to combine multiple xml data sources??

What I'm trying to do (without any results so far...) is to combine data from two different xml sources.
I have one source with a list of cultural events (agenda.xml) and another with a list of contacts (contacts.xml). Each source has a column with a contact name <co_name>.
I use a MasterDetail layout. When you choose an event in the MasterContainer (agenda.xml), the DetailContainer should display not only details from agenda.xml but when the name <co_name> in agenda.xml MATCH exactly a name <co_name> in contacts.xml, the DetailContainer also display the telephone number <co_phone> from contact.xml.
I will put my code down here, I hope somebody can help me find out what I'm doing wrong. (I tried something with "getdata" but obviously, it doesn't works...)
Thank you very much in advance!!!!!!
Véro
FIRST DATATSET: agenda.xml
<events>
<event>
    <ev_title>Title event 1</ev_title>
    <co_name>vero</co_name>
</event>
<event>
    <ev_title>Title event 2</ev_title>
    <co_name>marc</co_name>
</event>
<event>
    <ev_title>Title event 3</ev_title>
    <co_name>vero</co_name>
</event>
<event>
    <ev_title>Title event 4</ev_title>
    <co_name>marc</co_name>
</event>
</events>
SECOND DATASET: contacts.xml
<contacts>
<contact>
    <co_name>marc</co_name>
    <co_phone>123 phone of marc</co_phone>
</contact>
<contact>
    <co_name>vero</co_name>
    <co_phone>456 phone of vero</co_phone>
</contact>
</contacts>
HTML DOCUMENT
<html>
<head>
<link href="SpryAssets/SpryMasterDetail.css" rel="stylesheet" type="text/css" />
<script src="SpryAssets/xpath.js" type="text/javascript"></script>
<script src="SpryAssets/SpryData.js" type="text/javascript"></script>
<script type="text/javascript">
var dsAgenda = new Spry.Data.XMLDataSet("agenda.xml", "events/event");
</script>
<script type="text/javascript">
var dsContacts = new Spry.Data.XMLDataSet("contacts.xml", "contacts/contact");
function matchTheName() {
var rows = dsContacts.getData();
for (var i = 0; i < rows.length; i++)
if (rows[i]["co_name"] == "{dsAgenda::co_name}")
    return rows[i]["dsContacts::co_name"];
</script>
</head>
<body>
    <div class="MasterDetail">
        <div spry:region="dsAgenda" class="MasterContainer">
            <div class="MasterColumn" spry:repeat="dsAgenda" spry:setrow="dsAgenda" spry:hover="MasterColumnHover" spry:select="MasterColumnSelected">
                <div>{ev_title}</div>
                <div>{co_name}</div>
            </div>
        </div>
        <div spry:detailregion="dsAgenda dsContacts" class="DetailContainer">
            <div class="DetailColumnTitle">{dsAgenda::ev_title}</div>
            <div class="DetailColumn">{dsAgenda::co_name}</div>
            <div spry:if="'{dsAgenda::co_name}' == '{dsContacts::co_name}'" class="DetailColumn">{dsContacts::co_phone}</div>
        </div>
    </div>
</body>
</html>

create a new empty SpryDataSet.
var dsAll = new Spry.Data.DataSet(); // new base dataset
on your existing datasets, add onPostLoad observers, this are events that will be notified once the datasets has been loaded.
var default_obs = {
     onPostLoad: function(){
          // when both datasets are loaded, call out init fn
         if( ds1.getData() && ds2.getData() ){
               init();
Than we add it both datasets:
ds1.addObserver( default_obs ); // add the observer object to the datasets
ds2.addObserver( default_obs );
Now they will both call the init function when both the datasets has been loaded. The init function will create the actual new dataset. The data in the SpryDataSet is basically just an array with objects. And Spry has a method that loads an array in to the datasets.setDataFromArray
We are going to use that function to construct a new dataset:
function init(){
     if( dsAll.getData() ){
          return; // we already have data in our dsAll dataset, so no use to do it all over again
     var source = ds1.getData();
     var length = source.length;
     var result = [];
     for( var i = 0; i < length; i++ ){
          var matched_row = ds2.findRowsWithColumnValues({id: source[i]['@id']}); // checks if ds2. has a column with id: value
          if( matched_row ){
               var row = result[ result.length ];
               row = source[i];
               Spry.Utils.setOptions( row, matched_row ); // includes the matched_row object inside the new row object
     dsAll.setDataFromArray( result ); // set the new array as data
Something like should be needed to create it..

Multiple LDAP Servers and Attribute-Based Data Partitioning

Hello
We currently want to implement following szenario on Netweaver 2004s. From the
following SAP Help documentation we want attribute based data partitioning:
http://help.sap.com/saphelp_nw70/helpdata/EN/4e/4d0d40c04af72ee10000000a1550b0/frameset.htm
The difference to the SAP document is that we want a distribution of attributes over
multiple LDAP servers. So we tried to fit that concept into xml. see attached xml source.
The Portal finds both LDAP Systems but it is NOT that the useres are beeing merged
but they appear as two distict users in the portal UME. If you do a lookup in the portal
usernamagent system you get and see two users.
User1: unique ID = USER.Datasource1.uid
User2: unique ID = USER.Datasource2.uid
Obviously the UME system was not able to merge that information of the two distict
LDAP Systems. MSADS and Lotus Notes.
Hence my questions:
1) is it possible to distribute attributes over multiple ldap data sources
2) any ideas why UME constructs two different users based in Datasource ID's specified in XML
Thanks for any contributions or ideas,
Ulrich Scherb
<?xml version="1.0" encoding="UTF-8"?>
<dataSources>
    <dataSource id="PRIVATE_DATASOURCE"
                className="com.sap.security.core.persistence.datasource.imp.DataBasePersistence"
                isReadonly="false"
                isPrimary="true">
        <homeFor>
            <principals>
                 <principal type="group"/>
                 <principal type="user"/>
                 <principal type="account"/>
                <principal type="team"/>
                <principal type="ROOT" />
                <principal type="OOOO" />
            </principals>
        </homeFor>
        <notHomeFor/>
        <responsibleFor>
            <principals>
                 <principal type="group"/>
                 <principal type="user"/>
                 <principal type="account"/>
                <principal type="team"/>
                <principal type="ROOT" />
                <principal type="OOOO" />
            </principals>
        </responsibleFor>
        <privateSection>
        </privateSection>
    </dataSource>
    <dataSource id="NOTES_LDAP"
          className="com.sap.security.core.persistence.datasource.imp.LDAPPersistence"
          isReadonly="true"
          isPrimary="true">
          <homeFor/>
          <responsibleFor>
               <principal type="account">
                    <nameSpace name="com.sap.security.core.usermanagement">
                         <attribute name="j_user"/>
                         <attribute name="logonalias"/>
                         <attribute name="j_password"/>
                         <attribute name="userid"/>
                    </nameSpace>
                   <nameSpace name="com.sap.security.core.authentication">
                        <attribute name="principal"/>
                   </nameSpace>
               </principal>
               <principal type="user">
                    <nameSpace name="com.sap.security.core.usermanagement">
                         <attribute name="firstname" populateInitially="true"/>
                         <attribute name="lastname" populateInitially="true"/>
                         <attribute name="email"/>
                         <attribute name="uniquename" populateInitially="true"/>
                    </nameSpace>
                    <nameSpace name="$usermapping$">
                         <attribute name="REFERENCE_SYSTEM_USER"/>
                    </nameSpace>
               </principal>
          </responsibleFor>
          <attributeMapping>
               <principal type="account">
                    <nameSpace name="com.sap.security.core.usermanagement">
                         <attribute name="j_user">
                              <physicalAttribute name="uid"/>
                         </attribute>
                         <attribute name="logonalias">
                              <physicalAttribute name="uid"/>
                         </attribute>
                         <attribute name="j_password">
                              <physicalAttribute name="unicodepwd"/>
                         </attribute>
                         <attribute name="userid">
                              <physicalAttribute name="*null*"/>
                         </attribute>
                    </nameSpace>
                   <nameSpace name="com.sap.security.core.authentication">
                        <attribute name="principal">
                             <physicalAttribute name="uid"/>
                        </attribute>
                   </nameSpace>
               </principal>
               <principal type="user">
                    <nameSpace name="com.sap.security.core.usermanagement">
                         <attribute name="firstname">
                              <physicalAttribute name="givenname"/>
                         </attribute>
                         <attribute name="lastname">
                              <physicalAttribute name="sn"/>
                         </attribute>
                         <attribute name="uniquename">
                              <physicalAttribute name="uid"/>
                         </attribute>
                         <attribute name="loginid">
                              <physicalAttribute name="*null*"/>
                         </attribute>
                         <attribute name="email">
                              <physicalAttribute name="mail"/>
                         </attribute>
                    </nameSpace>
                    <nameSpace name="$usermapping$">
                         <attribute name="REFERENCE_SYSTEM_USER">
                              <physicalAttribute name="sapusername"/>
                         </attribute>
                    </nameSpace>
               </principal>
          </attributeMapping>
        <privateSection>
               <ume.ldap.access.server_type>MSADS</ume.ldap.access.server_type>
               <ume.ldap.access.server_name>ldap1</ume.ldap.access.server_name>
               <ume.ldap.access.server_port>389</ume.ldap.access.server_port>
               <ume.ldap.access.authentication>simple</ume.ldap.access.authentication>
               <ume.ldap.access.user>xxxxx</ume.ldap.access.user>
               <ume.ldap.access.password>xxxxx</ume.ldap.access.password>
               <ume.ldap.access.base_path.user>O=SMT_TEST</ume.ldap.access.base_path.user>
               <ume.ldap.record_access>TRUE</ume.ldap.record_access>
               <ume.ldap.unique_uacc_attribute>uid</ume.ldap.unique_uacc_attribute>
               <ume.ldap.unique_user_attribute>uid</ume.ldap.unique_user_attribute>
               <ume.ldap.access.context_factory>com.sun.jndi.ldap.LdapCtxFactory</ume.ldap.access.context_factory>
               <ume.ldap.access.user_as_account>true</ume.ldap.access.user_as_account>
               <ume.ldap.access.ssl_socket_factory>com.sap.security.core.server.https.SecureConnectionFactory</ume.ldap.access.ssl_socket_factory>
               <ume.ldap.access.objectclass.user>person</ume.ldap.access.objectclass.user>
               <ume.ldap.access.objectclass.uacc>person</ume.ldap.access.objectclass.uacc>
               <ume.ldap.access.naming_attribute.user>cn</ume.ldap.access.naming_attribute.user>
               <ume.ldap.access.auxiliary_naming_attribute.user>uid</ume.ldap.access.auxiliary_naming_attribute.user>
               <ume.ldap.access.naming_attribute.uacc>cn</ume.ldap.access.naming_attribute.uacc>
               <ume.ldap.access.auxiliary_naming_attribute.uacc>uid</ume.ldap.access.auxiliary_naming_attribute.uacc>
          </privateSection>
     </dataSource>
    <dataSource id="CORP_LDAP"
          className="com.sap.security.core.persistence.datasource.imp.LDAPPersistence"
          isReadonly="true"
          isPrimary="true">
          <homeFor/>
          <responsibleFor>
               <principal type="account">
                    <nameSpace name="com.sap.security.core.usermanagement">
                         <attribute name="j_user"/>
                         <attribute name="logonalias"/>
                         <attribute name="j_password"/>
                         <attribute name="userid"/>
                    </nameSpace>
                   <nameSpace name="com.sap.security.core.authentication">
                        <attribute name="principal"/>
                        <attribute name="realm"/>
                        <attribute name="domain"/>
                   </nameSpace>
               </principal>
               <principal type="user">
                    <nameSpace name="com.sap.security.core.usermanagement">
                         <attribute name="firstname" populateInitially="true"/>
                         <attribute name="displayname" populateInitially="true"/>
                         <attribute name="lastname" populateInitially="true"/>
                         <attribute name="fax"/>
                         <attribute name="title"/>
                         <attribute name="department"/>
                         <attribute name="description"/>
                         <attribute name="mobile"/>
                         <attribute name="telephone"/>
                         <attribute name="streetaddress"/>
                         <attribute name="uniquename" populateInitially="true"/>
                    </nameSpace>
                    <nameSpace name="com.sap.security.core.usermanagement.relation">
                         <attribute name="PRINCIPAL_RELATION_PARENT_ATTRIBUTE"/>
                    </nameSpace>
                    <nameSpace name="$usermapping$">
                         <attribute name="REFERENCE_SYSTEM_USER"/>
                    </nameSpace>
               </principal>
               <principal type="group">
                    <nameSpace name="com.sap.security.core.usermanagement">
                         <attribute name="displayname" populateInitially="true"/>
                         <attribute name="description" populateInitially="true"/>
                         <attribute name="uniquename"/>
                    </nameSpace>
                    <nameSpace name="com.sap.security.core.usermanagement.relation">
                         <attribute name="PRINCIPAL_RELATION_MEMBER_ATTRIBUTE"/>
                         <attribute name="PRINCIPAL_RELATION_PARENT_ATTRIBUTE"/>
                    </nameSpace>
                    <nameSpace name="com.sap.security.core.bridge">
                         <attribute name="dn"/>
                    </nameSpace>
               </principal>
          </responsibleFor>
          <attributeMapping>
               <principal type="account">
                    <nameSpace name="com.sap.security.core.usermanagement">
                         <attribute name="j_user">
                              <physicalAttribute name="samaccountname"/>
                         </attribute>
                         <attribute name="logonalias">
                              <physicalAttribute name="samaccountname"/>
                         </attribute>
                         <attribute name="j_password">
                              <physicalAttribute name="unicodepwd"/>
                         </attribute>
                         <attribute name="userid">
                              <physicalAttribute name="*null*"/>
                         </attribute>
                    </nameSpace>
                   <nameSpace name="com.sap.security.core.authentication">
                        <attribute name="principal">
                             <physicalAttribute name="samaccountname"/>
                        </attribute>
                        <attribute name="realm">
                             <physicalAttribute name="*null*"/>
                        </attribute>
                        <attribute name="domain">
                             <physicalAttribute name="*null*"/>
                        </attribute>
                   </nameSpace>
               </principal>
               <principal type="user">
                    <nameSpace name="com.sap.security.core.usermanagement">
                         <attribute name="firstname">
                              <physicalAttribute name="givenname"/>
                         </attribute>
                         <attribute name="displayname">
                              <physicalAttribute name="displayname"/>
                         </attribute>
                         <attribute name="lastname">
                              <physicalAttribute name="sn"/>
                         </attribute>
                         <attribute name="fax">
                              <physicalAttribute name="facsimiletelephonenumber"/>
                         </attribute>
                         <attribute name="uniquename">
                              <physicalAttribute name="samaccountname"/>
                         </attribute>
                         <attribute name="loginid">
                              <physicalAttribute name="*null*"/>
                         </attribute>
                         <attribute name="mobile">
                              <physicalAttribute name="mobile"/>
                         </attribute>
                         <attribute name="telephone">
                              <physicalAttribute name="telephonenumber"/>
                         </attribute>
                         <attribute name="department">
                              <physicalAttribute name="ou"/>
                         </attribute>
                         <attribute name="description">
                              <physicalAttribute name="description"/>
                         </attribute>
                         <attribute name="streetaddress">
                              <physicalAttribute name="postaladdress"/>
                         </attribute>
                         <attribute name="pobox">
                              <physicalAttribute name="postofficebox"/>
                         </attribute>
                    </nameSpace>
                    <nameSpace name="com.sap.security.core.usermanagement.relation">
                         <attribute name="PRINCIPAL_RELATION_PARENT_ATTRIBUTE">
                              <physicalAttribute name="memberof"/>
                         </attribute>
                    </nameSpace>
                    <nameSpace name="$usermapping$">
                         <attribute name="REFERENCE_SYSTEM_USER">
                              <physicalAttribute name="sapusername"/>
                         </attribute>
                    </nameSpace>
               </principal>
               <principal type="group">
                    <nameSpace name="com.sap.security.core.usermanagement">
                         <attribute name="displayname">
                              <physicalAttribute name="displayname"/>
                         </attribute>
                         <attribute name="description">
                              <physicalAttribute name="description"/>
                         </attribute>
                         <attribute name="uniquename" populateInitially="true">
                              <physicalAttribute name="cn"/>
                         </attribute>
                    </nameSpace>
                    <nameSpace name="com.sap.security.core.usermanagement.relation">
                         <attribute name="PRINCIPAL_RELATION_MEMBER_ATTRIBUTE">
                              <physicalAttribute name="member"/>
                         </attribute>
                         <attribute name="PRINCIPAL_RELATION_PARENT_ATTRIBUTE">
                              <physicalAttribute name="memberof"/>
                         </attribute>
                    </nameSpace>
                    <nameSpace name="com.sap.security.core.bridge">
                        <attribute name="dn">
                              <physicalAttribute name="*null*"/>
                         </attribute>
                    </nameSpace>
               </principal>
          </attributeMapping>
        <privateSection>
               <ume.ldap.access.server_type>MSADS</ume.ldap.access.server_type>
               <ume.ldap.access.server_name>ldap2</ume.ldap.access.server_name>
               <ume.ldap.access.server_port>389</ume.ldap.access.server_port>
               <ume.ldap.access.authentication>simple</ume.ldap.access.authentication>
               <ume.ldap.access.user>yyyyy</ume.ldap.access.user>
               <ume.ldap.access.password>yyyyy</ume.ldap.access.password>
               <ume.ldap.access.base_path.user>O=SMT_TEST</ume.ldap.access.base_path.user>
               <ume.ldap.access.base_path.grup>O=SMT_TEST</ume.ldap.access.base_path.grup>
               <ume.ldap.record_access>TRUE</ume.ldap.record_access>
               <ume.ldap.unique_uacc_attribute>samaccountname</ume.ldap.unique_uacc_attribute>
               <ume.ldap.unique_user_attribute>samaccountname</ume.ldap.unique_user_attribute>
               <ume.ldap.access.context_factory>com.sun.jndi.ldap.LdapCtxFactory</ume.ldap.access.context_factory>
               <ume.ldap.access.authentication>simple</ume.ldap.access.authentication>
               <ume.ldap.access.flat_group_hierachy>true</ume.ldap.access.flat_group_hierachy>
               <ume.ldap.access.user_as_account>true</ume.ldap.access.user_as_account>
               <ume.ldap.access.dynamic_groups>false</ume.ldap.access.dynamic_groups>
               <ume.ldap.access.ssl_socket_factory>com.sap.security.core.server.https.SecureConnectionFactory</ume.ldap.access.ssl_socket_factory>
               <ume.ldap.access.objectclass.user>User</ume.ldap.access.objectclass.user>
               <ume.ldap.access.objectclass.uacc>User</ume.ldap.access.objectclass.uacc>
               <ume.ldap.access.objectclass.grup>Group</ume.ldap.access.objectclass.grup>
               <ume.ldap.access.naming_attribute.user>cn</ume.ldap.access.naming_attribute.user>
               <ume.ldap.access.auxiliary_naming_attribute.user>samaccountname</ume.ldap.access.auxiliary_naming_attribute.user>
               <ume.ldap.access.naming_attribute.uacc>cn</ume.ldap.access.naming_attribute.uacc>
               <ume.ldap.access.auxiliary_naming_attribute.uacc>samaccountname</ume.ldap.access.auxiliary_naming_attribute.uacc>
               <ume.ldap.access.naming_attribute.grup>cn</ume.ldap.access.naming_attribute.grup>
          </privateSection>
     </dataSource>
</dataSources>

Hi Ulrich,
Hope your problem is resolved. We are using EP7 and SP18. We are doing some study on your first issue. i.e. Distributing a user attribute into multiple LDAPs. Can you please let me know the feasibility? If yes, what are all step do I have to follow? Expecting your valuable answer. Thanks in advance!
Regards,
Kabali

Ldapclient multiple LDAP requests

Hi,
I have setup an Directory Server for LDAP Authentication. Everything is working as expected, but some clients perform multiple LDAP requests. and decrease the performance of the Directory.
One of such client is an Solaris 8 client
# uname -a
SunOS Jetgold 5.8 Generic_117350-29 sun4u sparc SUNW,UltraAX-i2
Here is the logs in the directory. you can see multiple LDAP open requests for Directory server at the same time from same client. Here the /etc/hosts
# cat /etc/hosts
127.0.0.1 localhost
10.196.59.222 host host.domain.com loghost
10.196.57.1 ldap1 ldap1.domain.com
# tail -f access |grep 10.196.59.222
[27/Nov/2007:17:24:19 -0800] conn=53324 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:19 -0800] conn=53325 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:19 -0800] conn=53326 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:19 -0800] conn=53327 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:19 -0800] conn=53328 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:19 -0800] conn=53329 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:19 -0800] conn=53330 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:19 -0800] conn=53331 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:19 -0800] conn=53332 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:19 -0800] conn=53333 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:19 -0800] conn=53334 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:19 -0800] conn=53335 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:19 -0800] conn=53336 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:19 -0800] conn=53337 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:19 -0800] conn=53338 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:19 -0800] conn=53339 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:19 -0800] conn=53340 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:19 -0800] conn=53341 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:19 -0800] conn=53342 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:19 -0800] conn=53343 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:19 -0800] conn=53344 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:19 -0800] conn=53345 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53346 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53347 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53348 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53349 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53350 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53351 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53352 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53353 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53354 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53355 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53356 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53357 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53358 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53359 op=-1 msgId=-1 - fd=120 slot=120 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53360 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53361 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53362 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53363 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53364 op=-1 msgId=-1 - fd=120 slot=120 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53365 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53366 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53367 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53368 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53369 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53370 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53371 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53372 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53373 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53374 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53375 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53376 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53377 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53378 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53379 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53380 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53381 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53382 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53383 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53384 op=-1 msgId=-1 - fd=120 slot=120 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53385 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53386 op=-1 msgId=-1 - fd=120 slot=120 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53387 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53388 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53389 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53390 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53391 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53392 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
[27/Nov/2007:17:24:20 -0800] conn=53393 op=-1 msgId=-1 - fd=104 slot=104 LDAP connection from 10.196.59.222 to 10.196.57.1
Is there any configuration I am missing?
Thanks in advance for your response
Srikanth

Hi,
You can refer to the following weblinks for the same
HELP.SAP.COM
http://help.sap.com/saphelp_nw70/helpdata/EN/4e/4d0d40c04af72ee10000000a1550b0/frameset.htm
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/e1959b90-0201-0010-849c-d2b1d574768b
FORUMS
LDAP Server settings for Configuring Multiple LDAP in Portal UME.
LDAP Configuration - Multiple domains
EP7 - Multiple LDAP sample file
SAP Note
736471 UME Configuration of multiple LDAP data sources
Please let me know incase you have any issues.
Regards
Bir

Multiple Data Sources unavailability in CUP 5.3

Greetings All,
Our Organization has acquired another organization and wants to bring them on board in GRC CUP for user provisioning process.
The complexity here is they have a separate active directory and the merger of their active directory into the corporate AD is not slated for the next 6-8 months.
The GRC CUP version 5.3 comes with a single data source and multiple details data sources. I now have my CUP pointing out to LDAP1 (MS Active directory) and I am not able to see any users from LDAP2 (Acquired MS Active Directory) which is expected.
The AD team suggested LDAP Referral Chasing functionality that works well within MS windows or any other tools in the LDAP world.
I did not see any other facility or option to use LDAP chasing in CUP.
Any suggestions as how to connect to both LDAP's simultaneously without asking for another instance of CUP will be appreciated.
Best regards,
Angara

Greetings Ashish & Alley,
Thanks for the information and help. The situation here is, we do not have NW IDM and I wish we had it implemented; it would have solved many of our issues.
We are looking into AD as the primary source collecting the information and creating the user in 2 places (Backend & Portal). In backend we have almost all applications (HCM/ECC/CRM/BI/XI/SRM/MDM/BPCu2026etc).
There are about 10,000 users in one Ldap and about 4000 in another LDAP. When the request is for an existing user, I can map the datasoure to the most available ABAP Stack (Best would be HCM as most users (excluding contractors/consultants) would have ESS) and pull the user info and get the remaining information from Details data source in sequential order.
The Issue we have is with the New User creation, as the new user might be in LDAP1/LDAP2 based on the hiring organization and none of their information exists anywhere in the backend or in the portal - since we are using CUP to create even ESS accounts.
We are currently evaluating on one among the below three things:
1. Purchase NWIDM (not sure about the cost of the tool -Possibly 100 g's)
2. Upgrade GRC from 5.3 to 10 (To determine the timeline & cost)
3. Purchase a third party tool like an open data source or Sonatype (This tool can virtually connect multiple MS ADs into one AD tree and point CUP to this tool u2013may costs about 10g or so)
If anyone of you has any other information, please let us know. Thanks for all your advice and help.
Best Regards,
Angara Rao

EP7 - Multiple LDAP sample file

Hi,
I'm trying to setup multiple LDAP connections on our EP7 installation. I found alot of SAP help information as well as a helpful tread posted by Vivek Kumar. I am a bit stuck at one of the steps and hope that someone can please help clarify for me?
I have followed the instructions up to point 5d in Vivek's config steps, see below:
[The thread I'm following|LDAP Integration with Portal using MS ADS;
i.e.
5d) Update the properties for each datasource with the correct values obtained
from the "Direct Editing" tab (now stored in the configuration document). An
example is shown below:
className="com.sap.security.core.persistence.datasource.imp.LDAPPersistence" isReadonly="true" isPrimary="true"> ...i802895a.phl.sap.corp389cn=Directory Manager
ksdf8SDF#%</ume.ldap.access.password> <ume.ldap.access.base_path.user>ou=people,dc=phl,dc=sap,dc=corp</ume.ldap.access.base_path.user> ume.ldap.access.base_path.grup>ou=groups,dc=phl,dc=sap,dc=corp</ume.ldap.access.base_path.grup> <ume.ldap.access.server_type>SUN</ume.ldap.access.server_type> more stuff </privateSection>
I've also copied the LDAP Settings section and copied the contents to wordpad from the "direct editing" tab.
What I'm unsure of is what datasources needs to be updated with which values from direct editing. In particular I can't find the encrypted password is in direct editing (i.e. </ume.ldap.access.password>).
Any assistance or examples will be of great help.
Thank you
Regards
Deon Hattingh
[email protected]

Hi,
did you also take a look at the example on [help.sap.com|http://help.sap.com/saphelp_nw70/helpdata/en/4e/4d0d40c04af72ee10000000a1550b0/frameset.htm]?
In your dataSourceConfig file you can simply specify in the ume.ldap.access.password a "location"/placeholder for your password, e.g. $ume.ldap.access.additional_password.2
Then in the configtool under UME Ldap Data -> Additional LDAP properties you can define the "real" password in the sections ume.ldap.access.additional_password.1 (global), ume.ldap.access.additional_password.2 (global), ...
Hope this helps,
Holger.

Configuring more than one LDAP as data source

Hi Portal Gurus,
We have requiremnt to configure MS ADS LDAP-> DEEP HIERARCHY & Sun one LDAP->FLAT HIERRARCHY as PORTAL Datra Source.we have already configured MS ADS LDAP.
for merging these 2 LDAPS as a data source can anybody having experiece ...
we tried to configure with the below server parameters for 2nd lDAP merging as per below reference
Configuration of More Than One LDAP Data Source"http://help.sap.com/saphelp_nw04/helpdata/en/4e/4d0d40c04af72ee10000000a1550b0/frameset.htm".But
we could not suceeded.
Server parameters:
Server: xxxx:23xx
LDAP Search root: dv=hub, o=vds
Connection ID: cn=Directory Manager
password: xxxxx
we dont have user path or group path for the above 2nd LDAP.
anybody can help in this ..
Regards
Tag

Tag,
It sounds like this issue might be releated to the fact that your second LDAP connection is to SUN One. Maybe one of these links will help
http://help.sap.com/saphelp_erp2005vp/helpdata/en/aa/8f10f1e2bae346bef2853aa0f88f4c/frameset.htm
or
http://help.sap.com/saphelp_erp2005vp/helpdata/en/43/4c3725aeaf30b4e10000000a11466f/frameset.htm
Regards,
Keith
Message was edited by: Keith Crossett

Are Multiple (Concurrent) ABAP Data Sources for AS Java UME Possible?

Hi All,
We have a solution which is using a JAAS logon module for partner authentication. for reason's I won't go into we have decided that it is best to use an ABAP data source. We will also be using the same JAAS approach for other ABAP applications in the future. Ideally we would configure the same JAAS server to use ABAP UME data sources from ABAP server 1 and ABAP server 2.
I see there are provisions in the documentation for multiple UME data sources of different types but it doesn't clearly say about different concurrent data sources. IS this even possible? If so is it wise?
Thanks,
Doug

Julius,
Thanks again for your reply. This is confusing. We have an existing .Net logon application where we centrally administer accounts and where users log in. On successful login they are issued a .net Auth cookie. Our JAAS module takes that cookie, does a web service call back to .Net and authenticates them. So authentication is done on the basis of the .Net cookie, not the java UME. We simply need a java ume to allow users to execute the application that invokes the JAAS module. The application invokes the JAAS module and if they successfully authenticate they are forwarded to the requesting SAP application. So the JAAS ume is really just needed to allow various users to run the JAAS invoking application starter. Ideally we'd use the same starter application for users of SAP Application 1,2,3, etc.
So that's where the question came from on multiple ABAP UME data sources for a single Java instance.
Hope that makes sense. Regardless the answer I guess is not possible but you see the method to our madness. And yes it is madness.
Thanks,
Doug

Multiple LDAPS with same username!

Hi,
we have a case where we need to connect to multiple LDAP servers and configure SPNego for Kerberos authentication of portal. we have a problem in case of user names. some user names are same in both LDAPs. LDAPs are portal are positioned as (Landscape convension)
LDAP1: xxxx.yyyy
LDAP2: ssss.yyyy
Portal : pppp.gggg.yyyy
where as gggg.yyyy is a trusted domain for both xxxx.yyyy and ssss.yyyy.
we have login problem in same user case. (same user exist in xxxx.yyyy and ssss.yyyy). I haven't gone into details yet like logs and all troubleshooting stuff. Before doing all this just want to know your views whether I can do this or not. If I can achieve any suggentions how to proceed further?
Regards
Ravindra

Hi,
Kerberose (Spnego) is possible with multiple ADS data sources. Check SAP Note 1007227 and the below link.
http://help.sap.com/saphelp_nw70/helpdata/en/45/40a320773a7527e10000000a114a6b/content.htm
Regards
Deb

Multiple LDAPs with SSO Kerberos

Hello,
Right now I'm using SAP EP 7.0 EHP1 with one LDAP and everything is working fine. However, I have to integrate two new enterprises to the same SAP EP with different domains and differents LDAP's. I see some information about how to integrate the LDAP's but I want to know what is going to happend with the SSO configuration. How can I enable the same SSO functionality to the new enterprises with multiple LDAP's?
Please, any ideas? Maybe someone have information about this topic

Hi,
Kerberose (Spnego) is possible with multiple ADS data sources. Check SAP Note 1007227 and the below link.
http://help.sap.com/saphelp_nw70/helpdata/en/45/40a320773a7527e10000000a114a6b/content.htm
Regards
Deb

Multiple LDAP data sources in EP7.0 SP14

Similar Messages

Maybe you are looking for