Multiple SAP User Access Issue?

Dear Expert,
SQL Express 2005
Wndows Server 2003
Client PC RAM 1GB
Server RAM 16GB
SAP Version 8.8 PL15
14 Store Procedure
When multiple user connected with SAP (Logedin) at that time any user add any SAP document then all remaining user hanged approx 2 min after successfully add all user working normally.
Please Suggest me as early as possible
Thanks,
Srujal Patel

Hi Srujal.......
This is purely due to heavy customization may be thorugh Addon or through Stored Procedure.
Try nullifying effect of these 14 Stored Procedures and DC Addons if any and then ask users to add the documents. I am sure they wil work normally. This may happen because of FMS also.......
Regards,
Rahul

Similar Messages

WebLogic 10.3.0 WLI Domain - Microsoft AD administrator user access issue.

Hi SOA Experts,
We are facing issue of getting noaccess exception on console (below) when doing datasource testing using Microsoft AD administrator user. The same works fine when testing using WLS embedded LDAP administrator user in WLI domain. In plain WLS 10.3.0 domain (without WLI) with same Microsoft AD configuration they do not see this issue, they are able to successfully test data source using both embedded WLS administrator and Microsoft AD administrator user.
I enabled security ATN and ATZ debug flags and below is my observation.
In plain WLS 10.3.0 domain I see that default weblogic administrator user in embedded LDAP is part of administrators group. Microsoft AD administrator user is part of Administrators group from MS AD.
Whereas in WLI domain I see that default weblogic administrator user is part of Administrators & IntegrationAdministrators groups. In WLI domain Administrators group is again part of IntegrationAdministrators group (below is debug logs).
Below is Plain WLS Domain Debug log
####<Dec 6, 2010 5:20:14 PM EST> <Debug> <SecurityAtz> <slsol10> <AdminServer> <[ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)
'> <<WLS Kernel>> <> <> <1291674014123> <BEA-000000> < Subject: 2
Principal = weblogic.security.principal.WLSUserImpl("weblogic")
Principal = weblogic.security.principal.WLSGroupImpl("Administrators")
Below is WLI Domain Debug Log
<> <1291669863989> <BEA-000000> <XACML Authorization isAccessAllowed(): input arguments:>
####<Dec 6, 2010 4:11:03 PM EST> <Debug> <SecurityAtz> <slsol10> <AdminServer> <[ACTIVE] ExecuteThread: '5' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <>
<> <1291669863989> <BEA-000000> < Subject: 3
Principal = weblogic.security.principal.WLSUserImpl("weblogic")
Principal = weblogic.security.principal.WLSGroupImpl("Administrators")
Principal = weblogic.security.principal.WLSGroupImpl("IntegrationAdministrators")
The issue of Microsoft AD administrator user not able to test datasource in WLI domain seems to be happening because of IntegrationAdministrators group which comes by default with WLI domain (in plain WLS domain we do not have this group). Looks like the datasource which is being created in WLI domain seems to be being treated as WLI resource and user accessing it is being checked if it part of IntegrationAdministrators group. In this case weblogic default administrator user is part of IntegrationAdministrators, for which we do not see issue where as Microsoft AD administrator user which is not part of IntegrationAdministrators seems to be having problem.
Below is snipper of Microsoft AD administrator user in Debug logs
####<Dec 6, 2010 4:13:31 PM EST> <Debug> <SecurityAtz> <slsol10> <AdminServer> <[ACTIVE] ExecuteThread: '4' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <>
<> <1291670011687> <BEA-000000> <XACML Authorization isAccessAllowed(): input arguments:>
####<Dec 6, 2010 4:13:31 PM EST> <Debug> <SecurityAtz> <slsol10> <AdminServer> <[ACTIVE] ExecuteThread: '4' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <>
<> <1291670011687> <BEA-000000> < Subject: 2
Principal = weblogic.security.principal.WLSUserImpl("MSADAdminUser")
Principal = weblogic.security.principal.WLSGroupImpl("Administrators")
Also one more observation about datasource which is created is in plain WLS & WLI domain created datasource resource type is shown as “jdbc” which is expected, but in addition in WLI domain I observe that created datasource resource type is marked as JMX and DS is being considered as application (below), not sure if this has something to do with the issue.
Below is WLS domain debug log, below you can see that datasource is being treated as JDBC resource which is expected.
####<Dec 6, 2010 5:21:03 PM EST> <Debug> <SecurityAtz> <slsol10> <AdminServer> <[ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1291674063776> <BEA-000000> <com.bea.common.security.internal.service.AccessDecisionServiceImpl.isAccessAllowed Resource=type=<jdbc>, application=, module=, resourceType=ConnectionPool, resource=testDS, action=reserve>
Below is WLI domain debug log, below you can see that datasource is being treated as application and it says resource type as JMX
####<Dec 6, 2010 4:12:17 PM EST> <Debug> <SecurityAtz> <slsol10> <AdminServer> <[ACTIVE] ExecuteThread: '4' for queue: 'weblogic.kernel.Default (self-tuning)'> <<WLS Kernel>> <> <> <1291669937755> <BEA-000000> < Resource: type=<jmx>, operation=get, application=testDS, mbeanType=weblogic.j2ee.descriptor.wl.JDBCDataSourceBean, target=Name>
I created user in embedded LDAP in WLI domain with same name as MS AD administrator user and assigned it to Administrators group, that obviously works but is not acceptable solution.
Below is exception thrown on console when testing datasource using Microsoft AD administrator user.
weblogic.management.NoAccessRuntimeException: Access not allowed for subject: principals=[MSADAdminUser, Administrators], on Resource weblogic.management.runtime.JDBCDataSourceRuntimeMBean Operation: invoke , Target: testPool at weblogic.rmi.internal.ServerRequest.sendReceive(ServerRequest.java:205) at weblogic.rmi.internal.BasicRemoteRef.invoke(BasicRemoteRef.java:222) at javax.management.remote.rmi.RMIConnectionImpl_1030_WLStub.invoke(Unknown Source) at javax.management.remote.rmi.RMIConnector$RemoteMBeanServerConnection.invoke(RMIConnector.java:978) at weblogic.management.jmx.MBeanServerInvocationHandler.doInvoke(MBeanServerInvocationHandler.java:544) at weblogic.management.jmx.MBeanServerInvocationHandler.invoke(MBeanServerInvocationHandler.java:380) at $Proxy92.testPool(Unknown Source) at com.bea.console.actions.jdbc.datasources.testjdbcdatasource.TestJDBCDataSource.begin(TestJDBCDataSource.java:114) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:597) at org.apache.beehive.netui.pageflow.FlowController.invokeActionMethod(FlowController.java:870) at org.apache.beehive.netui.pageflow.FlowController.getActionMethodForward(FlowController.java:809) at org.apache.beehive.netui.pageflow.FlowController.internalExecute(FlowController.java:478) at org.apache.beehive.netui.pageflow.PageFlowController.internalExecute(PageFlowController.java:306) at
- BoyelT

This issue has been resolved.
The problem of Microsoft active directory administrator user not able to test the datasource in WLI domain is caused because of IntegrationAdministrators group & IntegrationAdmin role which comes in WLI domain. Assigning the Microsoft Administrator group to IntegrationAdmin role from WebLogic console has resolved the issue.
Below are steps for assigning the MS AD administrator group to IntegrationAdmin role from console in WLI domain.
======================================================
- Login to console and click on "Security Realms" and "myrealm"
- Go to "Roles and Policies" tab and expand "Global Roles" tree and "Roles" tree view under it.
- Click on "View Role Conditions" link for "IntegrationAdmin" role.
- Click on "Add Conditions" button select Group (default) for "Predicate List" drop down box and click Next button.
- Specify MS AD admin group name for "Group Argument Name" text box and hit on Add button.
======================================================
- BoyelT
Edited by: BoyelT on Dec 20, 2010 1:36 PM

SAP Web Access Issues

Hello Experts,
I have been given a link for SAP Web Access. I am able to access transactions and post data and write programs. However, none of the GUI functionality is working and is giving shorts dumps when i click on the layout tab for Adobe, Internal error for form painter in smartforms and a file not found error for layout editor for screen painter. I raised this issue with the Ides team but they do not have a resolution for it and they too get the same error on all of there systems.
Has anybody enocountered this issue before and if so could you please give me some direction.
One point is that for an existing Adobe form i'm able to successfully execute it and display the form.
Thanks for your help!
Minhaj.

Dear Juan,
I can access another server with http://FQDN:50000, It will show the screen of SAP Web Application Portal.
After I check parameter icm/host_name_full , I did not maintain anything, it is working fine.
Why in ERP system, I did not maintain anything like that server, I have only maintain FQDN, It is not working and did not show anything. Pls suggest me how to solve it.
Regards,
Pannee

Can multiple XP users access the same iTunes library?

Because I'm having a REALLY hard time getting that to work at all. I've moved my entire iTunes folder into 'Shared Documents' so that all users should be able to access it and changed the option in iTunes Preferences to the correct 'all users' path, but iTunes still tries to find the info in 'my' (sal's) documents instead of 'all.'
Anyone figure this out, or does it somehow break the EULA and isn't supported? The wife and I just want to use the same library since we're on one computer. Seems silly to not allow a user with admin rights to allow other users access.
Thanks,
Sal
Windows XP

Sal,
As this article in the Apple Knowledge Base explains the trick is to move the iTunes Music folder, not the entire iTunes folder, to "a publicly accessible location" and I believe they mean to suggest C:\Documents and Settings\All Users\Documents\My Music as a good place.
It is important that the iTunes Library files remain in Sal's Documents and Sal's Wife's Documents.

Can Multiple DOE users access same client

Dear All,
I have a use case where manager and his team have to use the same physical device ( It mean same client in the handheld and also the same application). Manager and all the team members are DOE Users.
As far as i know, we will have multiple local users in the client and mapped to single doe user, where as synchronization will happen through DOE sync user, who is configured in the client. During Sync DOE authenticates this user.
But in my use case, DOE should authenticate all the users (user with which i am synchronizing the data). Is this possible in the standard client? Is there any possibility to achieve this?
Regards,
Kiran.

HI,
Your requirement is a standard behavior and there is nothing like all the local client users are mapped to DOE users in default client.
If each local client user has a corresponding DOE server username(i guess it need to be the same username or so) , with a user logged in , he/she can provide their own sync password which will take sync user as the currently logged in local client user.
Only catch here that irrespective of which user is synching, all the messages in the queue (new data,modifications etc ) created by all the users will be send to server with this sync.
Regards,
Liji

SAP Business One 8.81 PL08 Mobile APP CRM Standalone User Access issue

Dear All
Is any facing the problem of Mobile application user with CRM Standalone license ,this user always has a permission denied problem (he is assigned all the licenses required .and authorization on the SAP is full . SSL certificate is installed ). I have installed the troubleshooting (.zip) file which dosent show up the panel .
Any Idea how to resolve?
Regards
Dayal

Hi Dayal,
well, it is neither recommended, nor tested or supported. Such installation attempt would go on your own responsibility. Of course you can try if, for example, a newer version from 8.82 works here, but this should be tested extensively, depending on how other processe are based on it.
Actually your 8.81 PL08 should not have reported problem since B1if version 1.10.0 should have been included in this package and last update action, maybe you can check here again.
In general, we recommend you upgrade to version 9.1 currently, unlike version 8.81 this version is in maintenance and offers all improvements, new features and bugfixes from the last 3,5 years.
I'm sure it's worth to consider a general upgrade.
I wish you success!
Best, Peter

CUIC Scheduler user access issue

This one has me stumped.
We recently finished an upgrade for a client that included a transition to a new virtual environment. I built out two 9.1.1 clusters, and did a disaster recovery restore from the old prod systems into the new prod system. After much foul language we got everything working, except an issue with runnihg scheduled reports.
If a superuser makes an edit to the report, like changing the scheluded run time, a normal level user can no longer make a change to the report. The superuser has to then delete the report, and the user recreate it. Even with the new reports, if the superuser makes a change, it locks out the user.
This is CUIC 9.1.1, and I am not seeing anything strange in the web interface. My CUIC fu is weak here, so any help would be greatly appreciated

I see this behavior in CUIC 8.5 as well. The workaround is for the superuser to do a "Run As" (from Security -> User List) as the user who made the schedule, then edit the schedule from there. The schedule will then stay owned by that user instead of the superuser.
-Jameson

New user access issue

i have one business user which i have added through EAS and this user is in MSAD and added into one of the group in Native directory. This users group has access to planning application provision and i can see him in this group and has access to the planning application. but when he tries to connect through essbase addin he can not connect to the planning databse.
Thanks in advance for the reply.

I am using the planning version 9.3.1 and first i tried to add the user from EAS and update the security but when user complained about the access i went to shared service and first remove him from the group refreshed the security and then i add him in the group from the shared service. the other users in the same group dont have any problem and this user can access other database but he can not connect to the specific one database only. Also the error says that user has not permitted access to the database.
Thanx john.

LDAP/OID Users granting other users access issue

Hi,
I have created 4 users (User1, User2, User3, User4) and 2 groups (Group1 and Group2)
User1 is the Group1 owner and User2 is a member of Group1
User3 is the Group2 owner and User4 is a member of Group2
I have made both groups private.
I have given User2 manage privilege on a portal page and have logged in as User2 and edited the page.
When User2 tries to Grant access to the page, they can see all the users in the OID ie User1, User3, User4, Portal etc
My thoughts were that User2 would only be able to grant access to other users in his group(s).
Basically, I want to be able to control which users a user can grant access to on a page. Is this possible?
Thanks
Joel.

What about SSL or LDAPS !
Can't seem to find any java examples which would support services of type:
ldapbind -U 1,2 for java API !

Calculated SAP USER ID not binding

Hello Users,
I have to calculate the SAP user ID in the method and then bind this to a container which is set up to flow to a send mail step where it is input as recipient type: Organization object and the expression is the container element. The container element is multiline (if multiple SAP users need to be output) and is type SWHACTOR where OTYPE = u2018USu2019 and OBJID = SAP USERS.
However after multiple testing in SWUS and using the debugger the workflow fails with message u2018No administrator for tasku2019. I debugged through the method and I am sure that the container element is populated in the method but when I debugged into SENDTASKDESCRIPTION , ADDRESSSTRINGS is initial which is the issue .
ADDRESS_STRINGS is a table container so my code in the method to set it is
SWC_SET_TABLE CONTINER <>, could this be incorrect? (should I set up the table variable as type ADDRESS_STRINGS and not SWACTOR)
Has anybody any suggestions as to what could be the issueu2026.when I change the expression on the SENDMAIL to WF_INIIATOR then the workflow completes but the user message must not go to the initiator of the workflow but to the calculated SAP USERID.
Any suggestions will earn points
Regards
David Dittmer

Hi David,
I think you're mixing up two separate issues here:
1) get the users you want to send a mail to (with a method)
2) send the mail to the users using a SendMail step in the workflow
You can look in the workflow log to see if 1) returns any users to the workflow.
If it does, you just have to bind that same container element to ADDRESSSTRINGS in SendMail and it should work.
I just tried it with a test workflow. I created a workflow container element called TESTMAIL with type SWHACTOR,
multiline, import and export and I put two initial values into it: US BAKKERR and US SMITHG.
I then created a SendMail step (which requires the creation of a new task) and in the binding attached &TESTMAIL& to &ADDRESSSTRINGS& (I left the default binding of G to &TYPEID&). It worked.
Please try that and figure out if your problem is with 1) or 2).
regards
Rick Bakker
hanabi technology

Report on User Access

Hi,
I want to run a report to view all user access within our subsidiary. I know I can see each users access individually by using transaction code SU01D, but is there away to see all users access at the same time?
Kind Regards,
Tracy.

Dear,
Please check: http://sap.ittoolbox.com/groups/technical-functional/sap-security/sap-users-access-to-transactions-1932475
Regards,
Syed Hussain.

Send notification mail to SAP user in step mail

Dear All:
My requirement is to send notification mail to multiple SAP user when a PO is created.
I am using step mail.
Kindly help me with this.
shegar

Hi,
Follow the below steps,
I hope you might have already created a workflow, or else cretae a workflow template from PFTC transaction and link the event of Created of the PO respective vusness object.
2. Then in the workflow determine or a BOR method to determine the agents, or create a RULE from PFAC transaction and include this rule in the send mail step
3. Include the body of the content in the send mail step....
Regards
Pavan

SuperUser access issue

Hi guys,
Just a critical issue that I'm trying to resolve, but i'm starting to turning in round...need help ...
After a big crash reinstalling and restoring data on a new SUN Sparc Sol10_patched 118222-30. I've got an Super User access issue.
Even if I'm logged in Super User I do not have Super User right. As an exemple as I can create files but I cannot move or copy those. When i start some application I cannot managed it because I do not have Super User right.
Does any one have an idea?
Tks
Cheers

Make sure you able to connect the db using command prompt or just ping <tnsname>
In connection pool use hostname:port/ServiceName
if helps mark
~ http://cool-bi.com

Multiple simutaneously logged in users accessing AFP home directories?

Hi,
Many of our problems are described in this guy's blog:
http://alblue.blogspot.com/2006/08/rantmac-migrating-from-afp-to-nfs.html
The basic capability we want is to have multiple simultaneously logged in users to have access to their AFP mounted home directory, which is configured in a sane, out-of-the box setup using WGM and Server Admin.
Multiple user access could take the form of FUS (fast user switching), or simply allowing a user to SSH into a machine that another user is already logged into and expect to be able to manipulate the contents of her home directory.
From my extensive searches, I have no reason to believe this is currently possible with 10.4 Server and AFP.
(here's the official word from apple: http://docs.info.apple.com/article.html?artnum=25581)
I've read that using NFS home directories will work, though.
I want to believe that Apple has a solution for this by now (it's been almost a year since we first had difficulty), or at least a sanctioned workaround. If Apple doesn't have one, maybe someone else has come up with something clever. I find it hard to believe that more people haven't wanted this capability! (not being able to easily search the discussion boards doesn't help, though...)
Thanks for your help!
Adam

Parallels Issue. Track at http://forum.parallels.com/showthread.php?p=135585

User Access Management(UAM) in SAP

What are the various options to perform UAM for SAP solutions from an external application? For example can we create Users, groups, assign roles etc within SAP?
1) Is webservice an option? If so, is it RESTful or SOAP based?
2) Is an RFC call available?
3) Can we use any other mechanism such as a BAPI wrapped with our own custom module exposed as an RFC?

I have looked at your screeenshots, and not too concerned with the MSMP settings yet as we are trying to first fix your Generation job
I would enable the admin review in your setting to just see if all the necessary data is being generated, i.e. in case there are blank role owners for some roles, this could be causing an issue.
As for your criteria selection, ensure no blank fields were left in the selection made.
I would have a read of the following WIKI and see if any of the points mentioned are applicable. The first mistake made by many is to not perform the sync jobs in the correct order.
Troubleshooting UAR Request Generation - Governance, Risk and Compliance - SCN Wiki
From my memory, I know for SOD reviews "offline risk analysis" had to be enabled, but unsure if this is also necessary for UAR.
Also refer to the following general wiki User Access Review(UAR) Workflow Configuration and Description - Governance, Risk and Compliance - SCN Wiki

Multiple SAP User Access Issue?

Similar Messages

Maybe you are looking for