NEED EXAMPLE AD INTEGRATION CONFIGURATION ON ACS 3.3, 5.3

Hi,
Please give example of Active directory configuration related to radius in Windows server 2003.
The same way need Step by step to AD configuration in ACS.
Please help on this. I searched alot but not getting any exact docs which say both of these things.
I need to configure End User (Wireless or L3 Device) --> ACS --> LDAP for Authentication
Regards,
Sakthivel

Before you integrate ACS 5.x to the AD, ensure that the TimeZone, Date & Time on the ACS matches with that on the AD primary domain controller. Also, define the DNS server on the ACS in order to be able to resolve the domain name from the ACS 5.x. Complete these steps in order to configure ACS 5.x Application Deployment Engine (ADE-OS):
Please follow the below link for step by step configurations because it's not possible to paste here full steps:
http://www.cisco.com/en/US/products/ps9911/products_configuration_example09186a0080bc6506.shtml

Similar Messages

Initial configuration of ACS 5.1 for EAP authentication for Wireless clients

Hi,
I have set-up with below devices :
Wireless LAN controller 5508
LAP 3302i
and ACS 5.1
since i am new in ACS 5.1 configuration , I need so information to go ahead to configure ACS 5.1.
which EAP method to use for wireless client authentication ? what is the best practice ?
I have gone through some cisco documents and it shows that best practice is to configure PEAP but for the same , I need to install certificate in ACS server as well in client PC. is that so ?
I have no clear picture for this certificate ?
from where i can get this certificate or do i need to purchase this certificate separately from cisco. how to install it in ACS server ?
I will be obliged to get atleast initial configuration for ACS 5.1 to enable the EAP method,
I need GUI based initial configuration for ACS 5.1
This mentioned ACS 5.1 is installed on ACS 1121 hardware appliance.

Hi,
which EAP method to use for wireless client authentication ? what is the best practice ?
-> I would advise the most widely spread EAP method, which has the best ratio security/easy to deploy: PEAP with MSCHAPv2, which is available by default by all windows machines.
I have gone through some cisco documents and it shows that best practice is to configure PEAP but for the same , I need to install certificate in ACS server as well in client PC. is that so ?
-> You will always need to install a server certificate, however, there is no need for client certificate because the authentication is based on the MSCHAP credentials exchange, not certificate based. The only requirement on the client regarding certificates is the following.
If you want to validate the server certificate, you have to install the server certificate under the trusted CAs of the clients.
If you do not require to trust the server certificate, you can simply disable the option of server certificate validation.
I have no clear picture for this certificate ?
from where i can get this certificate or do i need to purchase this certificate separately from cisco. how to install it in ACS server ?
-> The server certificate can be a simple self signed certificate that you generate and install on the ACS GUI.
Please feel free to follow this step-by-step guide on
PEAP under Unified Wireless Networks with ACS 5.1 and Windows 2003 Server:
http://www.cisco.com/en/US/partner/products/ps10315/products_configuration_example09186a0080b4cdb9.shtml or in pdf
http://www.cisco.com/image/gif/paws/112175/acs51-peap-deployment-00.pdf.
HTH,
Tiago
If this helps you and/or answers your question please mark the question as "answered" and/or rate it, so other users can easily find it.

Need Example on Integartion of BEx application into EP

Hi
I need example on Integration of BEx application into EP and Display Data on EP from BW without using BEx web application.
Best Regards
Ravi Shankar

Hi Ravi,
have a look into the <a href="http://help.sap.com/saphelp_nw2004s/helpdata/en/88/3c1640d4642402e10000000a1550b0/frameset.htm">SAP Library</a>. There you will find descriptions of various options how to display BI content in the SAP NetWeaver Portal.
Best regards,
Martin

Need Sample Configuration in ACS 4.2

I need configuration of ACS 4.2 for logging domain users into Network Devices.

What is the current status of your deployment? Have you already integrated ACS 4.2 with AD/domain? If yes, are you able to fetch the active directory groups in group mapping section.
If you still need to integrate ACS with AD, please broswe the below listed post and download the word document to review.
https://supportforums.cisco.com/message/4076705#4076705
Once done, try and login to your network devices via domain username and password. In case it doesn't work, please go to reports and activities > failed attempts.
Let us know how it goes.
~BR
Jatin Katyal
**Do rate helpful posts**

PI 7.1 Integrated Configuration for AAE - Issue Accessing Attachment

Hello All,
PI 7.1 in its new features allows access to the Attachment using UDF's withing Graphical Mapping.
Tried this feature and works good in Graphical mappings; am able to access the Attachment; and write it into a Field on my target. This works with the standard XI pipeline steps of passing message from AE to IE back to AE.
When trying to use the same set up with the Advanced Adapter Engine, - Integrated Configuration; this feature doesn't seem to work and the mapping run time triggers a Null Pointer Exception.
None of the SAP documentation discusses this as a limitation of AAE and hence am wondering if this is a bug or is this a limitation? Has anyone on the forum tried this?
Regards
Bhavesh

Hi Bhavesh,
I also tried this scenario long back when PI7.1 was in Rampup mode. We tried and first part was working fine as you also written, but in second part we got stuck. After some research, we found that we cannot configure additional communication scenarios that contain, for example payload-based routing or a message split, with Integrated Configuration. You must define separate receiver determinations, interface determinations, and communication agreements to configure communication scenarios of this type. We can only configure communication scenarios where message is transfered withing AAE.
MAy be you need to check the receiver interfaces and Mappings or may somthing missing there.Also check for authorized Service User.
Possibilities are like something missing is in Integrated Configuration but not sure.
Regards
Aashish Sinha

MQ + OpenLdap: Any working example of LDAP configuration?

MQ + OpenLdap: Any working example of [LDAP configuration], [LDIF initial data] and [imobjmgr addTopicFactory/addTopic command] files ?
I'm using Sun MQ3.5 + OpenLdap2.2.20 as jndi remote binding mechanism.
I've unsuccessfuly tryed to add a Topic Factory!
Running the command
     imqobjmgr -i add_ldap_topic_factory.poperties
I get such an exception:
     javax.naming.OperationNotSupportedException:
     [LDAP: error code 53 - no global superior knowledge];
     remaining name 'cn=myTopicConnectionFactory'
This is the test configuration adopted using rootdn user to write to LDAP repository:
#slapd.conf
include /usr/local/etc/openldap/schema/core.schema
database     bdb
suffix          "dc=imq,dc=com"
rootdn          "cn=Manager,dc=imq,dc=com"
rootpw          secret
directory     /usr/local/etc/openldap/var/openldap-data
index     objectClass     eq
#test.ldif
dn: dc=imq,dc=com
objectClass: dcObject
objectClass: organization
dc: imq
o: imq
#add_ldap_topic_factory.poperties
version=2.0
cmdtype=add
obj.type=tf
obj.lookupName=cn=myTopicConnectionFactory
obj.attrs.imqAddressList=mq://localhost:7676/jms
objstore.attrs.java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory
objstore.attrs.java.naming.provider.url=ldap://localhost:389/o=imq
objstore.attrs.java.naming.security.principal=cn=Manager,dc=imq,dc=com
objstore.attrs.java.naming.security.credentials=secret
objstore.attrs.java.naming.security.authentication=simple
Thanks for any suggestion,
Silvano

Agreed.
I've been wanting to test the steps and write a tech article on this
and post it to somewhere on sunsolve.sun.com but have not had
time yet.
In any case, the instructions Ken-shi gave are below including
the 3 files (etang.ldif objectstore.properties slapd.conf). Not sure
how messy this posting can get due to size of files.
I'd much rather point you to a sunsolve article but don't want
to make you wait. When I do post the sunsolve article, this thread
will be updated with a ptr to it.
===Begin instructions===
Attached please see my working configuation files.
1.Modify your OpenLdap configuration. (see slapd.conf)
start OpenLdap: ./slapd
2.Modify you initial data.( see etang.ldif)
load initial data: ldapadd -x -D "cn=Manager,dc=etang,dc=com" -W -f
etang.ldif
3.ObjectStore properties ( see objectstore.properties )
create your object store with "Administration" GUI on windows;
while creating destinations or connection factories, be sure that the
lookup names start with "cn=".
===End instructions===
===Begin etang.ldif===
dn: dc=etang,dc=com
objectClass: dcObject
objectClass: organization
dc: etang
o: Etang Corporation
description: The etang corporation
dn: cn=Manager,dc=etang,dc=com
objectClass: organizationalRole
cn: Manager
description: Directory Manager
dn: o=IMQ,dc=etang,dc=com
objectClass: organization
o: IMQ
dn: ou=imqusers,o=IMQ,dc=etang,dc=com
objectClass: organizationalUnit
ou: imqusers
dn: cn=admin,ou=imqusers,o=IMQ,dc=etang,dc=com
objectClass: person
cn: admin
sn: admin
userPassword: admin
dn: cn=guest,ou=imqusers,o=IMQ,dc=etang,dc=com
objectClass: person
cn: guest
sn: guest
userPassword: guest
===End etang.ldif===
===Begin objectstore.properties===
java.naming.provider.url ldap://10.1.0.195:389/o=IMQ,dc=etang,dc=com
java.naming.factory.initial com.sun.jndi.ldap.LdapCtxFactory
java.naming.security.principal cn=admin,ou=imqusers,o=IMQ,dc=etang,dc=com
java.naming.security.authentication simple
java.naming.security.credentials admin
===End objectstore.properties===
===Begin slapd.conf===
# See slapd.conf(5) for details on configuration options.
# This file should NOT be world readable.
include          /usr/local/openldap/etc/schema/core.schema
include /usr/local/openldap/etc/schema/cosine.schema
include /usr/local/openldap/etc/schema/inetorgperson.schema
include /usr/local/openldap/etc/schema/dyngroup.schema
include /usr/local/openldap/etc/schema/java.schema
include /usr/local/openldap/etc/schema/nis.schema
include /usr/local/openldap/etc/schema/misc.schema
# Define global ACLs to disable default read access.
# Do not enable referrals until AFTER you have a working directory
# service AND an understanding of referrals.
#referral     ldap://root.openldap.org
pidfile          /usr/local/openldap/var/run/slapd.pid
argsfile     /usr/local/openldap/var/run/slapd.args
# Load dynamic backend modules:
# modulepath     /usr/local/openldap/libexec
# moduleload     back_bdb.la
# moduleload     back_ldap.la
# moduleload     back_ldbm.la
# moduleload     back_passwd.la
# moduleload     back_shell.la
# Sample security restrictions
#     Require integrity protection (prevent hijacking)
#     Require 112-bit (3DES or better) encryption for updates
#     Require 63-bit encryption for simple bind
# security ssf=1 update_ssf=112 simple_bind=64
# Sample access control policy:
#     Root DSE: allow anyone to read it
#     Subschema (sub)entry DSE: allow anyone to read it
#     Other DSEs:
#          Allow self write access
#          Allow authenticated users read access
#          Allow anonymous users to authenticate
#     Directives needed to implement policy:
# access to dn.base="" by * read
# access to dn.base="cn=Subschema" by * read
# access to *
#     by self write
#     by users read
#     by anonymous auth
# if no access controls are present, the default policy
# allows anyone and everyone to read anything but restricts
# updates to rootdn. (e.g., "access to * by * read")
# rootdn can always read and write EVERYTHING!
access to * by * write
# ldbm database definitions
database     bdb
suffix          "dc=etang,dc=com"
rootdn          "cn=Manager,dc=etang,dc=com"
# Cleartext passwords, especially for the rootdn, should
# be avoid. See slappasswd(8) and slapd.conf(5) for details.
# Use of strong authentication encouraged.
rootpw          secret
# The database directory MUST exist prior to running slapd AND
# should only be accessible by the slapd and slap tools.
# Mode 700 recommended.
directory     /usr/local/openldap/var/openldap-data
# Indices to maintain
index     objectClass     eq
===End slapd.conf===

Device not configured in ACS

I have some devices in my LMS 3.2 Master-Slave ACS-mode, that are, according to the DCR and AAA portlet, not configured in ACS
However I have checked that the devices are in ACS (in NDG and based on ip addresses, unique or by using wildcards)
What could be the reason why LMS can't find the devices in ACS?

Hi,
If you have configured the devices in ACS and the LMS and ACS intergrity has been done then we need to break the integrity and redo it once again.
break the ACS and cisco works integrity, restart the deamons and then integrate it once again.
Please let me know if it helps.
Regards,
podhillo

Integrated Configuration in PI 7.1

Hi All,
I am using 3 BAPIS at the receiving side out of which 1 BAPI will be picked as per the condition in the condition editor.
1.So,do I need to tick the "Sender Uses Virtual Receiver" check-box in the "Integrated Configuration" section
2.But when I go for creating the "Integrated Configuration"section without ticking the "Sender Uses Virtual Receiver" check-box ,
it gives me the error that it is already assigned to the object;conflicting direct connections,sender agreements,or integrated configurations are not permitted.
3.I have configured the Sender Agreement,Receiver Agreement before the "Integrated Configuration" section.So,what shall I do?Shall I tick the "Sender Uses Virtual Receiver" check-box in the "Integrated Configuration" section ?
Thanks in advance.

Hi ,
Thanks for the reply.
Actually I am having the Process Order coming in the source with 5 to 6 relevant fields.Out of these Process Order fields Status is one of the fields.Based on the the StatuS field the BAPIs will be called at the receiver.So can I skip Integrated Configurations as I am imposing the condition on the data in the payload(Source Structure) as Integrated configuration will not be helpful in my scenerio.?
Or shall I skip Sender Agreement ,Receiver Agreement?
Also,in PI 7.1 Integration Directory there is one section as "Value Mapping Group".I suppose that it is used if and only if value mapping is used.But I am not using any kind of value mapping so can I skip that section?
Thanks in advance.
Edited by: Shweta Kullkarni on Aug 19, 2009 5:19 AM

SystemAck in integrated configuration

Hello all.
I have configured an integrated configuration for a proxy -> soap scenario.
The sender adapter - is SOAP with XI 3.0 protocol.
in the section: HTTP Destination (from NWA) - I have written the ECC HTTP destination
(defined with url: http://<ecc server>:8000/sap/XI/engine/?type=entry )
The messages go out ok, but when I look in the ECC - the proxy doesn't get a system ack.
When I look in the message monitoring in the PI - I can see the SystemAck in successful, and in Transport part it says:
Loopback - so it seems that the ack is not being sent out of the PI.
Is there anything else to configure to make the ack to be sent back to the ECC?
Any help will be appreciated.

Hi,
Did you request this acknowledgement while calling the proxy from the backend system? This is a prerequisite to receiving it there. See an example of how to do it here:
http://help.sap.com/saphelp_nw04/helpdata/en/f4/8620c6b58c422c960c53f3ed71b432/content.htm
Also, see section 5. Limitation of this document below - it says that acks are not supported by ICO.
http://www.sdn.sap.com/irj/scn/index?rid=/library/uuid/70066f78-7794-2c10-2e8c-cb967cef407b
However, I remember setting it up once and acks were sometimes sent properly. In particular, System OK acks were sent. But when an error occurred during mapping, no ack reached the backend system.
Hope this helps,
Greg

Integrated Configuration - AAE - Monitoring

Hello All
I am trying to understand how Integrated Configuration works in the runtime and things look rather neat to me with my scenario working.
But monitoring this in the RWB, few questions cropped up, which I hope someone can help answer:
1. Inbound and Outbound Payload Monitoring
When message get processed within the Integration Engine, we can see the input payload and also the output of the mapping. In the case of the Integrated Configuration, is this not possible? I don't see any new special window open and hence how is the monitoring of the various steps specifically input and output done?
2. Mapping Trace not accessible
To further analyze what is new, we put a few standard XI trace steps into the mapping to see where these traces are displayed in the runtime. We thought it would be a part of the Audit Log, but it is not. Has anyone experience with how trace (custom mapping trace using the AbstractTrace object ) can be used with Integrated Configuration or is that another limitation with PI 7.1 and the Integrated Configuration?
To me these two are major requirements as a application developer to do my development and support and hence am wondering whether to gain performance have these options been eliminated or is there some set up needed on the server which we have missed.
Thoughts , ideas welcome.
Regards
Bhavesh
PS : You know what my questions to the Subject Matter Experts at the Bangalore teched are going to be

Hello Rodrigo,
Regarding monitoring of different versions of the message processed by means of AAE, this is unfortunately not possible in PI 7.1x - message is persisted only once in such scenarios (after receiver/interface determination). Multiple persistence of the processed message in Java stack is only available in 7.3x - there you have options for configurable staging (property xiadapter.stage.conf of J2EE service XPI Adapter: XI) and logging (property xiadapter.logger.conf of J2EE service XPI Adapter: XI) of the message so that several versions of the message (e.g. before mapping and after mapping) can be observed (incl. these versions' payloads). Technically, it is possible to setup staging/logging for different processing steps (namely stages - analogue of pipeline services in classical Integration Engine processing) - but, as I said, in 7.3x and not in 7.1x.
Speaking about creation of custom audit log entries, did you check SAP standard AuditMessageKey and AuditAccess for this? (http://help.sap.com/saphelp_nwpi711/helpdata/en/3b/6fe540b1278631e10000000a1550b0/frameset.htm)
Regards,
Vadim

How to test integrated configuration?

Hi,
I've set up an Integrated Configuration.(ICO)
I know i cannot test from Tools >> Test Configuration
I'm testing from RWB, i suppose i have to put my xml using the adapter engine test message option instead of the integration engine test option. You think that is correct?
Whatever i do i still get an error message saying there is no receiver determination for the given business component and interface. I thought for ICO you dont need Receiver Determination? Am i wrong?
Are there other/better ways to test this ICO?
Thx
Robert

Hi,
Small recap of the issue: i want to test an Integrated Configuration from the RWB.
My scenario is File to SOAP (synchronous)
All cache refreshes both in SXI_Cache and CPA cache were good.
If i test from RWB >> INtegration Engine >> Test Message then i get the following return:
".... Error While Sending Message: Error stack from response: No receiver could be determined...."
(this response is understandable: ICO is not on the IE and the combination of Sender Component/INterface/Namespace will not be found there, so we get an error)
But...
If I test from RWB >> Adapter Engine >> Test Message with these details:
Sender Component = Sender Comm Component from ICO
Interface = Sender Interface from ICO
Namespace = Sender Namespace from ICO
User/Passw are good
QoS: Best Effort
XML = good
then i get the following result:
"....Error While Sending Message: Additional error text from response: com.sap.engine.interfaces.messaging.api.exception.ConfigException: ConfigException in XI protocol handler. Failed to determine a receiver agreement for the given message. Root cause: com.sap.aii.af.service.cpa.CPAObjectNotFoundException: Couldn't retrieve outbound binding for the given P/S/A values: FP=;TP=;FS=TEST_ICO;TS=;AN=SIOS_ICO_ReadCustomer;ANS=urn:vitens:isu:installation:create; in the current context [Unknown]. ......"
receiver agreement?
So i wonder if it is possible at all to test the ICO from the RWB?
Any comments are helpful.
Also i'm wondering if there could be installation settings wrong for AAE (we're on PI 7.11)
Or maybe there are settings in the Service Interface i should do differently?
Kr
Robert

Query on Integrated configurations(IC)

Hi all,
i am trying to create a integrated configuration for our(file-to-file).
I am following the steps mentioned in the how to guide,
[http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/700058f0-b1a1-2a10-39a8-ab2627b87cfa?quicklink=index&overridelayout=true|http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/700058f0-b1a1-2a10-39a8-ab2627b87cfa?quicklink=index&overridelayout=true]
1) i created sender CC.
2)Created reciever CC.
But, when i started creating IC,
i am not getting my interface & namespace in value list(search help).
do i need to create a complete configuration scenario, before creating IC??
wondering , wat is missing actually.
regrds.
san

guys,
i was able to do it.
we just need to manually mention interface name & namespace .
it works..........

"XI demo examples must be configured before first use"

Trying to execute the "Checking Flight Seat Availability" (Proxy-to-Proxy Communication) in Client 105 but there seems to be a problem. A new SAP screen states "XI demo examples must be configured before first use, Read the documentation under Help - Application Help", and unfortunately there is no content in the Help either. I am 100% sure that the example have been properly configured according to the Configuration Guide but obviously I have missed something. The BSP application in the SAP system of the Integration Server (client 105) has been activated.

Hi,
please check the following link.
http://help.sap.com/saphelp_erp2005/helpdata/en/ae/fd773f12f14a18e10000000a114084/frameset.htm
Please note the following points from SAP help. please note the sentence in bold wich states that you must create the configuration objects yourself. Since different customers have different requirements in an integration scenario, Integration Directory content is not shipped. It is the task of consultants and administrators to configure the data in the Integration Directory at the customer site
The features of the demo examples include several complete integration scenarios and comprise the following parts:
·        Design objects in the Integration Repository
The design objects are defined and shipped by SAP.
·        Configuration objects in the Integration Directory
You must create the configuration objects yourself. SAP provides comprehensive recommendations to help you.
·        Example applications
SAP has implemented example applications for the communication parties involved. These example applications also contain user interfaces. You use these to execute the demo examples.
·        Configuration guide
Detailed configuration instructions for the standard configuration recommended by SAP are available for the demo examples. These describe all the steps required to configure the demo examples in detail. A basic knowledge of Process Integration is sufficient to be able to make the relevant configuration settings.
·        Documentation
Besides the detailed configuration instructions, additional documentation is also available. This also describes how to use the individual demo examples and explains the technical concepts addresse
Please award points for helpful answer.
thanks
sharmistha

FI integration configurations

Hi, I needed the areas where configurations are required by a FI consultant in the FI module for integration with other modules. Would be great if someone could throw light on this!

<b>FI MM Integration:</b>
FI to MM integration is happen at OBYC, there you will assign GL accounts for Transaction Keys like BSX(Inventry), GBB. You will specify the Valufatin Modifier, Valuation class and assign the GL account.
Materials are maintained at Plant or Company code level, that is nutting but Valuation Area, A Valuation Area can be a plant or a Company code. Copule of Valuation areas is group and name as Valuation Grouping code/valuation modifer, and to this valuation modifier and valutin class we assign GL account.
So, at the time of inventry posting of particular material, the system will check its Valuatoin Class, then determines Valuation Area, and finally selects the GL account specified and updated in that particular account.
That how the integration with MM happen.
<b>FI to SD integration</b>
FI to SD integration will happen at VKOA. we will assing GL account to the transaction key like ERL(Sales Revenue)WRX(GR/IR) account etc.,
Satish
Please assign point if useful

Ciscoworks - devices "not configured in ACS"

Hi all,
Can anyone explain why Ciscoworks places some new devices in the above category even when the device config, ACS, etc is all configured correctly? I have a handful of devices that keep going into this category and there is nothing I can do to stop it happening - it is a real hassle as you have to then set CW to non ACS mode restart the daemon, delete the entries etc etc.
If anyone can describe how I can get CW to manage such devices properly and possibly even tell me how to stop it happening in the future it would be of great help.
Many thanks in advance (though I know some of you would rather have points ;-)
Scott

Hi Scott ,
Device will fall to " Devices not Configured in ACS " only in 2 condition :
1. Device is actually does not Exist in ACS
2. It EXist in ACS with different IPADDRESS or HOST NAME.
There is no direct way to delete these devices once they are on the Not Configured
in ACS list. However, one workaround is:
Step 1. Create a dummy NDG group in ACS to include these devices.
Step 2. Delete the devices in DCR and then in ACS.
Note: In order to delete a device from DCR we need to follow this procedure:
1.- Go to Common Services >> Devices and Credentials >> Reports >>
Devices that are not configured in ACS and generate a report.
2.- Now that we have all the devices that we want to delete, please go to
Common Services
>> Device and Credentials >> Device Management and select all the devices
from CS (Common Services database).
3.- Click on Delete and a confirmation message will pop, agree to this.
I hope this will help you
Thanks
Afroj

NEED EXAMPLE AD INTEGRATION CONFIGURATION ON ACS 3.3, 5.3

Similar Messages

Maybe you are looking for