Orchestrator security of Integration configuration accounts

I have just installed Orchestrator 2012 R2 and I am planning to use the application to carry out several activities including general maintanance tasks as well as to control the Delegation of security permissions.
I have 2 teams of people that are required to carry out the different tasks
The first team need to configure the general mainenance tasks and will require an AD account that that as readonly or limited AD permissions.
The second team need to configure a run book to delegate security permissions for Domain Admin accounts and so needs full Domain Admin permissions.
Is there a way that I can allow both teams to have the Active Directory Integration Pack without first team being able to use the high privilege credentials.

Only if you have a separate Orchestrator instance for each team. Integration Pack permissions are common to all Runbook Designer users.

Similar Messages

Error during sync integrated configuration - incoming payload missed

Hi guys,
we are suing PI 7.11 and trying to use the new feature integrated configuration wherever possible.
Now I test a sync szeanrio where sender is SOAP and receiver is RFC.
The messages fails in SOAP Sender channel with the error that there is no suitable receiver found for this message.
During integrated configuration content based routing is used.
com.sap.engine.interfaces.messaging.api.exception.MessagingException: com.sap.engine.interfaces.messaging.api.exception.MessagingException: Receiver Determination failed for message e54dba61-9ded-11de-801a-020000000038(OUTBOUND)
But the message fails without persisting the payload, so I could check what value is missing in the receiver rules.
Furthermore the message is only displayed in the sender chanel and is not shown in rwb
While using the normal way of messsage processing where the integration server is involved, such errors are persisted and the payload is also available.
Is that the normal behaviour of integrated configurations.
Could the behaviour be parametrized?
Any help appreciated
Kind regards
Jochen

Hi,
thanks for helping.
Because of integrated configuration the integration server is passed and there is no entry in sxmb_moni.
I already tried this blog, but it doesn´t work for me.
I changed the parameter according to the blog.
But the message content of sync messages are stilled deleted.
Does the parameter changed requires restart of adapter engine or complete java stack?
There two templates one called 'Usage_Type_all_in_One' and above there is an node named equal to the server node name. The parameter of which template have to be changed.
I tried both with out success.
Hopefully you could help me using this feature
Kind regards
Jochen

Integrated Configuration- Problem occurred in receiver agreement for sender

Hi , I am using AAE in PI 7.1 and it is proxy to file scenrios.
When Ia m doing testing in Integration Directory in test configuration its giving me this error .
Problem occurred in receiver agreement for sender -<ECCBUSINESSSYSTEM> to receiver -BS_D_EPS,http://abc.com/sap/pi/HR/Qualifications.Qualifications_Async_Out: No receiver agreement found for , -<ECCBUSINESSSYSTEM> , BS_D_EPS, http://abc.com/sap/pi/HR/Qualifications, Qualifications_Async_Out
( here it should take interface Qualifications_Async_In, but logs says it is pointing to outbound interface)
here when I am going in to trace logs then it seems that are not able to understand the receiver interface . rather then it is taking sender inface in logs..
In trace logs . I am getting
Receiver Determination
<Not found>
<Trace level="1" type="B">CL_RD_PLSRV-ENTER_PLSRV</Trace>
<Trace level="1" type="T">R E C E I V E R - D E T E R M I N A T I O N </Trace>
<Trace level="1" type="T"> Cache Content is up to date </Trace>
<Trace level="2" type="T">Start with given receiver - BS_D_EPS </Trace>
<Trace level="2" type="T">Using Receiver Determination 00000000000000000000000000000000 </Trace>
<Trace level="1" type="T">No Relation found - accept given Receivers. </Trace>
<Trace level="2" type="T">...extracting Receiver from Header: BS_D_EPS </Trace>
<Trace level="2" type="T">Classic Receiver Determination via Rules. </Trace>
<Trace level="3" type="T">...create rule engine </Trace>
<Trace level="2" type="T">No Receiver found behaviour: 0 </Trace>
<Trace level="2" type="T">Number of Receivers:1 </Trace>
<Trace level="1" type="E">CL_RD_PLSRV-ENTER_PLSRV</Trace>
Interface Determination
<Not found>
<Trace level="1" type="B">CL_ID_PLSRV-ENTER_PLSRV</Trace>
<Trace level="1" type="T">I N T E R F A C E - D E T E R M I N A T I O N </Trace>
<Trace level="1" type="T"> Cache Content is up to date </Trace>
<Trace level="1" type="T">...There is no Interface Determination configured for receiver party and receiver service BS_D_EPS </Trace>
<Trace level="2" type="T">Check conditions for (Inb: Party Srvc If) BS_D_EPS Qualifications_Async_Out </Trace>
<Trace level="2" type="T">...valid InbIf without Condition: Qualifications_Async_Out </Trace>
<Trace level="2" type="T">Number of receiving Interfaces:1 </Trace>
<Trace level="1" type="E">CL_ID_PLSRV-ENTER_PLSRV</Trace>
Operation Mapping
<Not found>
<Trace level="1" type="B">CL_MAPPING_XMS_PLSRV3-ENTER_PLSRV</Trace>
<Trace level="2" type="T">......attachment XI_Context not found </Trace>
<Trace level="3" type="T">Mapping already defined in interface determination </Trace>
<Trace level="1" type="T">No mapping configured </Trace>
<Trace level="1" type="E">CL_MAPPING_XMS_PLSRV3-ENTER_PLSRV</Trace>
I have developed the other integrated configuration scenario and this is working fine .
please let me know how can I troubleshoot it

I am using sender as Soap and receiver as File adapter.
here the problem is that while going for interface deteremination and receiver agreement it is calling to Outbound interface .
It should call the inbound interface. I put all the details correctly and deleted all the objects and crated again for both Ir and Id..
I put the name of inbound interface in configuration but while executing its calling outbound interface.

ABAP Proxy sender possible in integrated configuration AAE with PI 7.11

Hi guys,
we are running PI 7.11.
We have serveral scenarios where the senderis an ABAP proxy and the receiver is reached by a jave adapter.
With Ehp1 the SOAP adapter offers the possibilty to chose XI 3.0 as message protocol.
We use this feature already in scenarios where ABAP proxy is receiver.
But is it also possible to use it at sender side?
Kind regards
Jochen

Hi Volker,
thanks for your help.
You could also use ABAP proxy at sender side during integrated configuration.
Prerequisite is to implement SAP note 1349125 and use following url for acessing the PI from SAP backends.
http://<host>:<port>/XISOAPAdapter/MessageServlet?ximessage=true
With this URL you could ABAP proxies in normal scenarios where integration server is involved as well as in integrated configurations.
Kind regards
Jochen

PI 7.1 Integrated Configuration for AAE - Issue Accessing Attachment

Hello All,
PI 7.1 in its new features allows access to the Attachment using UDF's withing Graphical Mapping.
Tried this feature and works good in Graphical mappings; am able to access the Attachment; and write it into a Field on my target. This works with the standard XI pipeline steps of passing message from AE to IE back to AE.
When trying to use the same set up with the Advanced Adapter Engine, - Integrated Configuration; this feature doesn't seem to work and the mapping run time triggers a Null Pointer Exception.
None of the SAP documentation discusses this as a limitation of AAE and hence am wondering if this is a bug or is this a limitation? Has anyone on the forum tried this?
Regards
Bhavesh

Hi Bhavesh,
I also tried this scenario long back when PI7.1 was in Rampup mode. We tried and first part was working fine as you also written, but in second part we got stuck. After some research, we found that we cannot configure additional communication scenarios that contain, for example payload-based routing or a message split, with Integrated Configuration. You must define separate receiver determinations, interface determinations, and communication agreements to configure communication scenarios of this type. We can only configure communication scenarios where message is transfered withing AAE.
MAy be you need to check the receiver interfaces and Mappings or may somthing missing there.Also check for authorized Service User.
Possibilities are like something missing is in Integrated Configuration but not sure.
Regards
Aashish Sinha

Dynamic Configuration not working with Integrated Configuration

Hi All,
Dynamic Configuration works fine in PI 7.3 when Classical Configuration is used. However the same does not work using Integrated Configuration.
Scenario :
SOAP -->SOAP Synchronous scenario in PI 7.3 (Dual Stack).
Trying to save a value from Request mapping using dynamic configuration and use the same in response mapping.
UDF Code :
Request Mapping :
DynamicConfiguration conf = (DynamicConfiguration) container.getTransformationParameters().get(StreamTransformationConstants.DYNAMIC_CONFIGURATION);
DynamicConfigurationKey Variable = DynamicConfigurationKey.create("http://sap.com/xi/XI/System/SOAP", "Variable1");
conf.put(Variable, a);
Response Mapping :
DynamicConfigurationKey Variable = DynamicConfigurationKey.create("http://sap.com/xi/XI/System/SOAP", "Variable1" );
string1 = conf.get(Variant);
Note : Using Integrated Config(AAE Processing) - Response header does not have DynamicConfiguration header node , but Classical Configuration has that.
Regards,
Parimala
Edited by: ParimalaE on Mar 1, 2012 1:33 PM

For us this is what we had:
This didn't work (getInputParameters is the newer stuff that doesn't work):
DynamicConfiguration dc = (DynamicConfiguration)container.getInputParameters().getValue(StreamTransformationConstants.DYNAMIC_CONFIGURATION);
DynamicConfigurationKey dck = DynamicConfigurationKey.create("http://sap.com/xi/XI/System/SOAP","TServerLocation");
dc.put(dck,"https://xyz.api-salesforce.com/services/Soap/c/26.0/0DFa00000008jis");
return "";
This works for us(we had to remove getInputParameters):
DynamicConfiguration dc = (DynamicConfiguration) container.getTransformationParameters().get(StreamTransformationConstants.DYNAMIC_CONFIGURATION);
DynamicConfigurationKey dck = DynamicConfigurationKey.create("http://sap.com/xi/XI/System/SOAP","TServerLocation");
dc.put(dck,"https://xyz.api-salesforce.com/services/Soap/c/26.0/00D3000000001X0");
return "";

Integrated Configuration in PI 7.1

Hi All,
I am using 3 BAPIS at the receiving side out of which 1 BAPI will be picked as per the condition in the condition editor.
1.So,do I need to tick the "Sender Uses Virtual Receiver" check-box in the "Integrated Configuration" section
2.But when I go for creating the "Integrated Configuration"section without ticking the "Sender Uses Virtual Receiver" check-box ,
it gives me the error that it is already assigned to the object;conflicting direct connections,sender agreements,or integrated configurations are not permitted.
3.I have configured the Sender Agreement,Receiver Agreement before the "Integrated Configuration" section.So,what shall I do?Shall I tick the "Sender Uses Virtual Receiver" check-box in the "Integrated Configuration" section ?
Thanks in advance.

Hi ,
Thanks for the reply.
Actually I am having the Process Order coming in the source with 5 to 6 relevant fields.Out of these Process Order fields Status is one of the fields.Based on the the StatuS field the BAPIs will be called at the receiver.So can I skip Integrated Configurations as I am imposing the condition on the data in the payload(Source Structure) as Integrated configuration will not be helpful in my scenerio.?
Or shall I skip Sender Agreement ,Receiver Agreement?
Also,in PI 7.1 Integration Directory there is one section as "Value Mapping Group".I suppose that it is used if and only if value mapping is used.But I am not using any kind of value mapping so can I skip that section?
Thanks in advance.
Edited by: Shweta Kullkarni on Aug 19, 2009 5:19 AM

Exception in Integration Configuration

Hello,
we get an exception in the Integration Directory when we create an Integration Configuration. When saving the changes we get the following error message:
Internal error: Link from Integrated Configuration | bs_cbp_c | http://BusinessPartner/asynchronous | BPartnerModifyAOut | | to object type "ifmoper" with role "IIF0" is not permitted
Can someone explain, what this message should tell us?
May it be that this error occur when using a service interface of type "Stateless (XI-3.0 compatible)"? This is the case here...
We are running on a SAP PI 7.1 EhP1...
Thanks in Advance.
Best Regards,
Lars

Hello Lars
There are some known issues in this area. See the notes below:
1) #1338699 Assigned users in Integrated Configuration
2) #1322118 Expression Editor in Integrated Configuration
I recommend that you apply the latest XI patches for your current SP release. This way you will have all the latest bug fixes. See note #1335523 FAQ: Deployment PI Patches in Release 7.1 and higher.
Regards
Mark

Question about Integrated Configuration (Advanced Adapter Engine in PI 7.1)

Hello,
When you use Advanced Adapter Engine in PI 7.1 with Integrated Configuration scenario, it bypasses ABAP stack therefore you can't monitor processed message in SXMB_MONI. Instead this message shows up only in RWB Adapter Engine message monitoring. When you select the message from there, you can view the BEFORE mapping payload in Message Content tab. My question is how do you view the AFTER mapping payload when using Integrated Configuration.
Thanks,
Jay

> My question is how do you view the AFTER mapping payload when using Integrated Configuration.
You can't.
So first you have to configure a standard scenario and test the stuff. When everything is fine, remove the standard scenario and create an Integrated Configuration.

Parameter setting for RFC Lookup in Integrated Configuration

hi Experts,
I am using AAE feature of PI 7.1 to create a file to file scenario with mapping.
I have to perform RFC_LOOKUP in mapping.
I have Created a parameters in Message Mapping and Operation Mapping and performed required binding between them.
Details of parameter are:
   Name:         RFC_Lookup
   Category:    Adapter
   Type:          RFC
   Parameter: Import
I am using Integrated Configuration in ID.
Please tell me where do I assign values to parameter in ID when using Integrated Configuration.
Thanks.
Girish

Hi guys,
I have the same issue.
I want to use an parameterzied mapping during an integrated configuration.
But I don´t find any place to specify the value for the parameter.
Are parameterized mappings not possible with integrated configuration?
If I create an normal configuration using interface determination, I could specify the parameter value
Kind regards
Jochen

Integrated Configuration - Possible for this scenario?

Hi experts,
Could you please tell me if Integrated Configuration would work in this scenario, if so could you please tell me how.
A file is read and accordingly a RFC call is made. The response of the RFC is used to determine receivers. The receivers are other RFC's and IDoc's to different systems.
I was planning to use the receiver determination step in BPM to achieve this.
I am on PI 7.11
Thank you.
Radhika.

> Could you please tell me if Integrated Configuration would work in this scenario, ...
No. You cannot use IC in combination with BPM.

Integrated configuration (PI 7.1) throws error when do 'Test Configuration'

I am doing Proxy to Web Service (SOAP) sync scenario. We are using Integrated Configuration. After created integrated configuration and test this from (Tools --> Test Configuration) it throws the following error at the receiver agreement step.
Sender Agreement - Green
Receiver Determination - Green
Interface Determination - Green
Operation Mapping - Green
Receiver Agreement - Red.
Problem occurred in receiver agreement for sender -DR4400_D to receiver -ESRI,urn:AssetManagement.AddressManagementSearchCapabilitiesFromECC_Out: No standard agreement found for , DR4400_D, , ESRI, urn::AssetManagement, AddressManagementSearchCapabilitiesFromECC_Out

Test Configuration cannot be used to test Integrated Configuration Scenario.....refer my reply here:
Re: Integrated Configuration in PI7.1
Regards,
Abhishek.

SystemAck in integrated configuration

Hello all.
I have configured an integrated configuration for a proxy -> soap scenario.
The sender adapter - is SOAP with XI 3.0 protocol.
in the section: HTTP Destination (from NWA) - I have written the ECC HTTP destination
(defined with url: http://<ecc server>:8000/sap/XI/engine/?type=entry )
The messages go out ok, but when I look in the ECC - the proxy doesn't get a system ack.
When I look in the message monitoring in the PI - I can see the SystemAck in successful, and in Transport part it says:
Loopback - so it seems that the ack is not being sent out of the PI.
Is there anything else to configure to make the ack to be sent back to the ECC?
Any help will be appreciated.

Hi,
Did you request this acknowledgement while calling the proxy from the backend system? This is a prerequisite to receiving it there. See an example of how to do it here:
http://help.sap.com/saphelp_nw04/helpdata/en/f4/8620c6b58c422c960c53f3ed71b432/content.htm
Also, see section 5. Limitation of this document below - it says that acks are not supported by ICO.
http://www.sdn.sap.com/irj/scn/index?rid=/library/uuid/70066f78-7794-2c10-2e8c-cb967cef407b
However, I remember setting it up once and acks were sometimes sent properly. In particular, System OK acks were sent. But when an error occurred during mapping, no ack reached the backend system.
Hope this helps,
Greg

IDOC_AAE in integrated configuration and condition based routing RCVPRN

Hi,
we send IDOC's from an ERP system to our PI 7.3 system. The IDOC_AAE adapter is configurated inside an integrated configuration. The routing should base on the RCVPRN context field. But in that case the sending process exits in SM58 of the sender system.
If I use the XPATH based condition with RCVPRN of the EDI_DC40 structure the sending process succeeds.
Are the context fields not filled/used by the IDOC_AAE sender adapter?
BR,
Daniel

Hi Daniel, I can confirm this behavior, context objects for Idoc adapter do not work with IDoc_AAE. I also have to use XPath. Regards, Martin

Integrated Configuration - AAE - Monitoring

Hello All
I am trying to understand how Integrated Configuration works in the runtime and things look rather neat to me with my scenario working.
But monitoring this in the RWB, few questions cropped up, which I hope someone can help answer:
1. Inbound and Outbound Payload Monitoring
When message get processed within the Integration Engine, we can see the input payload and also the output of the mapping. In the case of the Integrated Configuration, is this not possible? I don't see any new special window open and hence how is the monitoring of the various steps specifically input and output done?
2. Mapping Trace not accessible
To further analyze what is new, we put a few standard XI trace steps into the mapping to see where these traces are displayed in the runtime. We thought it would be a part of the Audit Log, but it is not. Has anyone experience with how trace (custom mapping trace using the AbstractTrace object ) can be used with Integrated Configuration or is that another limitation with PI 7.1 and the Integrated Configuration?
To me these two are major requirements as a application developer to do my development and support and hence am wondering whether to gain performance have these options been eliminated or is there some set up needed on the server which we have missed.
Thoughts , ideas welcome.
Regards
Bhavesh
PS : You know what my questions to the Subject Matter Experts at the Bangalore teched are going to be

Hello Rodrigo,
Regarding monitoring of different versions of the message processed by means of AAE, this is unfortunately not possible in PI 7.1x - message is persisted only once in such scenarios (after receiver/interface determination). Multiple persistence of the processed message in Java stack is only available in 7.3x - there you have options for configurable staging (property xiadapter.stage.conf of J2EE service XPI Adapter: XI) and logging (property xiadapter.logger.conf of J2EE service XPI Adapter: XI) of the message so that several versions of the message (e.g. before mapping and after mapping) can be observed (incl. these versions' payloads). Technically, it is possible to setup staging/logging for different processing steps (namely stages - analogue of pipeline services in classical Integration Engine processing) - but, as I said, in 7.3x and not in 7.1x.
Speaking about creation of custom audit log entries, did you check SAP standard AuditMessageKey and AuditAccess for this? (http://help.sap.com/saphelp_nwpi711/helpdata/en/3b/6fe540b1278631e10000000a1550b0/frameset.htm)
Regards,
Vadim

Orchestrator security of Integration configuration accounts

Similar Messages

Maybe you are looking for