Portal-based logon Groups?

Hi,
I´m working with in a Application Sharing setup and in help.sap related to configuring Application Sharing in a clustered environment it mentions something about a portal-based logon group and a zone separator when just having a stand alone server with more than one server nodes.
This is found in the following document under ClusterLogonGroupName and ClusterGroupSeparator explanation.
http://help.sap.com/saphelp_nw70/helpdata/en/6d/41e74196d8c517e10000000a155106/content.htm
I have never heard about logon groups inside SAP Portal and a zone separator, has somebody worked with them? where do you configure them or is this info in help.sap not accurate?
Kind Regards,
Gerardo J

Hi Gerado,
You define logon groups to determine how client requests to certain applications are load balanced when your system setup uses the SAP Web Dispatcher or a third-party hardware load balancer in front of your application servers. For example, you can define a logon group so that a certain application (such as one with high CPU usage) is accessible only on two instances within your cluster, which are running on machines equipped with extra CPU resources.
http://help.sap.com/saphelp_nw70/helpdata/en/f3/795a421b5ec153e10000000a1550b0/frameset.htm
Information regarding the zone seperator can be found here:
http://help.sap.com/saphelp_nw70/helpdata/en/56/dcf4c12b072c4e89884dc164b3762c/frameset.htm
I have not worked with these, but they seem interesting.
Regards,
Kai

Similar Messages

SAP Portal J2EE logon groups

Please can you help.
Within ABAP you can go into SMLG and configure logon groups so you can separate user groups to particular application instances.
I would like to do the same within NW Portal and CE. We have external and internal users accessing the portal (NW 7.0) I have web dispatchers to load balance across application instances however is it possible to create logon groups and dedicate dedicated application instances to these user groups. I have read that you able to do this however the user groups would require different URL's and then the Web dispatcher can filter the URL and assign it to the relevant Java logon groups. The requirement which I have is that I am unable to change my URL so external and internal users use the same URL.Please note I only have 1 set of Portal Web dispatchers. The Web dispatchers serve both internal and external users. Also for extra information my portal mainly calls Web Dynpro code from CE. CE also has Web dispatchers as I have more than 1 CE app server. I assume if it is possible my requirement would also be to create logon groups within CE so external users use certain EP app servers and CE app servers and internal use other EP app servers and other CE app servers.
EP is version 7.0
CE is version 7.2
WD is version 7.3
Any help and advice would be appreciated.
Thanks
Ajay

Hi Arjun,
Thanks - I know how to make the logon groups in Java however I don't want to use different URL's for alias.
I have 1 URL for example jo.blogs.com/irj/portal which both my internal and external users use.
Is there any way I can make use of the logon groups without having to give my users 2 seperate different URLs.
Thanks
Ajay

Can Portal be configured with Logon Group?

Hi, gurus:
is concept 'logon group' used for Enterprise Portal?
how to configure Logon Group for enterprise?
Thank you
Br,
Chrina

Hi Chrina,
don't get me wrong. You still need a dedicated load balancer system to realize load balancing between multiple application servers. This could be a software load balancer (e.g. SAP Web Dispatcher) or a hardware load balancer (e.g. F5).
If you deploy an application, it is deployed to all application servers. A user who tries to access this applicaion could be forwarded (by the load balancer) to any of your application servers.
But sometimes you do not want this. In case you have an application which has very high CPU usage you can use logon groups to restrict the routing of the load balancer. Basically, you tell the load balancer to forward requests for a specific application to one of your application servers which belongs to a previously defined sub set of your cluster. For example, you have 4 application servers (AS1, AS2, AS3, AS4). Now you define a logon group for a certain application (App1), which is deployed on all servers. By defining the logon group you tell the load balancer to forward all requests for application App1 to either server AS1 or server AS2, but never to server AS3 or server AS4.
This way you avoid that all of your application servers become really busy processing requests for the applicaion with very high CPU usage.
Best regards,
Martin

Configure Balance logon Group in Portal

Hello experts,
I've installed the portal central instance in one machine and a dialog java instance for this portal in another machine, after i installed the webdispacher in central instance machine, now I want to configure the Logon Group, does anyone could help me ?
I don't have idea to do this, if someone does this configuration please help make the same.
Thanks

Hi,
Please check the below link for configuring the logon groups:
Link: [http://help.sap.com/saphelp_nw70/helpdata/en/c4/3a64b4505211d189550000e829fbbd/content.htm]
Hope it helps.
Thanks & Regards,
Gourav

Logon groups configuration for JAVA instances using NWA method

Hello guys,
we have a BI dual System landscape (CI ABAP+ JAVA plus 2 dialog instance ABAP+JAVA, based on NW04s. I have set up a Web Dispatcher to do a load balancing for JAVA instances. I configured the logon groups according this documentation using NWA (http://help.sap.com/saphelp_nw04/helpdata/en/45/3dbe11a82b6bf1e10000000a1553f6/content.htm).
The following point is still quite unclear for me:
I have defined the instance IDs (of DIs installed on linux servers) and exacte Alias in the logon groups definitions in NWA. Is it possible to proof somehow (while accessing my URL http://<host>:<port>/TestApp~test/<application_resource> ) either in web dispatcher ->Web Administration Interface(Application Server Monitor ?) or somewhere else on which Dialog Instance I actually land to be sure that my load balancing works properly and i don't land on my Central Instance?
Thanks a lot in advance.
best regards,
Polina

ok, I have understood what you ment in the first passage Thanks!
When I put javascript:document.cookie in my Internet Explorer Address Bar i got the following information:
PortalAlias=portal; saplb_STD_JAVA=(sapt20p_T20_20)207175450; JSESSIONID=(sapt20p_T20_20)ID1892984750DB11747115157906231437End; saplb_test=(lx003207_T20_20)206509050; saplb_*=(lx003207_T20_20)206509050
what does here saplb_STD_JAVA mean?
you can use following URLs to access any particular Java Server node of any server.
https://<host name>:<https port>/irj/portal;saplb_*=<Java serer node number> https://<host name>:<https port>/irj/portal;sapj2ee_irj=<Java server node number>
What is the difference between saplb_* and sapj2ee_irj?
Thanks in advance.
regards,
Polina

Create Logon Group on EP for Load Balancing

Dear All,
How to create logon group on EP.
This group will include group of dialogue instance systems.
(di01, di02, di03)
Current landscape is
all these 3 di are under CI(production system).
EP d/b is connected and mapped over this production system.
Now I want whenever user access EP they should not login to PRD sys but thy shd login to any one of the DI SYS.
Responce Awaited.
Regards,
Purav

please believe me, the portal has no such mechanism itself for this kind of load balancing - it is ALWAYS done by an external solution such as web dispatcher.
In a portal cluster the CI may or may not have the SCS installed (it depends on the specific installation) but each node has its own inbuilt load balancing via the dispatcher - however this is purely round robin not based on any kind of exta intelligence.
Although portal can be installed in a cluster, any nodes (app or otherwise) can be treated as individual servers. In order to balance load across any / all servers in this configuration an external mechanism must be employed.
Chances are anyone claiming to have done load balancing this way without hardware is almost certainly using the web dispatcher as an additional layer.
Haydn

Issue with parallel operation of SAP NW SSO 2.0 and SNC Client Encryption (Logon Groups)

Hi!
One of our customers is using the SNC Client Encryption solution to ensure encryption using SNC (based on Kerberos Technology) for their SAP GUI Dialog connections. They have lots of SAP backends DEV, QAS, PRD all with the SNC Client Encryption SNC Lib installed. The profile parameter snc/identity/as contains the following value: p:CN=SAP/<ServiceAccount>@<DOMAIN>.
Example: p:CN=SAP/[email protected]
The customer is using one AD Service Account "SNCServiceUser" with one registered SPN "SAP/SNCServiceUser" for all systems (yes, this is not recommended... but the case).
Important: All users use group entries in the SAP Logon (saplogin.ini). Means, for SAP logon the SNC name can not be manually configured on the SAP Front End. With group logons, the application server's SNC name is dynamically requested by the message server each time a SAP GUI connection is started. The SNC Name is greyed out in this case as dynamically obtained from the applications servers profile parameter snc/identity/as.
Now our customer implements SAP NetWeaver Single Sign-On 2.0 within his landscape. Based on the Secure Login Server 2.0 (SP3) he likes to use X.509 based authentication to his AS ABAP backends using SAP GUI SNC while others still use SNC Client Encryption.
Replacing the SNC Library on the AS ABAP
The Secure Login Library 2.0 (SP3) has been installed on one of the ABAP systems and the SNC Client Encryption SNC Library (which is based on SSO 1.0) is no longer used, thus we changed the parameter snc/gssapi_lib to point to the new SNC library. We removed the old PSE.ZIP containing the keytab and created the new SAPSNCSKERB.PSE incl. the keytab and proper credentials. To ensure parallel operation, we kept the snc/identity/as value as is = p:CN=SAP/[email protected].
After restarting the system with initialized Secure Login Library 2.0, still the SNC client encryption works fine for existing users.
The problem
We created on the Secure Login Server an SNC certificate for the AS ABAP which has the following X.509 Distinguised Name Fomat: CN=SAP/[email protected] This is to avoid having to change the snc/identity/as to an "real" X.509 DN which would lead to non-working SNC Client Encryption for all the other users using SAP GUI and logon groups.
As soon as we install the PSE via STRUST on the system the SNC Client Encryption solution stops working with error „Server refuses kerberos key exchange“.
As part of an pilot implementation we have installed Secure Login Client 2.0 (SP3) on some test PCs. The test PC with SLC is able to perform Single Sign-On with SNC based on X.509 (incl. Encryption) to the ABAP system.
Seems the SAP System now only tries to do X.509 based authentication thus key exchange fails. The problem is, we cannot change the snc/identity/as value because of the logon groups. If we were able to do so, we would in any case set the server identity to X.509 DN and in addition create the SAPSNCSKERB.PSE incl. keytab. This should work, as confirmed by SAP see this post.
Any ideas how to solve this and have both solutions in parallel?
Appreciate any help.
Regards,
Carsten

Hi all,
we was able to fix the issue. It was an issue with the customers cluster configuration and the $SECUDIR variable. This tricky issue leads to non working or sporadic working SNC Client Encryption...
This was how the configuration looks before:
Environment variable $SECUDIR is defined:
"/ABCDEF<SID>/usr/sap/<SID>/DVEBMGSxx/sec“
sapgenpse seclogin -l -v
running seclogin with USER="<SID>adm"
Credentials for username '<SID>adm':
0 (LPS:OFF):
         (LPS:OFF): /ABCDEF<SID>/usr/sap/<SID>/DVEBMGSxx/sec/SAPSNCSKERB.pse
1 (LPS:OFF):
         (LPS:OFF): /usr/sap/<SID>/DVEBMGSxx/sec/SAPSNCS.pse
After changing the $SECUDIR to "/usr/sap/<SID>/DVEBMGSxx/sec“ and re-creating the credentials, it worked like a charm.
As a result of this we can confirm, this configuration and SNC Client Encryption works with CommonCryptoLib in parallel to the SSO configuration.
And Valerie was right with 2. SLC starting from V. 1.0 SP2 PL3 was able to convert the CN= part of the SNC Name into an SPN, was my mistake. In addition SNC Client Encryption starting from Version 1 SP1 PL1 does this also.. just to make this clear
Thread closed hope this helps someone
Carsten

How to create Logon groups for JAVA Systems

Hi,
I am implementing an BI JAVA Landscape. We do have 1 Central Instance(CI) and 2 Dialog Instances (DI) JAVA Standalone. Everything based on NW04s
I have set up a Web Dispatcher to do a load balancing. The Web Dispatcher is connected to the Message Server (MS) of the JAVA CI to get all the information about the Engines.
I am now looking to create Logon groups to distibute the load according the application used applications. I am not sure if there is a possibility to set up logon groups (server groups) directly somewhere in the J2EE engine, or if I have to set this up in the WebDispatcher konfiguration files?!
Thanks in advance and best regards,
Dominik

We're trying to do something similar with NetWeaver CE 7.1.
According to [this documentation|http://help.sap.com/saphelp_nwce10/helpdata/en/45/3dbe11a82b6bf1e10000000a1553f6/frameset.htm] there are 3 steps to doing this for NetWeaver CE 7.1:
1. Logon Groups
2. Web Dispatcher profile changes
3. HTTP Provider property changes
We've set up a Logon Group in the NetWeaver nwa and associated the two instances (one host) with it.
"[Configuring Logon Groups Using Configuration Files|http://help.sap.com/saphelp_nwce10/helpdata/en/45/3c3f0cad9f4c2de10000000a1553f6/frameset.htm]" says: "...to create the files using HTTP Provider service."
There it doesn't say exactly how to generate those 3 text files; it says: "1. Create the icrgroups.txt and urlinfo.txt files that define the logon groups. For more information, see the documentation of SAP Web Dispatcher." ; but, has no link to what it says to see. So, I manually go to ["SAP Web Dispatcher", "Assigning Logon Groups"|http://help.sap.com/saphelp_nwce10/helpdata/en/b4/9aa8862e714e6db8e74e48e5d3283b/frameset.htm]. But, it all pretty much breaks down there because it's referring to apparently non-NetWeaver CE 7.1 stuff (as near as I can tell); for instance, how do the transactions SMLG and SICF relate to NetWeaver CE 7.1, or am I in the wrong place?
I tried to press ahead with files similar to the examples here, but I hit this error in the Web Dispatcher:
[Thr 5132] *** WARNING => ICT: path prefix /Curam/ not allowed in this context. Only prefix / allowed. [ictxxptab.c 764]
[Thr 5132] *** WARNING => When a file is specified in wdisp/J2EE/url_map_location only URL prefix '/' is supported. See also SAP note 1033470. [icrxx.c 2925]
The note reference looks hopeful, but I cannot read it; I get:
Note 1033470
The requested SAP Note is either in reworking or is released internally only
Does anyone have a copy of this Note or knows if it's helpful?
Has anyone done this with NetWeaver CE 7.1?
Tahnks,
William

Connection to ECC with SAP Logon Group failing

I'm creating a new system connection to an ECC backend using a logon group (transaction SMLG in ABAP stack). I have created the connection with the wizard as a SAP_R3_LoadBalancing connection and given it the appropriate Group, Logical System Name, Message Server, Remote Host Tppe and SAP Client. Also I've given it an Alias.
SSO is working correctly between the portal and ECC.
The System Connection Tests > Connection Test for Connectors works, as can been seen::
Test Connection with Connector
Test Details:
The test consists of the following steps:
1. Retrieve the default alias of the system
2. Check the connection to the backend application using the connector defined in this system object
Results
Retrieval of default alias successful
Connection successful
However, if I try to connection to this system with the Alias, it fails. If I change the alias to a system with a standard R3 connection with a specified hostname, it works. The /etc/services is correct and contains the appropriate entries. Any ideas?
Regards,
Graham

Hi Srikishan,
Thanks for the response. When user from CRM logged in another language than EN for eg. FR, clicks on external link in CRM, takes to EN, only if that language FR is not installed in ECC, else it will take to the same language in which CRM user logged in. This cannot be controlled in SSO configuration. Is this correct?
In case if FR is installed in both the systems, ie CRM and ECC, but user wants to log only to EN when clicked the external link(to ECC) from CRM, how we can configure this, Is any parameter can control or SSO setup configuration available? Please advice.
Regards,
Shahul Hameed

Content delivery in portal based on user roles ?

Portal Server new bee...
Please can anyone point me to guides/url where i can look to enable content delivery in a portal based on user roles and how to establish SSO.
I have installed Portal Server6.0 and iplanet Directory Server Management Edition installed.
I did go through PS Development guide and got some sample containers up and running in the portal.
Thanks.

For the role-based delivery, Comment 1 sends you in the right direction. Here are a couple things to keep in mind as you read through the customization guide.
The basic gist of what you need is to define your organization profiles with all the services defined at the org level. Then you can define simple profiles at the role level. These will probably focus around the selected and available attributes on the table containers.
Then you might want to pay particular attention to the merge, lock, and propogate attributes. These will allow you to define how the role affects the availability of channels (does the role add, remove, or force the channel?). The easiest thing to do is probably to start with a core group of channels, and then have each role define additional channels that are of interest and should be added to the selected/available lists.
Having roles remove channels will make matters a little more confusing and harder to maintain.

Logon Groups in ABAP system

Hello All,
I have set up SLD on my J2EE Web AS to connect to my newly installed ABAP 2004s system. After the set up in RZ70, I am able to see my ABAP system listed in the "Technical Systems-> WebAS ABAP" in my J2EE engine's SLD.
Now, I am trying to set up JCO connections in webdynpro content admin. And I can't see a logon group in the wizard.
Do I need to create a logon group in my ABAP 2004s system? If yes, how do I create one? Do I need to add any users in the logon group? I am a novice about logon groups, is it similar to a member group in portal? What other settings do I need to give to this newly created group (if one needs to be created).
Thanks,
Ky

Thanks Michael. I created a logon group ("MYLGNGRP") and published to SLD using RZ70. Now I can see the logon group in my SLD in the message server settings.
However, when I create a JCO destination and "Test" it, I got the below error.
[code]com.sap.mw.jco.JCO$Exception: (102) RFC_ERROR_COMMUNICATION: Connect to message server host failed Connect_PM TYPE=B MSHOST=XXXX GROUP=MYLGNGRP R3NAME=NSP MSSERV=sapmsNSP PCS=1 ERROR Group MYLGNGRP not found TIME Mon Mar 19 18:17:58 2007 RELEASE 640 COMPONENT LG VERSION 5 RC -6 MODULE lgxx.c LINE 3515 DETAIL LgIGroup COUNTER 1 [/code]
Is there any configuration that needs to be done on MYLGNGRP?
Thank you,
Ky

Configuring Logon groups for JAVA instances using NWA method

Hello,
we have a BI dual System landscape ( CI ABAP+ JAVA plus 2 dialog instance ABAP+JAVA, based on NW04s. I have set up a Web Dispatcher to do a load balancing for JAVA instances. I configured the logon groups according this documentation using NWA (http://help.sap.com/saphelp_nw04/helpdata/en/45/3dbe11a82b6bf1e10000000a1553f6/content.htm).
The following points are still quite unclear for me:
1. according documentation I should specify the following profile parameters:
[Define the special HTTP URLs, which SAP Web Dispatcher uses to send to the AS Java to retrieve the logon groups information]
wdisp/J2EE/group_info_location = [?] /JavaEE/public/icf_info/icr_groups
wdisp/J2EE/url_map_location = [?] /JavaEE/public/icf_info/icr_urlprefix
Wich values should i take here actually? These one or /J2EE/icr_groups and /J2EE/icr_urlprefix ?
2. Also I have to configure (in visual administrator) the GroupInfoRequest and UrlMapRequest properties of the HTTP Provider service running on server processes. They recommend to use /J2EE/icr_groups and /J2EE/icr_urlprefix. Should it be the same values as defined in those profile parameters?
3. I have defined the instance IDs and exacte Alias in the groups definitions in nwa. Is it possible to proof somehow while using my URL http://<host>:<port>/TestApp~test/<application_resource> either im web dispatcher (traces?) or on a web site on which DI I actually land to be sure that my load balancing works properly and i don't land on my Central Instance?
Thanks a lot in advance for your advices.
best regards,
Polina

Understood, Install the web dispatcher and configre the ABAP Message Server Port and ms/http_port (T-CODE:SMMS). Test this link
http://host:port/sap/public/icf_info/icr_groups
and this would retrieve the list of ABAP (SMLG) cofigured groups.
For java load balancing, icm of that host will send the incoming requests to JAVA Dispatcher. The load balancing happens on the basis of server nodes and can be found in the web dispatcher session dispatching table.
There are no necessary parameters required for java load balancing except the number of server nodes you'll hookup to that dispatcher.
There is an option called service based, where we configure the j2ee hosts to accept the connections for the services which are running but I haven't seen much customers using this option.
Bottom line: No changes are required for java side and enable the "ext rfc" option for abap logon groups and rest will be taken care by Web Dispatcher.
Use connection pooling and high timeouts to acheive the better througput and use the SSL termination on Web Disp.

Regarding Logon Groups

hi friends,
                can any one please solve this problem for me?,
In my EP 6.0 system i configured the SLD and I created the Jco destination,when i tested it it's giving error like"ERROR:Logon Group PUBLIC not found"
can u please where can i get the logon group?.

Hi,
*You can find that option by logging into SLD " Log on to SDL through portal i.e. http://<servername>:<portnumber>/sld"*
Follow these steps below then.:-
It might sometimes happen that Message Server and Logon Group is not configured to configure them, follow the process
For Message Server:
          i.            Log on to SDL through portal i.e. http://<servername>:<portnumber>/sld
          ii.            Choose Technical System. Click it.
          iii.            You will observe New Technical System button, click it.
          iv.            System Type: Select Web AS ABAP , if you want to connect to R/3 System and incase you are using Java application use Web AS Java
          v.            General: Log on to R/3 System through SAP Log on pad. Go to System à Status, check for SID, Installation Number and Database Host Name.
          vi.           Central Servers: Give Host Name and Port Number and Instance Number.
For Logon Group:
         a.            Click on Add New Logon Group, this will open a row in the table.
         b.            Log on to R/3 through Logon pad and get Logon Groups ids and the transaction code is "SMLG".
         vii.            Application Servers: Click on Add Application Server and then give Host Name and Instance Number of R/3 System.
         *viii.           *Clients: Give Client number (System id) and Logical Client Name (which we can get from SMLG code). And click finish.
Hope this helps.
Regards,
Shailesh Nagar

Set FQDN in Logon Group

Hi Gurus,
In SMLG - Maintain Logon Groups, is there possible to set fully qualified domain name (FQDN) instead of IP address to Logon Group?
This is because if I only set the Public IP for this Logon Group, internal user in LAN is not able to use this Logon Group to access R3.
Anyone has any idea? Please help.
Thanks,
HauChee

Hi Hau,
(Sorry if Hau is not your first name !)
It is not possible to enter a FDQN as the help is :
IP address
(Numeric) IP address of the application server. This should be specified only if the application host belonging to the instance has to be addressed from the frontend side using a different IP address than that used for communication within the application host. This could be the case if, for example, the communication from application host to application host uses a different network than that used for the communication from the frontend to application host
I think you need the 2 different saplogon groups AND you need to find a way from the portal to check if the laptop is connected internally or externally. The portal would then choose the right saplogon group :
Also, I don't really understand the need : I think it would be much nicer for your users to use directly sapgui when connected internally than webgui.
webgui, IMHO is just an acceptable way to work when not in house.
Regards,
Olivier

URL logon groups are empty in SMMS

hello,
i'm trying to configure http load balancing with message server.
i've created a logon group and assigned it to url webgui in SICF
it seems to work but in sape note 751873 it is said that logon groups and corresponding urls could be loaded and checked in transaction SMMS using functions via Goto -> Expert functions -> HTTP
the problem is that, here in SMMS, my url logon groups list is always empty...
is it normal?
regards

Hi Olivier,
In case you use Integrated ITS in a Portal environment you should have a closer look at notes 1029194 and 1040325.
Thanks and regards,
Dieter

Portal-based logon Groups?

Similar Messages

Maybe you are looking for