Portal Roles link to ABAP Roles

Hi,
i want the user to get the roles that are assigned to him in the ABAP system. We have roles for specific functional area like MM, Sales & Finance. I know if i create a portal roleand link the role to the abap role and set the prperty fo the role to be entry point i can get the roles as in the abap.
What i want to achieve is some thing like this. The every user core role will have a BW Home and BW reports Tab by default in the level one. When the user selects BW Reports the level 2 should be filled with the abap roles assgined to him. Can any one help me if this can be achieved and if so the steps to be follow.
Thank you,
Ravi.

Hi ,
check the below document to get roles from erp into portal
https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/docs/library/uuid/f1cbe7ee-0901-0010-12b9-e6c74d94e132
After bringing roles into portal , do necessary settings in portal to appear in second level navigation ( do not set entry point =yes)
Koti Reddy

Similar Messages

J2EE roles vs Portal roles vs ABAP roles

(I also posted this on portal implementation, but i hope i receive more reactions here )
Dear all,
I have a question about the information on the following link:
http://help.sap.com/saphelp_nw2004s/helpdata/en/4c/6c0f40763f1e07e10000000a1550b0/content.htm
It says the following:
"These functions are intended to assign users and their assigned portal roles a corresponding role in the SAP System. This corresponding role (authorization role) contains the authorizations needed to execute certain functions from the portal."
1. These "...certain functions..." they talk about, can someome give an example of these functions?
2. Is it possible for example to create a role in the portal that gives a user authorisation for starting transaction SE80 in the backend system? Without making the role in the backend first and uploading it to the portal.
3. It's also possible to upload ABAP roles to the portal. Is the main reason for this that users can see their SAP menu (or part of it) in the portal? Or does this have other advantages too?
4. I'm very confused about the relation between J2EE roles, portal roles and ABAP roles. Is it possible to manage the roles for a user in one place, without having to do certain actions in the portal AND the backend system?
From what I've read on help.sap.com, you always need to do certain actions in both places.
A possible approach is the following (from what i know): Creation of roles in the R/3 system, without assigning to users. From a webdynpro application, a user can then be created and roles can be assigned: portal roles (via some API) and R/3 roles (via BAPIs).
I hope someone can give a bit information on this issue. I've done alot of reading on help.sap.com, but it's still an abstract issue for me.
Kind regards,
Joren

Hi Jorem
Re: point 3. I don't build portal roles through this mechanism as I don't believe in replicating the SAP easy access menu inside the portal. If there are some specific functions (transactions) that I want to run inside the portal, then I might use this mechanism to build the iViews once. I would rather start an iView that runs transaction SMEN and let the user see their regular easy access menu.
Please note that the speed of executing transactions in the portal isn't a function of the portal, but the fact that you are using ITS, for example, to web enable the transaction...
Re: point 4. Groups are a UME concept. They have nothign to do with ABAP groups. They can be created directly in UME through user administration functions, or they can be created in the LDAP and then they are visible in the portal. If the UME points to an ABAP system, then the ABAP roles are autoamtcially visible as UME groups. Groups created in the UME need to have the members assigned through user admin functions of the Java engine. Groups stored in LDAP are maintained using LDAP admin tools. There are upload utilities that allow you to maintain LDAP users and groups through text files. Google LDIF for more details.
Roles on the portal need to be built in the portal contetn directory. As Michael mentioned, this can be automated by the use of the role upload function built into the portal.

ABAP roles v/s Portal Roles

Hi All,
Currently I was going through EP security docs where I came across this
"An important difference between ABAP roles and Portal roles is that in the portal,no authorizations are defined for the backend application itself. This must still be
done within the backend applications (for example, mySAP ERP)."
Can somebody plz explain me this..
Would also like to know more difference between ECC and EP security,
Thanks,
Ajit

Hi Ajit,
I have been looking into this for some time as well, but am still not sure of some things myself nor which scenarios fit best to which security aspects.
My understanding is that it depends on how the portal is connecting to the backend.
If the portal user is the backend user, then the portal role is just a permission to click on things in the portal. The portal roles are mapped to the backend roles in the ABAP system (so you can, and need to, define what that portal role can infact do when the portal user "clicks" in the backend, using the backend roles of the same backend user context).
If the portal user is not the backend user (i.e. it is a system service for generic access to the backend), then you should restrict the backend access to the bare minimum of that service and control the security in the portal application (the calling application) as the backend user context is not the same.
So it is a "design" answer as well...
There are a few good posts about this if you use the search. If you find a good one, then please link it here so that others who use the search and follow up on their questions can use it as well.
At the top of the forum, there is a sticky thread on FAQs and other usefull discussions. Sadly, portal security does not have any links yet, so if you find a good one then let me know.
Cheers,
Julius

Link ECC roles to Portal roles (Portal is using LDAP source for UME)

Hi all,
If a user is assigned a certain ECC ABAP role, they should also receive a related portal role. Our portal is using LDAP.
If our portal ume source was an ABAP system, I think it would be easy to achieve the ECC to ABAP role linkage.
We were thinking of developing a UME java webservice and have an ABAP proxy class consume it to allow our abap system to assign the correct portal role, and delete the portal role.
Any other ideas?

Rajendra,
Thx for your reply. Can you provide any more details as to the design of your solution with the web service? We are thinking of running a batch job nightly with a some mapping table in ECC to determine what ABAP role should link to the portal group then call the webservice to add the user to the portal group or delete the user from the portal group.
A second question is...does SAP Identity Manager offer any solution for this type of requirement?
Thanks

Can anyone help me understanding the links between Launchpad roles, PFCG roles, and portal roles!?!

Hi experts,
I am looking at the newer EhP5 and EhP6 functionality for ESS and MSS, specifically the WD ABAP portal applications. I've turned on all the business functions and services I think our team wants, however I'm confused on how to move forward in using them. For a little tech info, we are on EhP6 for the backend, but our portal is 7.02.
My first step was to assign the com.sap.pct.erp.ess.wda.Employee_Self_Service_WDA portal role to our test ESS user group in our sandbox environment. The ESS user got a new ESS tab in the portal and it's linked to the Launchpad role ESS, Instance MENU. I'm comfortable with ESS at this point, still need to learn more about customizing the menu for different employee groups without creating additional Launchpad or SAP roles.
Question 1: Correct me if I'm wrong, but is the Launchpad roll ESS, instance menu linked to the PFCG role SAP_EMPLOYEE_ESS_WDA_2?
Next, I was looking to see if there was a similar portal role for MSS, but it seems I can't find one. I implemented the MSS Addon 1.0 for ABAP and the portal and got a new MSS portal addon role, but it doesn't seem to be connected to any MSS Launchpad role.
Question 2: Is there a portal role to assign to users/groups that is linked to one of the MSS Launchpad roles? If yes, what business function or service is it a part of?
I'd like to use of the existing MSS Launchpad role to test some of the new portal functionality, but I'm not sure how to do it.
Question 3: How is a Launchpad role assigned to a SAP role in PFCG? Anyone have some documentation they can point me too?
Kind regards,
Garrett Meredith

Thank you Samuli, this was very helpful in connecting many of the pieces.
For now I have a very good understanding of how the new ESS is controlled and modified.
It appears that FPM_LAUNCHPAD_UIBB could be used to develop a similar component to call a custom launchpad role for MSS containing a customized list of WDA applications.
Is a MSS Launchpad a good way to pursue since we use a SAP enterprise portal?
I found a PAOC_MSS package containing other MSS embedded packages.
Could I use one of the embedded packages in there and by creating a Component configuration in the FPM_LAUNCHPAD_UIBB for one of the MSS WD applications?
Based on the documentation link above, PFCG roles are for NWBC HTML or Desktop versions.
Kind regards,
Garrett

Abap+java stack, users not mapping to portal role.

We have the ABAP+java add-on install.
The UME is by default ABAP engine.
From Portal:
1 I create a portal user, it ALWAYS creates ABAP user in ABAP stack of WAS.
2. I create a portal role, it creates a role in the Portal.
3. When I assign the user this portal role,
having worksets and pages,
I get no pages or worksets shown in the portal page as soon
user logs in.
Can you help configure this so that I could see the pages and iviews inside this workset when user logs in.
Thanks a lot.
PS: posted this in webdynpro-ABAP. no reply came. Sorry to double post.

Hi Mike,
can you check into your WorkSet (or Pages) if you have setting up the Entry Point flag?
PS: Award points for good answers.
Best regards,
Gianluca Barile

Abap+java abap-user and portal-role PROBLEM?? help

We have the ABAP+java add-on install.
The UME is by default ABAP engine.
From Portal:
1 I create a portal user, it ALWAYS creates ABAP user in ABAP engine.
2. I create a portal role, it creates a role in the Portal.
3. When I assign the user this portal role,
having worksets and pages,
I get no pages or worksets shown in the portal page as soon
user logs in.
Can you help configure this so that I could see the pages and iviews inside this workset when user logs in.
Thanks a lot.

Hi Mike,
You did right,
Just check the Entry Point Property of your iView, page and workset to YES
there are two radio buttons yes and no select the yes one,
you can see your pages afte rlogin with the new user.
Regards
Abhimanyu L

Role Mapping For Portal Role Assignment and ABAP Role Assignment

Summary:
- Under the GRC configuration of Roles> Role Mapping we are trying to utilize the role mapping feature in GRC for associating a dependent role to a main role.
- We want to use this role mapping feature for the purposes of adding an Enterprise Portal role for every ABAP role that gets approved for the user in an ABAP component system (i.e. ECC, BW, CRM etc). We will have a 1:1 mapping of Enterprise Portal role to ABAP role defined in the role mapping section in GRC.
- We want to set up the workflow in such a way that the main role (ABAP role) is the only role that needs to be approved. The dependent role (Enterprise Portal role) should be added or not added based on the approval or denial of the main role (ABAP role). In other words if the role owner for the abap role approves the abap role, then both the abap and EP role will be provisioned by GRC and if the role owner rejects/denies the role, then neither the abap or EP role will be provisioned by GRC.
Problem Description:
Our Scenarios we tested:
Scenario 1:
Main Role: Attached to Initiator A & workflow A (routes to single approver based on role)
Dependent Role: Attached to Initiator B & workflow B (routes to auto approval or no approval)
*Problem with the Scenario 1setup above, the dependent role will always get approved & provisioned regardless of the approval or denial of the main role.
Scenario 2:
Main Role: Attached to Initiator A & workflow A (routes to single approver based on role)
Dependent Role: Attached to Initiator A & workflow A(routes to single approver (same as main approver) based on role)
*Problem with the Scenario 2 setup above, the dependent role will always also need to get approved by the same approver as main role and it opens the possibility that the approver may accidently approve the main role and deny the dependent role, which is not the ideal setup as we inherit the risk of human error.
Questions:
1. Does the dependent role need to be defined in an initiator at all since it will never directly be requested directly?
2. If the dependent role does need to be in the initiator file, please describe how to properly setup the initiator and workflow stage & path so that we can maintain the desired relationship with the main role approval dependency? (if the role owner for the main role approves the main role, then both the main role and dependent role will be provisioned by GRC and if the role owner rejects/denies the main role, then neither the main role or depedent role will be provisioned by GRC
Edited by: Rene Griffith on Feb 26, 2010 10:22 PM

I tested this set up.
1. Defined ABAP role as Manin role
2. Defined Non-ABAP role as dependednt role
3. ABAP role is set up in initiator requiring business approval.
4. Non-ABAP role is set up in initiator with no approval required.
Results Where Business Approver approves the ABAP Role
1. Only the ABAP role is displayed in approver view which is desirable.
2. ABAP role is approved and Non-ABAP role and ABAP role is provisioned.
Results Where Business Approver rejects the ABAP Role
1. Only the ABAP role is displayed in approver view which is desirable.
2. ABAP role is rejected but Non-ABAP role is provisioned which is not what we want. We want the Non-ABAP role not to provision if the ABAP role is rejected by the business approval.
Thanks again for your help.

Find user SAP Portal role in an abap program

Dear all,
We would like to check the SAP Portal role of a Portal user in a R/3 abap program.
do you know if there is a bapi or a RFC module function to do that ?
For example : the user CCDEMO (exists in EP and in R/3 backend) has a Buyer Portal role. In an abap program, I would like to have this information.
Thanks
kind regards
Véronique

Dear all,
We would like to check the SAP Portal role of a Portal user in a R/3 abap program.
do you know if there is a bapi or a RFC module function to do that ?
For example : the user CCDEMO (exists in EP and in R/3 backend) has a Buyer Portal role. In an abap program, I would like to have this information.
Thanks
kind regards
Véronique

Portal Roles (ABAP & JAVA)

Hi,
We are planning to go for a portal implementation for our BW reports..
I had a few questions with regards to the roles (BW & Portal) or (ABAP & JAVA)
Question 1:
I want a single place (BW) where I can assign all the roles (BI & Portal) to users, so when ever a user account has to be createu2026the support team will create it BW System and assign all the relevant roles in BI system
If YESu2026then how can I move the Navigational Role in portal (Role in which we publish iviews) that I created in portal to BW.
And also
How can I create a JAVA role in BW so that that role can be assigned to user and his portal options will be updated..
Thanks

Hi
Thanks for all the updates.
Few questions
How can i know Which user repository is my portal system connected to ? (LDAP or ABAP datasource)
and
If you have configured your BW system as the ume datasource for your portal - then your backend roles in BW will show up in portal as Groups. You may choose to assign your portal roles to these groups.
In BW if i assigned a Composite role to a user ...will it show as a group in portal and
As my requirment is to single place to create user either in portal or BW....if BW user roles are avaliable in portal as groups...
Can i insted of create a user account in BW and come to portal and assign portal roles to the user or user group to get portal previliges
Can i create user account in portal and assing the user to the corresponding groups in portal....will this action will create a user account in BW as well
Thanks

Portal roles as Hyper Links

Hi Gurus,
How to make portal roles as hyper link?
Regards,
venkat

Hi Venkat,
To provide access to a workset or page within a role via URL, just copy the 'PCD Location' parameter of the object within the role and use the following syntax:
http://<server>:<port>/irj/portal?NavigationTarget=ROLES://<PCD_LOCATION>
You could also use the short URLs to link directly to a page object:
1- Goto 'System Administration -> Navigation -> Short URLs'
2- Search for the page object, and find the corresponding short URL to the above mentioned PCD Location
3- Use the short version of the URL 'http://<server>:<port>/irj/portal?NavigationTarget=navurl://<SHORT_URL _ID>'
Hope this helps.
Regards,
Joseph
Added 'short URL' information
Message was edited by:
Joseph Zeinoun

Can I get the portal rol thought webdynpro abap?

I am working webdynpro abap and I need to get the rol portal.
Can I get the portal rol thought webdynpro abap?
Tkanks and best regards.
Maria Elena

I am working webdynpro abap and I need to get the rol portal.
Can I get the portal rol thought webdynpro abap?
Tkanks and best regards.
Maria Elena

Pass parameter to all iViews in a portal role

Hi,
we have a portal role containing several iViews for ABAP Web Dynpro applications. Now we want to assign the parameter sap-wd-lightspeed=X to all these applications. Is it possible to do this in the portal application and can the customer set it off if they want to?
One idea is to define a dummy iView with this parameter set in property Application Parameters, and define all iViews as delta-links of this dummy iView. But we have some iViews which need their one Application Parameters.
Thanks & regards,
Carlo

Hi Bies,
I hope you are calling the Webdynpro ABAP applications using AppIntegrator iview (com.sap.portal.appintegrator.sap.WebDynpro).
Application Name : ABAP application
Application Parameters:sap-wd-lightspeed=X
Thanks
Srikanth M

No portal roles are assigned for this user.If this problem persists, contac

I am trying to access portal first time using j2ee_admin user. It is saying "No portal roles are assigned for this user.If this problem persists, contact your system administrator."
iam using abap+java enginee how config in abap enginne ,iwant which role to assign j2ee_admin user
i already asiigned sap_j2ee_admin,SAP_BC_JSF_COMMUNICATION,SAP_BC_JSF_COMMUNICATION_RO but it show same problem
please help me..
Edited by: Mugala Balu on Aug 7, 2010 5:53 PM
Edited by: Mugala Balu on Aug 8, 2010 7:48 AM

Balu,
Well this issue has been discussed many a times in forums. You would have to point your data source to ABAP system.
Check this thread in [here|J2EE Failed to start , after changing UME datasource;.
Good Luck!
Sandeep Tudumu

Assigning Portal Roles

Hi All,
We have installed EP 7.0. The problem we are facing is : The "Portal Content" folder is not displayed under the "Browse Category" of content administration & system administration.
Why is it so? Do we need to add some other portal Roles to the user? If so.., which role we should add?
Also we are trying to add the portal role ID
" com.sap.pct.pdk.JavaDeveloper". But when we search for this role , we could not found this role. Whether the role has been renamed?
Kindly provide your suggestion on the above queries.
Regards,
Eben.

Hi,
Re: How to create and assign role
Portal:How to assign a Folder to a Role in Protal
I hope the above links will help you,
Regards,
Harish

Portal Roles link to ABAP Roles

Similar Messages

Maybe you are looking for