Problems using access control in sender agreement for SOAP adapter 7.1

I am trying to use Access Control Lists to restrict user access to web services/interfaces which are exposed via PI. This can be configured via the Integration Builder Directory using the u201CAssigned Usersu201D tab of both Communication Components (Business System) and Sender Agreements.
The configuration is via the above mentioned components. However, I understand that itu2019s the adapters which at runtime are responsible for actually applying these checks.
I have been having problems getting the access control to work using a setup involving a SOAP adapter of type SAP BASIS 7.10.
The symptom of the problem is that although the access control works as expected at the Business System level, any settings at the Sender Agreement level appear to have absolutely no effect whatsoever.
I have confirmed that I have no problems if I use an adapter of type SAP BASIS 7.00. However, I really need to get this working on 7.1.
I have looked on the SAP support portal but can not find any notes that relate to this.
Has anyone else had a similar problem? And have you found a fix for it?
Any suggestions would be welcome.
Edited by: Malcolm Dingle on Jun 17, 2009 1:08 PM

Hi Shai,
Please have a look at the following link and see if it helps you .
It deals with SOAP adapter installation and activation
Re: SOAP adapter installation and activation
Best Regards
Edited by: Prakash Bhatia on May 8, 2009 11:51 AM

Similar Messages

Login Module configuration for soap adapter ?

Hi Guys,
I have configured XISOAPAdapter for client certificate Authentication and i have created 1443 as the HTTPS port on the ABAP stack and defined this port in the instance profile.
Under SSL provider i have selected 50101 as the HTTPS port and the user mapping to the certificate works fine and i was able to login directly.
https://host:50101/XISOAPAdapter/MessageServlet - I was able to login with the user mapping to certifcate.
but when i try https://host:1443/XISOAPAdapter/MessageServlet - it is asking for the basic password authentication and the automatic login with the certifcate is not working. Our customer will be using this url to send messages to soap adapter.
under policy configurations for XISOAPAdapter, i have defined only clientcertificateloginmodule and define the rule as Rule1.getUserFrom=wholecert.
any help or suggestions would be appreciated.
Thanks,
Srini

Hi,
We also experienced that limitation when a vendor is connecting to our XI SOAP Sender Adapter. It is asking for basic username/password. What we did was to create a Generic XI user with a password on it and use SSL authentication at the same time. Our Scenario was PI --> XI --> SAP R3, with the PI system using an HTTP RFC destination with a Basic Logon and Active SSL option to connect to the same system as yours https://host:portnumber/XISOAPAdapter/MessageServlet
Let me know if this helped...
Regards,

Why we r not Creating Sender Agreement For HTTP & IDOc Adapter at Sender .

Hi Buddy's,
Why we r not Creating Sender Agreement For HTTP & IDOc Adapter at Sender .And why we create receiver agreements at receiver side bt not sender agreement at sender side.
Wat Is GLOBAL Container ?, where it will Occur & wat is the functionality of that.

Kumar,
1) XI integrattion server - IS expects the messages in XML format. If you see the HTTP request you will see that we pass all the info contained in the Sender areement in the the HTTP request itself , namely - Message interface, message type and the namespace (along with login parameters). For IDOCs the the IDOC- XML are are sent to the IS (through IDOC port configuration at the source system.
2) When send a message to XI the sender knows that XI system parameters, but when at the reciver end there could be any any system that is reciving the IDOc/HTTTp message. you specify those message through a commumication channel and this channel is associated to a receiver agreement.
3) A Global container is like a place holder for variables. You can set a variable here and access it throughout your mapping and hence the name.
A good example for a gloabal container is a counter to countthe number of records in te target side.
Regards,
Arvind ravindran

Why we do not need sender agreement for Mail and SOAP adapter

Hi SDN,
I know, we do not need sender agreement for IDOC ,HTTP,XI adapters. As these three adapters will run in Integration engine of the abap stack.
In our scenario if sender is other than IDOC or HTTP or XI .
By Refering Sivamni's blog.
/people/siva.maranani/blog/2005/05/25/understanding-message-flow-in-xi
message will be pickedup by communication channel with the help of sender agreement and prepare XI message header by performing cpa cache lookup. then message will go to module processor etc.
In our scenario if sender is IDOC or HTTP or XI .
As these 3 adapters are run in Integration engine.
Doubt 1:
how the integration engine will create the xi message header like sender interface sender system name etc...
Doubt 2:
I believe SOAP and mail adapter will run in adapter engine.but i came to know that we do not need sender agreement and sender comm channel for these two adapters too...then how the XI message header will create...
Please do correct me if i am wrong
and throw some light on the same..
Appreciate your help....
Regards,
Reehan.

Reehan,
Thanks for pointing me to that link. Guess I was wrong .,But,let me try to put to you why you need a sender agreement for a Sender SOAP Adapter,
1. In the sender SOAP adapter , the Sender Interface and the Interface Namespace as provided in the fields Default Interface Name and InterfaceNamespace. The Name of the Sender Service is provided in the WSDL when you ceate the WSDL in the Integration Directory. So, as all details are available in either the Sender SOAP adapter or in the WSDL url you do not need a Sender Agreement. It is not obligatory but you can always create the Sender Agreement.
2. For the mail adapter , if you select the option XIPAYLOAD, you will have the option to mention the Interface Name and Interface Namespace under XI Parameters and so in this case as once again the details provided in the sender agreement are available in the Sender Adapter itself the sender agreement is not needed for the mail adapter when you have select option XIPAYLOAD.
If you have selected XIALL then you need a sender agreement.
Regards
Bhavesh

Error while reading access data (URL, user,password) for the Adapter Engine

Hi,
Any idea on below message? I am doing file to file scenario and got the below tarce from sxmb_moni.
<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
- 
- <SAP:Error xmlns:SAP="http://sap.com/xi/XI/Message/30" xmlns:SOAP="http://schemas.xmlsoap.org/soap/envelope/" SOAP:mustUnderstand="">
<SAP:Category>XIServer</SAP:Category>
<SAP:Code area="INTERNAL">AE_DETAILS_GET_ERROR</SAP:Code>
<SAP:P1>af.pi1.piserver1</SAP:P1>
<SAP:P2 />
<SAP:P3 />
<SAP:P4 />
<SAP:AdditionalText>no_messaging_url_found: Unable to find URL for Adapter Engine af.pi1.piserver1</SAP:AdditionalText>
<SAP:ApplicationFaultMessage namespace="" />
<SAP:Stack>Error while reading access data (URL, user, password) for the Adapter Engine af.pi1.piserver1</SAP:Stack>
<SAP:Retry>M</SAP:Retry>
</SAP:Error>
Thanks
Balaji

It looks like the adapter engine is not able to register him self on SLD, you have to check in the SLD the "Exchange Infrastructure" domain, you have to verify restarting the J2EE the adapter engine update the entries in the SLD related to the specific XI Domain.
Launch Visual Administrator >> Server >> Services >> SAP AF CPA Cache
Enter the appropriate values for:
SLD.selfregistration.hostname (Use fully qualified hostname)
SLD.selfregistration.httpPort
SLD.selfregistration.httpsPort
Sandro

Error while reading access data (URL, user, password) for the Adapter Engin

Hi all,
I encountered a red flag in sxmb_moni and when I click on the flag, I get the following message:
Error while reading access data (URL, user, password) for the Adapter Engine
Is there any way I can resolve this? thanks all
Regards,
IX

Possible reason is Adapter engine is not registered on SLD. Check in SLD.
You can also try restarting J2EE adapter engine and update SLD entries specific to XI domain.
Lauch Visual admin go to Server > services > SAP AF CPA Cache
Enter the appropriate values for:
SLD.selfregistration.hostname (Use fully qualified hostname)
SLD.selfregistration.httpPort
SLD.selfregistration.httpsPort
Finally, if all the above seem to be correct check the userID / pwd for user ID : PI*.

How to write won WSDL file for SOAP adapter ?

Hi experts
Can any one expalin me how to write WSDL file for SOAP adapter ?
What and all things i need to know ? i have no idea on this....
I got the business but to WSDL ...i am very new to this
Adv...thanks
Rakesh

HI,
Please see the below links,
Consuming XI Web Services using Web Dynpro Part II-/people/riyaz.sayyad/blog/2006/05/08/consuming-xi-web-services-using-web-dynpro-150-part-ii
Consuming XI Web Services using Web Dynpro Part I -/people/riyaz.sayyad/blog/2006/05/07/consuming-xi-web-services-using-web-dynpro-150-part-i
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/0d7349b6-0901-0010-ddbe-ec43178a61ff
/people/sap.user72/blog/2006/01/16/xi-propagation-of-meaningful-error-information-to-soap-client
/people/kevin.liu/blog/2006/04/12/wsdl-11-binding-extension-for-soap-12
Regards
Chilla..

Enabling https for SOAP adapter

Hello all,
Can anyone suggest how to enable https for SOAP adapter in PI system?
Thank You,
Regards,
Hasan

Hi Hasan,
CHeck the blog :/people/rahul.nawale2/blog/2006/05/31/how-to-use-client-authentication-with-soap-adapter which guides you clearly
Also check SAP Note#891877 for reference.
Thanks and Regards,
Naveen

Adapter specific message attributes for SOAP adapter

Hi all,
I have gone through the SAP Help Documents for configuring SOAP Communication Channel. I am unable to understand how to implement ASMA for Soap adapter.
Please provide some links to help me understand the same
Many Thanks,
Neha

Hi Neha,
pls do chk the below links for SOAP adapter message attributes
http://help.sap.com/saphelp_nwpi71/helpdata/en/fc/5ad93f130f9215e10000000a155106/frameset.htm
http://help.sap.com/saphelp_nw04/helpdata/en/43/0a7d1be4e622f3e10000000a1553f7/content.htm
http://publib.boulder.ibm.com/infocenter/wbihelp/v6rxmx/index.jsp?topic=/com.ibm.wbia_adapters.doc/doc/sap_xi/sapximst38.htm
http://publib.boulder.ibm.com/infocenter/wbihelp/v6rxmx/index.jsp?topic=/com.ibm.wbia_adapters.doc/doc/webservices/webservices16.htm
Regards
Sampath

Problem with Sender Agreement for EDI File to Idoc scenario

I'm configuring PI for EDI with Seeburger Adapter (Calling as a Module) and I'm having an issue with the Sender Agreement using File Adapter.
Process used is File to IDOC. EDI data will be picked up from VAN (Using existing FTP process rather than using Seeburger FTP) and stored in a folder which is being accessed by PI to send to R/3 to create orders.
All my inbound EDI will be stored in same folder which should be picked up by XI and distribute the same depending upon the respective scenario's in ID and respective mapping/config in IR.
The whole process IR & ID works fine and also creates Idoc in R/3, if I configure for one customer for EDI 850, but when I try to configure for second customer for same EDI 850 having same ANSIX12 version (V4010) as previous customer, I get stuck at the Sender Agreement part for this second customer because I use the same CC for File read for both the customers (Scenarios) and since there is a limitation with File Adapter "sender channel must not be assigned to more than one sender agreement ".
How can I create the Sender Agreement using the same CC for my other scenario?
I tried creating multiple CC for different scenario but when I place a test file for customer A, I see that its being picked up by both CC's.
Pl Advise.
Thanks!
PSR

You need to configure splitter as module in sender file adapter (classifier->bic->splitter) as well as define a message splitter(with partner number and Seeburger mapping) in Seeburger workbench.
Thank you for the reply Aamir,
Do you have any document which can guide me through the process?
Does Seeburger Workbench play any role here? because I'm not using See FTP adapter to connect to my VAN. We get the data from the VAN using FTP process but not using See FTP. I'm using BIC to generate an XSD and SDA file, rest everything is in XI using File to idoc and IDOC to file process.
Thx
PSR

Huge problem using apple mail while sending email to a group...

Hey - I am quite confused... apple mail has huge problems using groups with about 150 addresses when writing and sending an email... the writing of emails is nearly impossible. Once the group name is inserted in the addressline (address book in iCloud!), apple mail uses nearly 100% CPU and further writing is nearly impossible. When sending such an email, all addresses are suddenly visible - though the box is NOT checked and the addresses should be hidden... what can I do? I use this feature (sending mails to groups) on a daily basis and cannot accept visible addresses...
Greetings and sorry for inconvenient english...
Christof

How about next time you send to the group, cc yourself, or include yourself in the group. Then receive the email on the iphone, you can "reply all" in order to send to the group. If you use an imap account, you can make a new folder, call it something like "groups", and save different group emails there for the next time you need to "reply all".

How to use "access control - administrator" in SQL

I have a report with checkboxes to select records for delete. Non administrators can only delete a subset of the records. So for some of the records I would like to hide the checkbox if the user is not an administrator. The checkboxes are created in the select statement.
I would like to know if there is a function that I can use in SQL that will tell me if the current user is administrator or not. I'm using the access control list.
Edited by: Rene W. on Mar 10, 2011 3:46 AM

Just found the apex_access_control table in my schema.
Guess I'll just use that.

Data Guard Summary problem using Grid Control.

I setup data guard using Grid Control and after completion, the console of the standby database shows: "Unable to determine Data Guard information." under the Data Guard Summary section. The primary database is not showing the standby. I'm using Red Hat Linux Server 5.7 (64bit) and Oracle 10.2.0.5. This is a standalone (no RAC or ASM involved). When I run show configuration, the following comes up:
DGMGRL> SHOW CONFIGURATION;
Configuration
Name: PRODDB_ghph@ora01
Enabled: YES
Protection Mode: MaxPerformance
Fast-Start Failover: DISABLED
Databases:
ghph - Primary database
gsbh - Physical standby database (disabled)
Current status for "PRODDB_ghph@ora01":
SUCCESS
I tried searching online and metalink but nothing. Any help in solving this problem would be appreciated. TIA
Edited by: Gensis2001 on Jan 8, 2013 3:08 PM

Gensis2001 wrote:
Does this make any sense?
SYS@gsbh> SELECT * FROM V$ARCHIVE_GAP;
no rows selected
SYS@gsbh> select process, status, sequence# from v$managed_standby;
PROCESS STATUS SEQUENCE#
ARCH CLOSING 60353
ARCH CLOSING 60352
RFS IDLE 60354
MR(fg) WAIT_FOR_GAP 58673
4 rows selected.Currently standby is waiting for the sequence *58673* but the later on archives of series 60353... are already archived.
Can you confirm that only archive sequence * 58673* is missing or any more? If you have less number of archives are missing then see how the parameters you configured. like FAL_SERVER, LOG_ARCHIVE_CONFIG, LOG_ARCHIVE_DEST_n so on.
Check below command and see any errors with remote destinations
select severity,error_code,to_char(timestamp,'DD-MON-YYYY HH24:MI:SS') "timestamp" , message from v$dataguard_status where dest_id=2;Source: http://www.oracle-ckpt.com/dataguard_troubleshoot_snapper/
If the archives are missing so many and you do not have backup, then certainly you have to choose incremental roll forward to synchronize the primary database, then only you can see the configuration status of Broker as valid. You can refer this article to perform incremental roll forward http://www.oracle-ckpt.com/rman-incremental-backups-to-roll-forward-a-physical-standby-database-2/

Problems using ActiveX controls

Hello all,
I bought a set of ActiveX controls provided with a installation routine.
Using those controls within LabView after installing them were no
problem, but for distribution purpose I have to install those ActiveX
controls manually.
So I tried to do it on a separate computer by registering the ActiveX
controls with regsvr32 [regsvr32 ]. But the attempt to
start a LabView program where these controls were embedded ended with
the error message "error opening document" (ole_lv5container) and "error
510 occurred while loading ActiveX control ..."
I'm working with Windows NT 4.0 and LabView 5.0f2.
Does anyone know, what I made wrong?
Bye, Alexander
Sent via Deja.com http://www.deja.com/
Before you
buy.

Hello all,
I bought a set of ActiveX controls provided with a installation routine.
Using those controls within LabView after installing them were no
problem, but for distribution purpose I have to install those ActiveX
controls manually.
So I tried to do it on a separate computer by registering the ActiveX
controls with regsvr32 [regsvr32 ]. But the attempt to
start a LabView program where these controls were embedded ended with
the error message "error opening document" (ole_lv5container) and "error
510 occurred while loading ActiveX control ..."
I'm working with Windows NT 4.0 and LabView 5.0f2.
Does anyone know, what I made wrong?
Bye, Alexander
Sent via Deja.com http://www.deja.com/
Before you
buy.

[SOLVED] xhost access control does not work for specified users

After last upgrade of xorg to v1.17.1-1 I get message: "unable to open display ":0" " when trying to run any window application as user specified in xhost. My xhost list looks like:
access control enabled, only authorized clients can connect
SI:localuser:steam
SI:localuser:root
But if I disable access control for everyone by invoking "xhost +" applications run on another accounts without problems. Does anyone has that problem too?
Last edited by slx (2015-02-22 12:24:17)

slx wrote:I see that fix is pending http://lists.x.org/archives/xorg-devel/ … 45644.html
Can you test package here http://pkgbuild.com/~lcarlier/test/ ?

Problems using access control in sender agreement for SOAP adapter 7.1

Similar Messages

Maybe you are looking for