Questions on user security etc

Hello, we are getting ready to implement an SOA strategy within our company and have decided to use XI as the interface to SAP from any other system. We have some (I have) questions on what some of the different approaches are for security. If anyone could help me with the following info (I have searched and searched and just not clear)
So before reading the scenario's here is the main thing I am trying to accomplish. Have webservices that take in a userID and password that is not stored in XI but on our LDAP server (like we have in the portal) and pass this to the back end ensuring user has writes to do desired function in sap. We want every user id so we can track if someone creates an purchase request etc, (instead of setting up a system id, audit puposes) So with that background I have the following scenarios
Scenario 1: Have a single sign on like the portal, so the user signs on with there normal account and XI accepts and forwards the request (this would mainly be a webservice) (I have seen some single sign on documentation but curious if it works in XI as it does in the portal)
Scenario 2: Same as one, but use ADS/LDAP as our authentication engine.
Scenario 3: Have userid put in, but no authentication is done on the front end but user is authenticated against the sap system and if allowed rfc/proxy is executed otherwise error message unauth is returned.
Scenario 4: Is the propagate principle mainly just to ensure the user has all rights to run all calls within internal XI procedures and wouldn't really apply to just ensuring user has rights in the backend?
I am sorry for the long question, I do reward points and I am just trying to get started on the right path with XI
Cheers
Devlin

Hi,
For your above cocern XI have provided the feature of Principal propagation with SSO ie.e Single sign On.
refer
Principal Propagation in SAP XI
/people/alexander.bundschuh/blog/2007/01/16/principal-propagation-in-sap-xi
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/808d3048-638c-2a10-35a6-faa48e50ad59
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/808d3048-638c-2a10-35a6-faa48e50ad59
/people/sap.user72/blog/2004/11/30/user-mapping-based-single-sign-on
http://help.sap.com/saphelp_nw04/helpdata/en/32/1c1041a0f6f16fe10000000a1550b0/frameset.htm
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/69d95112-0d01-0010-8297-fa31feea26e0
also you could provide SSL Configuration across the firewall
You need to setup SSL layer for HTTPS endpoint.
Possible HTTP security levels are (in ascending order):
HTTP without SSL
HTTP with SSL (= HTTPS), but without client authentication
HTTP with SSL (= HTTPS) and with client authentication
HTTPS comes in two flavors, both ensuring the confidentiality of data sent over the network
Thanks
Swarup

Similar Messages

Best J2EE framework for Crud, Master details, lists, user, security, etc?

Hi all,
Thanks in advanced for your constant help :)
My intention is to find a good J2EE framework to build small applications with the most common elements. ( Lists, Cruds, Master details, Search options, menus, user management, security, reporting, charting, etc).
Any thoughts ?

Any thoughts?

Get error while Integrating with Oracle's Enterprise User Security

Hi,
I am trying to create an Oracle Enterprise User integrating with OVD and MS Active Directory.
I am following all the steps in Integrating with Oracle's Enterprise User Security.
In the documentation section: "Configuring Oracle Virtual Directory for the Integration"
I have applied the steps successfully until:
Update and load the entries into the Local Store Adapters by performing the following steps:
I have successfully extended the Oracle Virtual Directory schema with the loadOVD.ldif
However I am getting errors in the next step: Update realmRoot.ldif to use your namespaces
The next step states the following:
Update realmRoot.ldif to use your namespaces, including the dn, dc, o, orclsubscriberfullname,
and memberurl attributes in the file. If you have a DN mapping between Active Directory and
Oracle Virtual Directory, use the DN that you see from Oracle Virtual Directory.
The realmRoot.ldif file is located in ORACLE_VIRTUAL_DIRECTORY_HOME/eus,
where ORACLE_VIRTUAL_DIRECTORY_HOME represents the location where Oracle Virtual Directory is installed.
The realmRoot.ldif file contains core entries in the directory namespace that Enterprise User Security queries. The realmRoot.ldif file also contains the dynamic group that contains the registered Enterprise User Security databases to allow secured access to sensitive Enterprise User Security related attributes, like the user's Enterprise User Security hashed password attribute.
Load your domain root information in the realmRoot.ldif file into Oracle Virtual Directory using the following command:
ldapmodify -h Oracle_Virtual_Directory_Host –p OVD_Port -D cn=admin -w Admin_Password -v -a –f realmRoot.ldif
When I run the ldapmodify command I get the following error:
add dc:
testldap
add objectclass:
top
domain
domainDNS
adding new entry DC=testldap,DC=local
ldap_add: Operations error
ldap_add: additional info: LDAP Error 1 : null
The actual realmRoot.ldif looks like this:
# Please uncomment the following one line if you are importing this
# LDIF file via OVD Manager or OVD Server's ldapmodify tool.
#version: 1
#dn: dc=com
#dc: com
#objectclass: domain
dn: DC=testldap,DC=local
changetype: add
dc: testldap
#o: subarashii
objectclass: top
objectclass: domain
objectclass: domainDNS
#objectclass: orclSubscriber
#orclsubscriberfullname: subarashii
#orclVersion: 90400
# If your domain structure has more layers than dc=subarashii,dc=com,
# for example, it's dc=us,dc=subarashii,dc=com, you will need to load
# the following ldif entry/entries too.
# Uncomment out the following, if required.
#dn: dc=us,dc=subarashii,dc=com
#orclversion: 90400
#orclsubscriberfullname: us
#objectclass: domain
#objectclass: top
#objectclass: orclSubscriber
#dc: us
# Adding EUSDBGroup entry
# Modify the memberurl attribute and replace it with your own domain name
#dn: cn=EUSDBGROUP,dc=subarashii,dc=com
#cn: EUSDBGROUP
#memberurl:ldap:///dc=subarashii,dc=com??sub?(&(objectclass=orclService)(objectclass=orclDBServer))
#objectclass:groupofuniquenames
#objectclass:groupofurls
#objectclass:top

Did you ever get your questions answered about the realmRoot.ldif file? Did you manage to configure a successful integration of OVD with EUS? I am battling with trying to get Oracle Virtual Directory integrated with Enterprise User Security, but every step I take in Chapter 7 of the OVD manual fails in some way, and the instructions are often vague. I am not sure how to modify the realmRoot.ldif file. Is there any improved documentation on this? I have logged a Service Request, but not getting any help. Any resources or documentation you know of that provides better guidance would be much appreciated. I am way behind my schedule now and this is a very frustrating exercise.
Thanks.

CMC tool raise http 404 error when viewing user security on server object.

Description of Problem or Question:
In investigating an issue promoting an LCM job, I attempted to use the CMC tool to look at the user security on a server object. When I executed the command the tool raised an error.
HTTP Status 404 - /CmcAppActions/jsp/Shared_Rights/rights.face.
type: Status Report
message: /CmcAppActions/jsp/Shared_rights/rights.face
description: The requested resource (/CmcAppActions/jsp/Shared_Rights/rights.face) is not available.
Product\Version\Service Pack\Fixpack (if applicable):
Business Objects XI 3.1 SP2
Apache Tomcat 5.5.20
Java 6.0.170
Relevant Environment Information (OS & version, java or .net & version, DB & version):
WIN Server 2003 Enterprise SP2
Sporadic or Consistent (if applicable):
Consistent error
What has already been tried (where have you searched for a solution to your question/problem):
I have done some research in service.sap.com and on the Web, but have found nothing concrete other than it appears to be an error in the install of the Tomcat server.
Edited by: Jon Russell on Jul 9, 2010 12:20 AM

Hi Alvaro,
Forgot this thread was open as of yet. There was a solutio but nothing concrete I can offer to th user community. The reason i that this devolved into a Note to SAP and, as I recall, the solution was for a BO consultant to remotely access our development server for BO an bsically do "brain surgery" in the SQL Server db we had supporting BO. It was a difficult issue an eventually required direct intervention from SAP-BO.

How to configure Enterprise User Security ?

Hi All,
I am following the oracle document for setting up Enterprise User Security to setup Enterprise user security between OID 11g and database 11g . but right now if i click on the "Enterprise User Security" link in the Security under the Server tab , I am getting a HTTP 500 internal error , please kindly provide your inputs .
Regards,
Senthil.

Hi,
You don't so much configure enterprise voice for federation, you just configure enterprise voice. Then when you configure you're environment for federation, the voice features will take care of themselves. The two are separation components / features.
But you'll need to be a little more specific; Are the two user forests using the same Lync environment through a forest trust(s) (resource or central forest topologies)? If they are, then you don't need to do anything with federation for these
two forests to leverage enterprise voice between their users - it will just work. However if each user forest is using a separate Lync environment, then you will need to configure federation between the two and make use of Lync Edge servers.
You can enable enterprise voice for users without an SBC or gateway, this component is used merely to connect your Lync platform to the PSTN. You may also use a direct SIP trunk to your mediation server as you have eluded to, although I never recommend this
in production for security reasons (which I feel others will back me on), it is still a supported option.
Let me know if I've interpreted this completely wrong.
Kind regards
Ben
Note: If you find a post informative, please mark it so using the arrow to the left. If it answers a question you've asked, please mark the thread as answered to aid others when they're looking for solutions to similar problems or queries.
Lync | Skype | Blog: Gecko-Studio

How to set Max Rows Retrieved by user security profile in CMC?

Hi
As we know, it is possible to set Max Rows Retrieved with query property (in the area 'Limits').
However, it is mentioned in official documents that this setting can be overwritten by the BOE administrator in user security profile. Could any one tell me how this is done in CMC?
Thanks in advance!
Qing

Hi Rishit,
Thanks for your answer!
Had a long holiday, so didn't give a feedback in time. Sorry for that!
There is a tab 'Controls' in Universe Parameter, where there is a setting used to limit the size of result set.
Then what's the priority between this setting and the similar setting in WebI query properties?
However, acutally my question is how to set the limitation by user security profile in CMC.
Do you have any idea about it?
Qing
Edited by: Qing Zhou on Jun 21, 2010 11:12 AM

Several questions about Application Security

Hello,
I have several questions about Application Security and perhaps I need a few tips...
I have a lot of users in a few groups which have access to my application! And the different groups should have only access to their pages.
In my application I use trees to navigate through the application.
So my idea is that i display different trees for the different user groups and restrict the user to access the URL....so the user can only see and contact "their" pages.
I know how to create the logic behind the trees, but how can I create the restricted URL access...
The "No URL Access" in the Session State Protection can not be used, because I use a lot of links in reports and HTML regions.
Is there another way to solve that?
But I am unsure if that is a "good" solution for my problem!
What do you think about that?
Am I going to do that too complicated?
Could that be done by authentication or authorization?
(By the way, I do not understand the differences between authentication and authorization. Can anyone help?)
I would be glad for any reply!
Thank you,
Tim

Hey Arie and Scott,
thank you for your quick reply!
Now I understand the context around authorization and authentication...
I try the Access Control List and I think that is a very nice feature! Really good!
But now I am wondering, how I can create more privileges?
So that I have a few "end-user-roles" and then I can choose who have access to a page and who not!
Does anybody know how to do that?
Thank you,
Tim

Questions on MIDP Security

Hi all,
I've a few questions on MIDP security to seek help:
1) Suppose I have a midlet to store confidential details on the mobile phone, if it doesn't make any connections to the internet, would anyone be able to retrieve the information I'd on the RMS?
2) Again, assuming no internet connection is made by the midlet. Suppose I've a login screen that prompts for a password & uses MD5. Can anyone crack it?
3) Is it possible to retrieve the midlet from the mobile phone itself onto a desktop?
Thanks for the help!

Yes, it is possible to retrieve the data stored in
RMS.
Just try it on a Nokia S60 phone:
1. download and install FExplorer (free file
explorer)
2. go to: c:\system\midp\<vendor>\untrusted\<midlet
name>\<?????> folder
3. select rms.db
3. choose options/send/SMS|MMS|e-mail|bluetooth|irda
Of course cracking is a harder work...does this means that I can follow your step 1 & goto whichever midlet that I'm interested in & send the JAR/JAD file via SMS/MMS/Email/BlueTooth/IRDA?

My boyfriend and I have our own iPhones but share an iPad. How do we create two different profiles or user accounts, etc?

My boyfriend and I have our own iPhones but share an iPad. How do we create two different profiles or user accounts, etc?

Unfortunately, at the moment you cannot create two user profiles on one iOS device.

Eternal ball, flashing question mark, kernel panic, etc... all! HELP!

Think this is a good, one... Here is the story:
Some apps will crash, that always happens, right? So I did not pay much attention to it until it was way too often. Learned about disk utility, repaired permissions on a regular basis and moved on. But then... One day disk utility told me there was something that could NOT be repaired. I ran and bought an External HD (usb.. not a good choice, but I found out that too late for an exchange). Backing up from there on was kind of a weekly thing.
But nothing to worry about, I could still use my iBook pretty well and with no problems. Then... one fine day I could not SAVE ANYTHING! Everything was working "normal", but when I wanted to save my work. It told me that I could not do it! Not even making a new bookmark from Firefox!
So I did verify and repair from disk utility, and I ran the hardware test giving me the following:
*ERROR CODE: 2STF/8/3:ATA -100 ata -6 -Master*
I have no idea what that means, but I used it to look for help online and everything pointed out that my HD needed to be replaced. I believe at this point is when I met the flashing folder icon with the question mark. Suddenly it would not detect the HD! But then... after turning it off and on for a few times it would see it and start-up normally. In one of those lucky start-ups I backed up all I thought was important in the external HD and made a clean install of OS X. Oh... and it is fun to try to install OS X when.. there is no HD in the list to pick for your destination! After a lot of patience, it would show up, but then is when I met the kernel panic mesg! After a few more tries (yes, I am a very patient person... sometimes), I finally could make a clean install of OS X. I even partitioned the HD to make sure there was nothing there.
Ok... seemed like it liked it.. but after a little while, strange things happened again, and after the restart, the blinking folder with the question mark again...
So... no choice, have to replace my HD right? I get a brand new Seagate, 120 Gb, 5400 rpm. Followed instructions from ifixit.com and after 3 hours (and a lot of fun!) I replaced the hard drive on my beloved iBook. This was really fun!
Installed the software on the new HD.. everything looks fine... for a few minutes. I tried to use right away what I use everyday to see if it works: web browser, iTunes, Activity Monitor, played a dvd perhaps, etc... And..? Nop... started crashing again... Got the blinking question mark after restart, etc. But now.. the hardware tests reports me no problems.
Ok... it was not the HD, but I already bought one, and installed it myself!... lets move on and see where is my problem.
Could it be the ram?
This model has only one slot of removable ram, and a built-in DIMM that I cannnot replace +(or can I?)+, so I remove the one I can, and restart it without it. First it looks fine again, everything is working, but after a while it starts crashing again. So.. it's not the ram... or at least it's not +this one+.
So... I think its time for a Professional to take a look at it, right?. So I took it to a Mac Store (not Apple store) and explained EVERYTHING to the guy that received my beloved iBook, he takes notes and tells me that it has to stay for a few days. After 1 week I receive a call from the store (another employee) telling me the sad news that my HARD DRIVE NEEDS TO BE REPLACED! And that they were very sorry but they cannot recover any of my data... what data?? All that was there was the OS!!!
So... a deep breath and I explain to him everything over the phone. Ok.. he says he will talk with the tech-guy and I'll hear from them in a few more days. I did...
I was very glad to hear it was a cable that connects the HD to the Logic Board (that's what I understood.. I think). That this was only 20 dollars, but somehow, with the labor I ended up paying around 100 dlrs! I found out later that apple changes this cable everytime they upgrade a HD.
Ok.. 200 dlrs spent already ($100 on my Seagate HD + $100 for the cable..), but if get my iBook to work again I'll be happy.
So I go home and start to work on installing and making everything work again: firefox, iTunes, fugu, tried cyberduck, taco, ... everything looked fine. But after a while... it happened again. Sometimes I don't even get the blinking folder, just a grey screen. I turn it off, and then comes the blinking '?' or it starts-up... and if it does, after a while it would crash.
(I started this post on my iBook, and I was like 2/3rd's through when I got the ball... and no response at all... tried force-quit... and nothing, had to power off..AND start this post all over again on my girlfriend's!!! )
So here I am... Of course I want to take it back to the guys at the MacStore and
complain about their poor job... But does anyone here has a good idea of what could it be?
My thoughts are something like this: Seems like if you do not use a lot of memory (I only have 512 Mb total, so a lot of it comes from the virtual, right?) it works fine, but somehow if it reaches a point where it needs more than a certain amount it would crash. I dont know if this even makes sense, but that's my feeling. The guys at the MacStore told me that they tested around 100 times restarting the computer and it looked fine, so yeah... if all they did was use a software to restart once and again, and again... without really using the memory, they would not see the problem, right? The problem comes later.. when you use the iBook.
Could it be then that the problem comes from the ram that is built-in? If so.. can this be replaced? Is it worth it? Can I do it myself?
Too many questions...
Any thoughts would be more than welcome and...
Thanks for reading all the post!
E

yeah....
the problem is that I do not have a firewire external HD, and it will not boot from my usb external...
Anyway... I am back from the MacStore and the guys told me that the next step would be to replace/work on the logic board, and that that was too expensive a job to do an an old iBook like mine, they did not recommend it to anyone (they told me they charge between 600-800 dlrs for this kind of job).
So... seems like my iBook is in a very bad shape.
I saw DT&T online and it seems like they do the job for half the price of the MacStore (before shipping costs), but... still, is it worth it?
I was thinking in the possibility to find someone who sells a used iBook in pieces because of a crashed screen or something, to get another logic board and try to replace it myself, but... is this something an amateur can do by himself?
Haven't checked ifixit.com for that yet.
Any ideas??
Thanks..
Edgar

Adobe reader will not open pdf files I have saved as, or, export as pdf to my desktop (latest Maverick). The same file does open when I am on the source website (i.e. user manuals etc.). Why?

Adobe reader will not open pdf files I have saved as, or, export as pdf to my desktop (latest Maverick). The same file does open when I am on the source website (i.e. user manuals etc.). Why?

iMac G4, Mac OS X (10.4.9)
Make sure you have the latest Adobe Reader installed for your OS.
http://www.adobe.com/support/downloads/product.jsp?platform=macintosh&product=10
Did you try using Preview. If you control click on the PDF on your desktop you can use the "open with" option.

Completion Insight not working correctly when using Enterprise User Security (EUS) logon

This is a pre existing issue we've experienced with SQL Developer, though I've only just worked out what is causing the issue it is present in previous versions of the tool, up to the current 4.0.EA2.
We experience issues with the Completion Insight functionality of SQL Developer.
When we log into a database using Enterprise User Security i,e authenticating against OID, the schema of the database account is prefixed to any reference to public synonyms, ie all user_%, all_%, dba_% and v$% views.
When I change the authentication of the database account back to normal database authentication the schema prefix correctly isn't shown. It simply suggests the synonym name of the views.
An example of this is as follows when attempting to query the DBA_TABLES view:
The database account is ORADBA and has DBA privs.
The EUS user that is mapped to the ORADBA schema is dbutler.
The ORADBA user is configured to authenticate externally (against OID).
I login with my dbutler directory credentials:
If I start typing:
select * from dba_tabl
The object name is suggested as ORADBA.dba_tables
If I change the authentication of the ORADBA account back to database authentication, the prefix is no longer present.
i.e If I start typing:
select * from dba_tabl
The object name is suggested as dba_tables

If you're not using DB 10.2 this is the "expected" behavior for the DB. See also metalink note 351170.1 "Enterprise Users Can Connect to a Database when the OID Account is Disabled"
regards,
--Olaf

I have 100 groups in planning for those 100 groups i want to build roles like interactive,view user,planner etc.for those how to change in export -import folder .xml file in that edit how to change user roles in that xml it will generate automatic id.h

I have 100 groups in planning for those 100 groups i want to build roles like interactive,view user,planner etc.for those how to change in export -import folder .xml file in that edit how to change user roles in that xml it will generate automatic id.how to do that in xml file ?

Thanks john for you are reply.
I had tried what you sad.I open shared service in that foundation project i had export shared service.after that in import-export file.In that role.csv,user.csv,group.csv.Like this file have.When i open user file added some users after i trying save in excel it shown messgse
I click yes and save the .csv file and import from share servie. i got error like this
am i doing right way john.or explain clearly

Questions about user-defined functions

Hello all,
I've got some questions about user-defined function in a message mapping:
1) How can I get the current date/time in format yyyy-mm-dd hh:mm:ss ? What is the java code for this?
2) I want to use the StreamTransformation constant TIME_SENT, only this is not in the right time-zone.
It is GMT and it should be CET (1 hour difference). How can I convert this in Java?
Can somebody help me with this?
Thanks in advance.
Kind regards,
Marco van Iersel

Hi Marco,
If the date format is fixed as you have mentioned,please use this:
                                String test = "2009-03-27 23:15:30";
          String test1 = test.substring(11,13);
          if(!test1.equals("23"))
          int a = Integer.parseInt(test1);
          int b = a+1;
          System.out.println("b"+b);
          String c = Integer.toString(b);
                                test = test.substring(0,10)+" " + c + test.substring(13,19);
                                return test;
          if(test1.equals("23"))
          test = test.substring(0,10)+ " 00" + test.substring(13,19);
          return test;
                                else return "";
Kindly let me know if this works.
Thanks.
Regards.
Shweta

A question about users assigned roles extraction

Dear all,
I have a question about users assigned roles list extraction. I need the list of the users who have already been created along with their assigned roles. According to what I found on Google, there is a table named AGR_USERS which provides the roles assigned to each user. Yet, this table provides only the SAP ID of each user along with the assigned roles. What I need more is to have also the first name and second name of each user.
So, do you know any table providing at least the following information:
1) First name of each user
2) Second name of each user
3) SAP ID of each user
4) All assigned roles to each user.
NOTE: I really need to have first name and second name in separate columns
Thanks in advance,
Dariyoosh

>
Shekar.J wrote:
> Agr_users for the user ID and role assignments
> USR02 to check the validity of the User ID
> and USER_ADDR for the first name and last name
>
> You can create a Table join of the above 3 tables to retrieve the data you require
Thanks to you and others for your attention to my problem
I don't know anything about ABAP programming, is there any transaction allowing to create this join? As it seems to me the column "UNAME" in the table "AGR_USERS" and the column "BNAME" in the table "USER_ADDR", both refer to the SAP ID of the user. As a result the condition of the join would be "WHERE (UNAME = BNAME)", is there any transaction/programme allowing to create this join?
Thanks in advance,
Dariyoosh

Questions on user security etc

Similar Messages

Maybe you are looking for