Relationship between groups and their members in LDAP directory missing

I use SAP EP 6 SPS14 with one LDAP Server as data source using this flat LDAP structure:
dn: dc=example,dc=com
objectClass: dcObject
objectClass: organization
dc: example
o: example.com
dn: ou=user,dc=example,dc=com
objectClass: organizationalUnit
description: All Users
ou: user
dn: cn=Max Mustermann,ou=user,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
cn: Max Mustermann
givenName: Max
sn: Mustermann
uid: 0001
userPassword:: bWF4
dn: cn=Max Meier,ou=user,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: person
objectClass: top
cn: Max Meier
givenName: Max
sn: Meier
uid: 0002
userPassword:: bWF4
dn: ou=groups,dc=example,dc=com
objectClass: organizationalUnit
description: All Groups
ou: groups
dn: cn=internal,ou=groups,dc=example,dc=com
objectClass: groupOfNames
objectClass: top
cn: internal
member: uid=0001,ou=user,dc=example,dc=com
dn: cn=external,ou=groups,dc=example,dc=com
objectClass: groupOfNames
objectClass: top
cn: external
member: cn=Max Meier,ou=user,dc=example,dc=com
The private section of the LDAP entry in the dataSourceConfiguration.xml looks like:
<privateSection>
               <ume.ldap.access.server_type>openLDAP</ume.ldap.access.server_type>
               <ume.ldap.access.context_factory>com.sun.jndi.ldap.LdapCtxFactory</ume.ldap.access.context_factory>
               <ume.ldap.access.authentication>simple</ume.ldap.access.authentication>
               <ume.ldap.access.flat_group_hierachy>true</ume.ldap.access.flat_group_hierachy>
               <ume.ldap.access.user_as_account>true</ume.ldap.access.user_as_account>
               <ume.ldap.access.dynamic_groups>false</ume.ldap.access.dynamic_groups>
               <ume.ldap.access.ssl_socket_factory>com.sap.security.core.server.https.SecureConnectionFactory</ume.ldap.access.ssl_socket_factory>
               <ume.ldap.access.objectclass.user>inetOrgPerson</ume.ldap.access.objectclass.user>
               <ume.ldap.access.objectclass.uacc>inetOrgPerson</ume.ldap.access.objectclass.uacc>
               <ume.ldap.access.objectclass.grup>groupofnames</ume.ldap.access.objectclass.grup>
               <ume.ldap.access.naming_attribute.user>cn</ume.ldap.access.naming_attribute.user>
               <ume.ldap.access.auxiliary_naming_attribute.user>uid</ume.ldap.access.auxiliary_naming_attribute.user>
               <ume.ldap.access.naming_attribute.uacc>cn</ume.ldap.access.naming_attribute.uacc>
               <ume.ldap.access.auxiliary_naming_attribute.uacc>uid</ume.ldap.access.auxiliary_naming_attribute.uacc>
               <ume.ldap.access.naming_attribute.grup>cn</ume.ldap.access.naming_attribute.grup>
</privateSection>
The pointers in the portal are:
User Path: ou=user,dc=example,dc=com
Group Path: ou=groups,dc=example,dc=com
If I log in as SuperUser, all users and all groups of the LDAP directory are there and I could log on as one of the LDAP provided users. But the relationship between the users and the groups, defined in the member of the objectClass groupOfNames, is missing.
Whats wrong???
Message was edited by: Holger Wohlhüter

Meanwhile I changed the GroupOfNames to GroupOfUniqueNames in the LDAP structure and solved the problem. I had to add this line: <physicalAttribute name="null"/></b> in the User mappings.
<nameSpace name="com.sap.security.core.usermanagement.relation">
     <attributes>
          <attribute name="PRINCIPAL_RELATION_PARENT_ATTRIBUTE">
               <physicalAttribute name="*null*"></physicalAttribute>
          </attribute>
     </attributes>
</nameSpace>
Message was edited by: Holger Wohlhüter

Similar Messages

How to easily find all the relationship between group and reports in OBIEE

Hi, All:
I am working with a production env which contains many group and reports.
I want to know if there is a quick way to export the relationship between all the group/users and all the reports/page/etc.
Thank you for the kind help.

Thanks so much !
May be you can suggest a way around what I trying to achieve. I migrated(imported) one BA from our Prod system to an R12 VIS demo system into the pre-existing APPS EUL as owner SYSADMIN. When I login as SYSADMIN I see all the workbooks(the ones that were migrated from PROD and the ones shipped with VIS). I am interested only in the Workbooks that I migrated from Prod System. There are 100's of migrated workbooks. I was thinking of creating another APPS user and grant this newly created user ADMIN privileges on the migrated BA and transfer ownership of all migrated WORKBOOK. This way when I login as the newly created user I will only see the migrated Workbooks. How do I automate the process to seperate them using SQL or otherwise
Thanks
Bismi

Ideal way to report on Nested Groups and their Members - I can get the script to work if there's one group, but not if there is two or more

Hi All,
I like to keep track of Groups and Users added into our Domain Admins. Yes, it should always be minimal, but if I can have a daily report just to be certain, I'll sleep better.
The following works just fine if there is a single nested group. I cannot get it to work properly if there is more than one. I'm hoping you'll see what I'm missing.
Works fine:
$admins = get-adgroupmember "domain admins"
foreach($i in $admins){if($i.objectClass -eq "group"){ get-adgroupmember $i.samaccountname |foreach {New-Object PSObject -Property @{ username = $_.name;Group = $($i.name)}} | select username,group | export-csv c:\Users_and_Groups.csv -Notypeinformation}}
Does not work well. Result is that the "Group" information doesn't change to the correct group:
$myCol=@()
foreach($admin in $admins){if($admin.objectClass -eq "group"){$myCol+=$admin.samaccountname}{foreach($i in $myCol){get-adgroupmember $i | foreach {New-Object PSObject -Property @{ username = $_.name;Group = $($admin.name)}} | select username,group
| export-csv c:\Users_and_Groups.csv -Notypeinformation}}}
Here is what I have in $myCol:
PS C:\Users\Administrator> $myCol
MarketingPSO
RMSysAdmins
I tried shortening up the one-liner a bit more, but for some reason the "RMSysAdmins" is the only Group listed even though Leia and Han are in the MarketingPSO Group:
foreach($i in $myCol){get-adgroupmember $i | foreach {New-Object PSObject -Property @{ username = $_.name;Group = $($admin.name)}} | select username,group }
username
Group
Leia Organa
RMSysAdmins
Han Solo
RMSysAdmins
c3po
RMSysAdmins
Darth Vader
RMSysAdmins
Boba Fett
RMSysAdmins
Thank you very much for your time,
Mr Mister

Hi Mr Mister,
To get nested group members, this script is for your reference:
function Get-ADNestedGroupMembers {
[cmdletbinding()]
param ( [String] $Group )
Import-Module ActiveDirectory
$Members = Get-ADGroupMember -Identity $Group|sort-object objectClass -descending
$members | % {
if($_.ObjectClass -eq "group") {
Get-ADNestedGroupMembers -Group $_.samaccountname
} else {
New-Object PSObject -Property @{ username = $_.name;Group = $Group }}
Get-ADNestedGroupMembers "groupname"
If there is anything else regarding this issue, please feel free to post back.
Best Regards,
Anna Wang
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

OTL - Table Relationship between Timecard and Workflow

Hi All,
Our employees work multiple projects and charge their time thru OTL to each of individual project as appropriate every pay period. Each project has it's own project manager. When an employee sumbits his timecard for approval the workflow routes an approval notification to EACH project manager. Every project manager must approve the employee's timecard before the "overall" timecard status is APPROVED.
For example, an employee works on four diffent projects - each project has a different PM. When the employee submits his timecard for approval an approval notification is sent to all four PMs. However, more than occasionally at least one of the PMs doesn't approve the timecard in a timely fashion so the employee's timecard is "hung up" waiting for approval.
I need to write a query in which I specifiy both an employee and particular pay period, and the query returns for the employee/pay peirod EACH Project Name, the PM for the respective project, and whether or not the the PM has approved the employee's time for the respective PM's project in the specified pay period.
Unfortunately I don't really know where to start. I don't know if there is an HXC or group of HXC tables that would allow me to report on the individual project manager's 'status' (i.e., has a PM approved his project in the employee's timecard)...or do I need to allow include some workflow tables such as (maybe ?) wf_notifications ? And if I need to include some WF tables can someone help me understand where the relationship between timecard and WF is definded/stored (in other words, for a particular timecard how can I query a WF table - for example, wf_notifications - and find all the respective notifications associated with that particular timecard ?
I hope my question is clear, but please advise if you have any questions. Thanks in advance for the help !!
Jeff

Hi Jeff,
Did you ever get an answer on this question, as I have similar issues.
One question you may be able to answer - Do all approvals on the project side need to be done for ANY project information to pull into Project Accounting, or as each Project Manager approves their portion does it pull in to PA?
Thanks very much!!
Lori

Difference/relationship between XML and XSD

Hi All,
Correct me if i am wrong,
When we create a source and a target datatype in IR automatically objects will be created in XSD.
The same way it does when we create message type.
In message mapping, We map source and target message type and when we test with sample data, we can view source and target in xml
My question is what is the difference/relationship between XML and XSD ?
Thanks,
ss

Hi,
XML (Extensible Markup Language) is a W3C initiative that allows information and services to be encoded with meaningful structure and semantics that computers and humans can understand. XML is great for information exchange, and can easily be extended to include user-specified and industry-specified tags.
Whereas
An XML Schema Definition (XSD) is an instance of an XML schema written in the XML Schema language. An XSD defines a type of XML document in terms of constraints upon what elements and attributes may appear, their relationship to each other, what types of data may be in them, and other things. It can be used with validation software in order to ascertain whether a particular XML document is of that type, and to produce a Post-Schema Validation Infoset.
I hope this clarifies.
Regards.
Praveen

2-way Trust Relationship between Windows and Mac Domain

Hi guys I hope someone can help me.
Just a quick explanation of what I am trying to do.
I have an Xserve running OSX 10.5.8 server, which is the OD Master. On that server I’m running Kerio mail server. I have a Microsoft 2003 server running AD.
The problem is I need to run BlackBerry Enterprise on the Windows server as the BlackBerry need active directory to work.
Since I have both system already running, I do not want to destroy my open directory just to get the BlackBerry working.
So what I have tried to do is create a 2-way Trust Relationship between the 2 domains, so the BlackBerry server will talk to the Kerio mail server.
The trust relationship appears to create fine from the Windows server side, but I’m not able to retrieve LDAP information from the open directory server.
The creation from the OSX server starts fine automated but then I had to finish it manually.
Has anyone else here created a 2-way trust relationship between Windows and Mac’s before? Any help on how you did it would be appreciated. Thanks

Have you checked on when the computer last checked in and changed the computer account password with the domain? When a computer changes it's password, Active Directory will store only the current password and it does not expire. The workstation
will store both the current password and the previous password. This for cases when you may restore Active Directory to a point before the computer password change.
To handle this, the workstation will try it's current password, then it's previous.
If you're restoring the workstation to a previous point in time, you may be rolling the stored passwords back too far for Active Directory to accept. I would only imagine this to be the case a handful of times if you're going back 1-2 days.
Are you experiencing 100% failure?

What's the relationship between Flex and AIR?

What's the relationship between Flex and AIR?
I only know that Flex is a Framework and the AIR is a runtime,
Can any one tell me more about these two object in detail,thanks a lot!

AIR is a runtime that supports a superset of the Flash Player API. You use it to run mobile and desktop applications, as opposed to browser apps.
Flex is a set of technologies for building either AIR apps or browser apps. It includes a framework of runtime classes (e.g, Button, DataGrid, etc.) to use in your applications, an SDK with a command-line compiler, and an IDE called Flash Builder (formerly Flex Builder) that supports intelligent editing, a design view, and a debugger.
So, a brief statement of their relationship is that you can use Flex to build AIR apps.
Gordon Smith
Adobe Flex SDK Team

Difference between Groups and roles?

Hi All,
What is the difference between groups and roles?
Thanks for your time and help.

Oracle does not have anything called a 'group'.
A role is a named object that can contain a set of privileges. The members of the set can be individual privileges or can be another role that contains its own set of privileges. Roles can then be granted to users (or to other roles) so that those users (or roles) have the specified privileges.
See the SQL Language reference - http://docs.oracle.com/cd/B28359_01/server.111/b28286/toc.htm
Read the topics for CREATE ROLE, GRANT and REVOKE

Separate document no. for SD revision document and detagging relationship between invoice and SD document no.

HI,
Country specific settings for India - Business transactions enables SD revision vide table TE872_SDCTRL_IND.
Whenever SD revision takes place system issue similar document no. as that of invoice and tagged it with XBLNR as per standard process.
Now issue that if that invoice is reversed, subsequent SD also gets reversed.
So business requires to have separate document no. for SD revision document and detagged relationship between invoice and SD document no.
I have explored event R507, 0010, 0060 and R436 but couldn't find input structure where such separate document can be assigned.
So can you provide hint which can assist in issue resolution?
Regards,
Paresh

Check this thread, if this helps.
[url] Link between MKPF table and EKKO or RBKP table [url]
I've done this as well earlier to create a custom document flow for archived documents where from the EBELN i've found all the related documents. Hope this helps.

Could I build 1:N relationship between CMP and BMP?

Hi, as subject, Could I build 1:N relationship between CMP and BMP?
Thanks a lot!
a13519

Container managed relationships only apply to CMP beans. You can look at the DTD in appendix B of the EJB spec or chapter 10 where they make this distinction.

What is rfc of creating relationship between ibase and partner?

I need bapi or rfc for assign a partner to ibase.
create relationship between ibase and parten.
pls.

Hi
check this link
Re: BAPI for creating IBASE structure
Regards
Pavan

Many to many relationships between Fact and Dimension

Hi All,
I have to solve two kind of many to many relationships between Fact and Dimension.
1. Many to Many relationship between Fact and Dimension, using a bridge table, with FKs in fact and dimension to bridge tables PK.
2. Many to Many relationship between Fact and Dimension, using a bridge table, and an intersection table, with FK in fact to bridge table, and 2 FKs in intersection table to Dimension and to bridge table.
I need help on implementing (how the mapping has to look like) them in OWB 9.2.0.2.8.
Thanks,
Aurelian Cojocaru

Aurelian,
Unfortunately, you cannot implement this in the dimensional model. You would have to use relational tables and relationships between those in order to implement your scenario.
Thanks,
Mark.

How to delete everything, but base group and their depends?

If I install KDE or Gnome, and even a bunch of different programs, or have too much broken system, or even what the cause ..
How to easiest delete everything, but to keep packages in base group and their depends?
Last edited by atommixz (2010-10-14 11:37:31)

You're drawing an erroneous conclusion. Dependencies for base are self contained within base. That is to say, you can install only the packages in base, and boot into a working system.
If it's not working, then it gives rise to the idea that you have packages outside of the base group that are providing the functionality of packages in base. I'm not willing to test this further than verifying what I think the output of the comm should be -- and it looks correct on my end.

Employee relationship between BP and org.BP missing

Hello,
I am getting few error in SRM when trying to order a shopping cart. After checking the user and BP through USERS_GEN i am getting this error.
"Employee relationship between BP and org.BP missing". Could anyone help me in this.
Thanks,
Pijush

Hi Pijush
Please let us know are you create the new EBP purchasing org copying from any other existing EBP purchase org, if yes, could you please delete the new EBP org assignment and create the new EBP org by using the Create icon and select u201CIs Line Supervisor ofu201D option. It will be resolve your issue.
Thanks
Sada

Relationship between db_flashback_retention_target and fast_recovery_area

Hi to all
I was doing a test on Flashback Database on my Oracle 11gR2 and I would like to seek clarifications on the relationship between db_flashback_retention_target and fast_recovery_area. Here are my current settings below:
SQL> show parameter db_flashback_retention
NAME TYPE VALUE
db_flashback_retention_target integer 60
SQL> show parameter recovery_file_dest
NAME TYPE VALUE
db_recovery_file_dest string L:\app\amosleeyp\fast_recovery
_area
db_recovery_file_dest_size big integer 20G
Here come the question. I know that the db_flashback_retention_target parameter specifies the upper limit (in minutes) on how far back in time the database may be flashed back. I did a testing and below is the sequence of events.
DELETE FROM SCOTT.EMP WHERE ename = 'KING'; -- *12:13pm*
FLASHBACK DATABASE TO TIME = "TO_DATE('2013-03-25 12:12:00','YYYY-MM-DD HH24:MI:SS')"; -- *1:30pm*
Select count(*) from SCOTT.EMP where ename='KING'; -- *1:31pm*
COUNT(*)
1
From this simple test, I was able to flashback database to more than 60minutes ago despite my retention window being set at 60minutes. Is this due to the reason that I have a huge db_recovery_file_dest_size of 20G? Thus, I am able to go back in time for more than 60minutes? Thanks for the sharing.

Hi,
So do you mean that the retention target can be at about 59,60,61minutes or more depending on the fast_recovery_area space? So it actually fluctuates ~ ?No it does not fluctuate. fast_recovery_area is just a storage area for multipurpose use for backup, backup copy, archived redo logs and flashback logs etc, so don't confuse it with flashback retention.
flashback retention time is the time which Oracle will always ensure you the flashback of database. If set to 60 minutes, it means you will certainly be able to flashback your database atleast 60 minutes.
If your fast recovery area is free, Oracle will not delete flashback logs (and you might be able to flashback to even several days if flashback logs have not been deleted from fast recovery area). It will only delete flashback logs if fast recovery area has small space left in it.
Only when I set the guaranteed restore points , then it will always store at 60 minutes?See following for this concept
http://docs.oracle.com/cd/E11882_01/backup.112/e10642/flashdb.htm#autoId8
Salman

Relationship between groups and their members in LDAP directory missing

Similar Messages

Maybe you are looking for