REPOSITORY SYNC

Hello,
Currently we are working on configuration of LDAP AD on GRC(sp13) system.
Done with all the required configuration as per the recommendations by SAP.
But, while trying to perform repository sync getting error as" USER ADAPTER IS EMPTY".
I am able to search the users in access request form. But,when i select the user,the user details are not being populated automatically.
Our AD has has an upper limit of 1,000 entries, which is the maximum possible number of hits in a search request. The no.of user's I am trying to sync is more than 7000.
I tried changing the page size, and gave values as 100,200,500,1000 but it doesn't work out.
SAP Notes refereed are, 1823253,175567,1510286,584121.
Please suggest,what steps needs to be performed.

Hi Sai,
Can you confirm and follow these steps..
1. LDAP connector name should be identical as LDAP Server name. These have to be the same.
2. What string is used while searching users in LDAP. Execute LDAP tcode and find the users with default string. for example ...(&(objectclass=*)(samaccountname = a*)). If you have some different string to serach users, then we need to find out from LDAP team if they can set your searchable string as default.
3. Check whether Base Entry is maintained in LDAP tcodes for your LDAP server. If not, maintain that as well.
4. Refer to SAP Note "1755767 - Repository object sync from LDAP fails".
Following these steps will ensure that you have all the configuration as per recommendations.
You can refer to GRC10 LDAP as search data source
This must help you in resolving your issues.
Regards,
Ameet

Similar Messages

Sync/Async JMS without BPM - No receiver specified in message object

Hi All,
My scenario is Proxy - JMS - Proxy. I have chosen to do this without BPM and had followed closely to the instructions given in various help documents/blog/forum threads. During testing, the proxy returns a system fault 'No receiver specified in message object'. In RWB it indicates that the correlation is correct and the JMS Receiver adapter is getting the response, below is part of the audit log:
2009-08-03 18:12:32 Information WRB: retrieving the message for de80831d-97f5-08f1-bdaf-00145e6883af ...
2009-08-03 18:12:33 Information WRB: retrieved the message: ApplicationResponse
2009-08-03 18:12:33 Information WRB: leaving WaitResponseBean
2009-08-03 18:12:33 Information MP: leaving
2009-08-03 18:12:33 Information The message was successfully delivered to the application using connection JMS_http://sap.com/xi/XI/System.
2009-08-03 18:12:33 Information The message status was set to DLVD.
When I check SXMB_MONI in XI-ABAP, I see 2 messages with status 'System Error - Restart not possible' and 1 with status 'Log Version'. The message with status 'Log Version' is the respond. The other 2 messages has the following error:
<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
- 
- <SAP:Error xmlns:SAP="http://sap.com/xi/XI/Message/30" xmlns:SOAP="http://schemas.xmlsoap.org/soap/envelope/" SOAP:mustUnderstand="1">
<SAP:Category>XIServer</SAP:Category>
<SAP:Code area="MAPPING">NO_RECEIVER</SAP:Code>
<SAP:P1 />
<SAP:P2 />
<SAP:P3 />
<SAP:P4 />
<SAP:AdditionalText />
<SAP:Stack>No receiver specified in message object</SAP:Stack>
<SAP:Retry>N</SAP:Retry>
</SAP:Error>
It seem to me that the system does not know where to go/what to do next after returning to the JMS Receiver adapter. I am at a lost what could have gone wrong. Here is how I've done my configuration.
Repository
- Sync Sender Interface for R/3 Backend
- Sync Receiver Interface for MQ
- Async Sender Interface for the reply
Directory
- 1 CC for JMS Recevier
- 1 CC for JMS Sender (for the respond)
- 1 CC for Proxy Sender
- 1 Interface Determination
- 1 Receiver Determination
- 1 Receiver Agreement for JMS Receiver
- 1 Sender Agreement for the reply
Any help is appreciated. Thanks.

Hi Prateek,
This is what was tried in my first case. I did exactly what was given in that link.But since the Message id being 32 bytes and length of correlation id is 24 bytes id is getting truncated.
So its not working fine.
@ke i am having a look at the note will update you on this
Thanks for your response
Rgds
Aditya

LDAP user sync in GRC.

Hi Experts,
We are trying to configure LDAP AD on a GRC system(sp 13).
Done all the required configuration and field mapping.
Connector is working and able to login to LDAP server with system user.
LDAP connector name is same as LDAP Server name.
Base Entry is maintained in LDAP tcode for LDAP server.
But, not able to perform repository sync,showing error message as "USER ADAPTER IS EMPTY".
Not mentioned attributes for the connector in "maintain connector settings", do i need to maintain these to run repository sync.
Please suggest,
Thank you in advance.....

Dear Sai,
please follow the instructions below:
1. LDAP connector name should be identical as LDAP Server name. Please check if this is same?
2. What string is used while searching users in LDAP. Execute LDAP tcode and find the users with default string. for example ...(&(objectclass=*)(samaccountname = a*)). If you have some different string to serach users, then we need to find out from LDAP team if they can set your searchable string as default.
3. Check whether Base Entry is maintained in LDAP tcodes for your LDAP server. If not, maintain that as well.
4. Refer to SAP Note "1755767 - Repository object sync from LDAP fails".
Following these steps will ensure that you have all the configuration as per recommendations.
Regards,
Alessandro

GRC 10.1 SP06 - Role sync fails with dump DBIF_RSQL_INVALID_RSQL

Hi!
We're experiencing an issue with the repository sync job for one connector. When selecting the full option, the sync for users and profiles report success but for the role sync we get the error "Error in RFC; 'Error in module RSQL of the database interface'" and a dump is generated in the back-end ( DBIF_RSQL_INVALID_RSQL) with the program /GRCPI/CL_GRIA_ROLE===========CP
The problem occurs in the sentence:
>>>>>
SELECT agr_name parent_agr FROM agr_define
"#EC CI_SGLSELECT
   84
INTO TABLE lt_derived
   85 *
WHERE agr_name IN it_incl_role
   86
WHERE agr_name IN lt_incl_role
   87
AND ( change_dat GE iv_update_date OR
   88
( create_dat GE iv_update_date AND change_dat = '00000000' ) ).
We've tried working with the parameter 1122 (Batch size for Role sync) switching it to different values like 500, 100, 50, 10 and even 1 but the error still persists.
Synch for another connector with the same GRC System works fine.
any idea?
Thanks,
Diego.

Sounds like an old foe from 10.0
http://service.sap.com/sap/support/notes/1632421
You may have to ask SAP to make a 10.1 version of this fix for you to apply to the plug-in system.
There is a specific note for this issue in both 10.0 and 10.1, but it is part of 10.1 SP01 (you are on SP06)
http://service.sap.com/sap/support/notes/1803121

Best Way To Work Remotely

I am a java programmer who develops software on a remote linux machine (connecting from a local windows machine). For years I've been hacking away using putty-ssh and vi. Since I move around a lot and work in a number of different places throughout the week, I find it easier to keep all the work on the server. However, I'm slowly growing frustrated with the situation. Shell connections require fast, reliable internet connections... something I can't always have.
I was wondering if anyone had a better solution. I've tried setting up Samba on the server but it's a nightmare getting around office firewalls... not to mention the security risk of running Samba over the internet.
I'm all out of ideas. Can anyone suggest a better solution? It would be greatly appreciated.

You might want to try a repository/sync based solution such as CVS.
If you run a decent IDE to access CVS (I personally use Eclipse), it is a dream situation. You can work on what you need to locally, then check changes up to the main system. Eclipse/CVS takes care of resolving collisions for source files modified by two people at the same time.
Very nice, very convenient - and you don't even need access to the 'net while you are developing.
- K

Risk Analysis shows no Roles or Users!!

Hi Team,
Please can you help me, I am configuring GRC AC 10's ARA and I am stuck with the issue when I execute Risk Analysis on Roles or Users, I am getting blank field. No data is getting pulled up from backend system. Although my Repository Sync job finished successfully when I did it for User, Roles and Profiles.
Please can anybody help.
Thanks,
Nick

Hi Nick,
please check this thread: GRC AC 10: RAR - no analysis results, or document: GRC AC 10: RAR - no analysis results
Regards, Andrzej

GRC AC User Search Data Source Configuration

Hello all!
I´ve configured BRM and ARM as recommended on SAP Access Control 10.0. A lot of things are working ok and some of them not. At this moment I´m testing an Access Request to lock a user, the problem happens when I try to search the user, I didn´t receive any return. Please check the print screen:
"Maintain Data Sources Configuration" is configured as the print bellow pointing to our ECC/HR system:
Someone can help?
Regards,
SAP Legend

HI,
Also maintain detail data source and make sure you run repository sync job..
Also check if the user you are trying to lock is present in the table GRACUSER/GRACUSERCONN.
Regards,
Neeraj

10.1 Remediation View Issue

Hi Folks,
Am trying to use the remediation view in 10.1 when i encountered the below issue
1. Used the "Remove Role" option and ARM request was raised which went thorugh the stages fine.
2. The role was removed from the backend system and the ARM request status is Finished
But when i tried to add the role again and tried to run the analysis using remediation view the role appears but with no option to remove, rather it just says Remove role is in progress (Previous ARM request number is mentioned)
P.S: I have already run the Repository Sync.
Any help would be appreciated

Hi Ameet,
Thanks for the response. The Repository job ran successfully
Below is a capture of the SLG1 log and this the only error which has repeated. I am not sure whether its relevant

ZLM Secondary

We're about to deploy a secondary server in our Management zone, but I have a question about managed devices. Once we deploy the secondary server does ZLM manage the "load balancing" of those devices (similar to how ZCM works when you add another Primary server), or would we need to ensure devices are registered to the secondary once we reach our threshold on the primary? I searched the forums and documentation and didn't find anything specific to my query. Back end is an external Oracle db.
Thanks!

On Fri, 15 Oct 2010 16:36:04 +0000, blewis12 wrote:
> We're about to deploy a secondary server in our Management zone, but I
> have a question about managed devices. Once we deploy the secondary
> server does ZLM manage the "load balancing" of those devices (similar to
> how ZCM works when you add another Primary server), or would we need to
> ensure devices are registered to the secondary once we reach our
> threshold on the primary? I searched the forums and documentation and
> didn't find anything specific to my query. Back end is an external
> Oracle db.
There is no automatic load balancing in ZLM. You used a URL when you
registered the devices (see rug sl) and the devices connect to the server
that is behind that URL. You can configure DNS round robin for that host
name of the URL and then the device would use the primary and secondary.
We currently have a primary/secondary configuration and use the pacemaker
cluster to provide one high available ip address that is used to register
the devices. By doing that we still have all connections to that ZLM
server that currently serves that ip address, which is mostly the primary
ZLM server.
The problem in our case is that we build and upload our own linux
software into ZLM and then install it on the devices. When the package
was uploaded you would need to make sure the package repository sync to
the secondary has occurred befor a device on the secondary will be able
to install it. Otherwise it would report that the package was not found.
To prevent all those things we currently server about 550 server mostly
via the primary server.
But we will recheck this once ZCM 11 is releases and we migrate to it.
Rainer

FF Id from Target system, does not appear to be assigned

Hi All,
I have configured ECC as a Connector, and a FF id with below roles, in ECC. After Repository Sync, the table GRACUSER, shows FF id from ECC. However, while assinging Owner to FF id, the FF id from ECC, is not shown.
SAP_GRAC_SPM_FFID
SAP_GRC_FN_BASE
SAP_GRC_FN_BUSINESS_USER
Any clue, what needs to be done here

HI Plaban
What is your configuration parameter 4010 role? Is that role assigned to the FF Id (before you ran the sync)?
Did you set the owner up as an Access Control Owner first?
Have you checked to ensure you have sufficient authorization GRC to assign the FF Id?
Regards
Colleen

[Solved] pacman -Syyu sync's repository and then repoistory.db

For instance I run 'pacman -Syyu' and it will then sync core, core.db, extra, etra.db and so on a so forth for all the repo's in my pacman.conf. It did not sync the .db on my last install which was up to date unitl I just did a fresh install using the archboot iso. I looked through the pacman.conf a few times and did not see anything obvious wrong to me. <-- not saying much
I searched this section of the forum going back about 2 months figuring it has to do with signatures and found nothing. So i believe it means that either a) my last setup was incorrect. b) My searching skills are lacking.
If this is normal that is fine, it doesn't bother me, was just curous about it.
Cheers.
Last edited by doug piston (2012-07-27 04:52:08)

Sure and I apologize for the delay and not includung this information to begin with.
┌─[jarvis][watson][~]
└──╼ sudo pacman -Syyu
Password:
:: Synchronizing package databases...
core 107.7 KiB 146K/s 00:01 [-----------------------------------------------------------------------------------] 100%
core.sig 4.2 KiB 44.9K/s 00:00 [-----------------------------------------------------------------------------------] 100%
extra 1408.6 KiB 547K/s 00:03 [-----------------------------------------------------------------------------------] 100%
extra.sig 4.2 KiB 44.6K/s 00:00 [-----------------------------------------------------------------------------------] 100%
community 1765.5 KiB 762K/s 00:02 [-----------------------------------------------------------------------------------] 100%
community.sig 4.2 KiB 42.5K/s 00:00 [-----------------------------------------------------------------------------------] 100%
multilib 90.6 KiB 148K/s 00:01 [-----------------------------------------------------------------------------------] 100%
multilib.sig 4.2 KiB 45.6K/s 00:00 [-----------------------------------------------------------------------------------] 100%
:: Starting full system upgrade...
resolving dependencies...
looking for inter-conflicts...
┌─[jarvis][watson][~]
└──╼ cat /etc/pacman.conf
# /etc/pacman.conf
# See the pacman.conf(5) manpage for option and repository directives
# GENERAL OPTIONS
[options]
# The following paths are commented out with their default values listed.
# If you wish to use different paths, uncomment and update the paths.
#RootDir = /
#DBPath = /var/lib/pacman/
#CacheDir = /var/cache/pacman/pkg/
#LogFile = /var/log/pacman.log
#GPGDir = /etc/pacman.d/gnupg/
HoldPkg = pacman glibc
# If upgrades are available for these packages they will be asked for first
SyncFirst = pacman
#XferCommand = /usr/bin/curl -C - -f %u > %o
#XferCommand = /usr/bin/wget --passive-ftp -c -O %o %u
#CleanMethod = KeepInstalled
Architecture = auto
# Pacman won't upgrade packages listed in IgnorePkg and members of IgnoreGroup
#IgnorePkg =
#IgnoreGroup =
#NoUpgrade =
#NoExtract =
# Misc options
#UseSyslog
#UseDelta
#TotalDownload
CheckSpace
#VerbosePkgLists
ILoveCandy
# By default, pacman accepts packages signed by keys that its local keyring
# trusts (see pacman-key and its man page), as well as unsigned packages.
SigLevel = Optional TrustedOnly
# NOTE: You must run `pacman-key --init` before first using pacman; the local
# keyring can then be populated with the keys of all official Arch Linux
# packagers with `pacman-key --populate archlinux`.
# REPOSITORIES
# - can be defined here or included from another file
# - pacman will search repositories in the order defined here
# - local/custom mirrors can be added here or in separate files
# - repositories listed first will take precedence when packages
# have identical names, regardless of version number
# - URLs will have $repo replaced by the name of the current repo
# - URLs will have $arch replaced by the name of the architecture
# Repository entries are of the format:
# [repo-name]
# Server = ServerName
# Include = IncludePath
# The header [repo-name] is crucial - it must be present and
# uncommented to enable the repo.
# The testing repositories are disabled by default. To enable, uncomment the
# repo name header and Include lines. You can add preferred servers immediately
# after the header, and they will be used before the default mirrors.
#[testing]
#SigLevel = PackageRequired
#Include = /etc/pacman.d/mirrorlist
[core]
SigLevel = PackageRequired
Include = /etc/pacman.d/mirrorlist
[extra]
SigLevel = PackageRequired
Include = /etc/pacman.d/mirrorlist
#[community-testing]
#SigLevel = PackageRequired
#Include = /etc/pacman.d/mirrorlist
[community]
SigLevel = PackageRequired
Include = /etc/pacman.d/mirrorlist
# If you want to run 32 bit applications on your x86_64 system,
# enable the multilib repositories as required here.
#[multilib-testing]
#SigLevel = PackageRequired
#Include = /etc/pacman.d/mirrorlist
[multilib]
SigLevel = PackageRequired
Include = /etc/pacman.d/mirrorlist
# An example of a custom package repository. See the pacman manpage for
# tips on creating your own repositories.
#[custom]
#SigLevel = Optional TrustAll
#Server = file:///home/custompkgs
Also I was wrong it isn't repository.db but actually repository.sig

Eclipse XQuery expression validation failed: The current configuration is out of sync with the XQuery resource in the repository.

I created a wsdl based on a dbadapter in jdeveloper, imported into eclipse and created the biz and the proxy and uploaded to oracle service bus, it works fine,
but happens now that i need to have a xsd and wsdl with business names and not table names, invented to create a xsd and wsdl file in jdeveloper
and then went to eclipse and tried t xquery tranformation, but when i add the replace in the message flow in the filed in Variable : body and Expression i look for the xquery and in the binding trying to put
$body/input parameter, get the following error [RouteNode1, Replace action] XQuery expression validation failed: The current configuration is out of sync with the XQuery resource in the repository.
what im doing wrong or its configuration
thanks in advance sonia

thanks
ok have created a table with only in column varchar2(1)
then the type object and the procedure to insert it works the proxy in the osb if i test it inserts
now in jdeveloper i created an xml file with
<?xml version="1.0" encoding="windows-1252" ?>
<vessel>
<barco>a</barco>
</vessel>
then i created a xsd based on this xml, and a wsdl based on the xsd
in eclipse created a xquery transformation and selected source as the xsd created in adf and target the xsd input parameter, dont know why in the purple ball of the input parameter it puts a ?, an a f.
then in the proxy xpath not writing anything in variable body and in the expression select the xquery and in binding select the parameter

Managing impact of GRC10 portal repository object sync

Hello all,
Now that our repository object sync for the Enterprise Portal connection is (finally) working accurately again, we are again facing the issue of how to manage the impact, since the system is, for all practical purposes, not usable during that 3+ hours each day. We are considering locking out the users and posting the sync schedule on the portal page to remind users that they will be locked out. Is this what others are doing? If you have a better idea, I would be interested in hearing about it.
Thanks,
Gretchen

Hi Nitesh,
We worked on this issue for quiet sometime with SAP to get this finally fixed You can check all below mentioned notes.
First Check:
Please check the Note: 1915763 - Error Provisioning from GRC 10 to SAP Portal while adding or removing a role in Change Account request type.
This Note says that if your LDAP set as data source is read-only in Portal, then you need to change it to Modifiable in order to allow create or change user belonging to LDAP.
We have set the UME correctly and no longer read-only. But our access requests still used to fail with the following messages.
"Object class name does not exist in IDM".
Second Check:
Kindly ensure the field mapping for portal is done in IMG settings properly.
If it is fine please check below note 2033714 - AC10.0: error in SGL1 "Object class name does not exist in IDM".
This note is only to check if you have made any mistake with your portal mapping and doesn't address the correct issue.
Third Check:
Finally after implementing SAP note 1941250 - UAM: Truncated parameters provisioned on changing users from Access Request
our issue got fixed.
Regards,
Madhu.

User created but can't log into Portal. OID not in-sync with Repository.

Logged into Portal as portal
Go to Administ Tab
Created a group i.e. TestGroup
Created a user i.e. TestUser, put the user's default group as TestGroup.
I logged-out and and tried to log in as TestUser it doesn't let me log into Portal.
I do see the TestUser under TestGroup when going to Administer Tab and checking it, but some how can't log-in. I tried to use wwsec_api.user_in_groups to print the group names using SQL-Navigator but it never returns anything for the user I created above.
username := 'TestUser';
groupid := WWSEC_API.USER_IN_GROUPS(p_user_name=>username);
..........Now if if try the following and use portal it returns me all the groups the portal user is in i.e.
username := 'portal';
groupid := WWSEC_API.USER_IN_GROUPS(p_user_name=>username);
..........Looks like OID and repository are not in-sync. Can someone give some in-sight why is this happening and what can I do to fix this. I even tried adding the user under some other groups but still never returns me the groups when I run the above PL/SQL.
Thanks

Under Administer -> SSO/OID Tab I have Enable directory synchronization is checked. But still can't log in. Any ideas.
Thanks

Repository Browser inactive Sync

Hi guys, I´m new using NWDI, specially using DTR and any info about the use of it specially from sync will be appreciated.
The issue that I have is that in NWDS in the Repository Broswser in the inactive version I had the correct src files, (Previously created by other guy), and in the active version the standard src files for e-commerce. The mistake I do is to "Sync preview" in the inactive node, then all the src files dissapear and I get a "copy" of the active node, so I need to recover the initial state of the inactive node.
I tried Sync to date, but nothing happens. Is there anyway to recover this src files ?

Hi, thank you for your reply, I have the dc´s backup, this backup is in other computer in the inactive node and in the local dc´s, I don´t know why or how the inactive and the active versions are different, I think the past administration doesn´t sync this, so, I have the backup in the inactive node, so, is the only way to upload this to the active version is by creating new activities ??? or can I make a migration of the src files folder to folder ? thanks.
Edited by: Isaac Mena on Dec 9, 2010 4:29 PM

REPOSITORY SYNC

Similar Messages

Maybe you are looking for