SAML AS JAVA user mapping. Can table VUSREXTID On AS ABAP be leveraged?

The documentation on the SAML AS java user mapping refers to Mapping SAML Principals to SAP J2EE Engine User IDs - User Authentication and Single Sign-On - SAP Library custom development. In my case the users are managed on the AS ABAP system. Can I leverage the ABAP mapping mechanism using VUSREXTID, similar to the user mapping on the ABAP AS Mapping SAML Principals to AS ABAP User IDs - User Authentication and Single Sign-On - SAP Library without building my own java program?

We have developed a login module which is working with Kerberos auth, not x.509 auth, but still solves a very similar problem to the problem you are describing. As you know, when SNC is used to logon to ABAP stack, the SNC name of the user is mapped onto a SAP user via entries in the USRACL table. Our mapping login module takes the authenticated user principal name from the shared state and uses this to lookup the entry in USRACL table on ABAP stack, and from this it will know which SAP user to use, and can update shared state with this info so that CreateTicketLoginModule will created an SSO2 ticekt for the mapped SAP user id.
This means that mapping of users externally authetnicated identity onto SAP user/client can be managed in one place, e.g in ABAP stack using USRACL table entires and su01 t-code etc.
I know it is not exactly what you wanted, since you are looking to use x.509 certifiates instead of Kerberos authentication, but I thought it was worth sharing so that you know the concept has already been implemeneted many times. Many of our customers use this login module when they have our product, for the same reasons that you have stated.
Thanks,
Tim

Similar Messages

Error: java.util.map can not be inherited with different arguments

Hi,
I am getting following error while building the source code.
C:\venus\src\com\martquest\messaging\msgio\MqMessageIOObjectCarrier.java:36: java.util.Map cannot be inherited with different arguments: <> and <java.lang.Object,java.lang.Object>
[javac] public class MqMessageIOObjectCarrier extends Properties implements IMqMessageIOObjectCarrier
What should I do to resolve this issue?
Thanks
Prachi

Hi,
I am getting following error while building the
source code.whose source code? If it's yours, you'd better look at where you are defining and using Map. The error code tells you exactly what's wrong.

User mapping certificate in UME (J2EE) with ABAP system as Backend (SNC)

I hope someone can help me with the user mapping concept (X.509 V3 certificates) for both "worlds" (ABAP and JAVA Stack).
I know how to install and configure certificate based (X.509) login to SAP ABAP and SAP JAVA (J2EE) Stack (--> enable encryption for communication and Single Sign On).
Situation:
We have a ready installed and configured X.509 certificate authentication environment for the ABAP world (between SAP GUI and SAP Server System)
and the user mapping was configured in the ABAP System (SU01). As the users are using certificates, the passwords are deactivated on the ABAP System.
Now if you want to integrate a JAVA (J2EE) Sytem and you want to configure the UME to the ABAP System (as Backend), you have an administrative effort problem with the user mapping (X.509) in the UME configuration.
1.) It is possible to assign manually the user public key to every user --> But to much effort
2.) As the user does not have a password (deactivated in the ABAP system), the way to combine the automatic mapping with a user login does not work.
3.) In the distinguished name of the user certificate there is no information about the SAP username itself
--> you are not able to use any information of the DN to bind a user in the Login Module configuration.
Now my question:
Is it possible to use the sncname information from the ABAP System (still configured and available) for the UME configuration?
As i know, it is possible to write an own Login Module. Does anybody has a customized Login module for this issue?
At the end the best solution would be to enable the same user mapping mechanism on the JAVA world as on the ABAP world. --> Mapping the Distinguished Name to the SAP User

We have developed a login module which is working with Kerberos auth, not x.509 auth, but still solves a very similar problem to the problem you are describing. As you know, when SNC is used to logon to ABAP stack, the SNC name of the user is mapped onto a SAP user via entries in the USRACL table. Our mapping login module takes the authenticated user principal name from the shared state and uses this to lookup the entry in USRACL table on ABAP stack, and from this it will know which SAP user to use, and can update shared state with this info so that CreateTicketLoginModule will created an SSO2 ticekt for the mapped SAP user id.
This means that mapping of users externally authetnicated identity onto SAP user/client can be managed in one place, e.g in ABAP stack using USRACL table entires and su01 t-code etc.
I know it is not exactly what you wanted, since you are looking to use x.509 certifiates instead of Kerberos authentication, but I thought it was worth sharing so that you know the concept has already been implemeneted many times. Many of our customers use this login module when they have our product, for the same reasons that you have stated.
Thanks,
Tim

Table name in Oracle for the User Mapping field?

Does anyone know the table name for the user Mapping field in EP6.0?
Thanks

Hi Alan,
why do you want to access the DB directly?! You can access the information via the Java API, which is in general the most secure way for the DB scheme is always "subject to change without notice"...
Best regards
Detlev

Question about Logon ticket with user mapping at BI-JAVA environment

We're implementing BI 7.0 including BI Java and SAP EP for end user
access.
I have two question about SSO method when we're using BI Java.
I know we can simply configure SSO logon ticket with BI-Java(EP
included) and BI-ABAP through BI template installer and we already
succeeded in that case.
But the problem is we want to change it to user mapping SSO method for
some our internal reason.
After we configure user mapping SSO, we've got SSO failed error when we
call BI-Java stuff like BEx Web Application iView.
After many testing implemented, we found SSO Logon ticket with user
mapping (using SAP reference system). It seems working now.
But our question is "Is it no problem when we use SSO logon ticket with
user mapping?" Is there any restriction or issue?
One more question is we can ONLY use user base mapping when reference
system used. How can we assign BI-ABAP users to EP Group?

Using an SAP Reference system is allright. But if the reason u r going for this is because of different usernames in EP and BI, why dont you go for user mapping.
Anyways, on restriction of reference syetms is that you can have ONLY ONE reference system defined in portal. In you case you can only have the BI system defined.
Hope this helps!!

User mapping when installing JAVA addin for ABAP

Hi,
I have installd SAP ABAP on a domain.
As the ABAP went fine and successfully gets installed.
When I am installing JAVA addon for ABAP it is throwing an error lke the users are not mapped.
So can any one guide me where actually I should map the SAP users in a domain.
Prashanth

Your question is very vague, please post the full error.
As this is a java add-in it should user ABAP as datasource so no user mapping should be required.
User mapping is used where java and backend system use different datasources and the naming conventions are different...
Theres not enough information here to give you an objective answer.
Regards
Juan

Java user-defined function for mapping a complex structure

All,
Hope one of you can help me with this. I have a structure with over 15 fields and would like to concatenate all the fields into one target field and while I do this, I need to ensure that each field is padded with blanks as defined the data type. Can one of tell me if this is possible with a java user-defined function and if so, what type of logic is needed.
Input_MT
Field_1 string len=10 "need"
Field_2 string len=6 "java"
Field_3 string len=7 "help"
Field_4 string len=8 "asap"
etc,
Output_MT
DataOut string "need java help asap "
(for some reason the exact spaces in between the words disappear in my Preview message)
I have several fields in the input mt and therefore I find graphical mapping using concatenate and my own user defined function padWithSpace too messy.
Thank you for you help.

Hi,
If your final req is to write all these fields next each other in a file, you can configure this in receiver file adapter by specifying the fixed length for each field.
If you want the padded string as your MM o/p, you can create a simple user defined funtion with 15 fields as input and 15 constants for their lengths, and find out the length of the each string and pad it with required no of spaces.
int max_len = 10;
int actual_len;
actual_len = a.lengh();
for(int i=0; i < (max_len-actual_len; i++)
a = a.append(" ");
return a;
praveen

Java code to get user mapping info

I am writing a Java Servlet that needs to read the username and password to a user mapping system. Can anyone post a code example that will accomplish this? I have already been looking through the forums, so please don't post links to other forum entries.

hello Pfister,
I'll send you one article link , just go thru it ,
you can many examples from basics. if you get any errors just take that error no. which displayed , you can find the solution for that error in the link.
This link you can see one good example:
http://www.onjava.com/pub/a/onjava/excerpt/java_cookbook_ch18/index.html?page=5
Regards,
Varun

Profile to User mapping table in 4.6

Hi Guys,
Can anyone please let me know if there exists a table that shows User to Profile mapping in 4.6

Hi Prakash,
Thanks for the quick reply.
Unfortunately the profiles to user mapping i am looking is SAP Standard(ex:SAP_ALL, SAP_NEW,,,,etc).
And these profiles are not present in roles.
So AGR_PRO and AGR_Users is not going to help in this case....
Any more thaughts around...

How can I see in what maps some table is used?

Hi,
Anyone can tell me how can I see in what maps some table is used, without open all of then?
Thanks,
Gustavo.

Good morning Gustavo,
OWB has some public views defined which can provide you with this information. Check Appendix D (Warehouse Builder Public Views) of the OWB User Guide for all info.
Log in as the owner of the design time repository, if you run the following query you'll have a basic overview of whic table is used in which mapping:SELECT MAP_NAME         MAPPING_NAME
,      DATA_ENTITY_NAME TABLE_NAME
,      BUSINESS_NAME    TABLE_OPERATOR_ALIAS
,      DESCRIPTION      TABLE_OPERATOR_DESCRIPTION
FROM   ALL_IV_XFORM_MAP_COMPONENTS
WHERE DATA_ENTITY_TYPE = 'TABLE'Good luck, Patrick

Seeburger Splitter:Fatal error in user mapping . java.lang.StackOverflowErr

Hello,
I have created a mapping E2X_SLSRPT_UN_D96A as we didnt have the standard mapping(See_) from Seeburger
In my scenario when I give hardcoded mapping name ,it works fine,so I assume mapping is correctly created and deployed.
But I need to use it with splitter,and in doing so,I am getting this error:
Message initiation failed: Adapter call failed. Reason: --- Conversion of synchronous request from module chain ended with errors ---Error: [Error:ID=not set;LEVEL=1] Fatal error in user mapping ... java.lang.StackOverflowError at com.seeburger.jucon.dochandler.SegmentDescription.semanticCheck(SegmentDescription.java:444) at com.seeburger.jucon.dochandler.SegmentDescription.semanticCheck(SegmentDescription.java:460) at com.seeburger.jucon.dochandler.SegmentDescription.semanticCheck(SegmentDescription.java:460) at com.seeburger.jucon.dochandler.InhouseDocReader.doSyntaxCheck(InhouseDocReader.java:1555) at com.seeburger.jucon.dochandler.InhouseDocReader.moveNext(InhouseDocReader.java:1852) at com.seeburger.jucon.dochandler.EdifactDocReader.moveNext(EdifactDocReader.java:457) at com.seeburger.jucon.dochandler.InhouseDocReader.moveNext(InhouseDocReader.java:1859) at com.seeburger.jucon.dochandler.EdifactDocReader.moveNext
My splitter configuration is :
classifier     classifierMappingID     Abc
classifier     destSourceMsg     MainDocument
classifier     showInAuditLog     true
bic     destSourceMsg     MainDocument
bic     destTargetMsg     MainDocument
bic     logAttID                          ConverterLog
bic     mappingName     AUTO
bic     saveSourceMsg     ORIGINAL_EDI
bic     split     true
splitter     mode     ASYNC
splitter     transaction     MESSAGE
The same configuration works fine with ORDERS message.
Also,I have configured same mapping name in Splitter section in Seeburger Workbench.
Has anyone encountered this error before?
Kindly let me know
Thanks.
Regards,
Shweta

Hi,
    I understand that you need to use Custom mapping for your EDIFACT Message...
Then did you created the generic mapping with Clasasifier ID...i.e ABC_edifact... (By default it will be See_Edifact)
so you need to create the generic mapping by Name provided in classifier ID of settings then....
need to create the child mapping in such a way that it calls the same (developed one...)
in default cases See_Edifact frames the child mapping name to be called based on the messages received ...
similarly your generic mapping need to call your child mapping....
Hope this clears you
Rajesh

How can i use exisitng user data(Id, password) for user mapping

Hi All,
For User mapping , we can import user mapping data for many users from user administration. and for each user
we can maintain mapping data in the standard format.
eg:
[User]
uid=user2
$usermapping$:BCE:user=ext_user2
$usermapping$:BCE:mappedpassword=password
i am clear till this point.
this all works if we know the userid and passowrd on the system 'BCE'.the passwords on the system 'BCE', are encrypted . so there is no chance for me to know the passwords.
so how can i use the existed userid/passowrd on the system 'BCE' for the mapped user and mapped password on the portal while doing usermapping.
Thanks in Advance,
Lakshmi

Hi,
I think this should work.
1. Setup SSO with SAP logon tickets first. How to do this is described many places, e.g. http://help.sap.com/saphelp_nw04/helpdata/en/d3/41c8ecb31d11d5993800508b6b8b11/content.htm
This SSO will not work at first, because the username is different in the back-end system. So what you need to do is to get the back-end username into the ticket (don't need a password because that is done by the SAP logon ticket)
2. Create a portal component which uses the usermanagement API to create a usermapping which only consists of the username and a blank password. You can do this manually I think if you have no reference system defined.
IUserMappingService umap =(IUserMappingService)PortalRuntime.getRuntimeResources().getService(IUserMappingService.KEY);
//this is the currently logged in user. You might another user
IUserContext user = request.getUser();
//Get the existing data (think it can be null)
IUserMappingData userMapping=umap.getMappingData(systemAlias, user);
HashMap map = new HashMap();
                         map.put(IUserMappingService.UMAP_KEY_USER, backEndUserName);
//add blank password               map.put(IUserMappingService.UMAP_KEY_PASSWORD, "");
//store the values                    userMapping.storeLogonData(map);
Voila, this should allow you to do SSO using SAP logon tickets, but with another name that you use against the portal. I am uncertain if this will work if you have multiple usermappings in the sap logon ticket
PS since the sap logon ticket is issued at logon time, you need to relogon to get the changes done by the code
Regards
Dagfinn

Java api: User mapping information

Hi all,
is it possible using Java Api to read User mapping information.
I need user name my portal user mapped to.

found an answer: Re: Getting User ID and Password Mapped to the Users

I want to write a java program that can add a user to a role or sub role to the Profile Database in iPlanet Portal Server 3.0. Does anyone has any idea or a sample program do such thing. Thanks, Tommy

I want to write a java program that can add a user to a role or sub role to the Profile Database in iPlanet Portal Server 3.0. Does anyone has any idea or a sample program do such thing? Thanks, Tommy

// create the user profile, get the handle back,
// and set the membership profile attributes.
ProfileAdmin newProfile = null;
try {
// the users profile name is the domain
// he belongs to plus their userName
// you will request.domain if your doing this from a servlet, domain_name is the domain_name the user belongs too
String profileName = domain_name + "/" + user;
     if (debug.messageEnabled()) {
debug.message("creating profile for " + profileName);
// create the user profile object
newProfile = ProfileManager.createProfile(
getSession(), profileName ,Profile.USER);
UserProfile userProfile = (UserProfile)newProfile;
     // set the role the user is a member of. Default is to set
     // the users to the default role of the domain they surfed to
     StringBuffer roleName = new StringBuffer(64);
// request.domain instead of domain_name if your doing this from a servlet ..
Profile dp = getDomainProfile(domain_name);
roleName.append(dp.getAttributeString("iwtAuth-defaultRole"));
     if (debug.messageEnabled()) {
debug.message("setting role for " + user + " = " + roleName);
userProfile.setRole(roleName.toString());
newProfile.store(false);
} catch (ProfileException pe) {
     debug.error("profile exception occured: ",pe);
return;
} catch (ProfileException pe) {
     debug.error("login exception occured: ",le);
return;
HTH ..

BW WAD is giveing java error due to duplicate user mapping

Hi,
In BW WAD is opening with some user IDs successfully.But for some user IDs it is giving jav error.
BW and portal integration is correct and SSO also configured properly.The problem is duplicate usermapping.How to find out ABAP ID is mapped to usermapping to java user vice versa.
Regards,
ARNS.

Hi,
In BW WAD is opening with some user IDs successfully.But for some user IDs it is giving jav error.
BW and portal integration is correct and SSO also configured properly.The problem is duplicate usermapping.How to find out ABAP ID is mapped to usermapping to java user vice versa.
Regards,
ARNS.

SAML AS JAVA user mapping. Can table VUSREXTID On AS ABAP be leveraged?

Similar Messages

Maybe you are looking for