SAPGUI and Portal Authentication using AD Credentials with usr/passw prompt
Hi Experts,
We have the following requirements:
1. Portal/EP has UME set to ABAP (in other words using ECC6 system's user/password).
2. ECC6 user-id's differ from Active Directory user.
3. User logs in to Active Directory.
4. User wants to log on to SAPGUI (ECC6 system), with a user-name password prompt, using the Active directory Credentials.
5. User wants to log on to Portal/EP, with a user-name password promt, using the Active Directory Credentials.
The following suggested solution was the closest to the requirement (without to much technical detail):
1. For SAPGUI, implement SSO on the workstation GUI's and maintain the Active Directory user in transaction SU01 in the ALIAS field.
This should enable the user to, after having logged onto the Active Directory, to open the SAPGUI and WITHOUT user-name password prompt, be authenticated and logged into SAP. This would entail settings to be done on each workstations GUI.
2. For the Portal/EP, implement Kerberos on the portal, setting it to authenticate to the AD. As per note 935644 maintain an additional attribute on the UME, to enable the mapping between the UME and the AD users.
This should enable the user, after having logged onto the Active Directory, to open Internet Explorer, go to the Portal URL, and be authenticated and logged into the portal, without WITHOUT user-name password prompt.
Do you know the viability of this solution, or whether there is any better suggestion (especially to keep the user-name password prompt, and without changing the ECC6 or Active directory users).
Regards.
AJP,
The description you have given is an exact description of the capability of our product. I represent a company called CyberSafe, and our products are designed and sold to SAP customers for integrating the SAP user authentication with Active Directory authentication. We have some unique features in our product which you could benefit from, e.g. our SAP GUI SNC library has the ability to popup a logon screen asking user for Active Directory account and password before it logs the user onto SAP. Also, when the SAP system has authenticated the user, either via the Web browser or via SAP GUI their Kerberos principal name (determined from AD account name and domain) is mapped onto a SAP user using a table in the ABAP system. The browser authentication even uses this same table for mapping so that an authenticated account name does not need to be same as the SAP user they log onto.
If you would like to discuss our product more, and/or arrange a free evaluation please contact me using the email address in my SDN business card.
Thankyou,
Tim
Similar Messages
-
I bought the iphone 4s about a year ago, he was not new. The seller told me that he did the factory unlock, but he lied. Now I live in Russia and want to use the iPhone with a local GSM sim card. Serial number (removed), IMEI (removed). Thank you!
Personal info removed to comply with the Verizon Wireless Terms of Service
Message was edited by: Admin ModeratorEdge has very clear restrictions, one being that you must have 6 months of clean payment history which you don't. Either wait until April 14, or good luck at Sprint.
I am unsure how it can be determined the payment mix up was the fault of CS, but regardless, the mix up was done. There can be any number of reasons why a payment could be missed without any fault on your part, however you are still the responsible party for the account and must live with the repercussions. -
Trying to get t my email, this comes up: We are sorry, but you will need to enable cookies and Javascript to use your Username with this site.
How do I do this?
George Szanto<br />
[email protected]see similar question answered at https://support.mozilla.com/questions/836913
To be notified of updates to a question whether it is your problem or not simply click on the "Get email notifications" and follow directed choice. Only the original poster can mark as solved, so there should be a slight difference in choice as an original poster and where you latch onto another question. The notifications only apply to the specific question where entered. -
How do i update my camera raw? I can not find the download update I've just brought a new d4s and I'm using the iMac with cs6 version. PLEASE HELP..
The Adobe auto updater is pretty decent in CS6. Just go to the Photoshop Help menu > Updates.
You will be able to update ACR, Photoshop and Bridge right there, if there are in fact updates available. -
My partner has the Iphone 5 and I am using a MacBook with version 1.0.2. When using the face time app to call him he says that cam freezes and he is unable to hear me. Any ideas of the problem and and ideas for resolving the issue?
Had the same problem, the only fault and the reason why it happend is a bad wifi connection!
Could ofc be something else, but thats my two cents! -
Dear Sir/Madam,
Adobe acrobat claims that there is an update.
However the update process is very flaky and unreliable.
Very poor service, with useless update prompts.
System report is attached.
Please fix the update, before advertising useless prompts for updates, for paid versions.
ThanksNothing is attached.
You should also be aware that there are a number of scams and malwares claiming fake updates.
Please post your report and tell us exactly what product and exact version you have.
And be aware you aren't talking to Adobe. -
Portal authentication using two login module stacks?
G'day,
I am noticing something odd when I authenticate to the portal: there are two login module stacks used.
Background: I have created a custom logon page, which is basically a form with username/password input as per [this guide|http://help.sap.com/saphelp_nw04/helpdata/en/62/601e1eebf54ca6a97e2873c8c63517/content.htm|Changing the logon screen]. I then modified the authschemes.xml file by defining a new authscheme "mylogon" that uses my own login module stack ("mystack") and uses the new logon page ("mylogonform"). This new authscheme is then made the default reference:
<authscheme name="mylogon">
<authentication-template>mystack</authentication-template>
<priority>21</priority>
<frontendtype>2</frontendtype>
<frontendtarget>com.foo.bar.mylogonpage</frontendtarget>
</authscheme>
<authscheme-refs>
<authscheme-ref name="default"><authscheme>mylogon</authscheme></authscheme-ref>
<authscheme-ref name="UserAdminScheme"><authscheme>mylogon</authscheme></authscheme-ref>
</authscheme-refs>
When I want to access the portal, up pops the "mylogonform" page, and on clicking the "submit" button the portal page for the user is shown.
Now here is the interesting thing: when the "ticket" login module stack is unchanged (ie. it uses the BasicpasswordLoginModule), then the log shows that authentication to the portal uses just my login module.
This can be seen as follows, where I navigate to the portal, logon as one user, then logoff and logon as another user:
Message : LOGIN.OK
User: tu-1
Authentication Stack: mystack
Message : LOGOUT.OK
User: tu-1
Authentication Stack: mystack
Message : LOGIN.OK
User: Administrator
Authentication Stack: mystack
The "mylogonform" page is shown when logon is required in both cases.
However, if I modify the "ticket" login module stack by replacing the BasicPasswordLogonModule with a custom logon module that does automatic authentication, then the following is observed when the "mylogonform" page is displayed:
Message : LOGIN.FAILED
User: N/A
Authentication Stack: ticket
Message : LOGIN.OK
User: tu-1
Authentication Stack: ticket
For some reason, the modified "ticket" login module stack is now being executed, which was not the case when this login module stack was unmodified.
This stack automatically authenticates the current user (the initial failure is because the new login module asks the browser to send authentication data), and this "failure" causes the logon form to be displayed.
I can logon to the portal as the same user, and the logs show that "mystack" login module stack is used:
Message : LOGIN.OK
User: tu-1
Authentication Stack: mystack
Logoff shows that "mystack" is used for the actual logoff, but "ticket" is called again automatically and succeeds:
Message : LOGOUT.OK
User: tu-1
Authentication Stack: mystack
Message : LOGIN.FAILED
User: N/A
Authentication Stack: ticket
Message : LOGIN.OK
User: tu-1
Authentication Stack: ticket
(Again, the initial logon failure is the new login module requesting that the browser send authentication data in the next request).
This brings up the "mylogonform" page, even though it appears that a user has already been authenticated. If I try to logon as another user, the following is shown:
Message : LOGIN.FAILED
User: Administrator
Authentication Stack: mystack
Login Module Flag Initialize Login Commit Abort Details
com.sap.security.core.server.jaas.EvaluateTicketLoginModule SUFFICIENT ok exception false true authscheme not sufficient: basicauthentication<mylogonform
Central Checks exception Call logout before login.
I guess one cannot authenticate as a new user until the current user has been logged out.
So ... why does the "ticket" login module get called in the second case, but not in the first case (or only shows logging in the second case) ?
What is the logic behind portal authentication and showing a logon page?
If I want to use custom authentication and a custom logon page, why is the "ticket" stack called at all?Jayesh,
there is no such thing like "login module stacks". The <b>do</b> exist on the other hand:
- login module
- logon stacks
Login module and logon stacks are part of the JAAS concept for defining a complex pluggable authentication scheme, original by SUN (see: java.sun.com/products/jaas)
A logon process is defined by a logon stack which itself consists of several login modules. Each login module performs an authentication step. Example:
login module 1: check if valid sap logon ticket provided
if module 1 fails: then login module 2: request user id/password
if module 2 succeeds: then login module 3: create new sap logon ticket for user
You can define multiple logon stacks and configure individual applications to use the one stack or the other.
The logon stack configuration is done using visual administrator. Here select the security provider service for configuring logon stacks.
btw: As logon stacks are "java-only", there are no transaction names (which only exist on Web AS ABAP).
Regards,
Dominik -
Oracle 9i/10G DB authentication using Active Directory (with out OID)
Hello All,
We want to use a Single-Password authentication scheme using the Active
Directory as the primary source for userId/Password.
We don't want to use the Active Directory and OID bridge.
As we have many databases and would like to configure all Databases to use Active
Directory for Authentication. Our goal is to have single id/password across all
the databases and any user should be able to login from any computer using their
windows id/password, note that we don't want to use the OSAuthentication.
We have read the documents provided by oracle for authentication using Active
Directory, we were able to create Oracle Schema in Active Directory and were
also able to register a DB with Active Directory and then created user as global
user in Oracle Database and provided the DN of the user. When we tried
authenticate with all this setup it comes back and says invalid ID/Password !!!
And with 10G database we get the Oracle Error ORA-03113: end-of-file on communication channel !!
Has any one tried or have information on Integrating Oracle to Auth against Active Directory?
Envoirnment:
Oracle DB Version: 9.2.0 and also tried on 10.0.1 with same results
Operating System: Windows 2000/ Windows 2000 Server
Constraint: We don't want to user OID ( as we don't have license for this
product ! )I have a thread started similar to your request.
OS Authenication on Windows
Somewhere I read this. It works on Oracle 9i on Linux, but I have not tried it with Oracle 9i on Windows.
SHOW PARAMETER OS_AUTHENT_PREFIX;
SHOW PARAMETER REMOTE_OS_AUTHENT;
CREATE USER OPS$SOMEUSER IDENTIFIED EXTERNALLY;
GRANT CREATE SESSION TO OPS$SOMEUSER;
For the username, I wonder if we are supposed to put the Windows Domain name as part of the username? Such as, for a Windows domain user MyDomain\SomeUser
CREATE USER OPS$MYDOMAIN\SOMEUSER IDENTIFIED EXTERNALLY;
I really wish Oracle or somebody created a guide or book on how to do this. -
Portal Authentication using Active Directory
I am trying to set up authentication using Active Directory. Can anyone provide me with instructions on what to do ? I know that I have to go to System Admin - > System Configuration - > UM configuration and change the Data Source. What else do I need to do...How do specify which domain to authenticate against. Do I have to change the XML file. Please help.
It depends on what you wanna do with the AD server. If you want to read/write on the AD then you have to first setup SSL connection between the two boxes.Else if you just want to read from AD server you don't require a SSL connection. Then you have to select the hierarchy type in the System Admin - > System Configuration - > UM configuration. Save.
Next thing you do is to open the config tool and modify your xml file accordingly.
And restsart the server.
Hope this helps.
Regards,
Hassan -
Pros and Cons of using JBDC Adapter with XI
Hi Experts,
Can somebody help me understand pros and cons in using different JDBC adapters with XI?
I would be really greatful to you.
Thanks & Regards
GopalHai,
Go through the links:
/people/varadharajan.krishnasamy/blog/2007/02/27/configuring-jdbc-connector-service-to-perform-database-lookups
http://help.sap.com/saphelp_nw04/helpdata/en/44/f565854b7341e6e10000000a1553f6/frameset.htm
Regarding JDBC Adapter in SAP XI
Configuring File and JDBC adapters
Thanks,
Rajani. -
32bit and 64bit Apps using Crystal 2010sp1 with a recordset
Hi
I'm using Crystal 2010sp1 with VS2010. I have some code that I did not write, which obtains a recordset and passes that to the ReportDocument. It then goes on to .Export() the report.
When my app is compiling as 32bit the .DataSourceConnections on the ReportDocument contains 1 item with the following properties:
DataBaseName=""
DBConnHandler=0
IntegratedSecurity=False
LogonProperties = { "ADO.Net DataSet Object", "0,4AFECC" } { "ADO.Net DataSet Object", "0,4AFECC" }
{ "Internal Connection ID", "2e3b2f7f-0c31-472a-9773-f301a7ba9a3e" } { "Internal Connection ID", "2e3b2f7f-0c31-472a-9773-f301a7ba9a3e" }
Password = ""
ServerName = "NewDataSet"
Type = CRQA
UserID = Nothing
And it exports perfectly!!
When compiled as "Any CPU" and running on a 64bit machine, the properties are:
DataBaseName=""
DBConnHandler=0
IntegratedSecurity=False
LogonProperties = { "Field Definition File", "BL_Extras.ttx" } { "Field Definition File", "BL_Extras.ttx" }
Password = ""
ServerName = "D:\EntaV4\ENTAReports\rpt\BL_Extras.ttx"
Type = CRQA
UserID = Nothing
And the export fails with the exception:
"Failed to load database information. Error in File BL_Extras {9D634275-70C4-42E8-B7EE-C2A69C0CDD2B}.rpt: Failed to load database information."
Why under 64bit is Crystal setting different connection details? And where is it getting the path for the ttx file in the ServerName property, my app and report are on my C drive in a totally different location. That folder on D had never existed on my machine.
I do happne to have the ttx file for this report, but putting it next to the rpt or in the above path makes no difference. I don't have the ttx for other reports though anyway and running as 32bit it works even if I delete the ttx though.
I have searched the error and found several pre-SP1 and non-recordset scenarios. I also read a little about create XML files for the reports but that is going to be too much work as there are hundreds of reports. It's not a lack of a 64bit ADO driver is it?
I thought i'd ask here for other solutions before I step back in time 10 years and make this app 32bit only.
I'm pretty sure this all worked on 2008 with CR2008.....I exported the data as XML from my datatable like you said. I did it both running as x64 and x86, the output was the same.
I thought i'd eliminate any bad code that might be in my main app by writing a little test app that loads that xml and drops it in a viewer control. I started a new project in VS, added a form with the Crystal Report viewer. I then wrote code to load the rpt file, and read the xml into a dataset, and then setdatasource on a report object to the first table of that dataset (which is what my main app is doing).
Dim crReportDocument As New ReportDocument
Dim filePath As String
Dim ds As DataSet
filePath = "c:\64crystal.xml"
ds = New DataSet()
ds.ReadXml(filePath)
crReportDocument.Load("C:\inetpub\wwwroot\SchedulerManager\rpt\BL_Extras.rpt")
crReportDocument.SetDataSource(ds.Tables(0))
CrystalReportViewer1.ReportSource = crReportDocument
Running it in x86 I am prompted for some parameters that the report required, and then the report renders in the viewer perfectly, no problems.
Running this app in x64 prompted me for the parameters, and then I get a msgbox saying:
Failed to load database information
Error in File BL_Extras {CD6C5C52-744C-433E-9297-87ECC3834262}.rpt:
Failed to load database information.
So then going back to what you asked, I went to the viewer control and click 'choose a crystal report' I get a 'Bad forumula result' error. If I select 'Create a new Crystal Report' and then 'From and existing report' and select the rpt file i'm working with. It then shows the rpt file in the VS designer with all the fields and sections and looks fine, though returning to the viewer gives the 'Bad Formula result' again. Seem to get this on several reports so am assuming its just because there is no data yet.
On this report now in my project I went to set datasource location and selected the XML it then shows NewDataSet with Table under it in the treeview. The update button is disabled if i select the table. If I select the dataset and click update it tells me:
"Some tables could not be replaced, as no match was found in the new data source. Please specify the table required for any unmodifeid tables". The top pane of this window is showing the file details of the ttx that it thinks is located on the D drive.
If I go to database expert and move the table over it then prompts me to find the ttx file. It doesn't let me skip this so I give in and tell it where it is. I then get the link tab. It shows the ttx with 23 fields and my xml table with 27 fields. It has 11 fields linked automatically,
A comparrison of the ttx and XML in notepad shows the following, the bold fields are the ones that did not auto link.
DateOption, ttx:Number, xml:unsignedByte
StartDate, ttx:dateTime, xml:dateTime
EndDate, ttx:dateTime, xml:dateTime
VenueGroups, ttx:Memo, xml:string
Profiles, ttx:Memo, xml:string
Users, ttx:Memo, xml:string
Extras, ttx:Memo, xml:string
RepGrouping: ttx:Number, xml:unsignedByte
IncludeDiscount, ttx:Number, xml:unsignedByte
VgrDescription, ttx:String(50), xml:string
CurSymbol, ttx:String(3), xml:string
CurName, ttx:String(30), xml:string
CurScaleFactor, ttx:Number, xml:short
ProDescription, String(50), xml:string
UseName, String(30), xml:string
TransactionDate, ttx:Datetime, xml:dateTime
StxCode, ttx:Number, xml:int
StxDescription, ttx:String(100), xml:string
MrwID, ttx:String(3), xml:string
MrwDescription, ttx:String(100), xml:string
Sales, ttx:Number, xml:int
Returns, ttx:Number, xml:int
Reserved, ttx:Number, xml:int
GrossSalesAmount, ttx:Currency, xml:decimal
GrossReservedAmount, ttx:Currency, xml:decimal
SalesVAT, ttx:Currency, xml:decimal
ReservedVAT, ttx:Currency, xml:decimal
Right clicking on all of these bold items on the table side (in the link tab) says that those bold fields are type Number. So not sure why the first 8 don't link as they are looking for Number. As for the last 4, in SQL these fields are type money, once read by vb.net into a datatable they are of type decimal. Not sure what crystal is expecting here.
I can manually link the 8, but it tells me for the 4 currency fields that the "data types are not compatibile"
I still don't get why if running as 32bit and passing the datatable from xml or sql to the rpt, even without the ttx, works without issue.
I think for now that i'm going to have to simply compile my main app for 32bit, but would still like to understand what is going on here. Thanks for helping to look into this.
Tony. -
Auto-authentication using NT credentials?
I have the following piece of javascript to detect an intranet user's NT id by creating an ActiveX component (IE 5.5). How can I pass this to an authentication module/login URL so that users are logged into portal automatically when they request the portal login page?
<script
language="JavaScript"
type="text/javascript"
event="onload"
for="window">
var net = new ActiveXObject("Wscript.Network");
document.all.strUsername.value = net.UserName;
document.all.strDomain.value = net.UserDomain;
</script>
thx,
MurrayYou need to build a URL something like:
http://server:8080/login/Ldap?page=1&TOKEN0=<username>&TOKEN1=<password>&Submit=Login
Have a look at the authentication templates under /etc/opt/SUNWips/desktop/default/iwtLoginProvider/ and check the form variables that are passed in for the authentication module you are using.
Stephen -
SLES 11 and MAC Authentication using FreeRADIUS
This is our first attempt at this. Not sure if this is the correct forum. We have a SLES 11 server. We are running FreeRadius FreeRADIUS Version 2.1.1, for host i686-suse-linux-gnu. We are testing just one Cisco WAP 4410N with a Lenovo laptop. All of our WAPs are Cisco 4410N. This is our first attempt at a Radius server. We are attempting to have users authenticate to our wireless network only by using their devices MAC address. This is for a Bring Your Own Device program for our school district. This program would allow students and teachers to bring their personal devices to school and attach to our network. We cannot install anything on their devices and need control over what devices connect. Once connected they would be subject to our Internet filter applicance.
We have been following the website http://wiki.freeradius.org/Mac-Auth#Plain+Mac-Auth.
We have made all the adjustments suggested in the website. We have created the file authorized_macs. At this time we have only one MAC address in this file. In our clients.conf file we have entered the following:
client 10.0.9.77 {
secret = xxxxxxxx
shortname = 10.0.9.77
nastype = cisco
This is the IP address of our WAP. We have configured the WAP under the Wireless section:
Basic Setting SSID = RADIUS TEST SSID broadcast enabled
Security currently disabled
Connection Control set to RADIUS with the IP address of the server and the secret question.
On the server in a terminal session we run /usr/sbin/radiusd -X. Which executes without any errors. When the laptop attempt to connect it times out and no meesage appear in the terminal session on the server. Obviously the laptop is not connected.
We have also attempted to connect by adding the following to the clients.conf file with no luck.
client 10.0.8.0/21 {
secret = xxxxxxx
shortname = KAHS
Any guidance would be greatly appreciated.Originally Posted by jdelucaka
This is our first attempt at this. Not sure if this is the correct forum. We have a SLES 11 server. We are running FreeRadius FreeRADIUS Version 2.1.1, for host i686-suse-linux-gnu. We are testing just one Cisco WAP 4410N with a Lenovo laptop. All of our WAPs are Cisco 4410N. This is our first attempt at a Radius server. We are attempting to have users authenticate to our wireless network only by using their devices MAC address. This is for a Bring Your Own Device program for our school district. This program would allow students and teachers to bring their personal devices to school and attach to our network. We cannot install anything on their devices and need control over what devices connect. Once connected they would be subject to our Internet filter applicance.
We have been following the website Mac Auth.
We have made all the adjustments suggested in the website. We have created the file authorized_macs. At this time we have only one MAC address in this file. In our clients.conf file we have entered the following:
client 10.0.9.77 {
secret = xxxxxxxx
shortname = 10.0.9.77
nastype = cisco
This is the IP address of our WAP. We have configured the WAP under the Wireless section:
Basic Setting SSID = RADIUS TEST SSID broadcast enabled
Security currently disabled
Connection Control set to RADIUS with the IP address of the server and the secret question.
On the server in a terminal session we run /usr/sbin/radiusd -X. Which executes without any errors. When the laptop attempt to connect it times out and no meesage appear in the terminal session on the server. Obviously the laptop is not connected.
We have also attempted to connect by adding the following to the clients.conf file with no luck.
client 10.0.8.0/21 {
secret = xxxxxxx
shortname = KAHS
Any guidance would be greatly appreciated.
And your windows machine is set to: Authenticate as computer when computer information is available?
Microsoft Corporation
Thomas -
What is the problem since i want to buy this online ?..My trial for 30 days was over unless granted more days
Which software does this concern? This forum is for issues with downloading and installing. If you have a purchase issue it needs to be addressed with Adobe Support directly.
Chat support (weekdays) -
For the link below click the Still Need Help? option in the blue area at the bottom and choose the chat option...
Make sure you are logged in to the Adobe site, have cookies enabled, clear your cookie cache. If it fails to connect try using a different browser.
Creative Cloud support (all Creative Cloud customer service issues)
http://helpx.adobe.com/x-productkb/global/service-ccm.html ( http://adobe.ly/19llvMN ) -
I'm in the market for a Laptop MAC solution to GPU accelerated editing. Because of multi-client workflow needs, I need to edit HD video with both FCP-X and ADOBE CS5.5 Premiere. The only GPU capable Graphics Cards that seem to satisfy both "camps" are from NVIDIA - GTX285 and NVIDIA Quadro FX 4800
Does anyone have these cards AND using both softwares AND having success at it?
I sure would appreciate any experienced advice with using NVIDIA GPU accelration with MacBook Pro especially!
Thanks,
~mars9How do you plan on using a PCIe card with a laptop? Via a Thunderbolt PCIe adapter? I can't help with that. In fact, I didn't think those adapters were even out yet.
I do have a Mac Pro and I use the NVDIA Quadro 4000 For Mac. This works great for Premiere Pro. As good as the 4800 and for less money. Check out this comparison.
http://barefeats.com/wst10g11.html
Maybe you are looking for
-
I cannot copy pictures to a Seagate as I get the out of memory notice with the only option to restart finder,repeatedly. I looked at older discussions and did not see a definitive fix, but many posted this, so I will as well: Many discussions were t
-
How to use different languages in iDVD
I want to create a DVD with different languages or with an audio comment to be chosen. Is this possible?
-
Connection errors with Pioneer AVH P3100DVD Car Stereo after iOS4.1 Update
I just upgraded to iOS 4.1 and now my Pioneer AVH P3100DVD car stereo has a "skipping" problem like a record or CD with a scratch in it when connected to my iPhone 4. I've tried disconnecting the USB cable, restarting both my iPhone 4 as well as my c
-
Malicious Javascript code added to the bottom of my HTML
Hello, Below is the code to my main page, called index.php. It is what shows when I type my domain into the browser. On a few occasions, when I open it in Internet Explorer, some malicious javascript code has been added to the bottom of the code.
-
[tutorial: inserts_updates_deletes] sql ex. cannot save changes
I working on the tutorial mentioned in the title. When I try to submit the changes on a new row I got the following error in the message box: Error:java.sql.SQLException: Expected to find "end of SQL command" instead found ";" at position 62.The exce