SAPJSF user role - does it have to be SAP delivered name ?

Hi Folks,
Security question - We are upgrading to EP 7.0 . The SAPJSF user ( in ABAP system) has the role SAP_BC_JSF_COMMUNICATION_RO.
Does the Portal need this exact named role ? If so ..can it be changed in the
Portal end ?
Our policy with roles is not to use the SAP delivered - so we copy and change
to our standard . Will the portal recognize a different role on the SAPJSF user.
This note got me thinking on this 908911
Thanks for input ! Dan

Ah, yes. It does read the role. It displays this role in the UME user interfaces as a group to which users are assigned. You can then assign portal roles to this "group."
See the picture in this document:
http://help.sap.com/saphelp_nw04s/helpdata/en/ed/18cc38e6df4741a264bddcd4f98ae2/frameset.htm
-Michael

Similar Messages

SCSFileDownloadServlet fails: User 'guest' does not have sufficient priv.

Hi,
We have an ADF application that is using SCSFileDownloadServlet to get documents from UCM. We added the servlet in web.xml and we are using this link to download the documents: /getfile?adapterName=our_adapter_name&dDocName=document12345&dID=12345
The issue is that sometimes it works but sometimes it fails throwing this message in the logs:
Event generated by user 'guest' at host 'CIS'. Unable to download 'COR-ER-421722'. User 'guest' does not have sufficient privileges. [ Details ]
An error has occurred. The stack trace below shows more information.
!csUserEventMessage,guest,CIS!$!csUnableToDownload,COR-ER-421722!csUserInsufficientAccess,guest
intradoc.common.ServiceException: !csUnableToDownload,COR-ER-421722!csUserInsufficientAccess,guest
*ScriptStack GET_FILE
3:checkSecurity,dID=421317,dDocName=COR-ER-421722
at intradoc.server.ServiceRequestImplementor.buildServiceException(ServiceRequestImplementor.java:2115)
at intradoc.server.Service.buildServiceException(Service.java:2260)
at intradoc.server.Service.createServiceExceptionEx(Service.java:2254)
at intradoc.server.ServiceSecurityImplementor.validateSecurityPrivilegeLevel(ServiceSecurityImplementor.java:813)
at intradoc.server.DocumentAccessSecurity.checkSecurity(DocumentAccessSecurity.java:170)
at intradoc.server.DocumentAccessSecurity.checkSecurity(DocumentAccessSecurity.java:121)
at intradoc.server.ServiceSecurityImplementor.checkSecurity(ServiceSecurityImplementor.java:371)
at intradoc.server.Service.checkSecurity(Service.java:2829)
at intradoc.server.FileService.checkSecurity(FileService.java:337)
at intradoc.server.Service.checkSecurity(Service.java:2807)
at sun.reflect.GeneratedMethodAccessor456.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
Is it possible to set a user/password to this servlet so it is able to download the documents everytime?
Thanks,
Josue

Hi go9189,
According to your description, you come across the error that User 'guest' does not have permission to run DBCC checkprimaryfile. This issue could happen when the login account doesn't have CREATE DATABASE, CREATE ANY DATABASE,
or ALTER ANY DATABASE permission in SQL Server instance, or that the login account has no access to the mdf and ldf files when attaching database, so SQL Server recognize the login account as a "Guest".
To solve the issue, you could pay attention to the points below.
1. Ensure that the login account has at least CREATE DATABASE, CREATE ANY DATABASE, or ALTER ANY DATABASE permission. You could grant the fixed server role 'dbcreator' or 'sysadmin' to the login account following the steps below.
a. Connect to SQL Server instance with the login account which has sysadmin fix server role.
b. Expand the folder 'Security', right click the login, and select Properties.
c. In the Server Roles tab, check the checkbox for 'dbcreator' or 'sysadmin'.
2. Make sure that the the login account has full control permission on the mdf and ldf files. For how to grant the login account with full control permission on the mdf and ldf files, please refer to the steps in the following article:
http://msdn.microsoft.com/en-us/library/bb727008.aspx
There is a similar thread for your reference:
https://social.technet.microsoft.com/Forums/en-US/e463df4c-8d26-46cf-aa2e-bddd97c7a9b8/user-guest-does-not-have-permission-to-run-dbcc-checkprimaryfile?forum=sqlgetstarted
Regards,
Michelle Li

User XIRWBUSER does not have authorization for message monitoring

Hi All,
In the Runtime WorkBench, when I choose the Message Monitoring, display Messages from Component Adapter Engine from Database, when I click on the start button, it shows me a error "User XIRWBUSER does not have authorization for message monitoring", how can I configure my xi to get the authorization for message monitoring of Adapter Engine? Thanks!
Regards,
Nick

Hi Nick,
Transaction PFCG. Enter the role you wish to check (SAP_XI_RWB_SERV_USER) and click on the display button.
Check that the Authorizations tab is green. If it is not, then you might need to generate the auth profile. Also check the User tab. If it is not green, then you should do a User Comparison as well (just click on the button inside the tab).
SAP Help URL:
http://help.sap.com/saphelp_nw04s/helpdata/en/52/67151e439b11d1896f0000e8322d00/frameset.htm
Cheers
Manish

VMM Shared ISO error "User account does not have permission required to open attachment"

I had this error once because the local service account was selected during installation of VMM. I have reinstalled VMM with a Domain service account and the error went away. However, the error is back.
"User account does not have permission required to open attachment '\\[servername]\VMMLibrary\server.ISO'. Error: 'General access denied error' (0x80070005). (Virtual machine ID GUID)"
I tried to create this VM on Host1 and got the error.
I then went to Host2 and was able to create the VM while using the same ISO on the same VMM library that failed on the Host1.
Both hosts have agent 3.2.7634.0 and are both running Hyper-V Server 2012 R2.
What is wrong with Host1 and how do I correct it?
Thank you.

This is a share configuration permissions issue.
http://technet.microsoft.com/en-us/library/ee340124.aspx
Brian Ehlert
http://ITProctology.blogspot.com
Learn. Apply. Repeat.

User J2EE_ADMIN does not have access to method rpData

Hello,
I'm using SAP ECC6 SR3 on windows x64 platform.
I try to launch report FP_PDF_TEST_00 in SE38 and I get following error message :
Test Program: Version Information (for Analysis Only) 1
*** SYSTEM ERROR
ERROR CODE : 100.102
ERROR MESSAGE :
SOAP Runtime Exception: CSoapExceptionFault : SOAP fault found in SOAP document /User J2EE_ADMIN does not have access to method rpData./<ns1:com.sap.engine.services.ejb.exceptio
SOAP Framework error: SOAP Runtime Exception: CSoapExceptionFault : SOAP fault found in SOAP document /User J2EE_ADMIN does not have access to method rpData./<ns1:com.sap.engine
I checked RFC ADS and it use J2EE_ADMIN to connect to /AdobeDocumentServices/Config?style=rpc.
Connection test returns no error.
Does anyone have an idea ?
Regards,

ADSUser could be locked as in this thread,
ADS Error: User does not have access to method rpdata.
Regards
Juan

User anonymous does not have permission to perform lookup : help needed

Hi All,
I'm facing a strange problem.
I'm using weblogic 8.1
Some ejbs are deployed in the application and security settings are done properly.
But sometimes, i get an exception saying that
'javax.naming.NoPermissionException: User <anonymous> does not have permission on weblogic to perform lookup operation. [Root exception is javax.naming.NoPermissionException: User <anonymous> does not have permission on weblogic to perform lookup operation.]
at weblogic.rjvm.BasicOutboundRequest.sendReceive(BasicOutboundRequest.java:108)' .
This ejb is invoked from a web application, and the exception happens only once in the server lifecycle (but not on the first try).
This happens in a JTA transaction and eventually the transaction gets timed out. Once timed out for the first time, further requests are executing fine and it is connecting with the configured security credentials.
Initially i thought ejb caching was causing the problem. But even after removing the cache, it is throwing the exception.
Only sometimes, it is trying to connect as <anonymous> user.
I'm so fed up with this..
Can anybody help me out..?

Which 8.1 SP are you on? If you open a support case, a support engineer may be able to identify a fix that has been included in a newer Service Pack.

Reg SAPJSF User role issue

Dear Experts,
I'm trying to disable password based log on for certain users in Portal and Portal uses the ABAP Stack as the repository (IT is a dual stack system).
But when i log in as j2ee_Admin user and try to do this in the "Identity Management" section, i get the following error message
"An error occurred in the persistence. The original message (possibly not translated) was: "Cannot update user UACC.R3_DATASOURCE.USER3 in ABAP backend system. Reason: The UME/ABAP adapter has recognized that the communication user is only assigned to the read-only role SAP_BC_JSF_COMMUNICATION_RO (or no role at all) in the backend system. Therefore UME was set to read-only mode for users from the backend system. See SAP Note 908911 for further information.". Contact your system administrator"
I have checked the SAPJSF Roles too and i see the following there under "Assigned groups"
Everyone
SAP_BC_JSF_COMMUNICATION_RO
SAP_BC_JSF_COMMUNICATION
Authenticated Users
Please let me know the way to overcome this problem.
Regards,
Karthik

Hello Karthik
According the SAP note 905188 - "Password change for ABAP users fails"
"If the communication user (default name: SAPJSF) has the 'read-only'
role (SAP_BC_JSF_COMMUNICATION_RO) in the ABAP system, users are no
longer able to change their own password.
This error is corrected with the following Support Packages:
o NetWeaver 2004: Support Package 16
o NetWeaver 2004s : Support Package 07
Until the corrections are available, the following workaround is
possible: Assign the additional role SAP_J2EE_GUEST to the communication
user in the ABAP system and restart the J2EE Engine.
This does not affect the authorizations of the communication user in the
ABAP system."
Please try to apply the note quoted above. I hope to help you!
Álvaro Ferreira Raminelli

Obtain a primary token for a user who does not have permission to logon locally

I would like to know whether it's possible to obtain a primary token for a user who doesn't have permission to log on locally. If yes, what the recommended way is for doing that.
I called LogonUserW with logon32_logon_network logontype for user which is not allowed to logon locally. It returned impersonation token. I called DuplicateTokenEx to create primary token but it still returned impersonation token.

A Network Logon is always going to return an impersonation token. This is by design.
A Batch or Service logon would return a Primary Token. The user would need the corresponding right to return these 2 types of token. Typically, all users are allowed to generate a Network Token (Impersonation Token) but as you have discovered
it has limited usage which is by design.
thanks
Frank K [MSFT]
Follow us on Twitter, www.twitter.com/WindowsSDK

BPEM End User role does not appear

Hi masters
What should I do to make the BPEM End User role appears on the portal Identity Management ?

Hi Ganga,
Firstly, check the BPM usage type is loaded in your SAP NetWeaver 7.3 system at http://<host>:<port>/utl/UsageTypesInfo
If the BPM usage type is loaded, check the BPM configuration wizards have been run in the SAP NetWeaver Administrator - http://<host>:<port>/nwa > Configuration > Scenarios > Configuration Wizard
Finally check the role exists via the SAP NetWeaver Administrator - http://<host>:<port>/nwa > Configuration > Security > Identity Management
If you aren't seeing all the options in SAP NetWeaver Administrator then you need to find someone with more authority and get them to grant you the SAP_BPM_SuperAdmin or SAP_BPM_SuperDisplay role.
If that's all ok you can then go back and check the role is visible in the Portal.
Regards,
Jocelyn

SP 2010 upgrade fails Error C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\config\WEBCONFIG.ACCSRV.XML, does not have element "configuration/configSections/sectionGroup[@name='SharePoint']"

I was upgrading my SP 2010 server to SP1 but at step 8 i get this error. I cleared configuration cache, moved the file out of the folder, got the same file from other farm where upgrade went smooth, but no success yet. I am at loss.
So i have another farm in SP1. As a fall back option i was thinking to move content database on that server and start hosting site there but now i find out pre sp1 content databse cannot be moved to sp1 farm just through content database migration.
Do only choice i have is to build dummy sp 2010 environment, move content database there and do upgrade there and move it to final production environment?
Is there anything else i can do for either upgradeing the current sp 2010 or moving it to new 2010 already on SP1?
Can pre sp1 2010 content db be moved to sp2013 sp1 directly?
Adit

Hi ,
How many SharePoint servers do you have? If you have more than one SharePoint server, you need to install SP1 on all servers in the farm.
Make sure you run SharePoint 2010 configuration wizard using “Run As administrator”.
Please check the log to find more information about this issue.
In addition, here is a similar post, please take a look at:
http://sharepointnomad.wordpress.com/2014/02/23/fixing-sharepoint-2010-configuration-wizard-error-webconfig-accsrv-xml-does-not-have-element-configurationconfigsectionssectiongroupnamesharepoint-or-it-is-invalid/
Best Regards,
Wendy
Wendy Li
TechNet Community Support

I received a text from another iPhone user who does not have an iPad, why did I receive the text on my iPad rather than my iPhone?

I have both the iPhone and New iPad and I was under the impression when sending a text it went from iPhone to iPhone or iPad to iPad. Also, if I send a text from my iPad to someone who only has the iPhone, it comes in on their iPhone. However, I received a text from an individual who only has an iPhone and it came to my iPad and never showed up on my phone...Which means had I not been at home I would not have known I had a text on my iPad???? How does it determine which device it will appear on?

You are probably right - I don't have my iPad with me and was confusing myself. But on the iPad it is receive at email addresses only.
Sending to the phone number will mean ONLY your iPhone gets the message. If you want it to go to ALL devices, then you should have them send to the email address associated with the AppleID you used to set up iMessage originally. Also set that email address up as your caller id on the iPhone so as you send out messages, people will reply to that and both your devices should get them.
Although Apple's notes indicate you should be able to do it - http://support.apple.com/kb/TS2755
what if you just type in a 10-digit phone number on the iPad instead of an email?
(I originally did all this with iOS 5.0, and I know then the number did not work on an iPad, but maybe with iOS 5 updates, it does now?)

Find all users who does not have access to a shared mailbox.

Hi all,
We are in the proces of setting up a hybrid enviroment with our E2010 towards Office365. As part of that, we want to move several batches of users. The first bunch if users we move should not use any shared mailboxes etc. but how do I find
those? I can see there are powershell scripts that find users who has a shared mailbox and then list the permission - but that is kind of the opposite than what I want :)
Browsing manually through users is not practical either as we have 10000+ mailboxes at the moment.
Hoping for a quick reply :)
/Trev

It is not possible to accomplish this by using powershell. Easier one is to get the list of people who has access on something with below and do easier data manipulation in Excel :
Get-Mailbox -Resultsize Unlimited | Get-MailboxPermission | ?{$_.isinherited -eq $False -and $_.user -notlike "*self*"} | select identity, user,accessrights
[url=http://www.lepide.com/]Lepide[/url]

Can I Share a document with a user who does not have righs to the site? (SharePoint 2013 on prem)

Joe is in Sales
He must Share a document with Jane in Marketing.
He only wants to Share this one document.
Does he need to go into the Sales site and add Jane as a site user? Jane will then be able to see everything on the site. No good.
Does Joe now need to break inheritance on all the other site libraries from Jane to hide them??
In a perfect world, Joe shares the doc with Jane. Jane gets email with link. Jane clicks link and goes to sale site where all she sees is the document that was Shared- nothing else.
Cheers, Jim ___________________________________________________ If this was helpful please mark as an answer.

With 2013, you can just Share the specific item. It will automatically break inheritance on that item and allow Jane to see that one document only and Jane will get a link inviting her to the document.
Trevor Seward
Follow or contact me at...
&nbsp&nbsp
This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Problem Create ANE,ArgumentError: Error #3500: The extension context does not have a method with the name

I little confuse about build ANE, I already follow all the direction, but the error always #3500 when I try to call the ANE.
I create ANE using java android.
The tools I use : Flash Builder running on Win-64 win.7. I think I must straight to the point, here what i made it first step by step;
1. I create the JAVA application first, with package senigo.extension.android then I create 3 file, Sample.java, SampleContext.java, PassTextFunction.java
Sample.Java Source Code
package senigo.extension.android;
import android.util.Log;
import com.adobe.fre.FREContext;
import com.adobe.fre.FREExtension;
public class Sample implements FREExtension {
@Override
public FREContext createContext(String arg0) {
// TODO Auto-generated method stub
Log.i("Sample", "createContext");
return new SampleContext();
@Override
public void dispose() {
// TODO Auto-generated method stub
Log.i("Sample", "Dispose");
@Override
public void initialize() {
// TODO Auto-generated method stub
Log.i("Sample", "Initialize");
SampleContext.Java Source Code
package senigo.extension.android;
import java.util.HashMap;
import java.util.Map;
import android.util.Log;
import com.adobe.fre.FREContext;
import com.adobe.fre.FREFunction;
public class SampleContext extends FREContext {
public SampleContext()
Log.i("SampleContext", "constructor");
@Override
public void dispose() {
// TODO Auto-generated method stub
Log.i("SampleContext", "dispose");
@Override
public Map<String, FREFunction> getFunctions() {
// TODO Auto-generated method stub
Log.i("SampleContext", "getFunctions");
Map<String, FREFunction> functionMap = new HashMap<String, FREFunction>();
functionMap.put("passText", new PassTextFunction());
return functionMap;
PassTextFunction.Java Source Code
package senigo.extension.android;
import com.adobe.fre.FREContext;
import com.adobe.fre.FREExtension;
import com.adobe.fre.FREFunction;
import com.adobe.fre.FREObject;
public class PassTextFunction implements FREFunction {
@Override
public FREObject call(FREContext arg0, FREObject[] arg1) {
// TODO Auto-generated method stub
FREObject result = null;
try{
result = FREObject.newObject("Hello World");
}catch(Exception e)
return result;
after all the file I create the jar file using click right on the tree view >> Export >> Jar File >> Sample.Jar (i already create jar file that just contain the src folder and after i frustrated, i create .jar file contain all the whole project folder but still didn't work out).
Ok, After that I create project Flex Library Project, That's contain the actionscript to call the native and the extension.xml, here the code.
Test.as Source Code, FYI : i already create public function and the static function the error still same #3500.
package senigo.extension.android
import flash.external.ExtensionContext;
public class test
private static var extContext:ExtensionContext = null;
public function test()
trace ("Test Constructor");
if (!extContext)
initExtension();
public static function get passText():String
trace ("Test Pass Text");
if (!extContext)
initExtension();
return extContext.call("passText") as String;
private static function initExtension():void
trace ("Vibration Constructor: Create an extension context");
extContext = ExtensionContext.createExtensionContext("senigo.extension.android", null);
extension.xml source code
FYI: in Flex when i put the Native Extension, they said must have Windows-x86 so I already create 3 ANE, that just contain Android-ARM , Contain Android-ARM and Default, Contain Android-ARM,Default and Windows-x86 but the error still same. I didn't got it where is the error.
<extension xmlns="http://ns.adobe.com/air/extension/3.1">
<id>senigo.extension.android</id>
<versionNumber>1.0.0</versionNumber>
<platforms>
<platform name="Android-ARM">
<applicationDeployment>
<nativeLibrary>Sample.jar</nativeLibrary>
<initializer>senigo.extension.android.Sample</initializer>
<finalizer>senigo.extension.android.Sample</finalizer>
</applicationDeployment>
</platform>

<platform name="default">
<applicationDeployment/>
</platform>
</platforms>
</extension>
After I create it, I copy the .swc file and extension file sample with the Sample.jar file.
I extract the .swc file, copy the library.swf to folder Android-ARM,Default,Windows-86 and I create build.bat that contain the command like this
adt -package -storetype PKCS12 -keystore senigo.p12 -storepass l10nk1ng -target ane senigo.extension.android.ane extension.xml -swc AndroidLib.swc -platform Android-ARM -C ./Android-ARM/ . -platform default -C ./default/ .
the I put the ane to Flex mobile project that I created:
I run it but got error #3500, I really confuse?? what's wrong with my code? is there something I wrong or I Miss it?
Please any one help me.. and when is already ane file can I debug it in Flex Mobile Project? I wanna looks the log.i code that i wrote but i confuse how to looking up in flash builder.
at the end, I wanna said Sorry if my english not very goods, and thanks, because wanna see my problem and thank you very much if You can gave me a solution's

Alex Rekish wrote:
Why you comment Windows-x86 in your extension.xml ?
I think that is a problem. You launch your application on Windows but ANE haven't got Windows-x86 implementation (also you don't include it while packaging). So your application use default implementation. But default implementation don't use any native code and cannot use ExtensionContext. And you got error.
If you don't need Windows-x86 native implementation than you need implement default implementation that different than Android-ARM. You don't need to use ExtensionContext in default implementation.
Thanks for you answer Alex Rekish, Sorry I didn't screen shoot all about the extension.xml. I comment it because the latest ANE that I build is contain Android-ARM and default. so I commented. but I already try it using just ANE that's just contain Android-ARM, with Android-ARM and windows-x86,and Android-ARM, and default, and Android-ARM,default,Windows-x86 the error still the same.
here the screen shoot, I embeded the ane that's i contain Windows-x86
in action script test.as I didn't change it anythings, I just play it on extension.xml to build the ane. is there any mistake over there? I interact with your answer that "If you don't need Windows-x86 native implementation than you need implement default implementation that different than Android-ARM. You don't need to use ExtensionContext in default implementation." I didn't need to user ExtensionContext? is means? in the actionscript? or in extension.xml? can you explained

Adobe air windows/C++:Error #3500: The extension context does not have a method with the name

I created a C++ dynamic dll called by air.
If the dll depends on other dlls, then the error#3500 occured. However removed other dlls, it works.
Could that mean the air can only call one dynamic dll that doesn't depend any other dlls?
does anybody met this problem before, or let me know what can I do?

Alex Rekish wrote:
Why you comment Windows-x86 in your extension.xml ?
I think that is a problem. You launch your application on Windows but ANE haven't got Windows-x86 implementation (also you don't include it while packaging). So your application use default implementation. But default implementation don't use any native code and cannot use ExtensionContext. And you got error.
If you don't need Windows-x86 native implementation than you need implement default implementation that different than Android-ARM. You don't need to use ExtensionContext in default implementation.
Thanks for you answer Alex Rekish, Sorry I didn't screen shoot all about the extension.xml. I comment it because the latest ANE that I build is contain Android-ARM and default. so I commented. but I already try it using just ANE that's just contain Android-ARM, with Android-ARM and windows-x86,and Android-ARM, and default, and Android-ARM,default,Windows-x86 the error still the same.
here the screen shoot, I embeded the ane that's i contain Windows-x86
in action script test.as I didn't change it anythings, I just play it on extension.xml to build the ane. is there any mistake over there? I interact with your answer that "If you don't need Windows-x86 native implementation than you need implement default implementation that different than Android-ARM. You don't need to use ExtensionContext in default implementation." I didn't need to user ExtensionContext? is means? in the actionscript? or in extension.xml? can you explained

SAPJSF user role - does it have to be SAP delivered name ?

Similar Messages

Maybe you are looking for