SNC Implementation
Hi Experts,
Could you please provide me the SNC implementation document.
Thank you
Siva
We are implementing SNC between NGA webmethods to SAP . The configuration
part is done from Webmethods side.and configuration is done from SAP side
except profile parameters settings.
We are using Single PSE file in both the systems.we have installed the
"libsapcrypto.o" successfully. and created the PSE and cred_v2 files.
we have imported and exported the PSE file. after that we have created the parameters. and i have rebooted the system. but the SAP is not up and running. Oracle is running. R3trans also working. i am attching you the dev-w0 log file.
please suggest me.
we are working in AIX environment. and web methods OS is Linux.
We did not use any third party tools.
Thnks in Advance.
more dev_w0
trc file: "dev_w0", trc level: 1, release: "640"
ACTIVE TRACE LEVEL 1
ACTIVE TRACE COMPONENTS all, M
M sysno 01
M sid DV1
M systemid 324 (IBM RS/6000 with AIX)
M relno 6400
M patchlevel 0
M patchno 196
M intno 20020600
M make: single threaded, ASCII, 64 bit
M pid 3850476
M
M
M Mon May 24 06:32:45 2010
M ***LOG Q01=> tskh_init, WPStart (Workproc 0 1 3850476) [thxxhead.c 1142]
M calling db_connect ...
C Got ORACLE_HOME=/oracle/DV1/920_64 from environment
C got NLS_LANG='AMERICAN_AMERICA.WE8DEC' from environment
C Client NLS settings: AMERICAN_AMERICA.WE8DEC
C Logon as OPS$-user to get SAPCAD's password
C Connecting as /@DV1 on connection 0 (nls_hdl 0) ... (dbsl 640 250407)
C Nls CharacterSet NationalCharSet C EnvHp ErrHp ErrHpBatch
C 0 WE8DEC 1 11324fde0 1132593a0 113258c58
C Attaching to DB Server DV1 (con_hdl=0,svchp=11325c0b8,srvhp=11325c318)
C Starting user session (con_hdl=0,svchp=11325c0b8,srvhp=11325c318,usrhp=113266688)
C Now '/@DV1' is connected (con_hdl 0, nls_hdl 0).
C Got SAPCAD's password from OPS$-user
C Disconnecting from connection 0 ...
C Close user session (con_hdl=0,svchp=11325c0b8,usrhp=113266688)
C Now I'm disconnected from ORACLE
C Connecting as SAPCAD/<pwd>@DV1 on connection 0 (nls_hdl 0) ... (dbsl 640 250407)
C Nls CharacterSet NationalCharSet C EnvHp ErrHp ErrHpBatch
C 0 WE8DEC 1 11324fde0 1132593a0 113258c58
C Starting user session (con_hdl=0,svchp=11325c0b8,srvhp=11325c318,usrhp=113266688)
C Now 'SAPCAD/<pwd>@DV1' is connected (con_hdl 0, nls_hdl 0).
C Database NLS settings: AMERICAN_AMERICA.WE8DEC
C DB instance DV1 is running on pharaoh with ORACLE version 9.2.0.8.0 since MAY 24, 2010, 06:32:34
B Connection 0 opened (DBSL handle 0)
B Wp Hdl ConName ConId ConState TX PRM RCT TIM MAX OPT Date Time DBHost
B 000 000 R/3 000000000 ACTIVE NO YES NO 000 255 255 20100524 063245 pharaoh
M db_connect o.k.
M ICT: exclude compression: .zip,.cs,.rar,.arj,.z,.gz,.tar,.lzh,.cab,.hqx,.ace,.jar,.ear,.war,.css,.pdf,.js,.gzip,.uue,.bz2,.iso,.sda,
.sar,.gif
I MtxInit: 0 0 0
M SHM_PRES_BUF (addr: 700000002d37000, size: 24000000)
M SHM_ROLL_AREA (addr: 700000890000000, size: 30720000)
M SHM_PAGING_AREA (addr: 7000008a0000000, size: 134217728)
M SHM_ROLL_ADM (addr: 70000000441c000, size: 2672386)
M SHM_PAGING_ADM (addr: 7000008b0000000, size: 656416)
M ThCreateNoBuffer allocated 324144 bytes for 1000 entries at 7000008c0002000
M ThCreateNoBuffer index size: 3000 elems
M ThCreateVBAdm allocated 7040 bytes (50 server) at 7000008d0000000
X EmInit: MmSetImplementation( 2 ).
X EM/TOTAL_SIZE_MB = 4096
B
B Mon May 24 06:32:46 2010
B db_con_shm_ini: WP_ID = 0, WP_CNT = 21, CON_ID = -1
B
B Mon May 24 06:32:47 2010
B dbtbxbuf: Buffer TABL (addr: 700000900000100, size: 30000000, end: 700000901c9c480)
B dbtbxbuf: Profile: max_objects = 5000, displace = 1, reorg = 1
B dbtbxbuf: request_unit = 2000, sync_reload = 5, inval_reload = 5
B dbtbxbuf: protect_shm = 0, force_checks = 0
B dbtbxbuf: tsize_retry = 14420224
B ***LOG BB0=> buffer TABL started with length 30000000 bytes [dbtbxbuf#8 @ 16037] [dbtbxbuf1603 7]
B dbtbxbuf: Buffer TABLP (addr: 7000000046aa100, size: 16384000, end: 70000000564a100)
B dbtbxbuf: Profile: max_objects = 200, displace = 1, reorg = 1
B dbtbxbuf: request_unit = 2000, sync_reload = 5, inval_reload = 5
B dbtbxbuf: protect_shm = 0, force_checks = 0
B dbtbxbuf: tsize_retry = 8156096
B ***LOG BB0=> buffer TABLP started with length 16384000 bytes [dbtbxbuf#8 @ 16037] [dbtbxbuf1603 7]
B dbtbxbuf: Reading TBX statistics:
B dbtbxbuf: 66 object entries precreated
B Layout of EIBUF buffer shared memory:
B 0: 1 * 4 = 4
B 1: 1 * 360 = 360
B 2: 21 * 40 = 840
B 3: 4001 * 40 = 160040
B 4: 2000 * 160 = 320000
B 5: 4001 * 8 = 32008
B 6: 1 * 200 = 200
B 7: 65 * 8 = 520
B 8: 28752 * 128 = 3680256
B Tracing = 0, Shm Protection = 0, Force checks = 0, Recovery delay = 500000
B dbexpbuf: Buffer EIBUF (addr: 70000000564c108, size: 4194304, end: 700000005a4c108)
B ***LOG BB0=> buffer EIBUF started with length 4096k bytes [dbexpbuf#6 @ 2342] [dbexpbuf2342 ]
B Layout of ESM buffer shared memory:
B 0: 1 * 4 = 4
B 1: 1 * 360 = 360
B 2: 21 * 40 = 840
B 3: 4001 * 40 = 160040
B 4: 2000 * 160 = 320000
B 5: 4001 * 8 = 32008
B 6: 1 * 200 = 200
B 7: 65 * 8 = 520
B 8: 28752 * 128 = 3680256
B Tracing = 0, Shm Protection = 0, Force checks = 0, Recovery delay = 500000
B dbexpbuf: Buffer ESM (addr: 700000910000108, size: 4194304, end: 700000910400108)
B ***LOG BB0=> buffer ESM started with length 4096k bytes [dbexpbuf#6 @ 2342] [dbexpbuf2342 ]
B Layout of CUA buffer shared memory:
B 0: 1 * 4 = 4
B 1: 1 * 360 = 360
B 2: 21 * 40 = 840
B 3: 9001 * 40 = 360040
B 4: 4500 * 160 = 720000
B 5: 9001 * 8 = 72008
B 6: 1 * 200 = 200
B 7: 193 * 8 = 1544
B 8: 31488 * 256 = 8060928
B Tracing = 0, Shm Protection = 0, Force checks = 0, Recovery delay = 500000
B dbexpbuf: Buffer CUA (addr: 7000008c2e23108, size: 9216000, end: 7000008c36ed108)
B ***LOG BB0=> buffer CUA started with length 9000k bytes [dbexpbuf#6 @ 2342] [dbexpbuf2342 ]
B Layout of OTR buffer shared memory:
B 0: 1 * 4 = 4
B 1: 1 * 360 = 360
B 2: 21 * 40 = 840
B 3: 4001 * 40 = 160040
B 4: 2000 * 160 = 320000
B 5: 4001 * 8 = 32008
B 6: 1 * 200 = 200
B 7: 81 * 8 = 648
B 8: 28751 * 128 = 3680128
B Tracing = 0, Shm Protection = 0, Force checks = 0, Recovery delay = 500000
B dbexpbuf: Buffer OTR (addr: 700000920000108, size: 4194304, end: 700000920400108)
B ***LOG BB0=> buffer OTR started with length 4096k bytes [dbexpbuf#6 @ 2342] [dbexpbuf2342 ]
B ***LOG BB0=> buffer CALE started with length 500000 bytes [dbcalbuf#5 @ 2274] [dbcalbuf2274 ]
B dbtran INFO (init_connection '<DEFAULT>' [ORACLE:640.00]):
B max_blocking_factor = 5, max_in_blocking_factor = 50,
B min_blocking_factor = 5, min_in_blocking_factor = 5,
B prefer_union_all = 0, prefer_union_for_select_all = 0,
B prefer_fix_blocking = 0, prefer_in_itab_opt = 1,
B convert AVG = 0, alias table FUPD = 0,
B escape_as_literal = 1, opt GE LE to BETWEEN = 0,
B select * =0x0f, character encoding =SBCS / <none>:-,
B use_hints = abap->1, dbif->0x1, upto->2147483647, rule_in->0,
B rule_fae->0, concat_fae->0, concat_fae_or->0
M PfHIndInitialize: memory=<7000008e007d328>, header=<7000008e007d328>, records=<7000008e007d358>
M
M Mon May 24 06:32:48 2010
M SecAudit(RsauInit): Start init of Security Audit Log for first wp.
M SecAudit(RsauInit): Shared memory for Security Audit Log already exists.
M SecAudit(RsauInit): Re-initialize with new profile parameters
M SecAudit(RsauShmInit): SCSA size................ = 4096
M SecAudit(RsauShmInit): addr of SCSA............. = 700000020000000
M SecAudit(RsauShmInit): addr of RSAUSHM.......... = 700000020000450
M SecAudit(RsauShmInit): addr of RSAUSLOTINFO..... = 700000020000488
M SecAudit(RsauShmInit): addr of RSAUSLOTS........ = 700000020000494
M SecAudit(RsauShmInit): SHM version.............. = 5
M SecAudit(RsauShmInit): SHM Slot version......... = 2
M SecAudit(RsauShmInit): RSAU active.............. = 0
M SecAudit(RsauShmInit): number of slots possible. = 10
M SecAudit(RsauShmInit): number of slots requested = 2
M SecAudit(RsauShmInit): number of slots used..... = 2
M SecAudit(RsauShmInit): user selection........... = 0
M SecAudit(RsauShmInit): max size of one file..... = 0 KB
M SecAudit(RsauShmInit): max size of all files.... = 102400 KB
M SecAudit(RsauGetCurrentProfile): Init of shared memory completed
M SecAudit(RsauGetCurrentProfile): Security Audit Log not active
M SsfSapSecin: automatic application server initialization for SAPSECULIB
N SsfSapSecin: Looking for PSE in database
N SsfPseLoad: started...(path=/usr/sap/DV1/DVEBMGS01/sec, AS=pharaoh, instanceid=01)
N SsfPseLoad: Downloading file /usr/sap/DV1/DVEBMGS01/sec/SAPSYS.pse (client: , key: SYSPSE, len: 1215)
N SsfPseLoad: ended (1 of 1 sucessfully loaded, 1 checked...
N MskiCreateLogonTicketCache: Logon Ticket cache created in shared memory.
N MskiCreateLogonTicketCache: Logon Ticket cache pointer registered in shared memory.
M rdisp/reinitialize_code_page -> 0
M icm/accept_remote_trace_level -> 0
M rdisp/no_hooks_for_sqlbreak -> 0
N SncInit(): Initializing Secure Network Communication (SNC)
N IBM RS/6000 with AIX (st,ascii,SAP_UC/size_t/void* = 8/64/64)
N SncInit(): found snc/data_protection/max=3, using 3 (Privacy Level)
N SncInit(): found snc/data_protection/min=1, using 1 (Authentication Level)
N SncInit(): found snc/data_protection/use=9, using 3 (Privacy Level)
N SncInit(): Trying builtin default as a
N gssapi library name: "sncgss.o".
N SncInit(): snc/gssapi_lib UNDEFINED in profile!
N YOU DEFINITELY SHOULD SET snc/gssapi_lib !!
M *** ERROR => DlLoadLib: dlopen()= 0509-022 Cannot load module .
0509-026 System error: A file or directory in the path name does not exist. -> DLENOACCESS (2,No such file or directory) [dlux.c 314]
N *** ERROR => SncPDLInit(): DlLoadLib("sncgss.o")=DLENOACCESS
N [sncxxdl.0340]*** ERROR => SncPDLInit()==SNCERR_INIT, Adapter (#0) sncgss.o not loaded
N [sncxxdl.0604]<<- SncInit()==SNCERR_INIT
N sec_avail = "false"
M ***LOG R19=> ThSncInit, SncInitU ( SNC-000001) [thxxsnc.c 223]
M *** ERROR => ThSncInit: SncInitU (SNCERR_INIT) [thxxsnc.c 225]
M in_ThErrHandle: 1
M *** ERROR => SncInitU (step 1, th_errno 44, action 3, level 1) [thxxhead.c 9621]
M
M Info for wp 0
M
M stat = 4
M reqtype = 1
M act_reqtype = -1
M rq_info = 0
M tid = -1
M mode = 255
M len = -1
M rq_id = 65535
M rq_source = 255
M last_tid = 0
M last_mode = 0
M int_checked_resource(RFC) = 0
M ext_checked_resource(RFC) = 0
M int_checked_resource(HTTP) = 0
M ext_checked_resource(HTTP) = 0
M report = > <
M action = 0
M tab_name = > <
M PfStatDisconnect: disconnect statistics
M Entering TH_CALLHOOKS
M ThCallHooks: call hook >SAP-Trace buffer write< for event BEFORE_DUMP
M TrThHookFunc: called for WP dump
M ThCallHooks: call hook >ThrSaveSPAFields< for event BEFORE_DUMP
M *** ERROR => ThrSaveSPAFields: no valid thr_wpadm [thxxrun1.c 730]
M *** ERROR => ThCallHooks: event handler ThrSaveSPAFields for event BEFORE_DUMP failed [thxxtool3.c 254]
M Entering ThSetStatError
M Entering ThReadDetachMode
M call ThrShutDown (1)...
M ***LOG Q02=> wp_halt, WPStop (Workproc 0 3850476) [dpuxtool.c 318]
thank & regards
Shiva
Similar Messages
-
Steps and Check list SNC implementation
Dear Experts.
Believe that you'll spend some time to put your precious quotes on this query.
1. How SNC implementation should be done, what are the steps to be carried out?
2. What are the Pre-requisites and check list for implementation?
3. What testing needed to be done after implementation.
Thanks in advance
VinothHi Vinoth,
Responsibilities:
BASIS / Security :
1. System Upgrade / Installation
2. Post upgrade activities like SPAU (if its upgrade), notes that are required to be implemented.
3. Email / SMS set-up (Exchange infrastructure)
4. Work-out the authorizations that need to be provided for different Business roles
XI / PI :
1. Download the content for latest SNC release
2. Set-up communication between ERP <> XI <> SNC
3. Check SLDCHECK
4. Configuration scenario e.g. Sender Agreement, Receiver Agreement, Receiver Determination, Interface Determination, etc.
Functional :
1. Master Data set-up
2. Required customizing
Hopefully, this should give an overall idea.
Regards,
Sandeep
Re: What are the ODM components available in SNC?
Posted: Aug 6, 2010 10:39 AM in response to: Sandeep Mandhana Reply
Hi Nikhil & Sandeep,
Thanks for your valuable information.
Could you please let me know the checklist and steps that should be followed while implementing SNC.
Basis/Security peoples responsiblities?
XI/PI peoples responsibilites?
Functional peoples responsibilities?
Thanks in advance
vinoth -
Hi SNC Experts ,
We were planning to build an SNC demo in our internal systems.I want to know if 2 months is a reasonable timeline to configure SNC and integrate it with ECC .
The scenarios we are looking at is
SNC for Forecast Capture .
Inventory Tracking
Customer Collaboration
We want to build this demo for abt 2 locations.
Let me know if it is a reasonable timeline.
Thanks in advance for your replies.
Regards,
Ranjini.Hi Ranjini,
It depends on whether the system is ready by assuming there no issue from basis or XI it reasonable time line.
You can configure SNC and integrate it with ECC .
As per SAP for SNC for Forecast Capture,Inventory Tracking,Customer Collaboration time line is 9 weeks
Limits of Pilot Scope:
1u20133 plants, <= 3 customers, <= 200 products
Thanks,
Nikhil -
Hi,
I read one statement some where else. The statement is XSLT mapping (e.g. for SNC mappings). Here my question is what is this SNC mapping and how we will do this SNC mapping in SAP XI
Thanks
RaoHi,
Connections between SAP system components that communicate using RFC can be secured with SNC, which secures the data communication paths between the various SAP system components. SAP systems support external security products that implement cryptographic algorithms. With SNC, you can apply these algorithms to your data for increased protection
Configuring SNC
http://help.sap.com/saphelp_nw04/helpdata/en/c3/d2281db19ec347a2365fba6ab3b22b/content.htm
A example where SNC implementation is useful
Security in XI
Regards,
Prateek
Message was edited by:
Prateek Srivastava -
Performance Impact When Using SNC Communication
Hello,
Does anybody know if and how much performance impact there is if we use SNC for communication between the SAP Server and SAPGUI?
I think there are two areas that may be impacted; Network and server CPU.
For network load, I did find a part in "Front-End Network Requirements for SAP Business Solutions" document saying "overhead of roughly 350 bytes per user interaction step" but it does not specify the type of encryption. I wonder if there is any other info on this?
For CPU impact, how much overhead should I consider for sapgui access?
I see no field for this in the quicksizer and I can't seem to find any white papers on this subject.
Thank you in advance.>
Peter Adams wrote:
> Ken,
>
> if you plan to use SAPcryptlib for SNC between SAP servers, then you should use a SAPcryptolib-compatible solution for the SNC communication between SAPGUI and SAP server, and there is only one vendor who can provide this. Let me know, if you need help finding it. My contact information is in my SDN business card.
Just so Kan is clear - It is not legal to use the SAP cryptolib provided by SAP for SNC between SAP GUI and SAP servers, so if x.509 is the desired mechanism you need to purchase additional software from the company which Peter works for to provide SAP GUI SNC-based SSO. I think instead, Kan might be using the free SAP supplied SNC Kerberos library, which is why I asked him to confirm this in my last post. I doubt he is interested to buy any third party software.
> As to the performance discussion: first of all, yes, there will be a small performance impact if SNC is used (no matter which type or implementation), but from our experience with many actual SNC implementations, I can state that this is practically not relevant. It is not noticeable by users. There were never any performance discussions with customers. See also SAP Note 1043694.
I agree with this - the performance impact is not noticed by users, but the system managers who look after the servers where SAP is installed, and the team responsible for the network need to be aware of any differences (if any) when SNC is turned on and when SNC is turned off. I think this is why Kan is asking these questions, not because he is concerned about users noticing any difference when they logon to SAP.
> Just a first quick comment on certain statements above: Tim's arguments for proving his overall statement are not conclusive from my perspective. Nor do I think his overall statement itself is correct.
The facts I mentioned are well known facts, e.g. symmetric crypto is far better from performance point of view than asymmetric. I know the examples I have shown which I found when doing a quick google search were not conclusive, but they were shown as initial examples, not necessarily the best examples. This is why I specifically mentioned that if you search in google yourself you will see many more references where comparisons are done between Kerberos (e.g. symmatric) compared with PKI (e.g. asymmetric).
> First of all, he only selects one aspect of performance - CPU impact of encryption algorithms.
No, I didn't. Some of the examples I referred to also discuss other differences. I also mentioend other differences such as memory and what protection level is used when configuring SNC.
> But for a true comparison, you'd have to look at all relevant aspects (latency, network overhead, ...).
Yes, I agree. No doubts here.
>Network performance overhead is usuallly worse with Kerberos than with PKI.
This is not true. When SAP is using SNC, the GSS-API standard is used and so the only network communication involves SAP software sending a standard GSS token from the workstation to the SAP server, and this GSS token is often about the same size, regardless of which mechanism is used, so any network performance differences are not related to the mechanism, but more related to the complexity of the cryptography used on each end (mostly on the server side).
>Second, you need to look at the specific usage scenario. For example, the first report referenced by Tim is an analysis about different Token Profile mechanism for WS Security, for one specific implementation. This does not allow to draw any conclusion for the SNC use case in general, and for sure not for a specific implemenation. It does not take the overhead for the encryption of the message content into account. Third, Tim associates PKI exclusively with asymmetric encryption. Yes, it is well known that asymmetric algorithms are slower than symmetric ones, but it is also well known that the encryption of the message content (by far the majority of the data) happens with symmetric encryption algorithms in the PKI scenario. With PKI-based SNC, you can even select a symmetric algorithm and use a more performant one that the ones that Kerberos prescribes.
Kerberos works with many different symmetric algorithms as well, so mentioning that the alg is selectable is not relavent to any comparison.
> To summarize, I will try and collect facts that will support the opposite point of view. From our practical experience, the performance overhead is not relevant, and criteria like consistency with SAPcryptolib, strength of security, ease of administration, choice of authentication and encryption mechanism, etc. are much more important.
>
> Peter -
No Relationship found to partner error..in Maintaining the ASN Number Ranges in SNC SC
Hello SNC Gurus,
We are working on one of SNC implementation project. We have to implement three Scenarios 1. Purchase Order Processing 2. Release Processing 3. Supplier Managed Inventory. I have done the configuration part perfectly in SNC for the above 3 scenarios.
I am facing an issue when i am performing the activity Maintaining the ASN Number Ranges activity.
Exactly the Error message is " No Relationship found to Partner **************(Partner No)
Here i created different partners to different Users for example for Customer Users and Supplier Users seperate business partners.
When i am trying to maintaining the ASN Number Ranges in SNC, I am getting the above issue. Not able to move forward and struckup this particular point. Please reply me the solution to overcome this issue, if anybody faced the above kind of issue earlier in your project expieriances.
Thanks,
SN.Hi Bharath,
Here in i am confirming the below answers for your questions
1. Yes its assigned to Partner. Its assigned to Customer.
2. Customer View -- Via /n/sca/ich_c t code.
3. I am defining the number range interval for the Customer. which my user id already assigned to Customer.
Here i am facing the issue in 2 activities. Facing the No Relationship Found to PartnerNo error in 1.. Maintaining ASN Number Ranges Attribute
Facing the error with " You are not authorized to maintain the Customer or Supplier " in 2. Maintaining ASN Number Ranges Intervals.
This is the input i entered in SNC Web UI path ASN Number Ranges Attribute Activity : Master Data --> Number Ranges --> Number Range Attributes: Interval Type : ASN, Customer : 1000 , Supplier : Vendor which is CIFFed to SNC. Append/Replace : A, Prefix : A2, No Overwrite : Check box should select , Max Number Length: 10
For Maintaining ASN Number Ranges Intervals activity : Customer : 1000, Supplier: 390001, IntervalFrom : 00000001 , IntervalTo : 19999999
Please let me know for any more information required. and reply back to me based in the above inputs mentioned is there any route cause to resolve this issue.
Thanks,
SN -
SNP Planned order - Doesnt get the complete BOM when CIFd to ECC
Hello,
When we create SNP Planned order in APO and sent to ECC, the Planned order doesn’t get the complete BOM, it works for the most part, except if we have Materials from multiple plants within the same BOM (sourcing from multiple plants).
Do we have to do any separate Configuration for this scenario?
We are planning only the End item in SNP, and we are generating the production version and PDS transfer to APO. We are not transferring all the materials to APO.
if we go to the Change mode of the Planned order in ECC and re-explode the BOM, I get all the components from the BOM, its just that when the planned order gets created thru the CIF we have this issue.
Any help would be appreciated.
Regards
GkHello Marius
Thank you for your quick response.
I looked at the SAP note you mentioned, the description seems to be matching with the issue we are having. Recently we had SNC implemented, and the note states that that can be the case why the components are getting deleted during planned order creation.
The only thing about this note is its very old, and we are having the SAP 6.0 and SCM 7.2 ,
Do you think this would be still applicable.
I will look into the details and let you know whether the note is applicable for us.
Regards
Gk -
SAP GUI with SNC logon and Hummingbird Exceed - SAP GUI window size issue
We have discovered an issue when SAP GUI 7.10 is used to logon via SNC and Hummingbird Exceed is used on the same workstation to logon to a UNIX system either via x-windows or telnet.
When the user logs onto a UNIX system using Hummingbird Exceed, then uses SAP GUI to logon to a SAP system with SNC authentication, the SAP GUI authentication works, but the favourites list is not fully displayed and has to be resized before any of the entries are available.
Has anybody else seen this issue, and do they know if there is a fix available ? We wondered if there might be an issue with fonts or some other sort of conflict between Exceed and SAP GUI, but it is strange that the problem only occurs if SNC authentication is being used, and when userid+password is used to logon to SAP the problem does not occur.
Cheers,
TimHello Tim and Wolfgang,
I was curious too as I found it interesting... so I tested a few combinations, but could not reproduce what Tim has described, at least not before my CPU reached 100% and the applications stopped responding (~2GHz processor, 1GB RAM, 48 kbps connection, latency ~ 2 x width of the Pacific Ocean, but Backend 7.00!).
However I did notice some indications which might be a help (based on 7.00!):
Back in 4.?? there was a problem in that large menus could not be searched(!). Sorry, I don't have access to SAP now, but from memory the note # was 444043 (or very similar) and introduced a form routine for large menus - from a printscreen I still have the message number which led me to the note - 'I476(S#)'.
The system certainly distinguishes between MENU_TYPEs and the above note corrections could be found in several locations relating to the SAP menu 'S', the role menu 'A' etc, but I could only see that for favourites 'F' this is implemented for the menu search (when searching, not when loading).
@ Tim: Ask you customer to create a favourites menu which only has 1 node or max 2 (certainly not more than 4!) and ~ 20 executable objects in it (not more than 30!)? Can they under any conditions achieve the described problem with such a menu?
If not possible to reproduce, then the closest I could guess is a maximum limit of 4 nodes and max 30 objects for a 'F'avourite menu, before it is a minimum candidate for "performance problems" and consideration to be converted to a role ('A'ctivity group) menu instead.
Sorry that I can only help by speculating, because I could not reproduce what you have described.
Hopefully this problem will not happen to me in the New Year, and hope you will solve it for the rest of the year
Cheers,
Julius
Updated memory (not RAM) by: Julius Bussche on Jan 3, 2008 9:07 AM -
SMI error on Web UI of SNC 5.1
Dear experts,
I'm working on SMI (Supplier Managed Inventory) implementation with SAP SNC 5.1. I'm trying to do a demo on SNC.
At moment I have:
1) Created our set of master data.
2) Configured the CIF communication to send from ECC to SNC the maser data: Material, Plant/Location, Vendor/Location, Contract.
3) Sent successfully the Master data from ECC to SNC according to the CIF communication defined before.
4) Configured Partner Profile in ECC.
5) Created a Business Partner in SNC.
6) Created a Transportation Line in SNC.
7) Created a demand in ECC.
8) Sent successfully the demand from ECC to SNC through PI (by PROACT and related XML).
9) I have approached the portal on Web User Interface where the Vendor creates the Replenishment Plan (SMI Monitor details), here I can see the material, the plant but there is an error with display of demand.
Here the error message is:
Time series error in class /SCF/CL_ICHDM_DATAAXS method /SCF/IF_ICHDMAXS_2_CNTL~SELECT
Planning object structure 9AINVM1 was not found
I have seen and implemented the customization of OSS note 1019289 but the error is still there.
I'm going crazy to solve it. Could you please help me?
Thank you very much in advance for your support.
Nicola
Edited by: PTP Team Accenture on Jul 11, 2011 9:57 PMHello Nicola,
To activate Planning object structure 9AINVM1 go to transaction code:/N/SCA/TSDM09 select inactive Times series data type INVM1(Note there will be 2 INVM1 time series data type one with active check box checked and second with uncheck check box select the second one uncheck INVM1).
Select Active planning Object structure and execute.
If you are still getting same problem then checkout the SAP note 1143456.
Regards,
Nikhil -
Error in SNC SMI Scenario - Demand Data is Not Getting Displayed
Hi All SCM SNC APO Members,
For SMI scenario I am sending Stock and Demand data from R/3 to SNC(5.1) System. The Stock data(Safety Sotck, Stock on hand etc) is visible in XML messages but demand is not getting updated in Supplier view in SNC.
What could be the reson behind that and how it will be rectified?
Please let me know which program and which table/keyfigure is responsible and how can i correct this.
I am using standard SAP settings.
Do i need to execute any report to update demand?
Regards,
SKHi SK,
Make the following SPRO settings if it is not there:
Step 1: Goto SPRO--->SAP SCM - Implementation Guide -->
SCM Basis-->
Processing Inbound and Outbound Messages-->
Process Types for Inbound Messages-->
Determine Default Process Types
Checked XML PROACT_I ProductActivityNotification - Inbound should be linked to ICH - Supplier Collaboration.
Step 2: Goto SPRO--->SAP SCM - Implementation Guide -->
SCM Basis-->
Processing Inbound and Outbound Messages-->
Process Types for Inbound Messages-->
Define Sender- and Recipient-Dependent Process Types
Click on new entry enter as follows:
XML Message: PROACT_I ProductActivityNotification
Send. System
Sender
Recipient : <Supplier_location>
Process Type :ICH - Supplier Collaboration
After above setting you should get Stock and demand in Web UI.
Regards,
Nikhil. -
Issue with parallel operation of SAP NW SSO 2.0 and SNC Client Encryption (Logon Groups)
Hi!
One of our customers is using the SNC Client Encryption solution to ensure encryption using SNC (based on Kerberos Technology) for their SAP GUI Dialog connections. They have lots of SAP backends DEV, QAS, PRD all with the SNC Client Encryption SNC Lib installed. The profile parameter snc/identity/as contains the following value: p:CN=SAP/<ServiceAccount>@<DOMAIN>.
Example: p:CN=SAP/[email protected]
The customer is using one AD Service Account "SNCServiceUser" with one registered SPN "SAP/SNCServiceUser" for all systems (yes, this is not recommended... but the case).
Important: All users use group entries in the SAP Logon (saplogin.ini). Means, for SAP logon the SNC name can not be manually configured on the SAP Front End. With group logons, the application server's SNC name is dynamically requested by the message server each time a SAP GUI connection is started. The SNC Name is greyed out in this case as dynamically obtained from the applications servers profile parameter snc/identity/as.
Now our customer implements SAP NetWeaver Single Sign-On 2.0 within his landscape. Based on the Secure Login Server 2.0 (SP3) he likes to use X.509 based authentication to his AS ABAP backends using SAP GUI SNC while others still use SNC Client Encryption.
Replacing the SNC Library on the AS ABAP
The Secure Login Library 2.0 (SP3) has been installed on one of the ABAP systems and the SNC Client Encryption SNC Library (which is based on SSO 1.0) is no longer used, thus we changed the parameter snc/gssapi_lib to point to the new SNC library. We removed the old PSE.ZIP containing the keytab and created the new SAPSNCSKERB.PSE incl. the keytab and proper credentials. To ensure parallel operation, we kept the snc/identity/as value as is = p:CN=SAP/[email protected].
After restarting the system with initialized Secure Login Library 2.0, still the SNC client encryption works fine for existing users.
The problem
We created on the Secure Login Server an SNC certificate for the AS ABAP which has the following X.509 Distinguised Name Fomat: CN=SAP/[email protected] This is to avoid having to change the snc/identity/as to an "real" X.509 DN which would lead to non-working SNC Client Encryption for all the other users using SAP GUI and logon groups.
As soon as we install the PSE via STRUST on the system the SNC Client Encryption solution stops working with error „Server refuses kerberos key exchange“.
As part of an pilot implementation we have installed Secure Login Client 2.0 (SP3) on some test PCs. The test PC with SLC is able to perform Single Sign-On with SNC based on X.509 (incl. Encryption) to the ABAP system.
Seems the SAP System now only tries to do X.509 based authentication thus key exchange fails. The problem is, we cannot change the snc/identity/as value because of the logon groups. If we were able to do so, we would in any case set the server identity to X.509 DN and in addition create the SAPSNCSKERB.PSE incl. keytab. This should work, as confirmed by SAP see this post.
Any ideas how to solve this and have both solutions in parallel?
Appreciate any help.
Regards,
CarstenHi all,
we was able to fix the issue. It was an issue with the customers cluster configuration and the $SECUDIR variable. This tricky issue leads to non working or sporadic working SNC Client Encryption...
This was how the configuration looks before:
Environment variable $SECUDIR is defined:
"/ABCDEF<SID>/usr/sap/<SID>/DVEBMGSxx/sec“
sapgenpse seclogin -l -v
running seclogin with USER="<SID>adm"
Credentials for username '<SID>adm':
0 (LPS:OFF):
(LPS:OFF): /ABCDEF<SID>/usr/sap/<SID>/DVEBMGSxx/sec/SAPSNCSKERB.pse
1 (LPS:OFF):
(LPS:OFF): /usr/sap/<SID>/DVEBMGSxx/sec/SAPSNCS.pse
After changing the $SECUDIR to "/usr/sap/<SID>/DVEBMGSxx/sec“ and re-creating the credentials, it worked like a charm.
As a result of this we can confirm, this configuration and SNC Client Encryption works with CommonCryptoLib in parallel to the SSO configuration.
And Valerie was right with 2. SLC starting from V. 1.0 SP2 PL3 was able to convert the CN= part of the SNC Name into an SPN, was my mistake. In addition SNC Client Encryption starting from Version 1 SP1 PL1 does this also.. just to make this clear
Thread closed hope this helps someone
Carsten -
ECC = SNC ReplenishmentOrderNotification custom message through SAP PI
Helllo,
I have one issue during proxy call in SNC. We are implementing SNC system with our ECC 6.0 system for PO processing, PO Confirmation Processing. The interfaces used is the standard SNC PI package from SAP through SAP PI; however, we have extended PO IDOCs in ECC for some Z-fields and created a new message type in SAP PI and mapped them properly. The problem, when it reached SNC, I checked the XML message and it was as expected with the new Z-fields but when the inbound proxy is called, I got the following error:
Error during proxy processing An exception with the type CX_SY_DYN_CALL_ILLEGAL_TYPE occurred, but was neither handled locally, nor declared in a RAISING clause The function call of /SCA/BIF_REPLORD_BO failed; a field may have been assigned to the parameter IS_REPLORD_NOTIF whose type is not compatible with this parameter
it seems that the newly generated service interface is not reconginzing the new ReplenishmentOrderNotification message structure with the Z-fields
How can we resolve this issue and make the inbound proxy reconginze the new message stucture?
By the way, I found this Badi: BAdI for ReplenishmentOrderNotification_In? and I have no clue how it works if we need to implement it?
Thank you,Hi Alan,
Please check below threads.
1. INTERFACE_REGISTRATION_ERROR (inbound ABAP proxy)
2. ABAP ->INTERFACE_REGISTRATION_ERROR for outboud sync ABAP proxy
3. INTERFACE_REGISTRATION_ERROR using File-to-File method
Regards,
Deepak -
SNC : Error while creating Subcon PO with Order (F) account assignment cat
Hi,
I am trying to implement Outsourced Manufacturing scenario with ECC 604 and SNC 7.0
We would like to demonstrate "Real Time Consumption" once a phase has been completed for WO in SNC.
For this, it is necessary create Subcon PO with A/c assignment category F. While trying to create PO, i get the following error:
1. Acct assignment determination is not poss.in the account assgnmnt manager
Message no. IAOM220
Diagnosis
Errors occurred during the determination of the account assignment in the account assignment manager. Thus it is not possible to determine the account assignment.
2. Characteristics for Controlling object have errors
Message no. IAOM034
Diagnosis
There are errors in the characteristics that are transferred when creating or changing a Controlling object.
System Response
Processing stopped.
Procedure
Look at the messages prior to this object in the error log. They give an indication as to which characteristics have errors.
3. Hierarchy level 01 not defined in business scenario Outsourced Manufacturing
Message no. IAOM027
Diagnosis
In business scenario 'Outsourced Manufacturing', hierarchy level 01 was accessed. There is no key characteristic defined for this hierarchy level.
System Response
Processing is terminated.
Procedure
Inform SAP or the provider of the business scenario, if the business scenario was not provided by SAP.
If you are responsible for the business scenario yourself, check the definition of the business scenario.
Settings specific to CO order that have been maintained:
IAOM1 - Maintain Controlling Scenario
IAOM2 - Maintain Controlling Integration
KA02 - Default Cost assgnmnet
Tick RT consumption in ME11 (Vendor Purchasing Info Record).
Any idea???
Regards,
SandeepDear,
Did you also experience the following?
We are at the following step in the scenario:
Supplier confirms production progress =>Manufacturingworkorderproductionprogressnotification XML is generated => POST component consumption is executed in the R/3 system (ECC 6 EHP4).
We see the following problems after posting the component consumption
- table EKBE_SC is not filled
- in transaction kkf3 => CO production order => no booking/posting of progress
- Component consumption is reflected in an outbound delivery with movement type 543, but it is missing the link with the purchase order+item (see screenshot below) => as a result any post issue booking is not possible.
Thanks for your help.
Kindr regards,
Stefan Hemeryck -
What are the options for shipping Clerk centric role/view in SNC
Hi,
Is there a security role which gives only Shipping clerk view / ASN Management.
Anybody got this requirement.
Nornally we give suppliers role and as per the Scenario they implemented - Go to that scenario and start confirming the order / publish the PO and create the ASN.
Any ideas on any specific Security role / User Setting in SNC -supplier view so that -when supplier logs in he can see only Shipping clerk responsibilites or ASN management only.
Would appreciate immediate answer please
Thanks,
MaheshHi Mahesh,
For ASN you can have following roles:
ASN Maintenance (Supplier):
Role: SAP_SCM_ICH_ASN_SUP
With this role, you can maintain data on supplier Web screens for advanced shipping notifications (ASNs). You can access the following Web screens:
1) ASN Overview (Supplier)
2) ASN Details (Supplier)
3) Create ASN
4) ASN History (Supplier)
5) Due List for Purchasing Documents (Supplier)
6) Receipts and Requirements List (Supplier)
7) Quick View (Supplier View)
8) Alert Monitor
9) Notification Administration
You can also access the Packing screen from the ASN Details screen. In addition, you can display notes and alerts about ASNs.
ASN Display:
Role:SAP_SMI_ASNDISPLAY
With this role you can <b>display</b> all advanced shipping notifications (ASNs).
ASN Super user:
Role:SAP_SMI_ASNSUPERUSER
You can use this role to carry out all activities for processing advanced shipping notifications (ASNs), for example, receiving deliveries or canceling ASNs.
You can copy above role create your own Zroles as per your requirement.
Thanks,
Nikhil -
Steps to configure R/3 system to Portal implementation
Hi
Please provide steps to configure R/3 system to Portal implementation
when i m opening standard iview in ESS in portal i m getting following runtime error.
com.sap.tc.webdynpro.services.exceptions.WDRuntimeException: Failed to resolve JCO destination name 'SAP_R3_SelfServiceGenerics_MetaData' in the SLD. No such JCO destination is defined in the SLD.
Please help
ThanksHello Bhupinder Singh,
To use ESS/MSS services in Portal follow the following Steps
Maintaining jCo Connections
Use
jCo connections are used in iViews to connect directly to a backend. They are delivered with the portal content and must be activated (configured to access a specific system).
jCo connections have two parts: one with <jCo name>, and the other with suffix <jCo Name>_MetaData. The first one transfers user-specific data within the scenario; the other transfers only the needed metadata. For the jCo with name <jCo name>, SAP Logon Ticket is recommended as an authentication method. For the metadata connection, a user ID and password is needed. A system user created before is sufficient.
Procedure
Within this guide we generically describe the step-by-step procedure for an example connection set. Perform all steps for the following jCos:
u2022 SAP_R3_Financials / SAP_R3_Financials_Metadata
u2022 SAP_R3_HumanResources / SAP_R3_HumanResources_MetaData
u2022 SAP_R3_SelfServiceGenerics / SAP_R3_SelfServiceGenerics_MetaData
u2022 SAP_R3_Travel / SAP_R3_Travel_MetaData
u2022 SAP_R3_SelfServiceGenerics_MetaDataFIN
1. Open the Web Dynpro Tool Applications overview page of your SAP NetWeaver Application Server Java: (http://<host>.<domain>:<port>/webdynpro/welcome)
2. Select the Content Administrator link (or use a direct link, such as http://<host>.<domain>:<port>/webdynpro/dispatcher/sap.com/tcwdtools/Explorer) and logon with j2ee administrator rights
3. Choose the Maintain JCo Destinations button.
4. The available jCos are displayed with a red light, indicating that they are not yet maintained.
5. In the JCo Destination Details iView, choose the Create button for the jCo you want to create.
6. In Guided Procedure Section 1: General Data, make the following entries:
Field name User action and values Note
Name <jCo_Name> or <jCo_name>_Metadata Do not change the client number (for example, 100)
Maximal Pool Size <keep default value>
Maximum connections <keep default value>
Connection Timeout (msec.) <keep default value>
Maximum Waiting Time (msec.) <keep default value>
7. Choose Next.
8. In J2EE Cluster, make the following entries:
Field name User action and values Note
Use Local J2EE engine <SID> on <host> Selected Keep default values
9. Choose Next.
10. In Connection Type u2013 Data Type, make the following entries:
Field name User action and values Note
Data Type Dictionary Meta Data Dictionary Meta Data selected for <jCo_name>_MetaData; Application Data selected for <jCo_name> maintenance
Destination Type Load-balanced Connection (recommended) For Dictionary Meta Data Connection, the value cannot be changed
11. Choose Next.
12. In Msg. Server Connection, make the following entries:
Field name User action and values Note
Message Server <select message server for your SAP ERP HR system> The values are taken from the technical system list of the SLD
Logon Group <select logon group for your SAP ERP HR system> The values are taken from the technical system list of the SLD
13. Choose Next.
14. In Security u2013 User Authentication, make the following entries:
Field name User action and values Note
Used Method <if using <jCo_name>, select Ticket>
<if using <jCo_name>_Metadata, value cannot be changed>
Name <enter connection user name> For example, rfcsysuser
Password/Confirm Password <enter a password>
Language English
SNC Mode Off For more information on SNC Mode, see the SAP NetWeaver 7.0 Help.
15. Choose Next.
16. In the Summary step, verify your settings, then choose Finish. The system displays a positive status message.
17. In the JCo Destination Details iView, choose the Test link. The system displays a positive status message.
If the test fails, try to ping the ABAP system using the URL link. Check your settings, especially SLD, and certificate upload.
Let me know weather your problem solved or not.
Please reward points if helpful
Please close the thread if problem solved
Thankyou,
Regards
Vijai
Maybe you are looking for
-
Don't want zip files as attachments
Sometimes a document such as Word or Excel will appear as a zip in my message when I attach it. I do not want to send a zip file. How can I stop Apple from converting it? I have an iBook G4 with Tiger. Yahoo says they are not doing it, problem is cau
-
Animation not showing in screen during audio recording
Happy New Year ; I am having a problem with getting an imported swf to animate in the screen while I am trying to do an audio recording. I set everything up as in the tutorial but it does not animate. Any suggestions would be greatly appreciated Than
-
General Ledger Accounting - SAP Library
To add a comment, please log in or register on the top of this page and choose Reply. Please write your comment in English. You can also go back to the SAP help page.
-
.
-
Hello Experts, I need to know which tables save personal data(last name, social security number, position, etc) for every user in the system. I have been searching and I know that ADRC,ADRP tables saved this kind of information, but I need an of