SSO Help - Portal to ABAP via logon tickets

Question

Hi All,
I've done this configuration in the past but it seems that the process has changed a bit and I'm in need of some advice.
I have a portal system which I've setup SSO. The SSO is done through Kerberos and the users are pulled from LDAP. Users login to their windows account, they hit the portal without having to login again, perfect. I used the new SPNego setup wizard to do this.
Now the issue I'm having. Portal user ID's are not the same as ABAP ID's. I have used a blank attribute in Active Directory (specifically "extensionAttribute7") to fill in the ABAP user ID's. I have modified the data source XML file in the portal to look like this:
<nameSpace name="$usermapping$">
<attributes>
<attribute name="REFERENCE_SYSTEM_USER">
<physicalAttribute name="extensionAttribute7" />
</attribute>
</attributes>
</nameSpace>
I have changed the UME property to look like this:
ume.usermapping.refsys.mapping.type = attribute
When I try to access an SAP report through the portal I get the error:
The initial exception that caused the request to fail was:
Ticket contains no / an empty ABAP user ID (see note 1159962)
My ABAP system is setup to create and accept logon tickets. Certificates have been exchanged on both systems (checked through NWA). It looks like the saplogonticket isn't picking up the ABAP user ID that I've stored in AD and mapped to in the XML file.
In the Java system, my logon ticket stack looks like this:
EvaluateTicketLoginModule SUFFICENT
SPNegoLoginModule OPTIONAL
CreateTicketLoginModule SUFFICENT
BasicPasswordLoginModule REQUIRED
CreateTicketLoginModule REQUIRED
Can anyone see an obvious step that I'm missing? Any tips would be appreciated.
Portal system is running 7.01 sp8
ABAP is running 7.01 sp8
Cheers,
Richard

Answer 1

Hi Arjun,
No I'm not using user mapping. I want to pass my ABAP user ID from an attribute I'm using in Active Directory. For some reason the sap logon ticket isn't picking up my username from the attribute when I try to go from portal to ABAP.
Hi Samarth,
Not sure I understand the request. The user is coming from the portal and is attempting to run a ABAP report from the portal. The user names are not the same. I am attempting to map the ABAP user ID to an Active Directory attribute that I can pass to the sap logon ticket.
Hi Siva Kumar,
Yes I checked the VA as well, the entries are there.
Thanks all for the suggestions. Keep them coming if you have more, they are greatly appreciated.
I basically followed this from SAP to set it up
http://help.sap.com/saphelp_nw70ehp1/helpdata/en/0b/d82c4142aef623e10000000a155106/frameset.htm
You are using an LDAP directory as a data source for the User Management Engine (UME). The user IDs for ABAP systems are already available in the LDAP directory. You no longer need to define a user mapping for each user, as the data is already available in the LDAP directory.
Cheers,
Richard