Visual Administrator Roles

Is there a way to create Java roles in order to allow an user to see certain services of the Visual Administrator?

Not too sure but check this if it could be any help
http://help.sap.com/saphelp_nw04s/helpdata/en/76/d8644233cfc553e10000000a1550b0/content.htm
Vara
[PLEASE REWARD FOR POSTING]

Similar Messages

Where the roles are displayed in Visual Administrator

I have created the roles through user admin i.e using
http://<server-name>:50000/useradmin/ . In Visual Administrator where I could see those roles.

hi
Visit the Cluster --> Server --> Services --> Security Provider -->User Management Tab
You may search for your users there and assign/re-assign the roles to them.
Regards
Ak.
Message was edited by: Arunkumar Ravi

Problem when login to Visual Administrator

Hi all,
Here is a problem while login into visual administrator.when i run go.bat file it is throwing a syntax error.
So,can anyone suggest me how to resolve.
As i need to active the services to run AE for Netweaver PI.
Thanks,
Kalyan.

Hi,
Try logging on the ABAP stack withthe J2EE_ADMIN and changing the password there.
Or you can update the password in the secure store area (admin/password<SID>)of the configtool.bat.
Try this very simple procedure and also try to check the below things also but try the first option.
Please follow steps one by one. it should resolve your issue.
Reasons for this issue; plz check it one by one.
1. Did you configure with ABAP? if yes, plz do below steps:
Plz assign SAP_J2EE_ADMIN role to J2EE_ADMIN user.
2. VA login dialog; Please check Port(5xx04) is right?
3. Admin password is wrong or lockecd.
If yes, Activate SAP* then reset or unlock it. For this jus follow below steps:
If you forgot or lock "Administrator or J2EE_ADMIN" password just follow below steps:
STEP-1: Enable "SAP*"
1.Start the Config Tool C:\usr\sap\<SID>\<engine-instance>\j2ee\configtool\configtool.bat
Ex: D:\usr\sap\F02\JC00\j2ee\configtool --> configtool.bat
2.Goto cluster-data --> Global server configuration --> services --> com.sap.security.core.ume.service
3.Double-click on the property "ume.superadmin.activated = TRUE"
4.Double-click on the property "ume.superadmin.password=<Enter any password ex: abc123>"
5.Save.
6.Restart the engine.
STEP-2: Login with "SAP*" into portal
1. http://<host>:<Port>/useradmin/index.jsp
2. Enter userid / password as" SAP* / <password ex: abc123>"
3. Search for "Administrator" user
4. Reset or change password for "Administrtor"
STEP-3: Disable "SAP*"
1.Start the Config Tool C:\usr\sap\<SID>\<engine-instance>\j2ee\configtool\configtool.bat
Ex: D:\usr\sap\F02\JC00\j2ee\configtool --> configtool.bat
2.Goto cluster-data --> Global server configuration --> services --> com.sap.security.core.ume.service
3.Double-click on the property "ume.superadmin.activated = FALSE"
4.Save.
5. Restart the engine.
STEP-4: Login with "Administrator"
1. http://<host>:<Port>/useradmin/index.jsp
2. Enter userid / Password as "Administrator / <password>
3. it will ask change password just change it.
Please reward points if it helps
Thanks
Vikranth

Visual administrator use remotely

Dear Experts,
How I can connect visual administrator and config tool through remote pc with using terminal server .Is there any separate utility available ?
one more question - I want use user administration through UME brower but when I am creating any user it is giving error "user can not create" . As per the ADM 200 I have to add SAP_BC_JSF_COMMUNICATION role to the user SAPJSF through GUI, I have added this role to the user but it is stuck at user comparison , giving error "role is locked by sap* user" .
pl. help , Is there any other process ? or where i am wrong .
regards
sonal.

Hai,
You can use Xmanager 3 which will help you in connecting to Visual admin and Config tool.
You can download the Evaluation version from any site and after 30 days you can use the Xmanager -Passive option life long.
Process to connect to Visual admin/Config tool from remote PC:
Start Xmanager you will get 'X' icon in the system tray, then start your session and run the 'go' script from your OS level. Speed will be a bit on the lower side, since you are exporting the DISPLAY from your remote server.
The role SAP_BC_JSF_COMMUNICATION has been locked by user SAP, ie,. somebody has been working with SAP user and editing or displaying the above said role. Due to this you are not able to compare the role.
Edit role SAP_BC_JSF_COMMUNICATION in PFCG.
1. Click authorization tab.
2. Click Change Authorization Data Button.
3. Expand all trees.
4. Asign full authorization at all authorization object.
After this try to create Users in UME.
Regards,
Yoganand.V
Edited by: Yoganand Vedagiri on Dec 19, 2008 11:33 AM

Visual Administrator - SLD DataSupplier write socket error

Hello,
I have install SAP Solution Manager 4.0 and am trying to test the Http://host:port/SLD connection. I can successfully login as the J2EE_ADMIN but the administration tab does not show as selectable and all the documentation we have come across is advising us we need to get into the Administration area to configure the SLD.
We have tried to assign the LcrAdministrator role to the user and assign SAP_SLD_ADMINISTRATOR on the ABAP end as well but still had no luck.

Hi,
Here is the complete SLD configuration steps:
http://<host>:<port>/sld. say http://localhost:50200/sld
Enter user name and password, and then choose OK.
Give some valid name like "J2E" as object server.
Go to administration link on top, there click on the button to start the server. The server must be running.
Click on the import link, and in that page click on Import CR content from the server button. It will import all required CR components in the list. (OR) alternatively, browse to the
<server>\usr\sap\<SAPSID>\SYS\global\sld\model\
Import first Cimsap.zip and cr_content.zip (MS Windows) and then choose Open. It will take 10 to 15 minutes to complete.
Open Visual Administrator. Choose "SLD data supplier" service under Server-> services node.
Go to HTTP Settings, enter the following
Host : localhost
Port : 50000
User :
Password :
Go to CIM Client Generation Settings on same window
Enter the following
Host : localhost
Port : 50000
User :
Password :
After Saving the details click on CIMClient Test
A pop-up screen shows CIMOMClient object generation and connection test successful. Click Ok. Now SLD is configured.
Regards,
Srinivasan T
Helpful answers=>POINTS

Session Expired after logging on to Visual Administrator - SLD Config

Hey Guys,
I have a NW2004s installation, both ABAP and Java stack, with UME pointing to the ABAP stack.
I created a user in ABAP stack, and assigned the J2EE_ADMIN role to this user.
I try to log into the Visual Administrator with this user. The login is successful.
However right after I navigate to the sld data supplier node and click it, I get the error message, Session Expired.
I think it is because I am not authorized to configure SLD or something like that.
When I created the user in the ABAP stack I entered all the roles for the user with which I am logging on to the Visual Admin:
SAP_SLD_ADMINISTRATOR
SAP_SLD_CONFIGURATOR
Anyhelp so that I can get over this problem and configure the SLD in the system.
Thank You.
Sumit.

J2EE_ADMIN role has all the rights(configure SLD etc) , make sure you configure the SLD and import the CIM model content you can login to SLD at http://<host>:5XX00/SLD and then access the data supplier bridge
where XX is your instance number

[SAP NetWeaver 2004] Can't logon in Visual Administrator

Hi community,
I can't login in Visual Administrator with SAP NetWeaver 2004 - Trial Version on Linux (NW4)
I try to logon using J2EE_ADMIN/ADMIN as login/password but when I try to connect it remains in connecting state.
In the logs I can see the following error:
Caller J2EE_ADMIN not authorized, only role administrators is allowed to access JMX
User J2EE_ADMIN on SU01 transaction seems correctly configured, and has the role SAP_J2EE_ADMIN
Where do I go wrong?
Thanks, Valerio
PS I know this release is old and not supported but it's not so resource-demanding as the 2004s version

Hi Valerio,
I think you dont have correct password maintained in the secure store. please try this.
1. check if j2ee_admin is locked or not in SU01.
2. if you know j2ee_admin's correct password
- go to configtool, by running /usr/sap/<SID>/DVEBMGS00/j2ee/configtool/configtool.sh
- in the secure store maintain the password of j2ee_admin in the field "admin/password/<SID>"
- set and this will ask you to restart java cluster.
- restart the java cluster by going through SMICM tcode in ABAP side. SMICM > Adminstration > J2ee cluster global > send hard shutdown > with restart.
Hope this helps.
Debasis.

Missing Visual Administrator

Hi there,
I'm searching the visual administrator on Unix (only j2ee) in the directory /usr/sap/<SAPSID>/JC<xx>/j2ee/admin/, but there is no subdirectory admin
The system is NetWeaver CE 7.1 ... Is it possible to install the system without visual administrator?
Thanks and best regards
Max

Hi Soujanya,
I want to assign SLD Roles to Group NWDI.Administrator. Could you please guide me where can I do so?
Thanks & Regards,
Prashant

Remoteaccess to Visual Administrator

Hello,
we have a Portal 7.0 and a lot of consultants have installed the visual binaries on their pc and are now able to configure/change things in the visual administrator. For production system we are planning to reduce this access. Can someone tell me with role/authorization you need to access the visual administrator? Is it possible change the security in the way, that no remote login is allowed?
Thanks
Alexander

Hi,
1. If your visual administrator (P4 Port) is accessable and not protected by any firewall you will not be able to restrict the physical access from outside. This access should only be possible from within your company network so I guess all the consultants who are accessing the J2EE using a local visual admin are located on the internal network and have a direct TCP Connection to the engine. If you know the IPs restrict the access using a firewall or just allow the access from a couple of hosts (e.g only yours) This only works if you have a static IP or if you can make sure that if you are using DHCP the DHCP Server always assigns the same address to your machine
2. Let's assume you are not able to restrict the physical access to the engine than you can still restrict the access on a user base. In order to access the Administration you have to be aware of any user within the j2ee who has appropriate administration rights (e.g. the Administrator user)
If the consultants know the Administrator password you should change it using the configtool (modify the password in secure store etc.)
If they have personalized users than just remove all the administration rights. Without administration rights a user is not able to access the J2EE Administration (You will get an error message in the status bar saying "Error while connecting")
Cheers
Marcel

Creating more administrator accounts for Visual Administrator

Hi
Is it possible to create more accounts for Visual Administrator besides the Admin account. So for example if I wanted to let the development team have access to Visual Admin but I dont want them to use the Administrator account ???
Regards,

Boris,
If you want to use the Visual Admin, use these instructions:
http://help.sap.com/saphelp_nw04s/helpdata/en/23/355d87507141548c6f893f28aac7f5/frameset.htm
If you want to use identity management (user administration console) use these instructions:
http://help.sap.com/saphelp_nw04s/helpdata/en/4a/e06f429c789041e10000000a1550b0/frameset.htm
Both UIs do more or less the same thing. With Visual Admin you can assign security roles. With identity management, you can assign UME roles and actions.
The identity management UI has been updated in NW2004s if you are using NW2004 use the instructions here:
http://help.sap.com/saphelp_nw04/helpdata/en/70/9be23d44d48e5be10000000a114084/frameset.htm
Feel free to ask more questions if you have trouble. I maintain some of those help files so I would be interested to find out where you are having trouble.
-Michael

J2EE_Admin cannot access Visual Administrator

I hope all you gurus are doing well.
OK, so here is the issue, I am trying to configure Adobe Froms on one of our SAP systems. Part of the installation requiers me to access Visual Admin. I am able to access VA using the emergency user but I cannot make any changes to the settings. I am NOT able to access the VA using J2EE_ADMIN or any other user. I keep on getting the following error:
Caller Visual_Admin not authorized, only role administrators is allowed to access JMX
When I initially encountered the error I accessed VA using SAP* and there was no Administrators group. So I created the group but I am not sure if that made any difference. I've checked the roles in SAP and J2EE_ADMIN has the SAP_J2EE_ADMIN role assigned to it.
I have also created other users and assigned the SAP_J2EE_ADMIN role to them but it still is not working.
Other than that is there anything that needs to be done within VA to add certain privilages to a Group?
How do I create the Administrators group?
Is SAP* limited to what it can do in VA?

Hi Glen
This forum is for Java EE 5 - which means that it's focused on NetWeaver 7.1 and up. These versions do not have Visual Administrator anymore. I think the default administrator is also now called "Administrator" (not "J2EE_Admin" anymore) - but I could be wrong on this last point.
Please could you clarify which version of NW you're using?
Thanks
Stuart

Visual Composer role.

Hello all,
When trying to access VC, I get the error "You don't have a Visual Composer role". I added the following roles to the J2EE_ADMIN ID under the User Management area (UME).
CAFDeveloper
CAFAdmin
CAFUIAdmin
But, I still get the error.
What else can I do?
TIA
Edited by: Casey Harris on Feb 25, 2009 9:26 PM

Hello and thanks for the response but I wound up using the roles below (they worked for me):
Role: pcd:portal_content/administrator/super_admin/super_admin_role
Desc: Super Administration
Role: pcd:portal_content/every_user/general/eu_role
Desc: Standard User Role
Role: pcd:portal_content/com.sap.gm.cnt/core/VCRole
Desc: VCRole
Best Regards

Can't Log into J2EE Engine Visual Administrator

I cannot get logged into our J2EE Engine Visual Administrator on our SAP Portal. After I enter my userid and password (which I know are valid) I get a progress bar which progresses to approx 50%, then errors out with the message: 'Error while connecting. Cannot open connection on host: <IP-address> and port: <port>'
I found this document to troubleshoot the problem:
https://cw.sdn.sap.com/cw/docs/DOC-29070?treeid=DOC-7447
It says the problem is likely that the P4 port is incorrect or the wrong transport layer is selected in my connection string. It suggests using the config tool to find the P4 port and has a diagram showing the port in the local properties. When I go to my config tool, I am missing the Local Properties box. My screen only shows the Global Properties. Is there somewhere else to check the port. I am pretty sure I have the right port because if I try to connect using an incorrect port I get the error message instantly.
The transport layer in my connection string is 'default'.
Can anyone help? Thanks.
Our Visual Administrator version is 6.40 Support Pack 22. The java version is 1.4.2_13.

Hi Kathryn,
P4 port is used for connecting to VA. P4 port will be 5<Inst no>04.
Please check if you have this port while connecting to VA. You can check this port in the index page of your portal.
Can you try restarting the portal instance ??
Also you need not enter userID for logging into VA. By default it uses "administrator" user.
You may also check if the administrator user is locked.
Revert if the issue persists.
Cheers.,
Raghu

OES MAPI problem of "Assigning Principals to an Administration Role"

Hi,
I meet the problem of programmatically Assigning Principals to an Administration Role using Oracle Entitlement Server Management API. I can successfully run the sample code following the <Developer Guide>, Chapter 5.4.3 Assigning Principals to an Administration Role
My code snippet is like this:
List<PrincipalEntry> principals = new ArrayList<PrincipalEntry>();
 principals.add(new BasicPrincipalEntry
 ("weblogic.security.principal.WLSUserImpl", "Lisa"));
 //Grant the users in the list the role
 admManager.grantAdminRole(adminRole, principals);
And no error or exception occurs in java app side or oes_admin side. But when login to http://vmware.localdomain:7001/apm admin GUI, I could not login with Lisa.
I also tried manually assign app1 with delegated admin role, and then Lisa can successfully login to admin GUI.
Then I run the app program to programmatically assign app2 with delegated admin role to Lisa. Login with Lisa could not see app2.
I have checked the system admin "weblogic" login to admin GUI and it can see that app2 already have Lisa listed on the external user of delegated admin of app2.
I even checked the DEV_APM.JPS_CHANGELOG in the oracle database schema for oes. I can see the changelog of java app assiging operation.
Can anyone tell me the reason why programmatically assign user to an delegated admin not work correct? Is there some mistake steps in my java app code or there is a bug in OES product?
I use the OES 11.1.1.5 version with Oracle Database 11.2.0, Weblogic 10.3.5 on Oracle Enterprise Linux 6 32bit.
Thanks very much.

Thanks very much for all the reply posts. With the suggestions from yours, I tried distribute the policy and finally it works!
The code snippet is from 4-8 Using the distributePolicy() Method , listed below:
//get the PolicyDistributionManager
PolicyDistributionManager pdm =
app.getPolicyDistributionManager();
//distribute policies
String distID = pdm.distributePolicy(true);
DistributionStatusEntry status = pdm.getDistributionStatus(distID);
System.out.println("Start distribute policy");
while (status.getPercentComplete() != 100) {
Thread.currentThread().sleep(200);
System.out.print(".");
status = pdm.getDistributionStatus(distID);
System.out.println("Finish distribute policy");
There is another trick that I discovered from DEV_APM.JPS_CHANGEBLOG:
If this is the first time that user be assigned as a delegated admin, you should also grant user with applicaionRole "APMViewer" to the application "oracle.security.apm"
You can refer to the sample code from 2-9 Assigning Principals to an Application Role , also listed below:
ApplicationPolicy app = ps.getApplicationPolicy("oracle.security.apm");
AppRoleManager roleMgr = app.getAppRoleManager();
//Construct the list of users to be granted
List<PrincipalEntry> principals = new ArrayList<PrincipalEntry>();
principals.add(new BasicPrincipalEntry
("weblogic.security.principal.WLSUserImpl", "Nick"));
//Grant the users in the list the role
//admManager.grantAdminRole(adminRole, principals);
AppRoleEntry appviewerRole = roleMgr.getAppRole("APMViewer");
roleMgr.grantAppRole(appviewerRole, principals);

Functional and Technical Administration Roles in Solution Manager

Hello
A big company has been implementing new functionality in Solution Manager during the last couple of years, they started with System Monitoring and EWA, Maintenance Optimizar, then Project Implementation, now Service Desk and ChaRM. This is company has a wide open structure in IT and a discussion has been raised about who is the owner of soluton manager in IT.
In my experience I always propose two main roles one is Technical Administrator Role and the other is Functional Administrator role. The former is more basis oriented, in charge of the installation and update of stacks in Solman, basic-initial configuration and then working mainly in setting Solutions, RFCs, System Monitoring, EWA, SAP services, OSS connections, Diagnostic, E2E Root Cause Analysis and also support in ChaRM (in setting up the transport routes, security)
On the other hand, I support a role of SolMan Functional Administrator which deals with Implemenation side, ASAP methodologies, business process definition, integration with ARIS, setting up project standards, coaching Project Managers, ensuring good application information. Also in Service Desk and ChaRM, setting the process, customizing, implementing and controlling that things are running smooth in SolMan productive.
I would like to get from you your inputs and experiences regarding how to set-up those roles, whether there are clear lines to divide responsiblities or what kind of definitions should be made.
Many thanks
Esteban Hartzstein
Director
Tebyon Consulting

As recommended by some colleagues I am also investigating Customer Center of Excelence as a reference to define roles and responsibilities, particularly in the concept of Application Lifecycle Management.
Any other input is welcome.
Regards
Esteban

Visual Administrator Roles

Similar Messages

Maybe you are looking for