Working scenario - Portal UME with LDAP
Hi Experts,
I've installed Portal sneak preview which is 7.0 SP9 in my laptop and at the moment i'm using Web AS database is the user storage for portal.
Now wanted to change the user storage to any ldap (for windows) server and wanted to look at the working scenario.
Now ..
1. Which is the recommended LDAP server for windows, to the above scenarion
2. Can i use LDAP is the user storage for sneak preview versions.
3. Any useful documents to achieve this.
4. Please remeber i'm on Windows XP.
Please leave your valuable suggestions
Thanks
MMK
Mohan,
Here is the LDAP related documentation on the UME data source LDAP:
http://help.sap.com/saphelp_nw04s/helpdata/en/48/d1d13f7fb44c21e10000000a1550b0/frameset.htm
-Michael
Similar Messages
-
Automatic upload of roles from ECC to portal (UME with LDAP)
Hi experts,
This thread reopen the question asked on the following message : automatic upload of roles from BI to portal
However, it concerns this time "UME with LDAP".
Problematic :
SAP Library 04s tells us that is not yet possible to automate role replication (or role assigment replication) from ABAP Based back-end to Netweaver Portal. Only manual process for initial upload is possible.
Source = http://help.sap.com/saphelp_nw04s/helpdata/en/41/5e4d40ecf00272e10000000a155106/frameset.htm
Questions :
1 - Did anyone ever try to implement such an automatic tool ?
2 - What if I'm not able to write on the Active Directory ? I am still able, at least, to automate role assignment replication from ABAP Based back-end to Netweaver Portal (ie. UME with LDAP) ? Directly from SAP R/3 to EP through UME, without passing through Active Directory since the group field is not maintained in AD.
Many thanks for your inputs
Alexis MARTINHello,
As I did not read the previous thread I don't know what exactly you are trying to achieve, but I can tell you about what we have done - as far as it is not too late yet.
We use the portal with integration to a BI system. In the ABAP stack we have lots of roles with menu items for hundreds of reports. We want the users to see these roles in the portal.
First we have used the role migration tool of the portal to upload these roles. There is a Java API for executing role uploads from code. You need to create a webservice in the java stack to call this api, and can call the webservice from ABAP.
However it is just a question of time and role size until this will not work at all. Standard role migration is more or less crap, stability is a problem. It also creates a lot of logs in the PCD and thus fills the database with trash. (After a few OSS messages there is now a program for deleting logs + you can turn of logging.) Also upload of larger roles takes up to an hour, and you alwasy have the problem that your portal roles are not up to date during the day.
When I got completely fed up, I have implemented an own navigation connector. When you log on to the portal it will connect to the ABAP stack via RFC, load the role, and generate the portal menu from it. It uses caching, but on every logon it checks whether the role has been updated in ABAP since the last time it was loaded. It is up to date, faster then PCD navigation, and you need absoluetely no periodical synching at all. I cant even understand why this is not offered by SAP per standard!
Drawback is that it will of course only work for the menu items, and only menu items with an "URL-type" are supported. I'm prettry sure however that it would be possible to implement a few other types as well.
Let me know if you are interested in the solution, I can give you a few additional details: oliverDOTsvisztATwienerbergerDOTcom
Oliver -
Hi Experts,
I've installed Portal sneak preview which is 7.0 SP9 in my Desktop and at the moment i'm using Web AS database is the user storage for portal.
Now wanted to change the user storage to any ldap (for windows) server and wanted to look at the working scenario.
Now ..
1. Which is the recommended LDAP server for windows, to the above scenarion
2. Can i use LDAP is the user storage for sneak preview versions.
3. Any useful documents to achieve this.
4. Please remeber i'm on Windows XP.
Please leave your valuable suggestions
Thanks,
Lokesh.Hi,
Hi Experts,
I've installed Portal sneak preview which is 7.0 SP9 in my Desktop and at the moment i'm using Web AS database is the user storage for portal.
Now wanted to change the user storage to any ldap (for windows) server and wanted to look at the working scenario.
Now ..
1. Which is the recommended LDAP server for windows, to the above scenarion
I guess on Windows the best choice is ADS. If I get your requirement correctly you want to install a local LDAP Server on your machine correct? I don't know if it is possible to install ADS standalone on Win XP. In general you can use any LDAP Server so you should be able to get it working even with openLDAP if you are fimiliar with the LDAP protocol. I think openLDAP is not supported by SAP so maybe you should try something like SUN Directory Server (You can download a trial from the SUN Website). There is a version for Windows and it works without problems on WIN XP (I've tried a couple of times)
2. Can i use LDAP is the user storage for sneak preview versions.
I bet you can. You just have to choose the appropriate XML-File for UME Userstore that supports LDAP as UME and it should work.I've not tried with trial version but I think there are no limitations in the trial version regarding UME configuration.
3. Any useful documents to achieve this.
Check these out:
http://help.sap.com/saphelp_nw70/helpdata/EN/63/14f5b51a6eff429f2d8b2063400e82/frameset.htm
http://help.sap.com/saphelp_nw70/helpdata/EN/48/d1d13f7fb44c21e10000000a1550b0/frameset.htm
http://help.sap.com/saphelp_nw70/helpdata/EN/37/cfd93f130f9115e10000000a155106/frameset.htm
All you have to take care of is to choose the appropriate hierarchy supported by UME to store your user information within your directory (all this is described in the pages linked above)
4. Please remeber i'm on Windows XP.
I do
I hope this helps
Cheers -
Revertion of Portal UME from LDAP to DB Only
Hello All Portal Gurus,
I have one query. Can i revert back my Portal UME database from LDAP read only + DB configuration to DB only. I know the default configuration of the UME after installation remains DB only. But if we change it to LDAP ADS readonly, then can we change it back to DB only by any means or by any action?
Need the suggestions from Portal Gurus...
Thanks in Advance
Regards
SrinivasHi Srinivas,
how did you try to reset the UME settings? Using portal system administration?
If yes, go for the config tool. For further help see:
[Configuring UME|http://help.sap.com/saphelp_nw70/helpdata/EN/eb/00954081efb90ee10000000a155106/frameset.htm]
HTH,
Carsten -
Hello everybody,
i have some problems.
My initial position:
Installed dual stack SAP NetWeaver Portal 2004s
--> Datasource for UME: ABAP-System
Installed OpenLDAP
Have anybody some guidelines for the configuration a UME with LDAP.
I had read all SAP help entries. Not so helpful.
I couldnt change DataSource, i dont know why ;-(
Please help
reneHi,
If you are using SAP Web AS ABAP User Management as datasource, you cannot change to any other data source configuration. For details, see SAP Note [718383|https://www.sdn.sap.com/irj/servlet/prt/portal/prtroot/com.sap.km.cm.docs/oss_notes/sdn_oss_bc_jas/~form/handler].
http://help.sap.com/saphelp_nw04/helpdata/en/49/9dd53f779c4e21e10000000a1550b0/frameset.htm
Regards,
Praveen Gudapati -
Portal integration with Agile systems
Hi All,
Has anybody worked on Portal integration with Agile systems. I mean pulling data from Agile systems.
Any specific documentation would be of help.
Regards,
TomTom,
you may want to check this
https://www.sdn.sap.com/irj/scn/advancedsearch?query=agile&cat=sdn_all
Thanks
Bala Duvvuri -
UME with ABAP AS and LDAP Datasource
Hello SDN´s
We have tried very hard for the last days configuring the ume-xml for the following scenario:
- LDAP is used to authenticate the user
- AS ABAP is used to store the roles of the user (because they automatically becomes groups in the portal)
- the portal and the ABAP-system are on different servers
Given facts:
1) we canu2019t synchronize the roles of the ABAP system to the LDAP
2) we have to use the open-LDAP for the authentication
3) DataSources are readonly
4) User can have similar or different userid´s on the DataSources (Mapping required)
Therefore, we read the user and account information from the LDAP and groups/roles form the ABAP AS.
Result:
a) user with similar userid on LDAP and ABAP AS: These user were no longer able to log on to the portal
b) user with different id´s (mapped) on LDAP and ABAP: Can log on
Questions:
- Is it true that similar userid´s leads to inherent problems of the UME Persistence Manager?
- Did we set up a wrong config-xml?
- Is there any other way how we could authenticate to the LDAP and having the Roles of a user read from the ABAP system dynamically?
Thank you very much for your help
Sincerely, A. HunzikerHi Andre,
Not sure if my remarks below can help you but I do hope that it can shine you some light.
We have LDAP as our main UME, which is configured in our Portal7.0. This means that security groups created in LDAP are "replicated" into the Portal. We created Portal Roles which are assigned to the security groups created in LDAP. We also use SSO and it was setup via the SPNego Wizard (http://help.sap.com/saphelp_nw70/helpdata/EN/45/40a0de773a7527e10000000a114a6b/frameset.htm). This way, the user only needs to login via Windows and access the Portal without having to login (when users have the same Windows userID as that of their SAP ID). If the users have a different userID between Windows and SAP, then they do a user map under personalization of the Portal.
To connect our Portal to our backend systems, we created a reference system (http://help.sap.com/saphelp_nw70/helpdata/EN/89/6eb8deaf2f11d5993700508b6b8b11/frameset.htm) and we have our Portal certificates in all backend systems (http://help.sap.com/saphelp_nw70/helpdata/EN/d3/41c8efb31d11d5993800508b6b8b11/frameset.htm).
With the above, users have SSO from Windows to Portal and via the reference system, they can enjoy SSO as well into our backend systems.
Basically we have control what the users can see from the Portal (directly from LDAP security groups with users assigned to that) and what the user can do on backend is still maintain in the backend authorisation setup.
Hope that can help you.
Ray -
Parent / Child Groups in Portal with LDAP
Heya,
we are using EP 7 on SP 10 (NW 7), for User Authentication we use the UME with a configured (writable) LDAP
Server as backend with a flat hierarchie. We have a Federated Portal Landscape with
3 Portals connected to one "main" portal and using Remote Role Assignement on the main portal for
our right managenemt.
Remote Roles which are added to Groups are working fine, but as soon as we try to use
the parent/child group functionality we are facing the problem that the user who logs on
has no access to anything in this group.
According to http://help.sap.com/saphelp_nw04s/helpdata/en/af/0cfc3f09c2c442e10000000a1550b0/frameset.htm
the only restriction for the use of child / parent groups is that:
"If user management is set up with write access to an LDAP directory, the following restriction applies:
When assigning members to a group that is stored in the LDAP directory, you can only assign users or
groups that are also stored in the LDAP directory. You cannot assign users or groups from the database
to groups from the LDAP directory. "
We fullfill the above condition (everything is LDAP based) - sooo: Any Hints for me / Someone facing
the same problem.
Thanks,
MarcoHi Murali,
User Configuration
A particular company has the following setup:
● Two roles: External and Internal
● The role Internal contains users who also belong to two user groups: N.America and Asia
● User A belongs to both the role Internal and the user group N.America
● User B belongs to both the role Internal and the user group Asia
● User C belongs to the role External
Conditions Defined in Portal Display Rules
1. If Group = N.America
Then Portal Desktop = Orange Flavor
2. If Role = Internal
Then Portal Desktop = Green Flavor
3. If Group = Asia
Then Portal Desktop = Blue Flavor
4. If Role = External
Then Portal Desktop = Red Flavor
Note that user A matches conditions 1 and 2; (ii) user B matches conditions 2 and 3; and (iii) user C matches condition 4.
Results
According to the list of priorities, these are the results:
● User A receives portal desktop "Orange Flavor" (according to condition 1 which has priority over rule 2)
● User B receives portal desktop "Green Flavor" (according to condition 2 which has priority over rule 3)
● User C receives portal desktop "Red Flavor" (according to condition 4)
still any help on portal disktop rules to can see this link http://help.sap.com/saphelp_nw70/helpdata/EN/4b/29cf122f414721964269e1b675d62c/frameset.htm
if helpful don't to give points
thanks
best regards
ep -
Config UME with ABAP+LDAP datasource
Hi all,
We are implementing an EP installation. We want to reuse the abap role assignment for the portal roles and we require a SSO solution based on SPNego.
Now we can implement each on it's own fine. The question is how we can connect the ume to use both abap and ldap datasource. I opened an OSS about it and they said it's possible, supported but I'm on my own when it comes to implementing it (or consulting offcourse).
Anyone had experience with this configuration or can provide me with the datasource schema file?
Thank in advance,
EricTry the following:
1. Download the SPNegoWizard_645.zip (for 7.0) SPNegoWizard_640 (for 6.40)from SAP Note 994791 and unzip it.
2. Adjust the user running the SAP system in Active Directory
3. Copy the EAR and XML Files from the SPNegoWizard.ZIP file to a temporary directory on the server.
4. Open up the Visual Administrator. Logon with the admin ID.
5. SID ->Server -> Services -> Deploy
6. Open the Config Tool. (Yes to using DB settings)
7. Select UME LDAP Data
8. Browse to the XML file you copied earlier. (dataSourceConfiguration_ads_readonly_db_with_krb5.xml)
Click the upload button.
9. Select the Configuration file you just uploaded. Click OK on the Warning message.
10. Setup the Connection details as specified below:
Server Name: xxxxxx
Server Port: xxxxxxx
User: SAPService<SID>@domain.com
Password: xxxxxx
Use UME unique id with unique LDAP attribute (checked): samaccountname
User Path: dc=<domain>,dc=com
Group Path: ou=xxxxxx,ou=xxxx,dc=xxxx,dc=xxxx
11. Click the Test Connection button you should see:
Click Close when done.
12. Click the Test Authentication button, enter NT user ID and NT password, and click the authenticate button and you should get a success message:
13. Select cluster-data Global Server Configuration services com.sap.security.core.ume.service
14. Edit the ume.admin.addattrs.
Add the values: krb5principalname;kpnprefix;dn
Click the Set button.
15. Click the Save button or File -> Apply.
16. Close the Config tool and restart the JAVA engine.
17. After the engine is restarted, continue on with the Kerberos configuration.
18. Open up the SP Nego Wizard by going to the following URL: http://<server>:<port>/spnego
19. Logon with the Administrator user ID.
20. Select the check boxes for the u201CService user is created and configured in Active Directoryu201D and u201CUME configuration includes SPNego specific settingsu201D
Click the Next button
21. Click the Add Kerberos Realm button and enter your domain name (e.g. company.com)
22. For the Realm Configurationu2019s KDCs (Key Distribution Centers) put in <KDC host> and 88 for the port (the port should already be filled in.
23. In the KPN (Kerberos Principal Name) section enter the Service User Name & Password.
Service User: SAPService<SID>
Password: xxxx
Leave LDAP Host - blank
24. Click the Next button
25. Select Prefix Based for the Resolution Mode and Click Next
26. In Policy Configuration we want to create a new policy called spnego. Tick Basic password Fallback (when SSO do not work) and tick SSO with Logon Tickets. Click the Next button.
27. Click Finish on the Confirmation screen.
28. Close the browser and restart the engine.
29. After the engine has finished restarting, continue with the final steps.
30. Open up the Visual Administrator. Logon as the Administrator ID.
31. SID Server Services Security Provider
32. Go into change mode by clicking the change button.
33. On the Runtime tab Policy Configurations tab Select ticket from the Components list.
34. On the Authentication tab for the ticket component select Authentication Template: spnego
35. Now go to the useradmin service (http://<server>:<port>/useradmin) to test the Kerberos SSO. You should get signed on without entering a user name or password.
You are done! -
About EP(on UNIX) UME integration with LDAP
Hello guys,
We want that UME use LDAP(read-only) as data source .
Our EP installed on UNIX , LDAP on Windows.
Connection data
Server Name: sapsso
Server Port: 389
User: p106658 (an administrator user)
Password: ******
User Path : ou=test,c=us,o=gnpjvc
Group Path: ou=test,c=us,o=gnpjvc
We fill the data reference document on help websit :Configuring the UME to Use an LDAP Directory as Data Source .
But test connection always failed.
Is there any solution?
Thank you!
LouisHi,
check your JDK version, some SUN version (>1.4.2_13) won't work with Kerberos. Start with SAP Note 968191 to gain more information.
For checking the Java JDK parameters and recommendations / bugs, take a look at these Notes:
716604 for the Sun JDK (Windows, Linux, Solaris)
716926 for the HP JDK (HP-UX)
716927 for the IBM JDK (AIX)
1234382 for the IBM JDK IT4J (IBM i, iSeries, OS/400)
717376 for the IBM JDK Classic (IBM i, iSeries, OS/400)
746299 for the IBM JDK (Linux for zSeries)
810008 for the IBM JDK (Linux on POWER)
861215 for the IBM JDK (Linux on AMD64/EM64T)
br,
Tobias -
Link ECC roles to Portal roles (Portal is using LDAP source for UME)
Hi all,
If a user is assigned a certain ECC ABAP role, they should also receive a related portal role. Our portal is using LDAP.
If our portal ume source was an ABAP system, I think it would be easy to achieve the ECC to ABAP role linkage.
We were thinking of developing a UME java webservice and have an ABAP proxy class consume it to allow our abap system to assign the correct portal role, and delete the portal role.
Any other ideas?Rajendra,
Thx for your reply. Can you provide any more details as to the design of your solution with the web service? We are thinking of running a batch job nightly with a some mapping table in ECC to determine what ABAP role should link to the portal group then call the webservice to add the user to the portal group or delete the user from the portal group.
A second question is...does SAP Identity Manager offer any solution for this type of requirement?
Thanks -
Sync User Locks from LDAP(Microsoft AD) to Portal UME
Hi All,
Currently we have our Portal UME connected to LDAP (Microsoft AD) as our data source. I can bring up all Active Directory users in Portal, however the users that are locked and disabled in Active directory are still active in portal. To be more clear the expiration date of a userid in AD does not sync with Portal UME account expiration date. Is there a way to bring in the expiration value in to portal?
Regards,
JunaidConfig tool may not have expiry date as mapping in Additional LDAP prop tab, you may need to look for configuration file where you can map the logical attribute to the LDAP.
Licensing impact depends on your contract with SAP.
However you can check portal users with USMM at the end of URL.
E.g.
remove 'irj/portal' from your initial portal link and add 'usmm' -
CUP 5.3 with SAP EP 7.0 (UME as LDAP Read Only)
Hi experts,
I have a simple question to figure out whether or not it's possible to :
- use CUP 5.3 to ONLY assign UME portal groups on EP 7.0, considering the fact that my portal has UME as Read-only LDAP?
SAP Notes and SAP docs (including How-to Configure SAP BusinessObjects Access Control .3 for SAP NetWeaver Portal 7.0) don't provide an answer for this.
If you follow the documentation with a Portal UME as read-only, you will have an error like : "Can not modify firstname attribute on Active Directory..."
To sum up
- EP 7.0 has UME = Read-only LDAP
- CUP 5.3 has UME = Read-only LDAP
- We want to use CUP to assign portal groups without modifying users file. According to documentations and previous posts on SDN it seems that everyone has write access on the Active Directory servers What if we don't?
Many thanks for your answersProblem was solved implementing patch 2 for GRC 5.3 - SP08
VIRAE08P_2-20002300.SCA Patch for VIRAE 530_700 SP08
The issue mentioned in my above message was described in SAP note 1168508 -
Problem with LDAP in BEA Portal
Problem with LDAP in BEA Portal
I have a list of 50 user which should be cerated in portal staging(devlopment) machine and should be transfered to
production machine using LDAP
Steps which i followed to create Users
1.Create User Profile with 2 parameters branch and Role
2.I have list user in the Xls file with Username,password ,branch and Role
3.Write a java File which will read the Xls File
4.The users are created in the staging machine for the portal
Steps which i followed in LDAP to tranfer the created User form Devlopment to Production
1.Export the created user from Devlopment (which was moved as .DAT in my local directory)
2.import the user from local direcory to production machine
The Users are imported in the production machine with username and password but the role and branch values are empty
We need a solution for importing the user with role and branch corresponding to each user.
Thanks in Adv
SureshIn Portal 8.1, user name and password in stored in LDAP where as user profile values are stored in database. That is the reason you are not able to see the user profile values.
Check once again whether you can see these values through admin tool. In case,it is not(after confirmation again),you might have to use APIs to do this for you incase you dont want to manage through Admin Tool.
Thanks,
Prashanth Bhat. -
Problem with users in portal - login conflict with LDAP.
Hi.
Let me describe our problem:
We've a EP5 portal with LDAP conected to a central LDAP server, users access with the same user and password to all the different systems.
The problem happens to users who have theyr passwords expired. We already set to 0 the password expiration days to avoid future problems but that didn't applied to the already expired ones.
This affected users cannot change the password due to problems with the connection rights to LDAP server.
We're trying to find the place there it's set that the user is in some kind of "password expired" status, directly in a database table if neccesary, to change the status manually, as system does not allow os to set it by user administration in portal.
Any suggestions would be appreciated.Restoring expired Portal passwords
Solved
Maybe you are looking for
-
Extending Wireless Coverage; What's wrong with this picture?
I would like to extend the coverage of my home WiFi network. I have an Airport Extreme 802.11n+Gigabit Ethernet as my central router which connects to my cable modem. Unfortunately I don't have a couple of Airport Express gadgets handy to extend my A
-
Calculate Excise amount as per duty rates check box in J1IEX
Hi, In J1IEX Duty rates tab, there is one check box as Calculate excise duty base on duty rates , but thta check box is Disable i How to make it as enable so that we can click to to recalculate the excise rate, also my problem is that i
-
Can't see Macintosh HD when trying to reinstall
In short: Trying to reinstall Yosemite after erasing disk, can't see Macintosh HD when asked to select install disk, can I lay see recovery (which is locked). Can see disk under disk utility but no Erase tab visible, only First Aid and Partition tabs
-
hi my classic ipod 160 gb can't write more than 5gb , and after that it's go slowly and transfer the songs to much slow , when i reject it, it delete every thing i put inside , and told me to restore the device !! and the loop start again !
-
Wi-Fi Problems on my Early 2008 MacBook runnning OS X 10.7.5
Hello. I have a Early 2008 MacBook running OS X 10.7.5. When I first got my Macbook for Christmas, it had OS X 10.5.x, and the Wi-Fi connection was running fine, even when I was two rooms away from the router. Then I bought and installed OS X 10.6.3,