scheduled automatic upload of roles/user mapping from R/3 to EP6

[johan_winkelmans]

EP6.0 offers a nice tool to <b>upload roles</b> together with the <b>user mapping</b> from an R/3 backend system to the portal. This works very well, but in an environment where the user mapping happens on the backend system this <b>manual</b> process has to be repeated to keep the user mapping up to date.

It would be very useful if this process could run in <b>batch mode</b> and could be <b>scheduled</b>. Does anyone has a solution for this problem?

The way the portal user administration is designed works maybe very good for small companies, but for large companies with many users a <b>batch upload tool</b> is really needed!

<b>People from SAP</b> have told me that they are thinking about such a tool, but the pressure from the customers is not high enough to put it on their project list. So maybe we can <b>unite forces</b> to increase pressure on SAP project management.

[Former Member]

We have taken a different approach. We create and manage all roles and role asssignements in an LDAP directory. The same LDAP group (role) is mapped both to a portal role in EP and it is also synchronized with our CUA using the SAP utility "Ldapsync". Ldapsync can be run batch - it is actually a job called RSLDAPSYNC_USER which you can parameterize and schedule as you like. We have further enchanced it by writing our own Function Modules which replicate the same LDAP role to every child system of the CUA where that role exists.

The end result is that both the portal and CUA and all child systems use the same role assignements which are maintained in one place which is LDAP.

I looked at the other utilities that you mention, but they required too many manual steps.

[johan_winkelmans]

Thanks a lot for sharing this interesting information.

The reason why we would like to use our <b>backend system</b> for <b>role assignment</b> is that on the backend system all information exists that is needed for automatic role assignment.

For example:

- when a new employee is created in the HR module of R/3 a portal role for employee should be created automatically in the portal

- when a budget is attached to a user (in FI), this user should get a role in the portal automatically for budget management.

Does the role assignment and user creation on your LDAP happens manually or do you have a kind of automatic role assignment on your LDAP server?

Best regards,

J. Winkelmans

[Former Member]

Hi Johan,

Even i'm also facing the same situation,

did you found any solution for this.

and one more thing.

When i import the r/3 roles into portal some default iviews are created,but certain properties of Iviews are different for example "SAP GUI" it comes a "web gui" though i need to have "WinGui" . does any body knows how to change this..coz i cannot keep changing in all the iviews

Thanks in advance,

-Krishna

[johan_winkelmans]

Dear Krishna,

There are a few solutions for this problem and we are investigating some of them now:

- you can use an LDAP server. Transfer users and the groups to which they belong from the R3 system to LDAP. The groups correspond to the roles the users have. The portal can use the groups on the LDAP server. The portal roles have to be attached to the groups and not to the users.

- we are also thinking about writing a JAVA program that automizes the manual role upload that SAP delivers in the portal. The KM part of the portal contains a scheduler which can be used to schedule the upload of uesr mappings from R3 to the portal.

- you can also make an ABAP web service that is called from a program on the portal to transfer the usermapping. The program makes use of the UME API.

- Or you can make an ABAP program on R3 that calls a JAVA program on the portal that makes use of the UME API to store the user mapping on the portal.

your iview question:

Maybe you can change the default setting for the preferred GUI in the master iview that is used for the creation of the iviews. When you create a new iview the portal creates a delta link based on the master iview., so when you change the master iview all new created iview based on the master iview will have the correct setting immediately.

Best regards,

Johan

[Former Member]

Dear Johan,

I can try out the LDAP solution, we dont have a KM installed hence schedular part is ruled out. yes writing ABAP or Java process is the last option we have to use, as we cannot go for a CUA in the portal server.

and regarding the default iview problem ,

https://www.sdn.sap.com/sdn/collaboration.sdn?contenttype=url&content=https://

its the same suggestion which you gave.

Thanks for your answers,

-Krishna

[johan_winkelmans]

Dear Krishna,

You certainly should read the following page in the manual: http://help.sap.com/saphelp_nw04/helpdata/en/49/9dd53f779c4e21e10000000a1550b0/content.htm

It is possible to use the ABAP user management in R3 as the data source for the portal. Roles in R3 will be seen in the portal as groups. So with this solution the user management remains on the R3 system. With stack 9 of the portal there is no restriction on the number of users anymore.

Best regards,

Johan

[SamuliKaski]

Except that in the portal case ABAP roles as J2EE groups doesn't work anymore in SP9, as we unfortunately discovered in the current portal project I am involved in.

SAP supports ABAP roles as J2EE groups only on XI and there is the restriction that a portal can't be installed on the same J2EE Engine. If you ask me it was a really poorly documented shutdown of a nice feature. See notes 718383 and 780679 for SAP supported UME configurations.

I can only imagine the amount of dissatisfied customers SAP will have on their hands once live EP 6.0 SP2 customers using the ABAP role integration will upgrade their portal...

[johan_winkelmans]

We have tried to install the portal SP10 on a J2EE with ABAP roles as J2EE groups and it works very well.

Did you experience any problems? SAP doesn't support this kind of installation but we are using it because it is a solution for our problem. The alternative would be to program something by ourselves, but this solution would also not be supported by SAP.

[SamuliKaski]

Well, with pre SR1 the dataSourceConfiguration_r3_roles_db.xml configuration can be chosen on install. In SR1, at least when I did my last installation two weeks ago, it wasn't even possible anymore to choose dataSourceConfiguration_r3_roles_db.xml when installing.

About the project I mentioned in my previous post: I came into the project after the portal had already been installed (SP3) and patched to SP9 with the configuration file dataSourceConfiguration_database_only.xml. Afterwards it wasn't possible to switch to dataSourceConfiguration_r3_roles_db.xml in the portal UM Configuration and forcing the change in the Config Tool didn't work either (portal didn't come up after the change) so we weren't even able to get it running although we wouldn't have gone live with a non SAP supported setup either way.

Now you got me interrested. How were you able to setup a portal with the configuration file dataSourceConfiguration_r3_roles_db.xml? As I mentioned before I didn't even have the "ABAP role" option anymore when I did my last SR1 installation.

[johan_winkelmans]

We have 2 portal SP10 installation, both make use of the configuration file dataSourceConfiguration_r3_roles_db.xml.

The first one is based on a existing WAS ABAP 6.40 installation. To install the portal on it as an add in installation the JAVA stack has to be installed first. When you choose the J2EE for XI installation the configuration file dataSourceConfiguration_r3_roles_db.xml is used. When you install the portal on this J2EE stack it works fine.

The second installation we have is a portal on a standalone J2EE stack. I have upgraded this installation already several times. In order to have ABAP group support I changed the data source configuration manually. The portal doesn't allow you to switch to the desired configuration, but if you switch it first to 'database only', you can switch it again to 'WAS ABAP user management' after the J2EE engine has restarted.

If you have problems with this configuration when the J2EE is starting up, you have to check that the correct users (J2EE_ADMIN, J2EE_GUEST) and roles (SAP_J2EE_ADMIN and SAP_J2EE_GUEST, SAPJSF) exist on the R/3 system, according to the manual.

But I didn't have any problem after switching the data source.

How did you solve this problem? Did you do some programming yourself to get the ABAP roles as groups in the portal?

[SamuliKaski]

Oh, now I understand. With a Add-On installation it is still possible to select "ABAP roles".

It is possible that the portal didn't come back up because of the missing users in the backend, we didn't dig into it any deeper since we had a CSN open and SAP told that even if we were to get the ABAP roles working that configuration wouldn't be supported.

We didn't solve the problem, not entirely anyway. We are using dataSourceConfiguration_r3_rw.xml with manual Role Upload (incl. Role-User Assignments) until we are able to switch to a Active Directory (LDAP) based solution. The R/3 system will still be master but user accounts, group assignments (roles) etc. will be synchronized to the Active Directory using the SAP provided LDAP connector.

[SamuliKaski]

I heard yesterday from a reliable source at SAP that SAP will reintroduce the ABAP roles in SP12 so that it will be fully supported also for the portal scenario.

[juergen_kremp]

Hello,

it got a little later than SP12 and will be SP13 now.

SAP Note 834518 (once released) will annouce this change (together with some other corrections in the UME/ABAP connectivity).

Kind regards,

Juergen Kremp

[johan_winkelmans]

Hello Juergen,

Thanks a lot for your update. This is really good news for us!.

Best regards,

Johan

[Former Member]

Hi Johan,

did you fixed the automatic upload issue? If yes - how?

because I'm in the same situation right now ...

Thanks a lot in advance.

Best regards

Michael