- Read SAP Note 538405
- Read SAP Help: http://help.sap.com/saphelp_nw70/helpdata/en/b4/9aa8862e714e6db8e74e48e5d3283b/frameset.htm
- Download the webdispatcher from http://service.sap.com/ ->Support Packages and Patches-> Entry by Application Group-> Additional Components-> SAP Kernel-> SAP Kernel 32 Bit or SAP Kernel 64 Bit-> SAP Kernel 7.01 -> Operating system platform-> Database independent ->The package is called sapwebdisp_<>-<...>.SAR, where <> indicates the patch level
- Create a direactory /usr/sap/SID/webdisp on server and copy the downloaded webdispatcher sapwebdisp_35-10006297.sar
- Uncar the downloaded file
- /usr/sap/SID/SYS/exe/run/SAPCAR -xvf sapwebdisp_35-10006297.sar
- chown SIDadm:sapsys *
- Run this commnad to install webdispatcher: sapwebdisp.pfl -cleanup -shm_attach_mode 4 -auto_restart -bootstrap
- Installation process provide the values to below parameters:
- Hostname of Message Server (rdisp/mshost):messageserver hostname
- HTTP Port of Message Server (ms/http_port): 81Instance_Number
- Unique Instance Number for SAP Web Dispatcher (SAPSYSTEM): Give a unique name
- HTTP port number for SAP Web Dispatcher: 280_Instance_Number
- Create configuration for s(mall), m(edium), l(arge) system (default: medium): l
- At the end you will see this message, SAP Web Dispatcher bootstrap ended (rc=0), ð *** SAP Web Dispatcher up and operational (pid: 12956) ***
- Then start the webdispatcher: sapwebdisp pf=sapwebdisp.pfl -checkconfig
- Make sure the dispatcher started :
- ps -ef grep webdisp
- SIDadm 14561 11954 0 16:32:13 pts/2 0:00 grep sapwebdisp
- SIDadm 12956 1 0 16:26:29 pts/1 0:01 sapwebdisp pf=sapwebdisp.pfl -shm_attach_mode 6
Thursday, March 26, 2009
Installing SAP Webdispatcher
How to start/stop SDM on UNIX
- Log in as SIDadm
- Navigate to the usr/sap/SID/INSTANCE_NUMBER/SDM/program directory of your J2EE Engine installation.
- To stop the SDM Server, execute the command: StopServer.sh password=sdm_password
- To start the SDM Server, execute the command: StartServer.sh
Wednesday, March 25, 2009
Creating Jco Connections in Portal
- Maintain the default URL of the IGS as documented in SAP note 704604. The URL should be http://host:4SN80
- Make sure the IGS has been installed correctly on ECC as per SAP note 454042.
- Access the WebDynpro Content Administrator (open a browser and point to: http://host:5SN00/irj
- Navigate to Content Administration -> Web Dynpro
- Click the “Maintain JCo Destinations” button
- Click the Create link for SAP_R3_Financials_MetaData
- Accept the default for the J2EE cluster and click Next
- Make sure that “Dictionary Meta Data” is selected and click Next
- Select the right message server and then click Next
- Enter a user name and password that was defined earlier in the ECC system. Then click Next.
- Verify that everything looks okay, and then click Finish. The status indicator should turn to green
- Next, set up the SAP_R3_Financials connection
- Accept the default for the J2EE cluster and click Next
- Make sure that “Application Data” is selected and click Next
- Select the right message server and then click Next
- Select Ticket for Used Method in USer Authentication. Then click Next
- Verify that everything looks okay, and then click Finish. The status indicator should turn to green
- Continue the above procedure with other connections.
Single Sing On with Kerberos Authentication
- WebAS Java 640 SP15 or higher
- JDK 1.4 or higher
- Microsoft Windows Server 2000/2003 Active Directory
How to start the wizard:
2) In the SAP NetWeaver Administrator by following the path System Management -> Configuration -> SPNEGO Configuration Wizard. Steps: 1) Create and configure a service user on the Active Directory Servers (ADS), which act as a Kerberos Domain Controllers (KDC) with the below properties
- The password of the user must never expire.
- The user must be enabled to use DES encryption.
- setspn -a HTTP/FQDN serviceusername
- setspn -a HTTP/hostname serviceusername
- Do a quick check with setspn -L to see the settings are succssful.
- setspn -L serviceusername
- You should get the below screen.
- Logon to the Configtool and navigate to cluster-data -> UME LADAP data
- We have to connect j2ee UME to ADS. In order to do this, upload dataSourceConfiguration_ads_readonly_db_with_krb5.xml attached to the SAP Note 994791
- Enter the data in Connection details
- Make sure to test the connection and Test Authentication
- Restart the J2ee system.
4) Run SPNego wizard
- Start the SPNego wizard
- Select the check box Service user is created and configured in Active Directory to confirm that this step is completed
- Select the checkbox UME configuration includes SPNego specific settings to confirm that this step is completed
- Choose Next to proceed
- In the Jerberos Realm screen, Enter the name of the Kerberos Realm or Windows Domain inside the input field Realm Name.
- Choose Add KDC to add the host address and port for the Key Distribution Center (KDC).
- Choose Retrieve Principal to retrieve the AS Java Kerberos Principal Name (KPN), registered for the AS Java service user in the LDAP Directory. a. Enter the Service User Name. b. Enter the Service User Password.
- Choose Type Principal to manually enter the AS Java’s KPN. a. Enter the KPN of the AS Java in Principal. b. Enter the password for the AS Java service user in Password
- Choose Next to proceed
- Choose the Resolution Mode to use
- Use the Test resolution Mode functions to test the resolution of user ids from the configured domains
- Choose Next to proceed
- Choose the policy configuration to configure for Kerberos. a. Choose Use existing to select an existing template for Kerberos. b. Choose Create new to create a new policy configuration template.
- Add fallback authentication mechanisms for the case when Kerberos authentication fails. a. Choose Enable Basic Password Fallback to enable the login modules for authenticating users with a user id and password as a fallback mechanism. b. Choose Enable SSO with SAP Logon Tickets to enable the login modules for authenticating users with logon tickets as a fallback mechanism
- Choose Next to proceed
- Review the displayed information about the Kerberos configuration changes you made. The confirmation screen shows the configuration information for each of the configured Kerberos Realms or Windows Domains.
- Choose Finish to commit the changes. The wizard proceeds to the Final step and displays a confirmation of the changes you made.
- Restart J2ee system.
Final Steps:
- Logon to Visual Administrator and navigate to Server -> Services ->Security Provider, in Runtime -> Policy Configurations -> Components, select ticket.
- Switch to Edit mode and select spnego from Authentication template
- Select com.sun.security.jgss.accept from Components and choose Login Modul com.sun.security.auth.module.Krb5LoginModule
- Add isInitiator=false
- Change the Internet Explorer settings to use Integrated Windows authentication and test.
- Restart J2ee system.
TEST SSO:
Hit the URL http://host:port/irj/portal, It shoud not ask for username/password.
Enable Debug mode in J2EE System
Sample Login Module Stacks for Using Logon Tickets
Configuring the J2EE Engine to Accept Logon Tickets
- In the Trusted Systems section, choose Add Trusted System -> By Querying Trusted System.
- The System Landscape Directory (SLD) opens automatically and lets you select the system you want to add. Select the system and choose OK. The connection details for the selected system are displayed automatically.
- Enter your user name and password in the provided fields and choose Next.
- The details about the selected system’s certificate appear. To add the system, choose Finish. If you want to make changes, choose Back.
- Export the ticket issuing Trusted System certificate.
- In the Trusted Systems section choose Add Trusted System ® By Uploading Certificate Manually.
- Enter the System ID and Client in the provided fields.
- Browse to the location of the system’s certificate. Select the certificate and choose Open.
- Choose Next. The information about the system and the certificate is displayed. To add the system as trusted, choose Finish. If you want to make changes, choose Back.
Add the login module EvaluateTicketLoginModule (or EvaluateAssertionTicketLoginModule) to the login module stacks for the J2EE Engine policy configurations of the application components that accept login tickets for SSO. To do this, use the Security Provider Service of the Visual Administrator.
- In the Security Provider Service choose Runtime -> Policy Configurations -> Authentication tab.
- Select the policy configuration for the application component to accept logon tickets from the Components list.
- Choose the Switch to edit mode button.
- Choose Add New. The list of available login modules for the component appears.
- Choose the EvaluateTicketLoginModule (or EvaluateAssertionTicketLoginModule) from the list and choose OK.
After you complete the wizard, the ticket-issuing system is shown in the Trusted Systems list. The J2EE Engine accepts logon tickets that have been issued by the corresponding server.