Question Re: Provisioning Portal Through CUP in Additional Q&A

Provisioning Portal Through CUP

Former Member — Wed, 16 Feb 2011 17:25:42 GMT

Experts,

I am configuring EP provisioning through CUP. Our GRC and EP UME systems are both mapped to the same (multiple) LDAP's as a datasource. EP and GRC user Ids are the same and it corresponds to the Active Directory ID (LDAP).

But when trying to create a request I keep getting the following Error: u201Cerror creating requestu201D. MAKES NO SENSE

What Iu2019ve done so far:

Installed eRTA

Created an EP connector and tested successfully

Mapped EP fields

Imported EP roles

Created EP (basic no approval stage) EP workflow

I am able to search for roles, as well I can see what roles my ID has within the portal. This tells me the connection is working just fine, right? My only guess is that maybe I have the parameters wrong within the connector or field mapping but I checked those against the guide they seem correct.

Any ideas?

Kyle

Re: Provisioning Portal Through CUP

Former Member — Wed, 16 Feb 2011 17:35:55 GMT

Hi Kyle,

You may want to go through the guide for GRC intergration with portal at this link.

http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/502a14db-6261-2c10-22b5-95117ab0e5ed?quicklink=index&overridelayout=true

Also, make sure you have the right initiators set up for portal stage as well.

Regards,

Chinmaya

Re: Provisioning Portal Through CUP

Former Member — Wed, 16 Feb 2011 19:47:05 GMT

Chinmaya thanks for the response...

I have validated within that guide and the config that my fields are mapped properly. Or at least what I think is correct. I've also checked that our RTA ID has the proper access, which it should

The only one is question is the user USER_DATA_SOURCE

Currently I have USER.PRIVATE_DATASOURCE.um: but I have tried the USER. CORP_LDAP as well and no luck. As stated earlier our GRC and Portal UME is connected to (multple) LDAP's (3) so i was thinking that might make a difference?

My work flow is very basic as well. I created a cutom request type with the "assign" action. Assigned this to my EP intiatior, created a "no approver" stage and used both the intitator and stage for my EP path. Pretty basic is you ask me. I also tried assign the custom request type with "create" and "change" actions but it didnt seem to make a difference.

Kyle

Re: Provisioning Portal Through CUP

Former Member — Wed, 16 Feb 2011 20:05:03 GMT

The best way to determine the user data source would be to open the user id in the UME. if the user id is kweckman, there is a field in the UME user details called unique id. The unique ID field would be xyz.kweckman.

XYZ would be your user data source.

I hope that helps.

Regards,

Chinmaya

Re: Provisioning Portal Through CUP

Former Member — Wed, 16 Feb 2011 21:27:22 GMT

Again thanks for your response...

I took a look at what my ID has for a user source and it was "USER.CORP_LDAP_NA.usckww06". So I tried

USER.CORP_LDAP_NA & USER.CORP_LDAP_NA.un: and had no luck. With the error message only being "error creating request" this is proving hard to trouble shoot.

Then I thought maybe there is something weird going on with trying to assign role to an LDAP ID. So I used USER.PRIVATE_DATASOURCE.um: (which from my understanding is used if your database is the data source in the UME). This way I would be updating a user that exists on the database and not LDAP.

After creating that user ID on the UME, pulling it into the request and attempting to submit I still am getting the same error. I think I am out of ideas!

Kyle

Re: Provisioning Portal Through CUP

Former Member — Wed, 16 Feb 2011 22:17:01 GMT

Can you paste your logs?

Regards,

Chinmaya

Re: Provisioning Portal Through CUP

Former Member — Thu, 17 Feb 2011 18:12:40 GMT

System logs?

Re: Provisioning Portal Through CUP

Former Member — Thu, 17 Feb 2011 18:43:49 GMT

Yes the log from CUP, from the time you get the error

Regards,

Chinmaya

Re: Provisioning Portal Through CUP

Former Member — Mon, 21 Feb 2011 19:43:37 GMT

Chinmaya

After a substantial amount of testing I have some findings to report back:

It appears there is a delicate balance between the "USER_DATA_SOURCE" and request ACTIONS. Also you need to have a (.) period at the end of the data source. Ours is "USER.CORP_LDAP_NA."

Here is what I found:

Request type 'Assign' with USER.CORP_LDAP_NA. = Provisioning successful

Request type 'Assign, Create' with USER.CORP_LDAP_NA. = Provisioning successful

Request type 'Assign, Change' with USER.CORP_LDAP_NA. = Provisioning FAILS!

This is really counter intuitive since our ID's already exist in the UME via LDAP. You would think the create action would not work rather that the change action.. In addition you don't get any type of error message indicating the ID already exists.

Any thoughts on this? This will be a huge problem for us since we are only using 2 request types for STANDARD requests. One will include actions type 'Assign, Create' and the other 'Assign, Change'.

Also, we have three LDAP's hooked to our UME as a user source and portal provisioning. LA, NA and CA. It appears when I switch our data source to "USER.CORP_LDAP_LA." And try to provision portal roles to that directory its fails. Any ideas why it would error out for this LDAP directory? And any thoughts on how we might use multiple directories for this field?

Regards,

Re: Provisioning Portal Through CUP

Former Member — Mon, 21 Feb 2011 19:50:36 GMT

Hi Kyle,

I have had similar problems when provisoning to the UME, I havent been able to explain that so far. I might raise a message to SAP, if I cant find anything on the marketplace.

Also regarding your LDAP, it looks like you have 3 subsets NA,LA and CA. I am guessing there would also be a superset which contains all these. Maybe you can work with your LDAP adminstrator to see if they have that structure in place.

Regards,

Chinmaya

Re: Provisioning Portal Through CUP

Former Member — Mon, 21 Feb 2011 19:56:04 GMT

Thanks Chinmaya

As far as I know we don't have a Superset LDAP directory. We have them all separately connected to the UME. I'm guessing this will be an issue huh? Maybe we just create 3 different connectors with the different data sources.

Reagrds,

Kyle

Re: Provisioning Portal Through CUP

Former Member — Mon, 21 Feb 2011 20:30:12 GMT

Chinmaya,

Any ideas on this part? It should work!

I have a user in the LA directory which I can find in the UME. I manually change the data source field in the EP connector from _NA. to _LA. Try to provision that user with the same access as I was to users in NA and it errors out. You shouldnt need to change anything but that DATA SOURCE field if you wanted to swith the LDAP data source. Everything else should be the same RIGHT! ugh.

Re: Provisioning Portal Through CUP

Former Member — Mon, 21 Feb 2011 20:48:54 GMT

Hi Kyle,

Let me try and understand the scenario. You have 3 LDAP sources, Lets say active directory so shouldnt you also need to have 3 differnet Server names in the LDAP connector(For the three different AD's)? Or are they all on the same box?

Or do all users exist in all 3? If not are you using LDAP as user search data source? In that case it might be a problem, because you can have only one search source for the user.

Regards,

Chinmaya

Re: Provisioning Portal Through CUP

Former Member — Mon, 21 Feb 2011 21:07:51 GMT

Here is the scenario:

CUP user source = UME

UME user source = 3 LDAPS

Additionally CUP is using all 3 LDAP's for requestor authentication so we do have connectors for these in CUP.

That could be really confusing...

Additionally we have the EP connector where you need to put USER_DATA_SOURCE for the users you are provisioning to. I put the USER.CORP_LDAP_NA. as you directed (comes from the general information tab) while testing provisioning since that is where my ID exists. and it worked.

When I want to test provisioning to a user that exist in USER.CORP_LDAP_LA. my thought is you would need to change the USER_DATA_SOURCE to USER.CORP_LDAP_LA. since the user exists there stated by the general information tab.

But when I change this field I am getting "Error creating a request" when I look at the other fields It doesn't appear anything else needs to be changed in the EP connector fields.

I also tested this using various requests type with combination of assign, change, and create actions.

Re: Provisioning Portal Through CUP

Former Member — Mon, 21 Feb 2011 21:32:22 GMT

Hi Kyle,

Well one portal system can have only one LDAP source. Although what I do not understand is why it didnt work with the other LDAP source. DO you think it is a feasible option to create three portal connectors as well? Maybe that solves the problem if it works.

Also, I just found out that the create/delete user actions for portal works only after SP12 patch 1? Maybe you are not at SP12 Patch 1?

Regards,

Chinmaya

Re: Provisioning Portal Through CUP

Former Member — Wed, 23 Feb 2011 23:13:55 GMT

Chinmaya

I FIGURED IT OUT! Well sort of...

It appears that the reason I couldn't provision to those other directories was because my field mapping was not correct for each LDAP connector under the "provisioning" section.

Additionally a GRC miracle happened. I was able to put all 3 LDAP's separated by a comma in the USER DATA SOURCE within the EP portal connector field and provisioning actually works for all of them.

The bad part is we still cannot use our custom request type with actions 'Assign' and 'change' So still need to figure out what is going on here.

Thanks again for working through this with me

Re: Provisioning Portal Through CUP

Former Member — Thu, 24 Feb 2011 02:16:37 GMT

Thanks Kyle, thats good to know, I didnt know about the sepration from coma. About the create and change request are you on SP12 patch 1 or later?

Regards,

Chinmaya

Re: Provisioning Portal Through CUP

Former Member — Thu, 24 Feb 2011 15:47:42 GMT

Chinmaya

Yes, we are on SP 12 and I found that this is a know issue by others:

The problem is we are facing this with portal provisioning and user default as I understand are only for ABAP systems. So I don't know if creating a dummy user default will work in this case. Not to mention I'm not really too familiar with user default in the first place. Why does SAP standard functionality not work? It's beyond me.

Kyle