Java UME to ABAP backend

[Former Member]

Can java UME support multiple ECC ABAP backends?

I looked at the UME configuration for a java instance and it seems as though there is a one to one relationship.

Is this a truly 1:1 relationship in UME - ABAP configuration.

Thanks

Weyland Yutani

[Former Member]

Hi ,

If you dont have single sign on configured then CUA can be one of the option for all the backend systems.

[Former Member]

That is strange advice...

CUA master is an ABAP logical system and Java SID is not client capable, it is the logical system itself. So it is 1 Java : 1 ABAP from the view of Java and n : 1 from the view of ABAP (with ALL consequences associated to it!)

If you add Logon Tickets to the scenario then you have 1 : 1 <--> 1 --> n (where n is anything) but I don't think that is Weyland's question, so my answer is irrelevant here.

Perhaps you are refering to the "circus solution" of creating an ABAP client for each Java system and provisioning them from the CUA?

That is however not a solution, but rather more like a Chuck Norris fighting against a fleet of battleships (except with a more realistic ending...

Enjoy the weekend,

Julius

Edited by: Julius Bussche on Aug 20, 2010 9:37 PM

[Former Member]

I want to know if a UME can point to multiple ABAP backend. For instance I want my BI ABAP system and my ERP system to support a UME feed from my portal. Since it is java I cannot find anywhere that allows my java UME to point to to separate ABAP instance like BW and ERP.

I don't see where a UME pointing to an ABAP backend can support more than one ABAP instance; java instance can only hook into the ABAP backend 1 time; thus a 1 for 1 infrastructure.

Thank

Weyland Yutani

[Former Member]

What you can do is create "trust chains" and "hardwired connections" through to all these systems and then code it on your own in the application to handle exceptions, delays, downtimes, and have fun debugging it.

Good luck!

Cheers,

Julius

[xinleifeng]

Hi weyland

UME connects to ABAP backend as the datasource via the following two ways:

1. connect to a dedicated application host and client

2. connect to a message server and use logon group.

But either way means "one UME, one ABAP", it is not like the case where LDAP acts as the datasource, and you can

use multiple LDAP servers.

I can confim with you that it is not possible to connect to tow ABAP as the data sources from one UME.

This is the system design, just try to image, if it is allow, and if there is the same user named "test007" exists on both

of the ABAP, then how UME can identify this? as logically duplicated users are not allowed...

And also I don't understand why you need multiple ABAPs for the UME?

Just for a higher reliability? or is there anything else you want to achieve?

Thanks and best regards,

Thunder

[Former Member]

I have the same question and maybe can add some clarity as I am trying to find the same information.

I currently have many ABAP Backend systems that I want to connect my UME to, why? For the simple reason I want to have the ability to maintain users, create, change, delete, passwords, etc...from a Central UME instance.

I know it is possible to connect to the UME of each independant system and maintain a user from that system, but is there anyway to deploy a Central UME for user maintenance without deploying CUA or NW_IDM?

We have went down the path of GRC 5.3, but don't really want to go that way either, so I am just looking for a way to connect the Multiple UMEs from the independant systems to perform user admin on...any thoughts or did I make this more confusing?

Robert

[mvoros]

Hi,

you can't do that. You can have only one to one mapping between ABAP stack and UME. It looks more like you are looking for SAP IdM. IdM provides a central place where you manage all identities. It should be without extra license cost for SAP systems only.

Cheers

[Former Member]

> You can have only one to one mapping between ABAP stack and UME.

Actually, the ABAP logical system does not know that it is being used as a UME, other than the SAPJSF user being called from multiple Java logical systems (which is the same as the SID because it is not "client capable").

So... a Chuck Norris full-round-house-kick happens: If you assign a user an ABAP UME role, then they are equiped with the corresponding Java UME groups on all Java SIDs pointing to it, and if one of them disrupt the connection then all of them go down...

As the Java stacks are very "chatty" by nature, you will have a tough time trying to get the UME working again.

I would class it as an ugly enough workaround, to be able to conclude that your statement is correct

Cheers,

Julius

[Former Member]

Julius

Thank you for the information

Can you further expand on "trust chains" and "hardwired connections" ?

I want my java UME to support 2 or 3 backend ECC systems?

Thanks

Weyland

[Former Member]

What I meant is that you can use this in your portal applications, and the backend systems can trust each other and pass requests further, or if it is generic then you can enter a technical user into the destination definition of the connection.

But UME itself offers to my knowledge only 1 ABAP logical system as "store" to logon with.

On the ABAP side and in your applications you can become more creative - with all consequences.

Cheers,

Julius