Federated Portal Network Remote Role Assignment Step-by- Step Configuration

Transcription

1 Federated Portal Network Remote Role Assignment Step-by- Step Configuration Applies to: Consumer Portal: SAP NetWeaver 2004s EhP1 SP6 Producer Portal: SAP NetWeaver CE EhP1 SP3 Summary This article describes the activities to be followed for implementing Federated Portal Network between SAP- SAP portals. It contains step-by-step explanation of the tasks to be performed at both Consumer portal and Producer portal along with screen shots. It is applicable to content usage mode: Remote Role Assignment Author: Pramod Gopisetty Company: ITBMS Inc. Created on: 08 December 2010 Author Bio Pramod Gopisetty is a Consultant in SAP NetWeaver Portal. Expertise includes ESS/MSS, Web Dynpro ABAP and Web Dynpro Java. Photo should be in 65 pixels in width and 85 pixels in height SAP AG 1

2 Table of Contents Federated Portal Network... 3 Configuring Trust between Consumer and Producer Portals:... 3 On Consumer:... 3 On Producer:... 3 FPN (Federated Portal Network) Configuration... 4 On Consumer:... 4 On Producer Portal:... 5 Setting Permission on the Producer for Remote Role Assignment... 6 Configuring OptimizerC Service... 7 Known Issues:... 7 References: SAP Notes: Wiki Links: Help Links: Misc. Links: To check Permissions setup in the landscape Disclaimer and Liability Notice SAP AG 2

3 Federated Portal Network A federated portal network (FPN) allows organizations with multiple portals, SAP and non-sap, to share content between the portals. By implementing a federated portal network and sharing content between portals, organizations can provide users at each location with a single portal access point. From each portal configured as an access point, the users are able to access information, services and applications distributed on portals throughout the entire organizational network. This article describes the activities to be followed for implementing Federated Portal Network between SAP- SAP portals. It is applicable to content usage mode: Remote Role Assignment Configuring Trust between Consumer and Producer Portals: The below is procedure to exchange the certificates between Consumer and Producer portals On Consumer: 1. Navigate in Portal to System Administration System Configuration Keystore Administration 2. Download the verify.der file and save it on the local desktop 3. Unzip the file and extract verify.der to desktop and change the file name to development.crt 4. On Consumer: 1. Navigate to System Administration - System Configuration Keystore Administration Import Trusted Certificate On Producer: For importing the certificate from Consumer Portal 1. Navigate to <port>/nwa 2. Navigate to Configuration Management Infrastructure Trusted Systems 3. Click on Add trusted system By Querying Trusted System Give the below details a. System Type Java b. Scheme HTTP c. Hostname Consumer Host Name d. Port Number Consumer Port Number 2010 SAP AG 3

4 On Producer: e. Username - **** f. Password - **** For exporting the certificate 1. Navigate in Producer Portal nwa to Configuration Management Security - Certificates and Keys 2. In Keystore Views select TicketKeystore - from Key Storage View Details select SAPLogonTicketKeypair-cert and then click on Export Entry. This process should be followed for exchanging certificates between Consumer and Producer. FPN (Federated Portal Network) Configuration On Consumer: 1. Navigate to System Administration Federated Portal Myself as Content Consumer Manage My Producers 2. Right click on NetWeaver Content Producers from Context menu select New NetWeaver Content Producer 3. Give the producer name and id 4. Give the below details: a. In Object give the below details: i. Host Name: Producer Host Name ii. Port: Producer Port Number iii. In P4 Communication: (If using RRA (Remote Role Assignment) you don t have to maintain the P4 settings. There is no harm in maintaining the setting if you are using RRA.) iv. P4 Connection: Load-balanced via SAP Message router v. P4 Security: None vi. Host Name: Producer Host Name vii. Port: Producer Port Number + 4 viii. b. In the Display dropdown select Producer Registration give the below details i. HTTP/HTTPS Communications 2010 SAP AG 4

5 1. Your Consumer Name: Consumer System Id 2. Host: Consumer Host Name 3. Port: Consumer Port Number 4. Once the details are maintained Click on Register and the system will be registered on the Producer Portal. 5. On Producer Portal: After registration you can navigate to System Administration Federated Portal You will see the system you have registered in previous step 2010 SAP AG 5

6 Setting Permission on the Producer for Remote Role Assignment Certain portal permissions and UME actions must be assigned on the producer portal before a user administrator on the consumer can perform the remote role assignment, while other permission settings must be assigned either before or after the remote role assignment has been performed by the user administrator the consumer portal. In the Permission Editor on the producer portal, the system or content administrator must assign the following permissions: Object (on Producer) Role (any role that you are exposing for remote usage) Target User (on Consumer) User Admin -or- Delegated User Admin Permission Level Role assigner: enabled Description This permission setting allows the user administrator on the consumer portal to do the following in the Identity Management tool: 1. Search for and view the remote role. 2. Assign local users on the consumer to the remote role. In the Identity Management tool on the producer portal, the administrator must assign the following UME actions to a role to which the pcd_service user is assigned. If such a role does not exist, you need to create one and then assign the pcd_service user to it. Target User 1 UME Actions Description pcd_service 2 Remote_Producer_Read_Access 3 Remote_Producer_Write_Access 3 These UME actions enable the following: 1. Both UME actions are required so that a user administrator on the consumer can perform remote role assignments. 2. The Remote_Producer_Read_Access action is needed for portal business users to use remote role assignment content at runtime. 3. (Optional) When a role is deleted on a producer portal, the administrator performing this task must be assigned the Remote_Producer_Write_Access action (through the pcd_service user) so that all remote role assignments to that role on the respective consumer portal are automatically removed. Without this assigned action, the role assignments remain on the consumer after the source has been deleted on the consumer. Now the system is configured for doing Remote Role Assignment and a User Administrator on Consumer portal can access the content on the Producer portal and assign to end user SAP AG 6

7 Configuring OptimizerC Service Navigate to System Administration -> System Configuration -> Service Configuration. Browse to Application -> com.sap.portal.ivs.global.jndibridge -> Services -> OptimizerC. In the My Portal Address field, enter the full portal address including the domain Save your settings. Right click on the parent folder, and choose Administrate -> Restart the service. Known Issues: If the User Administrator assigned the roles and end users not able to see the content: 1. On consumer portal navigate to System Administration Federated Portal Myself as Content Consumer Cache Management 2. Ensure Cache Lifetime is set to seconds 3. And Clear the cache and synchronize to ensure the content is visible to end users If User administrator not able to see the roles in user Administration 1. On Producer Portal ensure you have pcd_service user setup properly with the UME Actions defined above. And go to the role assigned to the pcd_service user and assign the UME Actions Remote_Producer_Write_Access and Remote_Producer_Read_Access SAP AG 7

8 After the user is setup User Administrator can see the content on Producer in Consumer. If the problem still exists: On Consumer navigate to System Administration System Configuration UME Configuration go to User Mapping and see if Reference system is defined: Then some additional settings need to be maintained on Producer Portal. On Producer Portal: Navigate to Configuration Management Security Authentication In the Components search for ticket 2010 SAP AG 8

9 After this setting the system should be ready for usage SAP AG 9

10 References: SAP Notes: - Federated Portal Network (FPN)-Specific Component note. - Interoperability between 2 portals in FPN environment. Wiki Links: Help Links: Misc. Links: Activities for implementing Federated Portal Network Step by Step ba19500da527?quicklink=index&overridelayout=true Implementing a Federated Portal Network Remote Role Assignment To check Permissions setup in the landscape SAP AG 10

11 Disclaimer and Liability Notice This document may discuss sample coding or other information that does not include SAP official interfaces and therefore is not supported by SAP. Changes made based on this information are not supported and can be overwritten during an upgrade. SAP will not be held liable for any damages caused by using or misusing the information, code or methods suggested in this document, and anyone using these methods does so at his/her own risk. SAP offers no guarantees and assumes no responsibility or liability of any type with respect to the content of this technical article or code sample, including any liability resulting from incompatibility between the content within this document and the materials and services offered by SAP. You agree that you will not hold, or seek to hold, SAP responsible or liable with respect to the content of this document SAP AG 11