SAP BASIS & Security

Central Correction Notes for SAP Solution Manager

2016-03-18T23:33:00.000-07:00

Central Correction Notes for SAP Solution Manager

Starting with SAP Solution Manager 7.0 EhP1 the concept of a central correction note has been implemented. The goal of the central correction notes is to bundle all necessary corrections for the basic functions of SAP Solution Manager in one central note to avoid searching for mandatory corrections in Service Marketplace. These notes are regularly updated, so that you can at every time use these notes to keep your SAP Solution Manager system up-to-date.

Solution Manager 7.20

SP	Corresponding Central Note	Previous Update	Next Update planned
SP01	SAP Note 2087917	March 1, 2016	March 2016

SAP Solution Manager 7.1

SP	Corresponding Central Note	Previous Update	Next Update planned
SP01	SAP Note 1552585	July 28, 2011	no further updates
SP02	SAP Note 1584162	May 7, 2012	no further updates
SP03	SAP Note 1613410	July 12, 2012	no further updates
SP04	SAP Note 1633725	February 5, 2014	no further updates
SP05	SAP Note 1652693	December 10 , 2014	no further updates
SP06	SAP Note 1722332	December 11, 2014	no further updates
SP07	SAP Note 1734341	December 11, 2014	no further updates
SP08	SAP Note 1775242	April 1, 2015	no further updates
SP09	SAP Note 1817043	September 5, 2013	no further updates
SP10	SAP Note 1875627	November 2, 2015	no further updates
SP11	SAP Note 1933506	November 2, 2015	April 2016
SP12	SAP Note 1969109	October 29, 2015	April 2016
SP13	SAP Note 2048315	October 21, 2015	March 2016
SP14	SAP Note 2110259	November 3, 2015	March 2016

SAP Solution Manager 7.12 (on HANA)

SP	Corresponding Central Note	Previous Update	Next Update planned
SP01	SAP Note 1831407	February 4, 2014	no further updates

Solution Manager 7.0

SP	Corresponding Central Note	Next Update planned
SP18 & SP19	SAP Note 1172948	no further updates (final version November 7, 2012)
SP20 & SP21	SAP Note 1334252	no further updates (final version November 7, 2012)
SP22 to SP24	SAP Note 1405878	no further updates (final version November 7, 2012)
SP25 to SP27	SAP Note 1468591	no further updates (final version August 27, 2014)
SP28 to SP31	SAP Note 1635809	no further updates (final version November 3, 2015)

SAP Note 550742 - FAQ: General questions about Single Sign-On

2014-04-02T22:36:00.002-07:00

Symptom

FAQ

Other Terms

FAQ, security, Single Sign-On, SSO

Reason and Prerequisites

Solution

[1] Question: What is Single Sign-On (SSO)?

[2] Question: How do I implement Single Sign-On?

[3] Question: Why does Single Sign-On no longer work after one year?

[4] Question: Do all system have to have the same password?

[5] Question: Where can I find further documentation on SSO?

[1] Question: What is Single Sign-On (SSO)?

Answer:
The term Single Sign-ON (SSO) describes a solution that enables the system to determine the identity of a user without the user having to explicitly specify a user name and password in each application. It is a one-time logon to the system. However, there may be different technical conversions. Several different SSO solutions also exist for SAP.

[2] Question: How do I implement Single Sign-On?

Answer:
Different technical options are available to implement SSO.
Some of the solutions that are available in SAP systems include:
-Logon tickets (Workplace)
-Client certificate
-NTLM SSP
-PAS
For more information, see note 138498.

[3] Question: Why does Single Sign-On no longer work after one year?

Answer:
You are using a certificate that was issued by SAP_CA. For more information, see note 389186. These types of certificates are issued with a validity period of one (1) year only. Logon tickets are still issued after the validity period expires; however, an error is triggered when the logon tickets received are checked. In principle, the problem is not restricted to CA certificates; however, "self-signed" certificates are generated with a considerably longer validity period (up to the year 2038).

[4] Question: Do all systems have to have the same password?

Answer:
The current SSO methods enable you to assign different passwords for different systems.

[5] Question: Where can I find further documentation on SSO?

Answer:
Further documentation is available in the SAP Marketplace:
http://service.sap.com/security

This document refers to:

SAP Notes
1257108 Collective Note: Analyzing issues with Single Sign On (SSO)
114045 Consulting: Technical system security

This document is referenced by:SAP Notes (1)
1257108 Collective Note: Analyzing issues with Single Sign On (SSO)

SAP Note 434918 - Configuration for fully qualified host names for BSP

2014-04-02T22:35:00.000-07:00

Symptom

A BSP is started that contains a shortened URL (no domain name) is started from SE80. This problem can be solved with the new profile parameter icm/host_name_full.

Other Terms

DNS
Domains
Domain
FQHN: full qualified host name

Reason and Prerequisites

If the host name only specifies the host and port but not the domain (including the extension), the shortened URL of a BSP application appears as follows:
<protocol>://<hostname>:<port>/sap/...
Example: http://pwdf0487:1080/sap/bc/bsp/sap/it00/default.htm

In contrast, the full URL should be as follows:
<protocol>://<host name>.<domain> <extension>:<port>/sap/...
Example: http://pwdf0487.wdf.sap-ag.de:1080/sap/bc/bsp/sap/it00/default.htm

When you display the page (that is, the BSP) in the browser, an error message is issued because the domain is not specified.
You can determine whether the specifications of the domain are missing by branching to one of your BSP applications in the SAP System: Call the development environment in the SAP System (transaction SE80).
Select BSP Application in the pull-down menu in the left column and enter the name of your BSP application in the field underneath. Select Display (the glasses symbol).
Double-click on a BSP under Pages.
Select the Attributes tab.
Check whether the path specification in the URL field next to the host also contains the domain, as described under Cause and Prerequisites.
If the domain specifications are missing, proceed as described in the Solution section and use the icm/host_name_full profile parameter.

Solution

You require the latest kernel patch (ICM patch collection (VIII) and patch level 510 or higher) as well as the icm/host_name_full parameter. You can use this parameter to specify the fully qualified host name of the host on which the ICM is running and which can be accessed for requests, for example, ls3022.wdf.sap-ag.de rather than ls3022.
If several application servers are operated with one instance profile, you could consider the following procedure: Set the value icm/host_name_full = $(SAPLOCALHOST).domain.ext.

SAP Note 510007 - Setting up SSL on Web Application Server ABAP

2014-04-02T22:34:00.001-07:00

Symptom

This note concerns the setting up of Secure Sockets Layer (SSL) on the SAP Web Application Server ABAP.

Other Terms

SSL, TLS, Transport Layer Security, HTTPS, encryption, trust manager, STRUST, cipher suites

Reason and Prerequisites

This note provides a brief description of the steps required to set up SSL on the Web Application Server ABAP.
1. Install the SAPCRYPTOLIB on all application servers into the $DIR_EXECUTABLE directory. Note 397175 describes the prerequisites for downloading the library. If you are using a 6.10 kernel, copy the license ticket SAPCRYPTOLIB (file "ticket") into the $DIR_INSTANCE/sec directory on all application servers. As of kernel release 6.20, the license ticket is automatically generated at the system start.  As of SAPCRYPTOLIB pl32, you no longer require a license ticket file.  On all application servers, set the environment variable SECUDIR to the directory $DIR_INSTANCE/sec. If you want to protect the PSEs (key files) with a password, set the environment variable USER on all UNIX systems to the name of the UNIX user under whom the SAP system is running.2. Set the following profile parameters in the instance profile of all application servers and start the system:

  ssf/name          = SAPSECULIB
  ssf/ssfapi_lib    = <Path and file name of the SAPCRYPTOLIB>
  sec/libsapsecu    = <Path and file name of the SAPCRYPTOLIB>
  ssl/ssl_lib       = <Path and file name of the SAPCRYPTOLIB>
  icm/server_port_X = PROT=HTTPS,PORT=<TCP port number for HTTPS>

If you want to suppress/permit/enforce user logon by client certificate in the SSL log:

  icm/HTTPS/verify_client = 0 / 1 (default) / 2

If you want to use a key length of 1024 bits (only with kernel release 6.20 and higher, see Note 509495): sec/rsakeylengthdefault = 10243. Call transaction STRUST (trust manager) to create the SSL server PSEs.a) Create the default PSE (serves as a fallback for all instances without their own PSE).
Choose "Create" in the context menu of the "SSL server" node. As far as possible, the trust manager provides the correct entries so that you can then send the certificates to the SAP Trust Center Service for signing. In particular, set the following values:

Name = *.<WebAS domain>

Do not replace the "*" with a host name. The default PSE must also exist even if PSEs are created for all instances.b) Create individual PSEs for all instances: A list of all active instances is displayed in a second dialog box. The default Distinguished Name (DN) contains the following entry:

CN = <host name>.<WebAS domain>

Make sure that each instance is assigned the fully qualified host name that is used in the HTTPS log. You can assign a DN to several instances simultaneously, for example, when using a Network Address Translator (then, you must specify the fully qualified host name of the NAT as CN). All instances with empty an DN will use the default PSE (in Release 6.10, the "Create" parameter determines if the instance is assigned its own PSE). Note that no DNs must be more than 255 characters long.c) Create certificate requests for all instance PSEs. Expand the "SSL server" node in the tree control, double-click to load the instance PSE into the relevant node and select the "Generate certificate request" function. For the default PSE, you must only create a certificate request if there are instances without their own PSEs (in this case, double-click to load the default PSE into the "SSL server" node). Send the certificate requests to a CA, for example, the SAP Trust Center Service (http://service.sap.com/tcs ).

The certificate response must either be a PKCS#7 package with a complete upward path or a text file that contains a list of all required certificates in PEM format (that is, with a "-----BEGIN CERTIFICATE-----" header line and an "-----END CERTIFICATE-----" footer). As of Release 6.20, you can also import the certificate response as an individual PEM certificate if the CA certificate is saved in the database (to search for certificates, select "Import certificate", category = "Server CA"). Using the SAP Trust Center Service ensures that the certificate response has a valid format. Always import the certificate response into the PSE from which the original certificate request was generated (double-click on the corresponding nodes and call the "Import certificate response" function) and save the changes.d) If you want to allow logon via the client certificate, import the root certificate of the CA user into one of the SSL server PSEs. When saving, the system updates the certificate list of all SSL server PSEs. The certificate list contains the root certificates of those CAs whose user certificates are to be accepted.4. Creating the SSL client PSE (default).

This PSE is used in the SSL log if the WebAS issues a HTTPS request as client. For technical reasons, there must always be a SSL client PSE even if the system does not issue any client requests (the SSL implementation cannot be started if the PSE is missing). When creating the PSE, you can specify the following name:

Name = <system SID> SSL client default

If the system is to issue client requests, create a certificate request from the PSE and import the certificate response of the CA into the PSE. Then import the root certificates of the server CAs into the PSE certificate list whose certificates are to be accepted. To load the root certificate of the SAP Trust Center Service, select "Import certificate", database, Trust Center (short name) = "SAPTRUST", category = "Server CA". To import the certificate into the PSE, select "Import into certificate list".5. Creating additional SSL client PSEs (optional)

With a SSL client PSE (anonymous), the system can issue HTTPS requests without client authentification. If you require this PSE, only maintain the PSE certificate list. You can also define additional SSL client identities (Environment -> SSL client-> Identities). If you create new identities, they are displayed in the trust manager. You can now create the relevant PSEs, have the certificates signed by a CA and maintain the PSE certificate list.

Note that the changes made to SSL PSEs in the trust manager (for example, implementing the response of a CA and the certificate list changes) in a SAP WebAS before NetWeaver 710 will only take effect after you restart the ICMAN process (transaction SMICM, Administration -> ICMAN -> Exit Soft).

When, as of NetWeaver 710, you save or overwrite an SSL PSE, STRUST signals the PSE change to the icman, whereby the PSEs used for SSL are reloaded at runtime.  Existing communication connections are not impaired as a result. However, all SSL session caches are emptied in icman so that all new SSL connections go through a complete SSL Handshake. On servers with a very large number of simultaneous connections, this could lead to an increase in the CPU load and increased response times.6. (Optional) Configuration of available SSL cipher suites

You can change the available "SSL cipher suites" for SAP WebAS ( icman, sapwebdisp, msg_server und sap_http) and (as of Release 710) the incoming SSL-secured connections of the SAP AS Java using the SAP profile parameter

    ssl/ciphersuites=

as a process-wide or system-wide default (and therefore control the compiled default value).  When searching  for a shared ciphersuite using the client, the preference sequence of the server is important for SAPCRYPTOLIB.

For inbound SSL connections (SSL server), you can also define the available cipher suites individually for each service in the SSL configuration icm/ssl_config_<xx> for an ICM server port definition icm/server_port_<xx> using the string parameter CIPHERS:

   icm/server_port_<xx>= ..., SSLCONFIG=ssl_config_<yy>
   icm/ssl_config_<yy>=  ..., CIPHERS=...

The same rules apply to the value or content of the parameter CIPHERS as apply to the profile parameter ssl/ciphersuites.

The following table displays an overview of the SAPCRYPTOLIB ciphersuites that are currently available in order of preference. Ciphersuites marked with (+) were added with SAPCRYPTOLIB pl28:

   Category  Position        Name of SSL ciphersuite
  ----------------------------------------------------
  MEDIUM        1.      SSL_RSA_WITH_RC4_128_SHA
  MEDIUM        2.      SSL_RSA_WITH_RC4_128_MD5
(+)HIGH          3.      TLS_RSA_WITH_AES128_CBC_SHA
(+)HIGH          4.      TLS_RSA_WITH_AES256_CBC_SHA
  HIGH          5.      SSL_RSA_WITH_3DES_EDE_CBC_SHA
  LOW           6.      SSL_RSA_WITH_DES_CBC_SHA
  EXPORT        7.      SSL_RSA_EXPORT_WITH_DES40_CBC_SHA
  EXPORT        8.      SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
  EXPORT        9.      SSL_RSA_EXPORT_WITH_RC4_40_MD5
  EXPORT       10.       SSL_RSA_WITH_NULL_SHA
  EXPORT       11.      SSL_RSA_WITH_NULL_MD5

The above list (in the specified sequence) is the compiled default setting for SAP BASIS 640 and corresponds to the profile parameter value:

    ssl/ciphersuites=MEDIUM:HIGH:LOW:EXPORT

The compiled default setting for SAP BASIS 700 is:

    ssl/ciphersuites=MEDIUM:HIGH:LOW:EXPORT:!eNULL

and contains only ciphersuites 1 to 9 from the above list.

With the kernel correction described in SAP Note 1433874, the compiled default setting for SAP BASIS 700 or higher was changed to:

    ssl/ciphersuites=HIGH:MEDIUM:+e3DES:LOW:EXPORT:!aNULL:!eNULL

and a new profile parameter was added:

    ssl/client_ciphersuites=

If required, you can also configure the SSL cipher suites for outgoing SSL-secured connections of SAP AS ABAP regardless of the incoming connections.   If you do not set this parameter, the default value of the profile parameter ssl/ciphersuites also applies for outgoing SSL-secured connections.

The aforementioned kernel correction results in the following sequence of SSL cipher suites, whereby the AES-based cipher suites require a SAPCRYPTOLIB pl28+.

   Category  Position        Name of SSL ciphersuite
  -----------------------------------------------------------
  HIGH          1.      TLS_RSA_WITH_AES128_CBC_SHA
  HIGH          2.      TLS_RSA_WITH_AES256_CBC_SHA
  MEDIUM        3.      SSL_RSA_WITH_RC4_128_SHA
  MEDIUM        4.      SSL_RSA_WITH_RC4_128_MD5
  HIGH          5.      SSL_RSA_WITH_3DES_EDE_CBC_SHA
  LOW           6.      SSL_RSA_WITH_DES_CBC_SHA
  EXPORT        7.      SSL_RSA_EXPORT_WITH_DES40_CBC_SHA
  EXPORT        8.      SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
  EXPORT        9.      SSL_RSA_EXPORT_WITH_RC4_40_MD5

If you want the cipher suite with 3DES coding to be in first position of the preferred cipher suites, and if you do not want to use any EXPORT cipher suites, LOW cipher suites, and cipher suites with MD5 as the hash function, you can use the following value for the configuration:

    ssl/ciphersuites=HIGH:MEDIUM:!mMD5.

and you obtain a list with the four cipher suites (1), (2),(5) and (3) from the list displayed above as the result.

The parameter parts for the configuration of the ciphersuites are based on a combination of simple set theory and the preferred ciphersuites sequence.  The syntax of this ciphersuites parameter is based on a previous version of OpenSSL and less flexible than the current OpenSSL versions.

You can use the category to define which ciphersuites are relevant and you can use the category sequence to define which are the preferred ciphersuites; you can specify

   "!mMD5", "!mSHA1", or "!eNULL", "!eRC4", "!eDES", "!eRC2"

to remove specific ciphersuites from the selected categories in the list of selectable ciphersuites.7. (Optional) Configuration of available TLS protocol versions

Depending on the version, SAPCRYPTOLIB supports the following protocol versions of the SSL protocol or TLS protocol:

    SAPCRYPTOLIB <= pl26    SSLv3,          "BC"
    SAPCRYPTOLIB >= pl28     SSLv3, TLSv1.0, "BC"

The new protocol Version TLSv1. introduced with Version pl28+ is proposed by default or used if the communication parner also supports it.

There is also the protocol option "BC" for "Backwards Compatibility" that permits a Version 2.0 CLIENT-HELLO as the first message of an SSLv3 or TLS handshake, see

    http://tools.ietf.org/html/rfc6176#section-3
    http://tools.ietf.org/html/rfc5246#page-89

A configuration option for the supported TLS protocol version was added to the kernel correction described in SAP Note 1433874.  A single number must be placed before the configuration parameter for the SSL cipher suites, which is added from the following bit value:

    Value    Meaning
  -----------------------------------------------------------
      1      "BC" option (allow version 2.0 CLIENT-HELLO)
      64      SSLv3
    128       TLSv1.0

Both protocol versions and the BC option are active in the default setting, which results in a value of (128+64+1) = 193 for the protocol version flags (pvflags).

If you want an FIPS-compliant SSL configuration, that is, only TLSv1.0 (128+1)=129 and only SSL cipher suites with 3DES or AES encryption (HIGH), you can achieve this with the following setting:

    ssl/ciphersuites=129:HIGH

8. Information about interoperability with SSL and TLSa) The protocol option "BC" (Backwards Compatibility) is required for interoperability with Microsoft Internet Explorer (MSIE) Version 6 on Windows XP and Windows 2003, Firefox up to Version 3.0 and possibly other, mostly older, browser and SSL clients.

Background: XP and 2003 were delivered with MSIE Version 6 and SSLv2 is activated and TLSv1.0 is deactivated there by default.  When you upgrade MSIE to Version 7 or 8, SSLv2 is deactivated and TLSv1.0 is activated. However, the basic attributes of the "SChannel" component of the underlying Windows version are not changed by an MSIE upgrade.b) The attributes that can be used by Microsoft Internet Explorer for SSL or TLS are determined by the capabilities and attributes of the underlying operating system version, especially the security provider "SChannel" and the Microsoft CryptoAPI -- regardless of which browser version you have installed.

Some attributes are available on older platforms only after a Microsoft HotFix has been installed manually:

SChannel support for AES cipher suites:
  XP 32-bit:        ---
  2003, XP 64-bit:  http://support.microsoft.com/kb/948963

MS CryptoAPI support for SHA256-based digital signatures, includes SSL server certificates:

  XP 32+64, 2003:   http://support.microsoft.com/kb/968730

Microsoft "SChannel" supports the use of AES-based cipher suite (rfc3268) of SAPCRYTPOLIB pl28+ only in connection with the protocol Version TLSv1.0 and only as of Vista (and Windows 2003 after manually installing HotFix 948963).

Firefox 3+, Google Chrome and OpenSSL 0.9.8+ support AES-based cipher suites both on Windows XP as well as in connection with SSLv3.


References

This document refers to:
SAP Notes1901252 PT Web Services- Online communication to AT:Solution Details
1901250 PT Web Services- Online communication to AT : Technical Req
1896961 HTTP/HTTPS Configuration for SAP NetWeaver Gateway
1872926 Obsolete Note: PT Web Service: LC Online communication with Tax Authorities
1841573 SAPCRYPTOLIB 555pl36: bugfixes, error details, new features
1688545 OAuth 2.0 Server in AS ABAP Troubleshooting
1619442 Error when automatically reloading changed SSL PSEs
1553301 7.20 EXT Kernel - Usage
1531399 Enabling SSL for Session Protection
1452833 Prerequisites for analyzing support messages on STRUST
1433874 SapSSLReloadCred fix, SSLv3/TLSv1.0 configurability, GOST
1408879 ELENA: Set Up HTTP(S) Connection for Communication Server
1375378 Select the right version of an SAP security toolkit
1257108 Collective Note: Analyzing issues with Single Sign On (SSO)
1178155 Replacing PSEs in productive SSL Servers
1175193 Login ticket and ICM information is missing in SSO profile
834039 Certificate extension problems, Verisign (Japan)
758667 iSeries: Installing sapcrypto library for R/3
745103 Problemanalyse bei HTTPS-Kommunikation
700659 Security Guide: mySAP Supply Chain Management
698459 Trust manager: New root certificates
662340 SSF Encryption Using the SAPCryptolib
599270 Portal Content performance - composite SAP Note
597959 Portal content performance on EP 5.0 SP 6 - Sammelhinweis
578377 Digital signatures with SAPCRYPTOLIB
517860 Logging on to BSP applications
509495 Trust manager: Generating PSEs with a key length > 512 bits
508307 Trust Manager: Problems importing certificate responses
455033 SAPCRYPTOLIB versions, bugs and fixes
397175 SAP Cryptographic Software - Export control
354819 Collective note SAPSECULIB

This document is referenced by:
SAP Notes (35)1901250 PT Web Services- Online communication to AT : Technical Req
1896961 HTTP/HTTPS Configuration for SAP NetWeaver Gateway
1920429 PT Web Services:process hist. doc., global delivery, BOM
834039 Certificate extension problems, Verisign (Japan)
508307 Trust Manager: Problems importing certificate responses
509495 Trust manager: Generating PSEs with a key length > 512 bits
1553301 7.20 EXT Kernel - Usage
1433874 SapSSLReloadCred fix, SSLv3/TLSv1.0 configurability, GOST
597959 Portal content performance on EP 5.0 SP 6 - Sammelhinweis
517860 Logging on to BSP applications
599270 Portal Content performance - composite SAP Note
1688545 OAuth 2.0 Server in AS ABAP Troubleshooting
1175193 Login ticket and ICM information is missing in SSO profile
965076 Using HTTPS with the IGS
1619442 Error when automatically reloading changed SSL PSEs
1375378 Select the right version of an SAP security toolkit
1422864 CGsprint 1.x: Installation or upgrade
1408879 ELENA: Set Up HTTP(S) Connection for Communication Server
578377 Digital signatures with SAPCRYPTOLIB
397175 SAP Cryptographic Software - Export control
354819 Collective note SAPSECULIB
455033 SAPCRYPTOLIB versions, bugs and fixes
698459 Trust manager: New root certificates
700659 Security Guide: mySAP Supply Chain Management
1452833 Prerequisites for analyzing support messages on STRUST
662340 SSF Encryption Using the SAPCryptolib
1841573 SAPCRYPTOLIB 555pl36: bugfixes, error details, new features
1178155 Replacing PSEs in productive SSL Servers
758667 iSeries: Installing sapcrypto library for R/3
1844549 CGsprint 2.x: Installation/Upgrade
1636252 Installing a 7.20 kernel in SAP Web AS 7.00/7.01/7.10/7.11
1901252 PT Web Services- Online communication to AT:Solution Details
1529546 Troubleshooting note for QC Enterprise Integration issues
1257108 Collective Note: Analyzing issues with Single Sign On (SSO)
1531399 Enabling SSL for Session Protection

SAP Note 1175193 - Login ticket and ICM information is missing in SSO profile

2014-04-02T22:32:00.003-07:00

Symptom

Login ticket and ICM information is missing from the SSO profile.

Other Terms

ICM, Login, SSO, Process Controls

Reason and Prerequisites

Solution

Parameters are maintained in RZ10 for login tickets and ICM.  See related notes below.

SAP Notes817529 Checking the SSO configuration
510007 Setting up SSL on Web Application Server ABAP

SAP Note 817529 - Checking the SSO configuration

2014-04-02T22:31:00.001-07:00

Symptom

You want to use Single Sign-On tickets in the BW Web reporting environment. This note contains indicators and options such as how the system must be configured to be able to use SSO or to check the configuration.
For example, SSO must be configured correctly if (as recommended in Note 498936) you want to use the SAP logon 'SYSTEM/login.htm'.

Other Terms

SSO, SSO2, cookie, BSP, sso2test.htm, SYSTEM, login.htm.

Reason and Prerequisites

The Internet browser must accept cookies. You can set this in Internet Explorer 6 by selecting the 'Tools' --> 'Internet Options...' --> 'Privacy' menu option.

Solution

System parameter/settings
login/accept_sso2_ticket    = 1.
login/create_sso2_ticket    = 2 (recommended) or 1.
icm/host name full.

           To enable the Internet browser accept the SSO2 cookie, you must enter a fully qualified host name in accordance with Notes 434918 and 654982.
SAPSECULIB / SAPCRYPTOLIB

           You must use the SAP Security Library or the SAP Cryptographic Library.
Transaction STRUST

           In this transaction, you define which systems are meant to accept logon tickets. This is necessary, for example, if you want to access data from one system of a BW application to another application of another system, without having to log on again.

Documentation
http://help.sap.com/saphelp_webas620/helpdata/en/17/ f8973814eb481fe10000009b38f8cf/frameset.htm
http://service.sap.com/security


Configuration check

SAP delivers the sso2test.htm BSP application.
You can use this application to check whether an SSO2 cookie can be created.
Start Transaction SE80
--> 'SYSTEM' BSP application
  --> Pages with flow logic
    --> Right-click sso2test.htm
      --> Test
        --> Follow the instructions on the screen


You can also execute the following JavaScript command from the address bar of your Internet browser to check whether an SSO2 cookie currently exists: javascript:alert(document.cookie);
As a result, all current cookies are issued in an alert box.
If an SSO2 cookie exists, an entry would have to exist that begins with 'MYSAPSSO2=....'.


If you cannot display an SSO2 cookie despite this information, check the logon as described in Note 495911 and if necessary, open a message under the component BC-SEC-SSF.

SAP Note 900000 - Netweaver Business Client - FAQ

2014-04-02T22:29:00.001-07:00

Symptom

NetWeaver Business Client FAQ

Other Terms

Documentation, Troubleshooting and FAQ:

Solution

Introduction on SAP NetWeaver Business Client
http://www.youtube.com/watch?v=AAQRzKbNa1s
http://scn.sap.com/community/netweaver-business-client
https://experience.sap.com/post/show/51
http://goo.gl/5CcgS
http://scn.sap.com/docs/DOC-53471



Which FRONTEND-Platforms does the NWBC run on:

See
PAM (product availability matrix):
ReleaseLink to PAM - NWBC Destkop Client
700https://go.sap.corp/hqw
701https://go.sap.corp/hqx
702https://go.sap.corp/huq
730https://go.sap.corp/hur
731https://go.sap.corp/hus
740https://go.sap.corp/hut




ReleaseLink to PAM - NWBC HTML Client
700 https://go.sap.corp/huu
701 https://go.sap.corp/huv
702 https://go.sap.corp/huw
730 https://go.sap.corp/hux
731 https://go.sap.corp/huy
740 https://go.sap.corp/huz


further requirements/limitations/restrictions:
NWBC 4.0 Desktop version:
https://service.sap.com/sap/support/notes/1754946

NWBC 3.5 Desktop version:
https://service.sap.com/sap/support/notes/1620514

NWBC HTML version:
https://service.sap.com/sap/support/notes/1620576

Additional Information:
http://help.sap.com/saphelp_nw73ehp1/helpdata/en/4c/5bd9b297817511e10000000a42189b/content.htm?frameset=/en/66/48a793bc2f4ec5bdb8e7e93ea6cd9f/frameset.htm




Where to download the NWBC-CLIENT:


The most recent NWBC for Desktop versions and patches can be downloaded from the SAP Support Portal (service.sap.com/support). In the "Software Downloads" area, you will find the NWBC in "Support Packages and Patches", "A-Z Index", via keyword "NETWEAVER BUSINESS CLIENT"

DIREKT LINKS:
NWBC 3.5:
http://goo.gl/9dfVv
release dates:
https://service.sap.com/sap/support/notes/1593491
NWBC 4.0:
http://goo.gl/saiyA
release dates:
https://service.sap.com/sap/support/notes/1707623

what´s new:
http://youtu.be/V9dFB9qsYIo
http://goo.gl/7VoNc
http://goo.gl/5CcgS


Which BACKEND release is necessary to establish a NWBC connection:

See
http://help.sap.com/saphelp_nw73ehp1/helpdata/en/4c/5bd5ab97817511e10000000a42189b/content.htm?frameset=/en/66/48a793bc2f4ec5bdb8e7e93ea6cd9f/frameset.htm
Important: apply runtime (server) patches to it:
SAP_BASIS =<7.40
https://service.sap.com/sap/support/notes/1353538




Does NWBC 3.5 & 4.0 run as well against the "old" 3.0 runtime (http://<full qualified server>:<port>/nwbc)?
"old" means: http://help.sap.com/saphelp_nw73ehp1/helpdata/en/4c/5bd5ab97817511e10000000a42189b/content.htm?frameset=/en/66/48a793bc2f4ec5bdb8e7e93ea6cd9f/frameset.htm
check your version:
https://service.sap.com/sap/support/notes/1864151
follow note 1353538 to increase your version



Yes, but:
not the entire NEW (additional) feature set of NWBC 3.5/4.0 will work:
pure client depended features will work - yes

but most NEW features need server updates (SP) as well- those will currently work with backend SAP_BASIS 7.31

see as well:
http://help.sap.com/saphelp_nw73ehp1/helpdata/en/e7/dab3913e804de4a6aa7e5b31e1aa1c/content.htm?frameset=/en/66/48a793bc2f4ec5bdb8e7e93ea6cd9f/frameset.htm

or more detailed in:
http://goo.gl/ex0sx

examples of such features of NWBC 3.5 which will NOT work on lower backends (or without downports) are:
sidepanel

easy access

favorites

...

further limitations for NWBC 3.5 see at the end of this note.


UPDATE: Full feature set-downports for 3.5 & 4.0 are now available starting from (SAP_BASIS)+note 1353538:
7.00 SP28

7.01 SP12

7.02 SP12

7.11 SP11

7.20 SP08

7.30 SP09

7.31 SP03 (standard delivery = no downport any longer)
but 7.31 SP00-02 is NOT supported for ANY of the NWBC clients


Can NWBC 4.0 and 3.5 be installed on the same pc?

Yes

special case BAIO:

To use BAIO (BUSINESS All-IN-ONE):
first access the Enablement Kit for ERP 6.0 EHP3 in the Help Portal:

                       http://help.sap.com

                        > Best Practices

                         > Cross-industry packages

                          > Enablement Kit

                           > Installation and Upgrade
https://service.sap.com/sap/support/notes/1400383

SSO with NWBC:

http://scn.sap.com/community/netweaver-business-client/blog/2013/06/07/authentication-and-single-sign-on-with-sap-netweaver-business-client-nwbc



CONFIGURATION/DOCUMENTATION:
http://help.sap.com/saphelp_nw73ehp1/helpdata/en/4c/5b13bf97817513e10000000a42189b/content.htm?frameset=/en/66/48a793bc2f4ec5bdb8e7e93ea6cd9f/frameset.htm
https://service.sap.com/sap/support/notes/1527068

TROUBLESHOOTING:
Troubleshooting section in documentation:
http://help.sap.com/saphelp_nw73ehp1/helpdata/en/4c/5bd5d397817511e10000000a42189b/content.htm?frameset=/en/66/48a793bc2f4ec5bdb8e7e93ea6cd9f/frameset.htm
known issues:
https://service.sap.com/sap/support/notes/1378659
popups like warning & error descriptions have been moved from note 900000 -> 1378659
https://service.sap.com/sap/support/notes/1378659
SSO related errors:
this topic has been moved from note 900000 to
https://service.sap.com/sap/support/notes/1638715
server patches:
https://service.sap.com/sap/support/notes/1353538
current client release:
NWBC 3.5 download:
http://goo.gl/9dfVv

NWBC 4.0 download:
http://goo.gl/saiyA

SAP Note 1257108 - Collective Note: Analyzing issues with Single Sign On (SSO)

2014-04-02T22:28:00.003-07:00

Symptom

You are having problems with your implementation of Single Sign-On (SSO).

Other Terms

logon, login, Single Sign-On, SSO, authentication, SNC, Kerberos, Logon Tickets, X.509 Client Certificates, Java Add-In, Dual Stack, Diagtool, password

Reason and Prerequisites

This note should help you identify the cause of logon problems when a solution for SSO is implemented. There are a number of different technical solutions available for providing SSO, so this note contains several chapters, one each for the technical means used to implement SSO.

This note concentrates on problem analysis, but also mentions some of the most common specific issues. This note will not list all known issues that are related to SSO, as there are simply too many possible details involved. Unfortunately, even though the note concentrates only on the most common cases and how to analyze them, it is rather long.

Keep in mind that SSO solutions may appear quite complicated, especially if they span over a broad variety of system types that may exist in your system landscape.

Differentiate the possible implementations/solutions

The initial step to approach problems in SSO, of course, is to identify what SSO solution actually is being used. A first indicator is the client software: do you use a Web browser for accessing your servers, or do you use SAP's "classical" client program SAPGUI (sometimes called WinGUI)?
Attention: Newer client development and the related use of words make it easy to mix up certain versions of the Web browser-based clients with SAP's standalone client SAPGUI for ABAP servers. In the context of this note, the term SAPGUI will not be used for those Web-browser based clients.

Web browser-based clients can use either of the following mechanisms for implementing SSO:

SAP logon tickets (covered in this note) or

X.509 client certificates (covered in this note) or

SAML Browser/Artifact Profile (AS Java since NW 2004, AS ABAP since NetWeaver 7.10) (NOT covered in this note)

The SAPGUI always requires Secure Network Communications (SNC) for SSO.

Typical Scenarios

The most common situation where SSO is used are system landscapes that are made accessible by an SAP Enterprise Portal.
Here, usually SAP logon tickets are used, because they are easily available and can be created and accepted by all SAP server products. In a typical portal landscape, the SAP Enterprise Portal issues the user a logon ticket after the initial logon, which is then used for further authentication purposes, both in the portal itself as well as in all SAP back-end systems that are being made accessible from the portal. Some third party services can also use the SAP logon ticket for authentication through the use of SAPSSOEXT (a Java-based toolkit for verifying SAP logon tickets).

A completely different situation exists when the client software for accessing ABAP-based SAP servers is SAPGUI. With SAPGUI, the only
way to implement SSO is to install SNC. SNC, in turn, can be implemented in a number of ways - but it always makes use of the GSS interface provided by SAPGUI and the ABAP-based SAP servers.

For more general information about SSO, see SAP Notes 138498 and 550742.

In the following, we refer to the servers involved as the AS ABAP and the AS Java for ABAP-based and Java-based system, respectively.

Solution

In the following, you will find hints on how to analyze problems with logon and Single Sign-On, ordered by the technical means for authentication that are being used.

1. SSO based on SAP Logon Tickets

SAP logon tickets are messages that confirm a successful (primary) logon. They are created on the SAP server and are passed to the user's client. From there, they are also passed to the intended target system(s) (in newer implementations also directly to the target system). SAP logon tickets provide a "simple", but proprietary solution for Single Sign-On.

The actual strategy for analyzing problems with SAP logon tickets is to follow the path of the SAP logon ticket from its creation, and then along the paths it takes in the network, until it is finally received and verified in the destination server.

The (now outdated) note 356691 is intended to help with this, but it refers to older releases, where the "standalone Internet Transaction Server (ITS)" was common for Web-based access. This note may still be useful though in some situations, especially when you try to access SAP systems of older releases.

To assert the authenticity of a user, SAP logon tickets make use of digital signatures based on the DSA algorithms. (These functions fall under the SAP component for Secure Store and Forward BC-SEC-SSF.) As a consequence, Secure Store and Forward (SSF) needs to be configured correctly to be able to verify the logon tickets. This includes the configuration for trusting the SAP logon ticket issuer (in terms of SSF), which is done by storing the logon ticket issuer's public key (certificate) in the target system's certificate store. (The target system is the system that verifies the incoming logon ticket.) Additionally, the logon ticket issuer needs to be entered into an access control list (ACL). The required steps differ between the involved system's base technology (ABAP or Java), but from the SSF point of view, they serve the same purpose.

In general, tracing SAP logon tickets will follow the same pattern, which is independent from the base technology:

1. Check whether the initial logon was successful.
2. Check whether a SAP logon ticket was issued after the initial logon.
3. Check whether the SAP logon ticket was passed to the client software (Web browser).
4. Check whether the same SAP logon ticket was forwarded to the target system for authentication.
5. Check whether the SAP logon ticket was processed for authentication purposes on the target system.
6. Check whether the SAP logon ticket was successfully verified on the target system.

As you see, after the SAP logon ticket is created, it is forwarded through several layers within the ticket-creating system and then passed to the user's Web browser (or to the receiving system directly). The Web browser then needs to decide whether to forward the ticket (a cookie named MYSAPSSO2) to the target server(s). There the logon ticket is received, and again forwarded through some internal layers of the server to finally be verified in the programs responsible for authentication. Each of these steps can fail, and in most cases, the result will be just another popup asking for the user's logon ID and password. Unfortunately, only rarely a significant error message can be displayed.

1.1. SAP logon ticket creation and verification on the AS ABAP

On the AS ABAP, the profile parameters login/create_sso2_ticket and login/accept_sso2_ticket control the creating and receiving of SAP logon tickets on the server. See the online documentation for details.

Since SAP logon tickets make use of SSF, also the correct setup of SSF on the AS ABAP is required. To check the version of the installed security toolkit for SSF (and whether a security toolkit is available at all), run the report SSF02, using the default selection "Determine version". For further configuration of SSF for SAP logon tickets, which includes maintaining the Personal Security Environments (PSEs) of the server and maintaining the ACL, use the transaction STRUSTSSO2. Keep in mind that the maintenance here depends on the configuration of your system. Therefore, you may be required to run STRUSTSSO2 in both the working client (the one you are logged on to) and client 000. If you configure your system as recommended by SAP, the PSE used for handling SAP logon tickets is the system PSE, and in this case, all PSE and ACL maintenance can be done in the actual logon client.

Note: If you need to replace a certificate for use with SAP logon tickets, make sure that you not only replace the certificate in the certificate list of the related PSE in the target system, but also that you replace the ACL entry, even if the new certificate uses the same subject name as the one to be replaced.

The transaction SSO2 originally was set up to configure SAP logon tickets on mySAP Workplace systems. Keeping this in mind, you will find that SSO2 can still provide helpful information in analyzing SSO with logon tickets, but unfortunately is no longer so helpful in modern landscapes where an AS Java creates the SAP logon tickets for users (such as the portal).
In current landscapes, there is a configuration wizard available with the SAP NetWeaver Administrator that replaces the old SSO2 transaction. For more information, see SAP Notes 1083421 and 1014077.

The most important procedure for analyzing problems when creating, accepting, or verifying SAP logon tickets on the AS ABAP is described in note 495911.
Codes and error messages that are reported in the logon trace according to note 495911 are explained in note 320991.

Also see note 1055856 for several common issues related to using SAP logon tickets.

The corrections from note 1159962 extend the AS ABAP's error messages with a message that refers to the specific issue that can occur when a Java-based system issues incomplete tickets (most probably due to configuration mistakes).

Inside the AS ABAP, the Internet Connectivity Framework (ICF) is responsible for cookie handling. The SAP logon ticket is no exception, so you also need to check the security settings for applications in transaction SICF. The settings in SICF can be maintained differently for each Web service being offered.

1.2. SAP logon ticket creation and verification on the AS Java

On the AS Java, the creation and receiving of SAP logon tickets is configured in the login module stack of the service being called. Usually, it is sufficient to run the SSO2 wizard in the SAP NetWeaver Administrator to enable the use of SAP logon tickets (note 1083421).

For storing the 'SAPLogonTicketKeypair', which is used to sign its SAP logon tickets, and for storing the public-key certificates of other ticket-issuing systems, the AS Java reserves a special view in the Key Storage service named 'TicketKeystore'. If you have to re-create the logon ticket key pair manually, make sure you create it in the 'TicketKeystore' view and give it the name 'SAPLogonTicketKeypair'. Also keep in mind that the key pair must use the DSA algorithm, and (for the time being) the validity of the certificate can not exceed January 1st, 2038. SAP Note 912229 describes how to replace the key pair and certificate on your AS Java.

Also see the online documentation for your product for specific instructions.

The most important checks for settings are summarized in note 701205. If checking these (static) settings does not help, use the diagnostic tool described in notes 1045019 and 957707 for further analysis.

Finally, see note 1159962, which refers to a common configuration issue in the AS Java's login module stack and related error messages on the (receiving) AS ABAP.

1.3. SAP logon tickets on a dual-stack system

For the analysis of logon issues with SAP logon tickets on a dual-stack system, basically the two previous chapters apply at the same time.

In addition, see the attachment to note 701205, named 'Add-InDoku.zip', which refers to settings that are specific for Add-In and dual-stack installations.

1.4. Tracing the SAP logon ticket on the client (Web browser)

On the client side, SAP logon tickets are stored as non-persistent cookies named MYSAPSSO2. This means the cookies are stored in the main memory of the Web browser process only. Of course, this main memory is volatile, which makes SAP logon tickets difficult to detect. In the most simple case, if you enter 'javascript:alert(document.cookie);' as an URL, the Web browser reveals the cookies that are currently known, but unfortunately this method of detecting cookies is not always helpful.

A lot more information can be obtained from an HTTP trace, like URLs being used; names, domains and content of COOKIEs; or Web page content.
We recommended using an HTTP proxy tool to trace the HTTP traffic
directly at the client. SAP uses HttpWatch (http://www.simtec.ltd.uk or http://www.httpwatch.com). There is a free version that you can use to provide a trace file ('*.hwl' file) that can also be
analyzed/read in SAP support. Please ZIP before uploading!

1.5. Considering COOKIE properties

Since SAP logon tickets are handed over to the client (Web browser) in the form of a cookie, all cookie properties apply. This means that they are assigned a name ('MYSAPSSO2'), and the Web browsers will most likely only forward them to URLs inside the same DNS domain as that where they were created. Also, only one cookie with a given name can exist for a single domain.

Keep in mind that SAP has no influence on the way cookies are handled inside Web browsers, as the Web browser's behaviour is defined by the respective vendor's programming.

For further information related to cookies and Internet standards, see note 654982.

1.6. Special cases

There is a very specific situation where so-called reentrance tickets (a version of SAP logon tickets) can be used to log on to an HTTP-based session from an already existing SAPGUI session on the same application server. The solution described in note 612670 works for this specific situation. The use of this ticket for authentication on other servers (other instances or other systems) is neither intended nor supported.

For integrating non-SAP components into an SSO landscape that uses SAP logon tickets, SAP provides an interface named SAPSSOEXT, which can be used to evaluate and verify SAP logon tickets and return the data contained. For more information, see note 304450 and its referenced notes. Note 1040335 contains information about how to trace the activities of SAPSSOEXT.

2. SSO based on X.509 client certificates

Based on Internet standards, X.509 client certificates offer a nonproprietary solution to implement SSO. The use of X.509 client certificates for authentication requires the target system to offer HTTPS/SSL (see notes 510007, 739043 or 1019634, resp.).

In all cases, authentication using client certificates has two
prerequisites: the client certificate needs to be mapped to a user ID (logon name) that already exists in the system, and the client certificate needs to be accepted in terms of trust.

Note that trust can only be configured for certificates that are issued by a Certification Authority (CA). You cannot exchange individual X.509 client certificates to establish trust in this case.

2.1. X.509 Client Certificates on the AS ABAP

The AS ABAP uses the PSE maintenance in transaction STRUST for establishing trust. The certificate(s) of the CA that has issued the client certificates need to be present in the certificate list of the SSL server PSE that is being used to handle incoming HTTPS/SSL requests.

The mapping of the client certificate to the internal user ID is provided in the table USREXTID (maintenance view VUSREXTID). It takes the external identity type (here 'DN'), the subject name from the client certificate, and the internal user ID (that is, USR02-BNAME) as field values. Note that some encodings of the DN are interpreted differently in the kernel than in the ABAP layer. We recommend using plain ASCII for Distinguished Names (DN).

The setting of the profile parameter icm/HTTPS/verify_client determines whether the AS ABAP generally accepts or requires X.509 client certificates. As with accepting SAP logon tickets, the actual ICF service's security settings (transaction SICF) may influence the system's behavior.

For problem analysis when using X.509 client certificate authentication, see the developer traces provided with the procedure described in note 495911. In addition, the ICM traces can be helpful. For displaying the certificates that are exchanged between the client and server during SSL negotiation, set the trace level to 3. For all other SSL related messages, trace level=1 should be sufficient. (High trace levels reduce readability!).

2.1.1. SAP Passport

SAP offers the SAP Passport as a comfortable solution to provide X.509 client certificates to users of SAP systems. For more information, see the SAP Support Portal at http://service.sap.com/TCS and follow the links "SAP Trust Center Services in Detail ==> SAP Passports in your SAP solution" and/or "==> Single Sign-On with SAP Passports".

In addition to the items already mentioned, when doing problem analysis, you need to keep an eye on the validity of the system's Registration Authority (RA) certificate. (This certificate is the server's own certificate and it is in the system PSE of your AS ABAP. It is signed by the SAP DSA CA).

2.1.2. The general case

In the case that you are not using SAP Passports, you need to provide the required system settings mentioned manually. In particular, the user mapping in VUSREXTID can be tricky if your client certificates contain non-ASCII characters. In this case, to get the correct representation of the subject name (owner name) from the client certificate, open the certificate in STRUST (menu "Certificate --> Import") and copy the content of the field "Owner".

2.2. X.509 client certificates on the AS Java

The AS Java uses the Keystore service for maintaining encryption keys, certificates, and therefore, to establish trust. The certificate(s) of the CA that has issued the client certificates need to be present in the Keystore view named 'TrustedCAs'.

On the AS Java, the SSL service is where you configure whether a client certificate is accepted or required for authentication. For the published services, the configured login module stacks define the authentication options. If you want to accept X.509 client certificates for authentication, the 'ClientCertLoginModule' needs to be configured accordingly.

It is also the ClientCertLoginModule that defines the rule(s) to use to map the client certificate to the user'd ID on the AS Java. Certificates can be stored directly with the user account (and thus are explicitly mapped), or the rule extracts the actual user name from the SubjectName or SubjectAlternativeName attributes contained in the X.509 client certificate.

In case of issues, check the "Troubleshooting" topics in the online documentation for the User Management Engine (UME).

3. SSO based on SNC

With one exception (*), SSO can be considered a by-product when implementing message encryption with SNC on the AS ABAP. Encrypting the data traffic of DIAG (SAPGUI<-->server) and RFC (server<--->server) protocols requires that each partner possesses keys to use for encryption, and these keys are also used for mutual authentication. Therefore, when using SNC for encryption, everything is in place for providing SSO.

(*) The one exception is when implementing SSO by using the NTLM from the Microsoft Windows System Security Provider Interface. NTLM can only provide client-side authentication (which suffices for user-side SSO), but no encryption.

Note 66687 gives a summary about SNC in general. More detailed generic information is contained in the online documentation.

When analyzing SNC issues, you should always look into the traces that are written by the involved executables, that is, the SAPGUI trace if the SNC issue is on the client side, and the developer traces 'dev_w##' if the server side is concerned (display using transaction ST11).
Error messages related to SNC use the terms 'SNC' and/or 'GSS', so it is a good idea to search the server's work directory for occurrences of these terms using tools like 'grep' (UNIX) or 'find' (Windows).

3.1. Third-party security products

SNC uses 'Generic Security Service' (GSS). These GSS functions that are available for use with SNC are implemented in an "external security product", and not in the SAP kernel itself. This means that the functions themselves must be made available through dynamically loaded libraries (DLLs, shared libraries or shared objects) from a separate product.

SAP does provide libraries that are licensed for use with server-to-server communications, however, not for use on the client side. So, SNC for SSO will always require in a third-party product. For issues with the SNC implementation of your chosen product, refer to the support organization of your respective vendor.

3.2. SNC for Windows

To make the security products that are available with the Microsoft Windows operating system (SSPI = System Security Provider Interface) available for the GSS interface used by SAP programs, SAP does provide "wrapper libraries" for either NTLM or Kerberos on Windows 32bit or 64bit platforms.

See note 352295 for the libraries themselves as well as a description of the known issues with this SNC implementation.

3.3. Unsupported solutions

While the wrapper libraries attached to note 352295 make the Kerberos implementation coming with Microsoft Windows available, these are only available for pure Microsoft Windows landscapes. Other implementations of Kerberos may be interoperable, but SAP neither tests for interoperability, nor is SAP able to provide support for those Kerberos
implementations.

See note 150380 for a more detailed discussion.

4. Related issues

Finally, here are some additional issues that are more or less related to SSO.

4.1. Password-based logon

Password-based logon can behave like SSO if the password is being stored on the client side (example: destinations in transaction SM59).

Note 622464 discusses the relation between user types and password expiration. For user types in general, see note 327917.

In Releases beginning with 7.00, the AS ABAP offers new password rules (distinguishing upper and lower case, and an extended password length). In system landscapes where older and newer systems exist side by side, there may be issues when components that provide the "old" policies need to access newer systems. Note 1023437 discusses the use of downward-compatible passwords.

Often, SSO is mistaken for solutions that provide identical passwords throughout a large number of systems. From our experience, such attemps for password synchronization can not work completely successfully and also reduce the level of individual password security. Hence, password synchronization is not supported, as note 376856 describes.

4.2. SPNego

This is a special initial login on AS Java that does not require a user to enter a password to access the server. It is based on the user's login to the Microsoft Windows domain. It makes use of the Windows APIs called 'SPNego'.

The central note for issues related to SPNego (note 968191) unfortunately may contain some obsolete references and may also miss some of the newest related notes. However, it still offers a valid entry point for problem analysis and an overview of the concepts use. In addition, see the online documentation.

In new releases of the AS ABAP, SPNego is also supported with SAP NetWeaver Single Sign-On release 2.0 (or newer). Downports exist also for older (supported) releases, please see note 1798979.

4.3. SAP Shortcuts

SAP Shortcuts can store the user's password and therefore simulate SSO. Nevertheless, because the 'normal' password authentication is being used, it is not regarded as a "true" SSO implementation.

4.4. Other (third-party) products

Other third-party products for SSO (for example CA's SiteMinder) may be functional, but since SAP's support does not have any experience or information available, therefore, contact the respective vendor's support channels if you have any questions or issues.

4.5. Additional tips/common problems

Several common error messages and issues that occur when setting up Single Sign-On are addressed in note 1055856.

When using some implementations of SSO, it may be cumbersome to continue to keep your passwords valid. On the AS ABAP, you can set the profile parameter login/password_change_for_SSO to set whether passwords that have become invalid need to be updated. Note 869218 contains some corrections that need to be in place to make the API available for checking this profile parameter. Keep in mind that some front-end and middleware components may still require a related correction to make the concept finally work.

A list of all error codes that may be recorded in the developer trace during processing logon attempts is provided in note 320991.

SAP Note 1378659 - NWBC known issues & what to check when opening a ticket

2014-04-02T22:27:00.001-07:00

Symptom

Known issues of Netweaver Business Client >=3.0 (NWBC) and what to check when you open a support ticket on BC-FES-BUS*

Other Terms

accelerated ticket processing

Reason and Prerequisites

Incomplete error description
Be aware that most of the mentioned "errors" are not really a software bug (support) but missing/wrong configuration (consulting).
Based on our support experience we still mention them in here in order to give you a chance to correct this quickly.

But bear in mind that this does not automatically qualify it to a support case <->ticket.


We added well issus which are caused/miss configured outside of NWBC (does not indicate any responsibility of NWBC itself).

Solution

BEFORE A TICKET IS OPEND:

Try to reproduce with the most current Patch Level of your client version:

NWBC CLIENT versions:

download links:

NWBC 4.0 Desktop version:
http://goo.gl/saiyA

NWBC 3.5 Desktop version:
http://goo.gl/9dfVv

NWBC 3.0 Desktop version:
http://goo.gl/oJlzl

NWBC HTML version:
-not relevant since all server side-

patch level descriptions:

NWBC 4.0 Desktop version:
https://service.sap.com/sap/support/notes/1707626

NWBC 3.5 Desktop version:
https://service.sap.com/sap/support/notes/1559188

NWBC 3.0 Desktop version:
https://service.sap.com/sap/support/notes/1353593

NWBC HTML version:
-not relevant since all server side-

what´s new with NWBC 4.0:

http://youtu.be/V9dFB9qsYIo

http://goo.gl/7VoNc

http://goo.gl/5CcgS

general NWBC information:

Introduction to NWBC:
http://www.youtube.com/watch?v=AAQRzKbNa1s

NWBC community on SCN:
http://scn.sap.com/community/netweaver-business-client

FAQ:
https://service.sap.com/sap/support/notes/900000

Documentation:
http://help.sap.com/saphelp_nw73ehp1/helpdata/en/4c/5b13bf97817513e10000000a42189b/content.htm?frameset=/en/66/48a793bc2f4ec5bdb8e7e93ea6cd9f/frameset.htm
or as pdf:
NWBC DESKTOP version
-> Menu->Help -> Show Documentation

NWBC SERVER side (runtime based on SAP_BASIS):

check note 1353538

apply the highest patch mentioned in there

you can´t apply any of those?

either your SAP_BASIS version does meet the minimum level mentioned in here:
http://help.sap.com/saphelp_nw73ehp1/helpdata/en/4c/5bd5ab97817511e10000000a42189b/content.htm?frameset=/en/66/48a793bc2f4ec5bdb8e7e93ea6cd9f/frameset.htm

or you run against the portal - ABAP patches are not applicable.

Background information:

After that you will have the most current NWBC runtime available and you don´t have to read further in this sub chapter:

especially important to update your NWBC runtime if:

your problem/fix is already mentioned in note 1353538

you run on a rather old NWBC runtime-

check your current runtime patch level (PL) according to
https://service.sap.com/sap/support/notes/1864151
and compare the notes (PL) with the ones mentioned in note 1353538

if your runtime PL is lower than: current PL (see note 1353538) minus 2 -> apply the highest PL mentioned in note 1353538 in order to get to a current NWBC runtime.

Does the error occur as well without NWBC?

http://help.sap.com/saphelp_nw73ehp1/helpdata/en/4c/5b14a697817513e10000000a42189b/content.htm?frameset=/en/66/48a793bc2f4ec5bdb8e7e93ea6cd9f/frameset.htm

For instance if you have integrated:

the portal:
Does the same error occur already if you call the Portal directly/standalone (without NWBC on top)?

a webdynpro application:
Does the same error occur already if you call the Webdynpro directly/standalone (without NWBC on top)?
http://help.sap.com/saphelp_nw73ehp1/helpdata/en/4c/5b14a697817513e10000000a42189b/content.htm?frameset=/en/66/48a793bc2f4ec5bdb8e7e93ea6cd9f/frameset.htm

sap gui transactions:
Does the same error occur already if you call the sap gui transaction in the classical sap gui/directly/standalone (without NWBC on top)?

Hint:

NWBC as a top layer will not fix problems which do occur already on lower layers

quick test:

http://goo.gl/aNfsr

if the problem occurs in the standalone case (without NWBC) as well -> open the ticket on the respective application component.

WHEN OPENING A TICKET:

Attach:

Traces type 2:

https://service.sap.com/sap/support/notes/1883689
you might be requested later for other trace types

Reproduction description:

Screenshots/navigation/click path

SID/CLIENT/URLs

mention your backend version in use: (SAP_BASIS)
http://help.sap.com/saphelp_nw73ehp1/helpdata/en/4c/5bd5ab97817511e10000000a42189b/content.htm?frameset=/en/66/48a793bc2f4ec5bdb8e7e93ea6cd9f/frameset.htm

in case of NWBC DESKTOP:

which NWBC version you are using including Patch Level (PL)

retest with the most current PL (download links - see at the beginning of this note)

does the same issue occure as well in NWBC for html (browser only).

error numbers:
compare with trace type 1 or 4 from: https://service.sap.com/sap/support/notes/1883689

403 (Forbidden) error:

Check the chapter: "Active Services in the ICF"
http://help.sap.com/saphelp_nw73ehp1/helpdata/en/4c/5bdb8497817511e10000000a42189b/content.htm?frameset=/en/66/48a793bc2f4ec5bdb8e7e93ea6cd9f/frameset.htm

Most probably the appropriate SICF service has not been activated (troubleshoot with note 1883689 type 1 OR 4)

an example how to activate a SICF node:
note 1109215 (application dependent)

404 file not found (mimes/images are not displayed) - or looping at login

often ITS / web gui related

test a plain/standalone (no nwbc involved) webgui based transaction -> same/similar problems there?

verify https://service.sap.com/sap/support/notes/1308846

still 404's ? check note 808347 and/or open ticket on BC-FES-ITS

500 error in the client:

ITS / web gui related?:
open a ticket on BC-FES-ITS

RABAX:
UNCAUGHT_EXCEPTION CX_FQDN / An exception occurred that was not caught.
make sure fully qualified domain names are used: https://service.sap.com/sap/support/notes/654982 &https://service.sap.com/sap/support/notes/773830

NWBC on WTS/Citrix:

NWBC 3.0:

Installation:

http://help.sap.com/saphelp_nw73ehp1/helpdata/en/4c/5bd1f897817512e10000000a42189b/content.htm?frameset=/en/66/48a793bc2f4ec5bdb8e7e93ea6cd9f/frameset.htm

use >=PL6 of NWBC 3.0
http://goo.gl/oJlzl
PL description: note 1353593

Missing Taskbar Buttons:

https://service.sap.com/~sapidb/012003146900000583532011E/Taskbar_Buttons_missing.pdf

NWBC 3.5:

second login required (not occurring in non citrix environment).

use >=PL4 of NWBC 3.5:
http://goo.gl/9dfVv
PL description: note 1559188

SSO or Login related errors:

SSO2 configuration is MANDATORY for NWBC usage
Error:

popup on the frontend:

EN: 
"SSO logon not possible; logon tickets not activated on the server"   OR:

"SSO logon not possible; no logon ticket due to incorrect configuration"  OR:

"SSO logon not possible; browser logon ticket cannot be accepted"   OR:

"Please check your configuration of the SAP Logontickets (MYSAPSSO2-Cookie)

DE: 
"SSO-Anmeldung nicht möglich: Anmeldetickets nicht auf Server aktiviert"   ODER:

"SSO-Anmeldung nicht möglich: Kein Anmeldeticket wegen fehlerhafter Konfig"   ODER:

"SSO-Anmeldung nicht möglich: Browser-Anmeldeticket wird nicht aktzeptiert"  ODER:

"Prüfen Sie Ihre Konfiguration des SAP-Anmeldetickets (MYSAPSSO2-Cookie)

the following log entries in NWBC DESKTOP traces indicate the same problem:

C:\Users\<user name>\AppData\Local\SAP\NWBC\Traces\NWWBCTrace.log
"MYSAPSSO2 cookie missing after logon"

What to do:

Please read chapters "NWBC and Authentication" and "Logon Tickets" of the NWBC documentation where we explain some background information about the absoutely necessary MYSAPSSO2 cookie. (http://goo.gl/ngM7b)
To check whether HTTP requests contain the MYSAPSSO2 cookie you can use e.g. Fiddler as an HTTP sniffer (note 1883689).

above SSO errors do indicate an incomplete / incorrect (server side) sso configuration (consulting):

https://service.sap.com/sap/support/notes/817529

https://service.sap.com/sap/support/notes/1055856

http://help.sap.com/saphelp_nw73ehp1/helpdata/en/4c/5b142097817513e10000000a42189b/content.htm?frameset=/en/66/48a793bc2f4ec5bdb8e7e93ea6cd9f/frameset.htm

Further SSO related configurations/errors:

error displayed:
"the system is unable to interpret the sso ticket received"

http://help.sap.com/saphelp_nw73ehp1/helpdata/en/4d/a5ddc832211dcde10000000a42189c/content.htm?frameset=/en/4a/47abb3e1f41cd4e10000000a421937/frameset.htm

https://service.sap.com/sap/support/notes/701205

open a ticket on BC-SEC-LGN

troubleshoot SSO:

check whether the user is a "DIALOG" user - service and system users never get SSO tickets (https://service.sap.com/sap/support/notes/622464 for more details)

https://service.sap.com/sap/support/notes/1257108

https://service.sap.com/sap/support/notes/1638715

open a ticket on BC-SEC-LGN

integrated SAP GUI -when SNC transport layer encryption is active- SSO does not work at all (permanently prompting for user/password):

https://service.sap.com/sap/support/notes/1690531

HTTPS/SSL & client certificates are in place:

some of the clients can´t login the following is displayed (popup) & traced in type 2 of:
https://service.sap.com/sap/support/notes/1883689

error code: 0x80090326 and/or the following error text:

EN: The message received was unexpected or badly formatted

DE: Das Format der empfangenen Nachricht war unerwartet oder fehlerhaft

                    caused outside of SAP-code: check relation to http://support.microsoft.com/kb/933430/en-us for verification you can open a ticket on BC-SEC-SSL

Warning@Login:

switch to https:

EN: No switch to HTTPS occurred, so it is not secure to send a password

DE: Es erfolgte kein Umschalten auf HTTPS, Kennwort senden ist daher unsicher

https://service.sap.com/~sapidb/012006153200000000422012E/SSLsetup.pdf
(Document eventually as well helpful in case you have load balancers / web dispatcher in place).

multiple login warning:

EN: ' you are already logged on to the system in the following sessions '

EN: ' Sie sind im System bereits mit folgenden Sessions angemeldet '

https://service.sap.com/~sapidb/012006153200001041092013E/you_are_already_logged_on.pdf

Security Warning:

EN:

SAP Netweaver Business Client has identified a potential security concern.
(This location is not explicitly marked as safe/whitlisted)

DE:

SAP Netweaver Business Client hat ein mögliches Sicherheitsrisiko entdeckt.
or

SAP Netweaver Business Client hat ein potentielles Sicherheitsrisiko identifiziert.
(Folgender Ort ist nicht explizit als sicher gekennzeichnet)

see http://help.sap.com/saphelp_nw73ehp1/helpdata/en/c5/18826ad1e944dfb39aa1d0fe3a188a/content.htm?frameset=/en/66/48a793bc2f4ec5bdb8e7e93ea6cd9f/frameset.htm

Welcome message configured but does not appear:

Table: NWBC_CFG parameter WELCOME_MESSAGE (see http://goo.gl/Dxz9tZ) is not taken into account

apply the highest patch mentioned in note 1353538

& retest.

System Messages with strange characters@Login page:

           http://goo.gl/iYOs7

Browser not supported error:
" You are calling this web site with a browser that is not supported "

update your Unified Rendering by following this article:

http://wiki.scn.sap.com/wiki/x/2oQCFQ

If issue still persists:
Check in the Product Availability Matrix
https://service.sap.com/sap/support/pam
if the browser in use is supported with your Basis Release

--> Display All Product Versions --> search for basis version --> display Technical Release Information --> Web Browser Platforms

your browser is in that list: open a ticket BC-WD-UR

Login Page - when tabbing (keyboard) from user to password field - curser is not set correctly.

only occurs on SAP_BASIS 7.31 based backends

update your Unified Rendering by following this article:
http://wiki.scn.sap.com/wiki/x/2oQCFQ

in case of problems open a ticket BC-WD-UR

NWBC does not start up at all (no splash shown)- although configuration is o.k.:

Try on a different PC
most probably it is NOT a customer wide problem

Does it work for other users?
check for a corrupt windows user profile

Total Crash of your NWBC:

retest with the most current NWBC version:

NWBC 3.0: http://goo.gl/oJlzl

NWBC 3.5: http://goo.gl/wYgry

Chapter crash in the troubleshooting guide:
http://help.sap.com/saphelp_nw73ehp1/helpdata/en/4c/5bd5d397817511e10000000a42189b/content.htm?frameset=/en/66/48a793bc2f4ec5bdb8e7e93ea6cd9f/frameset.htm

check the windows event logging on the client at the time of the crash.

un+reinstall your .NET framework and your NWBC client
(especially if other PC´s don´t have the same issue).

Troubleshoot NWBC related performance issues:

important:
update your current NWBC runtime (note 1353538) + use most current NWBC client (download links@start of this note) -> retest

https://service.sap.com/~sapidb/012003146900000698932013E/PerformanceIssues.pdf

Special Cases:

Zoom Slider changed:
https://service.sap.com/~sapidb/012003146900000307472012E/FontSizeSliderPerformance.pdf

OBN resolution is slow:
https://service.sap.com/sap/support/notes/1630904

POWL:

locks sessions and displays error:

EN: ' Query <name of the Query> is already open in another session '

DE: ' Query <Name der Query> ist bereits in anderem Modus geöffnet '

check: https://service.sap.com/sap/support/notes/1433603

html client only: second (opening) window shows:

Error: "the specified application configuration was not found"

apply: NWBC runtime patch >=PL17
https://service.sap.com/sap/support/notes/1353538

change+save of child window does not update the POWL in the father window

apply: https://service.sap.com/sap/support/notes/1778521

Connection failures:

NWBC- fails with:

EN: " The NetWeaver Business Client is only supported with the NetWeaver 7.02 and 7.20 and further releases"

DE: " NetWeaver Business Client für Desktop wird nur ab Release NetWeaver 7.02 und 7.20 unterstützt "

install highest patch level metioned in note 1353538
background information: note 1368177

saprouter connection string fails:

https://service.sap.com/sap/support/notes/1310185

Proxy <->NWBC related Error:

Popup@Login:
The proxy configuration within Internet Explorer cannot provide a proxy for this server

-> see http://goo.gl/zUArw

Internet Explorer is configured to use an automatic proxy based on a file protocol 'e.g.: <(file//c:\windows\proxy.pac)>, only URLs based on HTTP can be supported

-> see http://goo.gl/855g8

Parser related issues:

Popup@Login:

                     EN: The backend connection for <connection name> generated a critical error: Parsing for server response is impossible.
                     DE: Backend der Verbindung <Verbindungsname> lieferte einen schwerwiegenden Fehler zurück: Parsing nicht möglich für Serverantwort

TRACE ENTRIES (note 1883689 type 2):
runtime\NWBCTrace.log:

                     "CreateDOM: failed to create XML parser instance (hr=0x80040154(Class not registered))"
                    OR:
                     "readDirectoryXML: failed to create XML parser instance (hr=0x80070015(The device is not ready.))"

see http://goo.gl/RFWK3

SAP GUI <-> NWBC related issues:

first of all: test the same issue with the most current sap gui:
see note 1053737 + most current NWBC client (download links@start of this note).

specific errors:

web gui is used although sap gui for windows is expected to show up.

Environment:
- load balanced SM59 remote destinations are in use

Troubleshooting:
- https://service.sap.com/sap/support/notes/1883689 trace type 3
- unpack zip and search in: \runtime\NWBCTrace.log
= result in the trace:
"URL is not complete to start Wingui (~service missing)"

Solution:
- configure the RFC against an application server. (Load Balancing = No)

- To achieve group login use SAP Logon Descriptions as described in
https://service.sap.com/~sapidb/012003146900000346922011E/Multi_System_SapLogon_Config.zip (Front end load balancing)

SCENARIO:
SAP GUI transaction running NWBC integrated with PFCG (other node details) configured "Target System" based on SM59 (remote destinations)

ISSUE:
at runtime it can happen that an integrated SAP GUI session is pointing towards the wrong system.

SOLUTION:
note 1827027

sap gui connection error popup: WSAECONNREFUSED: Connection refused

SCENARIO:
message server is used as well for http traffic load balancing, several app servers are in place
initial logon to NWBC -> integrated SAP GUI Transactions works on the first attempt
NWBC logoff and login again=works: but it randomly occurs that integrated sap gui connections get refused with error popup.

solution:
make sure you run the most current NWBC patch levels.
NWBC 3.0 >= PL71
NWBC 3.5 >= PL10
NWBC 4.0 >= PL07
download locations see note 900000

NWBC SAP GUI Integrator information popup:
With the current installation, all transactions will be started with SAP GUI for HTML
= Warning that no SAP GUI is installed on this client - to get rid of this warning:

install SAP GUI for Windows

if SAP GUI for Windows is not wanted but SAP GUI for HTML: http://goo.gl/f2HVY

SAP GUI for Windows is installed but still get this warning
check note 1527068

get rid of annnoying popup:

EN: "Unsaved data will be lost. Do you want to log off?"

DE: "Nicht gesicherte Daten werden verlorengehen. Möchten Sie sich abmelden?"

           https://service.sap.com/sap/support/notes/1508133

not NWBC but web gui related:

Popup of type:
"Sent URL
/sap(<long string>)/bc/gui/sap/its/webgui/?<parameters>" sample & solution:https://service.sap.com/~sapidb/012006153200000426282011E/sent_URL_popup.pdf

fired URLs too long:
https://service.sap.com/sap/support/notes/1459135
(and it´s realted notes)

NWBC 4.0 does not show 'SAP GUI status messages' after ending certain (mainly business) SAP Gui Transactions (e.g. confirmation of successful saving or list couldn't be retrieved etc.)

Cause:
Calling "default screen transaction" S000 triggers the "browser" to close the tab, and the status messages are "posted" afterwards -> tab already closed, message cannot be catched.

NWBC 4.0 works as designed:
tabbed browsing - the opened tab is closed if there is a return to the default SAP Gui transaction (S000 - default screen). In this case this behavior is automatically triggered by the application itself and there is no technical solution to catch the status message at the moment. Works currently only with NWBC <4.0 (different navigation paradigm) or alternatively with web gui integration.
We keep this in mind with further improvments of SAP GUI integration in upcoming NWBC releases.

NWBC navigation to sap gui transaction:
EN: ~"error: Transaction <TA>%20<PARAMETER> is unknown"
DE: ~"Fehler: Transaction <TA>%20<PARAMETER> ist unbekannt"

https://service.sap.com/sap/support/notes/1587833

+ >=PL6 (http://goo.gl/oJlzl)

EN: "SAP GUI failed to start transaction <TACode>"
DE: "SAP GUI konnte Transaktion <TACode> nicht starten"

Scenarios:

long running sap gui transactions <-> navigate away:
https://service.sap.com/sap/support/notes/1832849

if fails immediately:
http://goo.gl/Pb1Rjp

EN: "SAPGUI has closed the communication channel. All sessions are lost"
DE: "SAP GUI hat den Kommunikationskanal geschlossen. Alle Modi gehen verloren."

https://service.sap.com/sap/support/notes/1592316

yellow arrow icon (Log off -Shift+F3) ends in blank sap gui screen and final "SAP GUI has closed transaction <transaction>."
use NWBC 3.5 (http://goo.gl/9dfVv) instead of 3.0

OBN (object based navigation) errors:
IMPORTANT:
apply the highest available runtime patch mentioned in
https://service.sap.com/sap/support/notes/1353538

still failing with "failed to resolve Object Based Navigation target"? ->

95% chance that the role is not maintained correctly (config=consulting) check:
http://help.sap.com/saphelp_nw73ehp1/helpdata/en/4c/5cea8539c21d47e10000000a42189b/content.htm?frameset=/en/66/48a793bc2f4ec5bdb8e7e93ea6cd9f/frameset.htm &http://help.sap.com/saphelp_nw73ehp1/helpdata/en/4c/5bdc7f97817511e10000000a42189b/content.htm?frameset=/en/66/48a793bc2f4ec5bdb8e7e93ea6cd9f/frameset.htm

Special OBN error: "Error in Calling Up Application"

Scenario:

NWBC connected to a Portal

Webdynpro ABAP application is integrated into a portal PAGE

iView is assigned to this PAGE & page (OBN target) to the role

Workaround:

eliminate the PAGE and assign the iView (OBN target) directly to the role

other obn errors:

see
http://help.sap.com/saphelp_nw73ehp1/helpdata/en/4c/5bdc7f97817511e10000000a42189b/content.htm?frameset=/en/66/48a793bc2f4ec5bdb8e7e93ea6cd9f/frameset.htm

and OBN section of:

http://help.sap.com/saphelp_nw73ehp1/helpdata/en/4c/5bd5d397817511e10000000a42189b/content.htm?frameset=/en/66/48a793bc2f4ec5bdb8e7e93ea6cd9f/frameset.htm

Portal <-> NWBC

Popup@Logon: "Could not open the logon window for the server with the supplied URL"

in NWBC.exe#*.1.log (see note 1883689 Trace type 2):

<Timestamp> [Runtime] E    DoXmlGzipRequest failed  Exception
WebException: The remote server returned an error: (500) Internal Server Error.   at System.Net.HttpWebRequest.GetResponse()   at com.sap.nw.nwbc.csruntime.implementation.navigation.core.CsNavigationVirtualRoot.DoGZIPRequest(String url, String requestData, String& responseData, Boolean addSapClientAndNwbcContext)
[Runtime] E  Body of error response is EMPTY
CreateUriAndDotEscape: uri=http://<full qualified host name>:<portal-port>/ConfigurationWS/ConfigurationWSConfig?wsdl&style=document&mode=standard

Solution:
https://service.sap.com/sap/support/notes/1832862

"DSM: XHR Status was 500, not able to deliver PRO54-DSM data"

10% case:
NWBC Runtime not current:

apply the highest patch note of:
https://service.sap.com/sap/support/notes/1353538

FOR THE REST(90%) USE FRONTEND VERIFICATION TO ANALYZE THE PROBLEM:
https://service.sap.com/sap/support/notes/1883689

30% case:
not correctly maintained RFC destinations:

Sometimes not correctly maintained RFC destinations in the scenario are used and/or relevant SICF nodes are not active:
Check the problematic request/response in the http traffic and verify the

corresponding RFC destinations (IF used in your scenario)
TA: SM59

Possible problems: e.g. forgotten to adjusted the server definitions after a system copy?

or server definitions for system aliases are incorrect?
background information: http://goo.gl/vJCvb

relevant SICF nodes - active?
TA: SICF

30% case:
customer specific network/landscape issues:

e.g. wrong DNS resolution, wrong URL´s in the roles, blocking firewall, miss functional reverse proxy

15% case:
POWL caused:

check with trace type 1 OR 4 of note 1883689 -> 500 error in:
http(s)://<full qualified host>:<port>/sap/bc/webdynpro/sap/fitv_powl_assistantcheck with BC-MUS-POW support - most probably note 1902580 & 1909714 can help.

10% case:
if ITS / WEBGUI related:

http://goo.gl/TsNP7

frontend traces: (note 1883689 type 1 or 4)
in case of 403 errors in the ITS and/or mimes area
-> check the respective SICF nodes (activated?).
example for SICF node activation:
note 1109215 (application dependent - this note is for webdynpro not ITS)

verify note 1611466

5% case:
other reasons:

open a ticket include traces:
https://service.sap.com/sap/support/notes/1883689
type 1 AND 2 OR 4

Timeout when logging into NWBC:

Error popup at login:
The backend of connection <system> returned a fatal error: Request has timed out (12002)

solution/troubleshooting:
https://service.sap.com/~sapidb/012006153200000487922011E/Request_has_timed_out.pdf

APPLICATION INTEGRATION:

General:

http://help.sap.com/saphelp_nw73ehp1/helpdata/en/4c/5b14a697817513e10000000a42189b/content.htm?frameset=/en/66/48a793bc2f4ec5bdb8e7e93ea6cd9f/frameset.htm

Rendering problems:

Close button is missing in the (Web-dynpro)-application:

https://service.sap.com/sap/support/notes/1353538 (>=PL17)

https://service.sap.com/sap/support/notes/1507477 (when SAP_BASIS 7.02 SP<=7)

https://service.sap.com/sap/support/notes/1526176

if NWBC 3.0 DESKTOP version then it needs to be >=PL5
http://goo.gl/oJlzl (patch history: note 1353593)

NWBC HTML <-> IE9:

Rendering problems in IE9
https://service.sap.com/sap/support/notes/1579105

Branding image / Logo not displayed

double check your configuration again!
Here some examples:
https://service.sap.com/~sapidb/012006153200000159042012E/branding.pdf

BEx Web:

Popups or F4 help hangs (e.g. looping wheel or script error)

e.g. when entering values into fields

check https://service.sap.com/sap/support/notes/1764448

cProject:

webdynpro based search fails:
https://service.sap.com/~sapidb/012003146900000418672011E/SearchCprojectsFailsWebdynpro.pdf

launchpad issue: document is not loaded in external window
works with NWBC html but not with NWBC Desktop.

keyword in dump:
The ASSERT condition was violated
in method:
GET_DOCUMENTS_FOR_BASEOBJ

apply:
https://service.sap.com/sap/support/notes/1353538 (>=PL19)

mail workflow: URL link attachment opens cProjects but fails with dump due to a semicolon in the URL:

https://service.sap.com/~sapidb/012003146900000371472012E/cProjectMailsDump.pdf

Gantt chart overlaps embedded popup window

apply steps under section 'Exceptons' of
https://service.sap.com/sap/support/notes/1753381

Session handling in the canvas area:
EN: "User session (HTTP/SMTP/..) closed after timeout"
DE: "Benutzer-Session (HTTP/SMTP/..) nach Timeout abgebaut"

main reasons for these timeouts:

https://service.sap.com/sap/support/notes/882548

https://service.sap.com/sap/support/notes/1364845

https://service.sap.com/sap/support/notes/1578632

less often the reason for these timeouts:

https://service.sap.com/sap/support/notes/1169817

https://service.sap.com/sap/support/notes/1240592

https://service.sap.com/sap/support/notes/1379678

non of the above scenarios do apply?

open a ticket on BC-CST-IC and attach ICM trace:
During reproduction raise ICM trace level 3 (TA SMICM).

ROLE / MENU related issues:

generally be aware of:

https://service.sap.com/sap/support/notes/1321829

https://service.sap.com/sap/support/notes/1246860

Standard SAP Menu / Area Menu not shown entirely:

https://service.sap.com/sap/support/notes/1885214

ERROR: "The user menu tree for user <user> is empty."

expected menu entries don´t show up
(partially missing or completely empty)

generally that indicates that simply

no role is assigned to the user -> PFCG

role is assigned but folder is defined as a "link collection" instead of a "service map" - see:
http://goo.gl/OEq9qa

OR check the following application specific chapters:

Work Center (top level navigation) is not shown in NWBC for HTML:

https://service.sap.com/sap/support/notes/1879939

NWBC <-> GRC:

https://service.sap.com/sap/support/notes/1604326

not directly NWBC related:

https://service.sap.com/sap/support/notes/1653405

error: "There are no task available to you yet"
https://service.sap.com/sap/support/notes/1708513
https://service.sap.com/sap/support/notes/1681453

NWBC<->solution manager + other products in general:

menu partially missing - or:

no menu entries at all - ERROR:
"The user menu tree for user <user> is empty." or "No content available":
Possible root causes:

Scneario: Running load balanced e.g. webdispatcher
apply >=PL30 (see note 1353538)
check HTTPURLLOC http://goo.gl/xp85T (alternatively check keyword: x-sap-webdisp-ap & wdisp/handle_webdisp_ap_header in http://goo.gl/RFZo7
in case of SAP GUI content: http://goo.gl/oQaCW "Multi System Sap Logon Configuration"

Additional information: Beside the "no content available" popup @Login this load balanced scenario could cause as well a second login prompt in the content area -> fixed with the same approach as mentioned above

other products are used on top of a solution manager
https://service.sap.com/sap/support/notes/1346050

generally certain applications do use additional menu filters (BAdIs) which manipulate (remove+resort) the menu result AFTER the NWBC runtime "menu calculation" & BEFORE send to the NWBC client - example:
https://service.sap.com/sap/support/notes/1647153
another example - SRM see next chapter:

solman is dummping

https://service.sap.com/sap/support/notes/1601983

"There is no iView available for system"

if solman related: note 1709545

if obn related apply PL>=30  -> see note 1353538
+ in case DESKTOP client is used - retest with most current version:
3.0:
http://goo.gl/oJlzl  or
3.5:
http://goo.gl/9dfVv

EN: "FPM application <web dnypro application> was started without configuration"
DE: "FPM-Anwendung <web dnypro Anwendung> wurde ohne Konfiguration gestarted"

apply the hihgest patch level mentioned in note 1353538
(miniumum PL26)

NWBC<->SRM:

Popup at login: "no content available - contact your Administrator"

special case of SRM:
"Portal Independent Navigation Frame" (NWBC instead of Portal) further SRM customizing is required:
SPRO (path depends on SRM version):

SAP SRM > SRM Server  > Technical Basic Settings  > Portal Independent Navigation Frame.
activate switch "SRM_700_LOCAL_MENU" for NWBC navigation. (other related terms & responsible component: SRM-EBP-WFL-AC:rabax:
CX_NWBC=>RAISE
...
/SAPSRM/CL_URL_SERVICE=>GENERATE_ACCESS_URL )

other SRM related note:

Menu enries missing:
https://service.sap.com/sap/support/notes/1529553

Supplier Self-Services (SRM-SUS) multiple logons when navigating
https://service.sap.com/sap/support/notes/1665564
https://service.sap.com/sap/support/notes/1651708

Popup:
"Object or set with GUID 00000000000000000000000000000000 does not exist"
https://service.sap.com/~sapidb/012003146900000308222012E/ObjectOrSetWithGUID.pdf

catalog <-> SRM:
apply note 1746597 + highest Patch Level mentioned in note 1353538 for following errors:

dumping e.g. with error 'Parameter "" has an invalid value "". Possible values are:"".'

SRM does not 'resume' out of 'suspension' when coming back from catalogs.

catalog -> SRM =endless loop
root cause:
http<->https unwanted/incorrect protocol switch

SRM-Dump in NWBC when catalog items are transfered back to SRM

                    Check if the Dump refers to /SAPSRM/CL_CH_WD_INBOUND_HDLR
                    Switch off Inbound Handler as mentioned in:
https://service.sap.com/sap/support/notes/1294571
                    or implement:
https://service.sap.com/sap/support/notes/1903250

general Dump in NWBC canvas & ST22 dump fails in "check_invalid_chars url"

https://service.sap.com/sap/support/notes/1506161

Blank screen/no data transfer back to SRM/NWBC after external catalog item selection:

Scenario:

1. Item selection in an external catalog:
a) Catalog opens in an separate (NWBC-)window.
b) User selects an (several) item(s) out of the external catalog.
2. when transferring the Shopping Cart back to SRM (for placing the order) - NWBC shows an empty page instead of transfering the data successfully.

Check:

https://service.sap.com/sap/support/notes/1603168

still not working? - open a ticket on SRM-EBP-CAT

PDO Layer error:

https://service.sap.com/~sapidb/012003146900000494452011E/PDO_Layer_error.pdf

NWBC for HTML:

unwanted behavior: selection screens getting skipped - immediate results showing up.

https://service.sap.com/sap/support/notes/1766764

Content not showed properly / no proper behavior with Internet Explorer 10 (browser dependencies):

update your Unified Rendering by following article:
http://wiki.scn.sap.com/wiki/x/2oQCFQ

If issue still persists:
Check in the Product Availability Matrix
https://service.sap.com/sap/support/pam
if the browser in use is supported with your Basis Release

--> Display All Product Versions --> search for basis version --> display Technical Release Information --> Web Browser Platforms

your browser is in that list: open a ticket BC-WD-UR

NWBC 3.5 ONLY:

side panel does not show up

use >=PL5 of NWBC 3.5
http://goo.gl/9dfVv

ADDITIONAL INFO if applicable:

Frequency of problem occurrence:

Occurs on all tested desktops?

Occurs only on certain desktops?

Is there a pattern recognizably (e.g. only with certain browser versions or operating systems)

Not client/desktop related at all -> server related only?

Remote access

optional prepare a remote connection: - https://service.sap.com/sap/support/notes/494980

Generally we recommend a WTS connection to a client with SAP GUI and NWBC installed.

Http connects are o.k. as well especially for javascript and http error code debugging sessions.

don't forget a short description how to reproduce the error URLs, navigation path, transaction, users/credentials...

troubleshooting part of the documentation:

http://help.sap.com/saphelp_nw73ehp1/helpdata/en/4c/5bd5d397817511e10000000a42189b/content.htm?frameset=/en/66/48a793bc2f4ec5bdb8e7e93ea6cd9f/frameset.htm

+ most current delta documentation:

https://service.sap.com/~sapidb/012006153200000006462011E/delta_nwbc30_docu_20101222.pdf

SAP Note 940893 - Analysis of errors within the startup of J2EE Engine 6.40

2014-02-20T23:00:00.002-08:00

Symptom

A problem occurs when you start J2EE Engine 6.40 or 7.00. As of 6.40 Support Package 17 and 7.00 Support Package 8, the trace file of the startup framework references this note for further analysis.

Other Terms

error 193 LoadLibrary jvm.dll

Reason and Prerequisites

Since the start process of the J2EE Engine combines various SAP Support components, this note should help you to fine the correct queue to ensure that you receive support more quickly. For this reason, the 'Solution' section is also divided into the individual steps for the startup and the relevant components.

Solution

The first step in starting the J2EE Engine is to create the Java virtual machine. For this, you require the correct version of the JDK (refer to the section entitled 'Confirmation of the VM in use' in Note 943498). It is not sufficient to just have the Java Runtime JRE because you need the full JDK (including the Java Comiler javac) to compile the JSPs and EJB Stubs.

1. JDK detection issues

The engine is not able to start due to problems detecting the JDK.
- Check that you have installed the correct JDK version.
    Read the section entitled 'Confirmation of the VM in use' in Note 943498 to find the appropriate platform-specific note.

To identify the current version of the JDK, execute the following command at command line level:
           java -version                                               You must have installed the complete JDK/JSDK (including the Java Compiler javac).
- Check if there are redundant JDK versions and make sure that the SAP J2EE Engine uses the correct JDK version.

                                              Therefore, verify the corresponding parameter in the instance profile
        /usr/sap/<SID>/SYS/profile/<SID>_JC<num>_<host>
        jstartup/vm/home = <jdk home directory>.
This parameter has a higher priority than the environment variable JAVA_HOME.
                                                                - On Unix systems, it is important to verify the user rights.
If you experience problems with the JDK, open a message under the component for the relevant JDK provider (for example, BC-OP-SUN-JSE).

Helpful Notes:
718901   How to change the JDK of the J2EE Engine
817991   Startup Framework fails when starting a JLaunch process
741289   Profile parameters of the J2EE Engine are lost
943498   J2EE Engine does not start 6.40 and 7.0

THe JDK detection results will be stored in the configuration files
             *.vmprop
(for example, instance.properties.vmprop).
If these files contain the wrong information (for example, the path is wrong due to an upgrade), they can be deleted. Be careful not to delete the corresponding properties file.

2. Java VM shared library issues

- Check whether the *.vmprop files contain the correct information.
     If not, delete them. They will be created again the next time you start the engine.

- In Windows systems, error code 193 indicates that the wrong version of JDK was applied (incorrect bit lengths).

   On 64-bit systems, make sure that the JDK is also 64 bit.

  The trace fie contains the following error entry:

*** ERROR => DlLoadLib: LoadLibrary(jvm.dll) Error 193

- Unix systems issue the following error message: "cannot open
   file". Even though the file exists, this may also occur because the bit length is incorrect for JDK.
     Check to see if this is the case.

If you experience problems with the properties files, open a message under the component BC-JAS-SF.

Helpful Notes:
861215   Recommended Settings for the Linux on AMD64/EM64T JVM
722520   Recommended JVM and VM Settings for the Tru64 VM

3. Java VM initialization issues

Problems with initializing the VM are often caused by incorrect parameters in the VM. For more detailed information, refer to the dev_<node> trace file (for example, dev_server0) or std_<node>.out  trace file (for example, std_server0.out).
If std_<node>.out does not exist, check whether the checkmark for the console is set in the config tool. You can also verify this in the instance.properties file. The parameter console is set to 'Yes'. Change this using the config tool.
Examples of incorrect parameters:
- The defined heap is too big. There is not enough contiguous virtual address space to define the heap.

      As a result, the system issues the following error message:
       could not reserve enough space for object heap.
    This error often occurs on 32-bit Windows systems (Note 835704).
    You can use the address space viewer (Note 736462) and preload DLL (Note 853696) to resolve this issue.

- Unknown parameters, for example, -XX:<name> on IBM JDK result in the following error messages:

      Command-line option unrecognised: -XX:+PrintGCTimeStamps
    These error messages are in std_bootstrap.out.
    If the system issues this type of error message, open the instance.properties file and delete the parameter. The bootstrap process does not read this information from the database, but from this file.

When you adjust the memory settings after the installation, note that the application-specific recommendations have priority over the platform-specific and general settings.

On Windows platforms, you cannot initialize the JVM if a copy of JVM.DLL exists in the %windir%\system32 directory. The error message in dev_bootstrap is:
       *** ERROR => JHVM_LoadJavaVM: Cannot create Java VM (rc=-1)
       *** ERROR => Cannot load Java VM (server) (rc=-1)
       JLaunchCloseProgram: good bye (exitcode=-1)
To confirm this, set the trace level to 3 and restart the engine. The system issues the following error message:
      load shared library (jvm.dll), hdl 0
      using "C:\WINDOWS\system32\jvm.dll"
Delete the copy in the %windir%\system32 directory.

If you experience problems in this step, open a message detailing the error under the component BC-JAS-COR.

Helpful Notes:
709140 Recommended JDK and VM Settings for the WebAS630/640 SP4
723909 Java VM Settings for J2EE 6.30/6.40/7.0
716604 Access to Sun J2SE and recommended J2SE options

4. Java VM terminated with a non-zero exit code

These errors require a more detailed analysis.
Therefore, send the complete compressed content of the work directory and the log of the node affected (for example, the content of       \usr\sap\SID\inst<No>\j2ee\cluster\server0\log\system\server0.log) to SAP Support.

Note for Support employees: See internal Note <999112>.

Helpful Notes:
716604 Access to Sun J2SE and recommended J2SE options
709140 Recommended JDK and VM Settings for the WebAS630/640 SP4
723909 Java VM Settings for J2EE 6.30/6.40/7.0

SAP Note 1601120 - Extended check for access sequences in customizing

2013-04-17T10:34:00.003-07:00

Reason and Prerequisites
Extended checks for access sequences of pricing and pricing related usages during customizing download. For details please check note 1600482.

Solution
The solution can be implemented by the following steps:
1. Implement the manual preparation steps valid for your release.
2. Implement the attached coding changes.

------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component BBPCRM BBP / CRM |
| Release 400 From SAPKU40001 |
------------------------------------------------------------------------
1. Step to transaction SE91.

2. Choose message class CND_MAP

3. Select number 208 and hit the 'Change' button.

a) Create the following short text for the message:
'Data exchange was canceled due to a fatal error'
b) Save the message.
c) Deselect the check box 'self explainatory' and maintain the following longtext for the message:

Diagnosis
The data exchange was canceled due to a fatal error. The exchanged data was only partly posted in the system. The pricing customizing is inconsistent.

Procedure
Clean up the fatal error that triggered the cancellation, and then
startthe data exchange again for the corresponding exchange object.
<zh>Until the exchange for the corresponding exchange object is successfully completed, the pricing can lead to incorrect results.</>
d) Activate the longtext and save.

4. Select number 209 and hit the 'Change' button.
a) Create the following short text for the message:
'The access type A is not available (access seq. &1, access &2,
field &3)'
b) Save the message.
c) Deselect the check box 'self explainaty' and maintain the following
longtext for the message:
Diagnosis
The access type A (hierarchical access functionality) is not
available.
The error was triggered by access sequence &V1&, access number
&V2&, field &V3&.
Procedure
For details, see SAP note 1600482.
d) Activate the longtext and save.

------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component BBPCRM BBP / CRM |
| Release 500 Until SAPKU50019 |
| Release 520 All Support Package Levels |
| Release 700 SAPKU70001 - SAPKU70010 |
| Release 600 SAPKU60001 - SAPKU60010 |
| Release 701 SAPKU70103 - SAPKU70106 |
------------------------------------------------------------------------
1. Step to transaction SE91.
2. Choose message class CND_MAP
3. Select number 209 and hit the 'Change' button.

a) Create the following short text for the message:
'The access type A is not available (access seq. &1, access &2,
field &3)'
b) Save the message.
c) Deselect the check box 'self explainatory' and maintain the
following longtext for the message:

Diagnosis
The access type A (hierarchical access functionality) is not available.
The error was triggered by access sequence &V1&, access number &V2&, field &V3&.
Procedure
For details, see SAP note 1600482.
d) Activate the longtext and save.

Read Complete Note @ Market Place

SAP Note 1601052 - Extended checks for customizing of condition access sequence

2013-04-17T10:30:00.002-07:00

Reason and Prerequisites
Extended checks in the customizing view for condition access sequences.
For details please check note 1600482.

Solution
The solution can be implemented by the following steps:
1. Implement the manual preparation steps valid for your release (new messages). This is only necessary before 4.6C.
2. Implement the automatic correction instruction (coding changes).
3. Apply the manual post-processing steps valid for your release.

------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_APPL SAP Application |
| Release 45B All Support Package Levels |
| Release 46B All Support Package Levels |
| Release 46C Until SAPKH46C62 |
| Release 470 Until SAPKH47036 |
| Release 500 SAPKH50001 - SAPKH50025 |
| Release 600 SAPKH60001 - SAPKH60020 |
| Release 602 Until SAPKH60210 |
| Release 603 Until SAPKH60309 |
| Release 604 SAPKH60401 - SAPKH60410 |
| Release 605 Until SAPKH60507 |
------------------------------------------------------------------------

This note introduces a consistency check routine in the customizing view cluster for maintenance of access sequences.

After the coding changes have been implemented, the check routine has to be added and activated in the view cluster and its variants. This can be achieved by downloading and running the attached report
ZZ_VVC_UPDATE_NOTE_1601052.

The report has to be executed manually in the development system. The report adds routine V_T682_SAVE_CHECK to the save event of certain view cluster variants.

It is rarely possible that error messages arise (e.g. view cluster variants are locked by another user). In such a case the report has to be executed again after the situation that led to the error has been resolved (e.g.
user has unlocked the view cluster variants).
With this run all view cluster variants that were not updated due to the error situation should be updated.

IMPORTANT:
1. The report records the performed changes to a transport request. These changes should be transported together with the automatic coding changes from note 1601052. The report doesn't have to be
executed in the target (productive) systems.
2. It is not necessary to transport report ZZ_VVC_UPDATE_NOTE_1601052 to other systems than the development system.

In detail, report ZZ_VVC_UPDATE_NOTE_1601052 does the following:

a) The list of view cluster variants relevant for your release is determined.

b) The following view cluster variants are updated:
- V_T682
- VVC_T682_MA
Starting from release 4.6B furthermore:
- VVC_T682_VA
Starting from release 4.6C furthermore:
- VVC_T682_CQ
- VVC_T682_FA
- VVC_T682_KA
- VVC_T682_KE
- VVC_T682_MS
- VVC_T682_TP
- VVC_T682_TX
In case the check routine V_T682_SAVE_CHECK is already active for a certain view cluster variant, the view cluster variant is not updated.

c) All changed objects are recorded to a transport request. When you are asked by the report, you have to enter a transport request.

d) After the report was successfully run without any error message, the transport request contains two objects for every updated view cluster variant, e.g.:
R3TR VCLS VVC_T682_MA
R3TR TOBJ VVC_T682_MAC

SAP Note 1600091 - Deactivation of hierarchical access functionality

2013-04-17T10:26:00.001-07:00

Reason and Prerequisites
Extended checks during runtime for pricing and pricing related usages and during customizing of access sequences.
For details check note 1600482.

Solution
The correction consists of a Java correction as well as an ABAP correction.
These corrections are included in SAP AP 7.00 Support Package 26.
The application of these corrections is only possible with an installation of SAP_AP 7.00 Support Package 26 or a higher support package.
If it should not be possible to install a support package of SAP_AP 7.00, then please apply note 1798794 for ERP-systems or note 1776338 for CRM, SRM and GTS.

For Complete information please read the note @ Market Place

SAP Note 1599403 - Deactivation of hierarchical access functionality

2013-04-17T10:23:00.003-07:00

Reason and Prerequisites
Extended checks during runtime for pricing and pricing related usages.
For details check note 1600482.

Solution
Implement the manual pre-implementation and the attached changes in the
source code.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_APPL SAP Application |
| Release 45B All Support Package Levels |
| Release 46B All Support Package Levels |
| Release 46C Until SAPKH46C63 |
| Release 470 Until SAPKH47036 |
| Release 500 SAPKH50001 - SAPKH50025 |
| Release 600 SAPKH60001 - SAPKH60020 |
| Release 602 Until SAPKH60210 |
| Release 603 Until SAPKH60309 |
| Release 604 SAPKH60401 - SAPKH60410 |
| Release 605 Until SAPKH60507 |
------------------------------------------------------------------------

1. Step to transaction SE91.
2. Choose message class VT
3. Select number 664 and hit the 'Change' button.

a) Create the following short text for the message:
'Hierarchical access not possible (access seq. &1, access &2, field &3)'

b) Select the check box 'self explainaty' and save.
The following steps c) and d) are optional.

c) Deselect the check box 'self explainaty' and maintain the following long text for the message:

Diagnosis
The functionality of the hierarchical access is not possible.
The error was triggered by access sequence &V1&, access number
&V2&, field &V3&.

Procedure
Adjust the access type and continue processing.
For details, see SAP note 1600482.

d) Activate the longtext and save.

SAP Note 1600482 - Hierarchical access functionality

2013-04-17T10:21:00.005-07:00

Summary

Symptom

IMPORTANT: This and the related SAP Notes implement a change to the

functionality of the hierarchical access feature for use in pricing and

pricing-related functionality. Because of a court order in a patent

litigation involving SAP, application of these changes is mandatory for all

U.S. customers, all customers with U.S. installations, and all customers

with U.S. users. These changes are already included in Business Suite 2011

(including ECC 6.0 EHP6) and in SP26 of the SAP AP 7.00 software component.

Application of the related SAP Notes 1599403, 1600091, 1601052, 1601120

1643194, 1645515, 1645516 is required, either manually or via installation

of the relevant Support Packages.

Please see the attachment of this note to determine which notes are

relevant for your product versions.

The changes contained in these Notes are included in the Support Packages

for affected products as listed below:

Product Version Required Support Package Stack

R/3 4.6C SP17

Enterprise 4.7 x1.0 SP37

Enterprise 4.7 x2.0 SP37

ERP 2004 SP26

ECC 6.0 SP21

ECC 6.0 EHP2 SP11

ECC 6.0 EHP3 SP10

ECC 6.0 EHP4 SP11

ECC 6.0 EHP5 SP08

CRM 5.0 = CRM 2005 SP20

CRM 2007 SP11

CRM 7.0 SP11

CRM 7.0 EHP1 SP07

SRM 5.0/SRM 2005 SP20

SRM 7.0 SP12

SRM 7.0 EHP1 SP07

GTS 7.1 SP25

GTS 7.2 SP23

GTS 8.0 SP19

GTS 10.0 SP09

As detailed below, customers who do not use hierarchical access for pricing

or pricing-related usages will not be affected by the application of this

SAP Note. Nevertheless, if you are not using hierarchical access

functionality in pricing or pricing-related functionalities and are not

planning to use it, application of the notes relevant for your product

version is still mandatory. No further action beyond the application of

these notes is necessary, as application of these notes will not affect

your use of the SAP solution.

If you are not sure whether you are using this specific functionality, we

strongly recommend that you run the check report included in the related

SAP Notes 1600090 and 1601021 before you install a Support Package as

listed above. The check reports allow you to easily check whether this

specific pricing functionality is being used in your system(s).

When you install or upgrade to a new product version of an ERP, CRM, SRM or

GTS system, you will be required to implement at least the Required Support

Package level for that product version listed above. Until the Required

Support Package level is applied to your upgraded system, pricing and

condition technique will abort with the run-time error "support package

level not sufficient". Please review the information in this Note and

if you have additional questions about these changes or what you can expect

when you install a new product version.

Please read the following information carefully before applying these SAP

Notes.

Reason and Prerequisites

Translated version of this note being for convenience but not legally

binding.

Solution

Application of these Notes is mandatory for all U.S. customers, all

customers with U.S. installations, and all customers with U.S. users. This

and the related SAP Notes disable the hierarchical access feature (access

type = "A") in pricing and pricing-related functionalities, including

general pricing, rebate calculation, free goods, tax determination,

campaign determination, product determination, product substitution,

generic "data determination," GTIN (Global Trade Item Number) mapping, and

commodity pricing. Hierarchical access differs from a standard access

sequence.

Only the hierarchical access functionality is affected by this Note. The

use of standard access sequences to access condition records associated

with a hierarchy, such as a product hierarchy or customer hierarchy, is not

affected by this Note. The use of standard access sequences is not

affected by this Note.

Following the application of this SAP Note, pricing must use the standard

form of access sequence without access type "A". As detailed below,

customers who do not use hierarchical access will be unaffected by the

application of this SAP Note. Uses of hierarchical access outside of

pricing and pricing-related functionalities are also unaffected.

If you are not sure whether or not you are using this specific

functionality, we strongly recommend that you run the check report included

in the related SAP Notes 1600090 and 1601021 before you install a Support

Package as listed above. The check reports allow you to easily check

whether this specific pricing functionality is being used in your

system(s).

If you are not using hierarchical access functionality in pricing or

pricing-related functionalities and are not planning to use it, no further

action beyond the application of these notes is necessary, as application

of these SAP Notes will not affect your use of the SAP solution.

If you are already actively using or planning to use this functionality, we

request that you contact us by creating a support ticket under the

XX-PROJ-IMS-HA component so that we can work together to ensure that your

SAP solution continues to satisfy your needs in the future.

Overview: Impact of Installation of this SAP Note

1. Customers who do not use hierarchical access in pricing or

pricing-related functionality.

Customers will experience no change in their operation of the SAP

system.

2. Customers who use hierarchical access in pricing or pricing-related

functionality.

The SAP system will function differently, as described below, after

the application of this SAP Note.

a) Existing access sequences of the type "Hierarchical Access"

(created before the installation of this SAP Note) in pricing or

pricing-related functionality will no longer function as before.

Pricing will abort with a run-time error if an access sequence of

the type "Hierarchical Access" is used for searching price data.

These access sequences may be converted to the standard form of

access sequence. SAP can assist you with this process to ensure

that your SAP solution continues to satisfy your needs.

b) It will no longer be possible to create a new access sequence of

the type "Hierarchical Access" in pricing or pricing-related

functionality. The new access sequence cannot be saved. For

pricing and pricing-related functionality, use the standard form of

access sequence.

If you have any questions regarding this Note, you can contact us by

creating a support ticket under the XX-PROJ-IMS-HA component identified

above.

The Note is release-independent

SAP Note 16083 - Standard jobs, reorganization jobs (Part II)

2012-05-11T02:52:00.000-07:00

(Part I Continuation)

Clients and authorizations

Some of the jobs specified work with client-specific objects (for example, jobs). Whether a reorganization has any cross-client influence then normally depends on particular authorizations. The following table displays all of the client-dependent jobs. All of the other jobs are not client-dependent.

Job name:
SAP_REORG_BATCHINPUT

Jobs that are not client-dependent perform a reorganization in all affected clients. They require neither special authorizations nor a special user name.
The job SAP_COLLECTOR_FOR_PERFMONITOR must always be scheduled in client 000 with user DDIC or with a user with the same authorization.

For some jobs, note the following correlations:

Job SAP_REORG_JOBS:

See SAP Note 784969.

Job SAP_REORG_SPOOL:

Authorization S_ADMI_FCD-S_ADMI_FCD = 'SPAD'
Reorganization runs in chosen client (Client = '*', then runs in all clients)

Authorization S_ADMI_FCD-S_ADMI_FCD = 'SPAR'
Reorganization only in the client in which the actual job is running

Job SAP_REORG_BATCHINPUT:

Authorization profile S_BDC_MONI - BDCAKTI = 'REOG'
S_BDC_MONI - BDCGROUPID = '*'
Reorganization only in the client in which the job is running

Note:

The authorizations always relate to the user under whose ID the job is being processed.

If this user has the necessary authorizations to work in a cross-client manner, then it does not matter in which client the actual job is running.

Examples

User ADMIN has the Authorization S_BTCH_ADM = 'Y'. If Job SAP_REORG_JOBS is now scheduled with User ADMIN, the jobs are reorganized in all clients.

User REORG has the Authorization profile S_BDC_ALL. If Job SAP_REORG_BATCHINPUT is now scheduled with User REORG in Client 002, the batch input objects are reorganized in Client 002.

If the job SAP_REORG_ABAPDUMPS is scheduled in any client, all ABAP short dumps are reorganized in all clients.

User SPOOLADM has the authorization S_ADMI_FCD-S_ADMI_FCD = 'SPAD'. If the job SAP_REORG_SPOOL is now scheduled with user SPOOLADM and client 123 is specified for the program parameters, then the spool objects in client 123 are reorganized irrespective of the client in which the actual job is running. If you enter '*' as the client, all clients are reorganized.

NOTES: The job steps should be planned using a language that is available in the system. English should be available in every system. However, some of these jobs have steps set by default in German. The following is valid until further notice: the jobs must be modified if necessary when, for example, a Russian code page is used.

This Note is Release-Independent

SAP Note 16083 - Standard jobs, reorganization jobs (Part I)

2012-05-11T02:51:00.001-07:00

Symptom

There are a number of jobs that must periodically run in a live R/3 installation, for example, to delete outdated jobs or spool objects.
As of Release 4.6C, you can easily schedule these jobs as follows:
Transaction sm36, choose 'Standard jobs'.

Unfortunately, there is no easy-to-use support for such jobs within Basis Customizing before Release 4.6C. Therefore, you must schedule the jobs explicitly for these release levels.
This note contains a list of the required programs, their parameters, and the recommended repeat interval. In addition, names are suggested for the required jobs. Adhere to the recommendations, as the naming conventions enable us to check quickly and easily whether these jobs have been activated in your system.
This note applies as of Releases 2.1G and 2.2A.

Exceptions:
           Program RSXMILOGREORG is only available as of Release 4.6C.
          In earlier releases, use ZRSXMILOGREORG
           Note 182963
           Program RSAL_BATCH_TOOL_DISPATCHING is only available as
               of Release 4.6A.

Other terms
REORGJOBS.

Reason and Prerequisites
Note: Application-specific reorganization programs are not included in this list.

Solution

Job name	Program	Variant	Repeat interval

SAP_REORG_JOBS	RSBTCDEL2	yes	daily
SAP_REORG_SPOOL	RSPO0041/1041	yes	daily
SAP_REORG_BATCHINPUT	RSBDCREO	yes	daily
SAP_REORG_ABAPDUMPS	RSSNAPDL	yes	daily
SAP_REORG_JOBSTATISTIC	RSBPSTDE	yes	monthly
SAP_COLLECTOR_FOR_JOBSTATISTIC	RSBPCOLL	no	daily
SAP_COLLECTOR_FOR_PERFMONITOR	RSCOLL00	no	hourly
SAP_COLLECTOR_FOR_NONE_R3_STAT	RSN3_STAT_	no	hourly
	COLLECTOR
SAP_REORG_PRIPARAMS	RSBTCPRIDEL	no	monthly
SAP_REORG_XMILOG	RSXMILOGREORG	yes	weekly
SAP_CCMS_MONI_BATCH_DP	RSAL_BATCH_	no	hourly
	TOOL_DISPATCHING
SAP_SPOOL_CONSISTENCY_CHECK	RSPO1043	yes	daily
SAP_REORG_ORPHANED_JOBLOGS	RSTS0024	yes	weekly
SAP_CHECK_ACTIVE_JOBS	BTCAUX07	yes	hourly
SAP_DELETE_ORPHANED_IVARIS	BTC_DELETE_ORPHANED_IVARIS	ja	weekly
SAP_REORG_ORPHANED_TEMSE_FILES	RSTS0043	ja	weekly

In any case, refer to Note 48400 regarding the spool and TemSe
consistency check.

Note:

SAP_CCMS_MONI_BATCH_DP is not a reorganization job but is needed to start tools / methods in the system monitoring area in the background -> transaction RZ20/RZ21.

SAP_REORG_XMILOG reorganizes the table TXMILOGRAW. This table contains log information on the XMI interface (-> Note 182963).

As of Release 4.6A, the job steps are managed separately from the print parameters. This means that report RSBTCDEL no longer deletes any print parameters. Therefore you must additionally schedule the report

RSBTCPRIDEL,

which reorganizes print parameters in a cross-client manner. Since the number of print parameters increases more slowly than the number of background processing steps, you can execute this report after longer periods of time ( longer than one month).
You must refer to Note 307970 in connection with RSBTCPRIDEL.

The job SAP_COLLECTOR_FOR_PERFMONITOR was previously also called COLLECTOR_FOR_PERFORMANCE_MONITOR.

The job SAP_COLLECTOR_FOR_NONE_R3_STAT is available as of SAP Web Application Server 6.20 only.

On sapserv3, an improved version of RSPO0041 is available with RSPO1041 (Note 130978).

In addition, you should regularly run a consistency check of the spooler and the TemSe (Note 48400).

Batch input reorganization may not run at the same time as normal batch input activity up to and including SAP Release 30C (see Note 18307). The associated job must be scheduled for a time when no other batch input activity is scheduled.

***** Caution: The standard job SAP_REORG_UPDATERECORDS that was contained in some delivered versions must no longer be executed (see Note 67014). In its new version, the underlying ABAP Program RSM13002 is programmed so that it terminates when running in a job (that is, in the background). Therefore, the job SAP_REORG_UPDATERECORDS always terminates in this case. In any case, the job SAP_REORG_UPDATERECORDS should be deleted from the pool of standard jobs, if it is still there: sm36 -> 'Standard jobs' -> 'Delete standard jobs'. In addition, released jobs that may exist and contain report RSM13002 should be deleted. You can find and delete these jobs using sm37.

***** Caution: The job SAP_WP_CACHE_RELOAD_FULL is normally used to update data from the workplace component system to the workplace server.
This job can only be run on a workplace server, otherwise it will terminate. In the future, this job will no longer be delivered as a standard job.
If this job has been scheduled for your system, but you do not need it, delete the scheduled job in transaction sm37.

To eliminate ABAP dumps that are created due to runtime errors within an ABAP program, use the program RSSNAPDL. To simplify the related job scheduling, you also have the program RSNAPJOB. This program schedules RSSNAPDL within a job. Implicit assumptions:

Job name: RSSNAPDL

Variant: DEFAULT (therefore it must exist)

Start date : from the following day, 1:00 am

Repeat interval: daily

Using the Support Packages specified in Note 666290, report RSTS0024 deletes job logs that no longer belong to any job. Contact SAP if you need the report in a release that is not specified in Note 666290.

(Check Next Post)

SAP Note 1265906 - CCMS Central Autoreactions Job: Concurrency Check

2012-05-11T02:35:00.003-07:00

Symptom
The CCMS processes central auto-reactions with job SAP_CCMS_CENSYS_DISPATCHER. This job ensures that it runs only once at any given time by setting a lock in the NetWeaver enqueue server.
At at least one customer site, the SAP_CCMS_CENSYS_DISPATCHER job failed to complete correctly and remained 'active' for a very long time in the background processing system, retaining its lock in the Enqueue server.
This failure prevented processing of new central automatic reactions until the problem was corrected.

Other terms
central automatic reactions

Reason and Prerequisites
Inadequate error recovery in the SAP_CCMS_CENSYS_DISPATCHER job in the event of problems in the background processing or enqueue server.

Solution
Apply the correction in the associated support package or correction.

With the correction, the report RSAL_CENSYS_TOOL_DISPATCHING which runs in the CENSYS job checks the age of the lock that is present in the event that cannot obtain the lock.

If the lock is older than a fixed interval of 850 seconds, then the central system dispatcher ignores the lock and processes any unprocessed central automatic reaction entries in the table CSMCENTOOL.
The central system dispatcher quits, however, without doing any further processing if it determines that there are more than two SAP_CCMS_CENSYS_DISPATCHER jobs running (itself and the stuck job that is holding the lock). You can monitor for such occurrences by monitoring for aborted SAP_CCMS_CENSYS_DISPATCHER jobs.

Affected Releases

Software Component	Release	From Release	To Release	And subsequent
SAP_BASIS	70	700	701
SAP_BASIS	71	710	711

Correction delivered in Support Package

Support Packages	Release	Package Name
SAP_BASIS	700	SAPKB70019
SAP_BASIS	701	SAPKB70104
SAP_BASIS	710	SAPKB71008
SAP_BASIS	711	SAPKB71102

Read More @ https://service.sap.com/sap/support/notes/1265906

SAP Note 1381129 - SOLMAN_SETUP: Wrong Step User in Standard Jobs

2012-05-11T02:30:00.001-07:00

Symptom

Standard jobs were scheduled in SAP Solution Manager Configurations - Basic Configuration - Automatic Configuration activity "Schedule Background Jobs".

Some of those jobs abort due to missing authorizations of the step user.

For more information about standard jobs see transaction SM36 - Standard Jobs.

Other terms
SolMan, Setup, Job Scheduling
SAP_CCMS_MONI_BATCH_DP, SAP_COLLECTOR_FOR_JOBSTATISTIC, SAP_COLLECTOR_FOR_NONE_R3_STAT, SAP_COLLECTOR_FOR_PERFMONITOR, SAP_REORG_ABAPDUMPS, SAP_REORG_BATCHINPUT, SAP_REORG_JOBS, SAP_REORG_JOBSTATISTIC, SAP_REORG_ORPHANED_JOBLOGS, SAP_REORG_SPOOL, SAP_REORG_UPDATERECORDS, SAP_REORG_XMILOG, SAP_SOAP_RUNTIME_MANAGEMENT, SLCA_LCK_SYNCHOWNERS, SAP_REORG_CRM_PRODUCTS_INACTIV, SAP_WP_CACHE_RELOAD_FULL

Reason and Prerequisites
During the execution of the activity "Schedule Background Jobs", the current system user was set as step user instead of a special batch-user.

Solution
Implement the correction instruction of this note.
This will fix the error in the coding, so that a batch-user is set as step user when the activity "Schedule Background Jobs" is being executed again.

If those jobs were already scheduled and abort, delete them. After that execute the corresponding activity in SOLMAN_SETUP again so that they will be scheduled again with the correct user.

Caution: The batch-user has to be created in SOLMAN_SETUP before executing this activity! Otherwise the needed user is not known during the configuration.

Affected Releases

Software Component	Release	From Release	To Release	And subsequent
ST	700	400	400

Correction delivered in Support Package

Support Packages	Release	Package Name
ST	400	SAPKITL431

Corrections Instructions

Correction Instruction	Valid from	Valid to	Software Component	Last Modifcation
1156383	400	400	ST	01.09.2009 11:56:31

Read More @ https://service.sap.com/sap/support/notes/1381129

SAP Note 894279 - Background processing in SAP Solution Manager (Part III)

2012-05-11T02:18:00.000-07:00

(Part II Continuation)

New job framework 'Solution Manager Job Configuration' of the SAP Solution Manager

/SDF/MON_REORG report (Job SNAPSHOT MONITORING REORG): Reorganization of obsolete /SDF/MON analyses, scheduled daily since ST710 SP1 version.

/TMWFLOW/CMSSYSCOL2 report (Job SM:TMWFLOW_CMSSYSCOL): Program for collecting data of transports, notes and support packages of each System defined in table /TMWFLOW/CMSCONF using asynchronous RFC-function calls, scheduled daily, since ST400.

/TMWFLOW/RMO_STACKUPDATE report (Job SM:STACK_INFO_UPDATE): Update the stacks that are available for a product version (see SAP note 1581095), scheduled daily since ST400.

AGSSISE_DELETE_TMP_RFC report (Job SM:REMOVE TEMPORARY RFC): Delete temporary RFCs created during solman setup in case this was not done there due to some error, scheduled hourly, since ST710 SP1.

AGSSISE_SYSSOL_COLLECTOR report (Job SM:SISE_SYSSOL_COLLECTOR): The purpose of this report is to add all production systems to one standard solution, so that Early Watch can be scheduled automatically. A standard solution is created during the initial configuration of the Solution Manager (transaction SOLMAN_SETUP). This standard solution is used in this report. When the solution is created, the system proposes the name #SAP Solution#, which can be changed. If there is no standard solution, this report creates a standard solution #SAP Solution#. The report then selects all production systems belonging to the customer number using the installation number. All logical components containing one of the systems in the system role that correspond to the leading roles in the solution are then assigned to the solution. So that the Solution Manager is also included in this standard solution, the logical component #Z_SOLMAN_COMP# is created and assigned to the standard solution during the initial configuration. If this does not exist, it is created by the report. In addition, a special solution can be created for each customer number. This special solution is then used instead of the standard solution. You can maintain these customer-specific solutions in the view V_AISAPCUSTNOS (transaction SM30). The report automatically fills the customer number field in the settings of the corresponding solution for all solutions assigned to a customer number using V_AISAPCUSTNOS. Scheduled weekly since ST400.

AI_CRM_AIDIAGNOTIF_CREATE report (Job AI_CRM_AIDIAGNOTIF_CREATE): This report takes care of notifications coming from LMDB or CMDB, stating that a system or a device has been changed or created. It creates or updates an IObject for the system or device related to the notification. This IObject is then used for referencing in an Incident Message or other CRM documents. Scheduled daily during night, since ST710 SP5.

AI_CRM_IM_UPDATE_FROM_SAP report (Job REFRESH MESSAGE STATUS): This report is used for incident management in solution manager, to retrieve or replicate SAP messages. It replaces for ST 7.10 the old report RNOTIFUPDATE01 (see note 1566108). Scheduled hourly, since ST710 SP1.

AI_SC_LISTENER report (Job SERVICE_CONNECTION_LISTENER): This report periodically checks whether a service connection is planned to be opened. It replaces the previously necessary reservation. If a future connection event is selected in the transaction SOLMAN_CONNECT, it is saved locally in the Solution Manager. This program is scheduled every 10 minutes, and opens the system if required. Since ST400.

AI_SC_REFRESH_READ_ONLY_DATA report (Job REFRESH_ADMIN_DATA_FROM_SUPPORT): This report reads various information from the SAP Support Portal (like maintenance key data, system numbers of all known product systems in SMSY, installation numbers of these systems, contact persons, service types for remote connection, SAProuter) and saves it locally in the Solution Manager. If customer numbers are maintained in the maintenance view V_AISCUSTNOS, the report can create business partners per customer number, get installation numbers for customer numbers, put the product systems of these installations in SMSY. It is scheduled every day since ST400.

AI_SC_SEND_SYSTEM_RELATIONSHIP report (Job SEND_SYSTEM_RELATIONSHIP_TO_SUPP): This report sends information to the SAP Service and Support Backend systems, which is required by the service connection types "SAP Solution Manager" and "SolMan Diagnostics". The numbers of all product systems known to transaction SMSY are sent. Systems which are known to the Solution Manager diagnostics are flagged, and the system numbers of Solution Manager and Solution Manager Diagnostic systems are sent to SAP. See SAP note 962516 for further information. It is scheduled every day since ST400.

AI_SDK_FILL_FILE_TYPE_TABLE report (Job SM: GET FILE TYPES FROM SAP): For security reasons, only special file types are allowed as attachments in messages sent to SAP - all other attachments will be rejected. The program determines all relevant file types from CSS. Scheduled every 3 months since ST400.

DSVAS_APPL_CSA_REORG_TASKTABLE report (Job SM:CSA SESSION REFRESH): This report clears the CSA task status icons in the graphical overview of central systems administration. It is scheduled every day since ST400.

DSVAS_APPL_CSA_UPD_TASKSTATUS report (Job SM:CSA UPDATE TASKSTATUS) updates status symbols of CSA tasks in the graphical overview of central systems administration. It is scheduled every 30 minutes, since ST400.

DSWP_BPM_REORGANIZATION report (Job SM:REORG BPMON ALERTS): This report performs the reorganization of Business Process Monitoring alert data for all solution which contain monitoring data. Scheduled daily during night, since ST710 SP5.

DSWP_CI_ISSUE_BUFFER_TABLE report (Job SM:UPDATE ISSUE BUFFER). This report updates the buffer for the issue management (issues and their joins are stored in temporary tables for performance optimization). It is scheduled every day, since ST400.

DSWP_GET_CSN_COMPONENTS report (Job SM:GET CSN COMPONENTS): this report gets the application components from CSN and saves them into tables. It is scheduled every week, since ST400.

DSWP_GET_PPMS_DATA_AUS_OSS report (Job SM:GET_PPMS_DATA_AUS_OSS): This report retrieves PPMS data from the SAP Support Portal and saves it in the Solution Manager. This information is required for the Service Sessions. Scheduled daily (random execution time per customer system), since ST400 SP22.

E2E_DCC_AGT_MON report (Job E2E DCC AGENT MONITORING): This report collects the diagnostic agents statuses (metric "Diagnostic Agent unavailable") into the Monitoring and Alerting Infrastructure. It is scheduled every 10 minutes, since ST710 SP1.

E2E_EFWK_HOUSEKEEPER report (Job E2E EFWK HOUSEKEEPING): Housekeeping job for the extractor framework. Scheduled daily. Since ST710 SP1.

E2E_EFWK_RESOURCE_MGR report (Job EFWK RESOURCE MANAGER): This job is checking if data extractors defined within the EFWK in table E2E_ACTIVE_WLI are due to execution regarding their actual status described in table E2E_EFWK_STATUS. If data extractors are due, then they are executed in the managed systems via RFC call due to the settings in table E2E_RESOURCES. If no data extractors are due, the report is finished immediately, generating no further workload. Scheduled every minute. Since ST710 SP1.

E2E_HK_CONTROLLER report (Job E2E BI HOUSEKEEPING): This report performs housekeeping activities on the E2E Diagnostics BI Infocubes statistical records (see SAP note 1480588). Scheduled daily. Since ST710 SP1.

GN_GENERATE_CHECK report (Job GN_GENERATE_CHECK). This report creates a worklist with objects (some industry specific function modules) which need generation. To be run before GN_WORKLIST_GENERATE, Scheduled every day, since ST400.

GN_WORKLIST_GENERATE report (Job GN_WORKLIST_GENERATE): This report generates the objects (some industry specific function modules) in the worklist created before by GN_GENERATE_CHECK report. Scheduled every day, since ST400.

HRBCI_ATTRIBUTES_BUFFER_UPDATE report (Job HRBCI_ATTRIBUTES_BUFFER_UPDATE): This report updates CRM organizational data (model and attributes) into the buffer for a specific day. The program also offers you the option of preparing mobile client distribution for the scenarios SALE and SERVICE. Scheduled daily. Since ST400.

PR_DIAGLS_CLEANUP report (Job DIAGLS_CLEANUP): This report purges the E2E Diagnostics logs. Scheduled daily, since ST710 SP1.

PR_DIAGLS_COMPUTE_STATUS report (Job DIAGLS_COMPUTE_STATUS): This report updates the status of the elements of the landscape API. Scheduled daily, since ST710 SP1.

PRGM_DSWP_NA_SYNC_DLS report (Job SAP_NOTIFADMIN_SYNC_DLS): This report triggers a synchronization of distribution lists from mail server to the database. Scheduled daily, since ST710 SP1.

RAGS_DSWP_SERV_CONTENT_UPDATE report (Job SM:Service Content Update): The job should run once a day if it is set to active in the SD Work Center. The job performs an update of all the service content. For more details please see SAP note 1143775. As of ST400 Ehp1.

RAGS_ENGAGE_CYCLE_DB_2_CRM report (Job SM: TRANSFER CYCLE (DB->CRM)): Since ST400 SP26, solution manager can handle transaction type 'SLFC' for Engagement Cycle in "SAP Engagement and Service Delivery" work center. As the DB structure was changed, this report transfers the data created before SP26 to the CRM and the new DB schema. Scheduled only once, since ST400 SP26 (Ehp1).

RAGS_FILE_EXT_L_DL report (Job SM:LONG FILE EXT DOWNLOAD): Download from CSN and update the long file extensions that can be handled for incident exchange (Alert inbox and message creation). Scheduled weekly, since ST400.

RAGS_SERVREQ_LOAD_FROM_SAP report (Job SM:SYNC SERVICE REQUESTS): This report regularly collects service requests from SAP. Scheduled hourly, since ST400 SP23.

RAGS_WORK_BPM_CACHE report (Job SM:FILL BPM CACHE FOR WORKCENTER): After creating a solution (in DSWP or 'SAP Solution Manager Administration' work center), the new solution does not appear in Business Process Operation work center automatically. This report refreshes solution landscape buffers for BPO work center. Scheduled daily, since ST400.

RAGS_WORK_SD_CACHE report (Job SM:FILL SD CACHE FOR WORKCENTER): This job fills the cache for the SAP Engagement and Service Delivery work center. Scheduled hourly, since ST400 (this report does nothing starting ST710 SP1, as buffers are not used anymore for both services and issues data which are read directly).

RBM_REFOBJ_BUFFER_UPDATE report with SAP&ISSUES variant (Job SOLMAN_ISSUE_STATUS_REFRESH): The SAP Solution Manager buffers message attributes such as the current user and the processing status. This periodic job collects these message attributes from the message system and makes them available for analysis. Scheduled hourly, since ST400.

RCSDCCHANDLETASKS report (Job SM:CSDCC HANDLE TASKS): This report synchronizes the list of requests for the SDCCN download with the list of SAP Solution Manager service sessions. Scheduled daily, since ST400.

RDMD_ACCELERATE_DOC_USAGE report (Job SM:ACCELERATE DOC USAGE): This report accelerates the where-used list for documents in the Solution Manager. Scheduled daily, since ST400.

RDMD_MIGRATE_TECH_INTERFACE report (Job SM:MIGRATE_TECH_INTERFACE): As of ST400 SP15, it is possible to create and use interfaces in the solution directory of SAP Solution Manager. This report generates the interfaces for any existing technical interfaces. Scheduled daily, since ST400.

RDMD_REFRESH_INDEX report (Job SM:REFRESH_INDEX): This job updates the index for solutions once a day. This is updated on demand for changes in solutions, but this job should run in order to obtain a secure status. Scheduled daily, since ST400.

RDMD_REMOVE_INCON report (Job SM:REMOVE INCONSISTENCIES): This report removes potential data inconsistencies in the solutions. Scheduled daily, since ST400.

RDSMOPBACK_AUTOSESSIONS_ALL report (Job SM:EXEC SERVICES): This report executes service sessions in Solution Manager, carries out services daily (or weekly) and schedules new services. Scheduled daily, since ST400.

RDSMOPCOLLECTSOLUTIONDATA report (Job SM:SEND_SOLUTIONS_TO_SAP): This report sends the data of the appropriately configured solutions to SAP. Scheduled daily, since ST400.

RDSMOPSERVICEINFOS report (Job SM:SYNC SOLMAN INFO): To transfer the information about SAP Solution Manager usage (components used by customers) to SAP. Scheduled daily, since ST400.

RDSWP_ARCHIVE_WMS report (Job DSWP_ARCHIVE_WORKMODES): This report archives work modes older than 30 days. See SAP note 1538133 for more details. Scheduled every 12 hours, since ST710 SP1.

RDSWP_CLEAN_DSWPJOB report (Job SM:RDSWP_CLEAN_DSWPJOB): This report removes some unnecessary jobs. Scheduled monthly in ST400, daily in ST710.

RDSWP_DTM_UPDATE_DT_STATUS report (Job UPDATE DOWNTIME STATUS): This report updates the Downtime Manager data (downtime status) to ensure semantic consistency. Scheduled daily, from ST400 SP15 to ST710 SP2.

RDSWP_NA_DEL_NOTIF_ADMIN_DATA report (Job SAP_NOTIFADMIN_DELETE_USERS): This report deletes recipients or recipient lists used for notification for which the delete flag is true and last_changed_by date is older than 30 days (by default). Scheduled daily, since ST710 SP1.

RDSWP_SC_MANAGED_SYSTEMS report (Job SM:SELFDIAGNOSISSELFCHECK): This report executes self checks on the managed systems of the solution manager. Scheduled weekly, since ST710 SP1.

RDSWP_ISSUE_REFRESH report (Job SM:SYNC ISSUES FROM CRM): The table DSWPISSUE, which contains information from the CRM document and the support message (context), is updated by this report. This function is required for issue tracking and Service Plan. Scheduled hourly, in ST400 only.

RDSWP_NM_SYNC_USER_DATA report (Job SM:SYNCHRONIZE USER DATA FOR NOT): This report synchronizes user data for the Notification Engine from Solution Manager satellite systems. Scheduled daily, in ST400 only since SP15.

RDSWP_SELF_DIAGNOSIS (Job SM:SELFDIAGNOSIS): This report updates self-diagnosis information (solution-specific and cross-solutions yellow and red alerts used in service desk, issue management...). More details can be found in SAP note 1073382. Scheduled daily, since ST400.

RDSWP_SELF_DIAGNOSIS_CRM_TRF report (Job SM:SELFDIAGNOSIS_SEND_TO_SAP): This report sends data from self-diagnosis application on customer's solution manager system to SAP (CSS system). Scheduled monthly, since ST400 SP26.

RDSWP_SSA_MOVE_2_ARCHIVE_QUEUE report (Job SM:MOVE TO ARCHIVE QUEUE): This report triggers the archiving of the services and sessions (EWAs), for which the preset retention period was exceeded. Scheduled daily, since ST400.

RDSWPCI_ISSUE_PROJECT_CONTEXT1 report (Job SM:MIGRATE_ISSUE_PROJECT_CONTEXT): This report migrates the project contexts for issues. Scheduled daily, since ST400.

RDSWPCI_SURVEY_TRANSFER report (Job SM:SURVEY TRANSFER): This report transfers the questionnaires for customer satisfaction with the service session and issue processing to SAP. Scheduled weekly, in ST400 only.

RDSWPCI_TOPISSUE_TRANSFER report (Job SM:TOP ISSUE TRANSFER): This report transfers the top issues that you have exchanged with SAP. Scheduled daily, since ST400.

RDSWPCISERVICEPLAN report (Job SM:SYNC SAP SESSIONS): The session scheduling in the service plan is updated daily by SAP. This report is required to receive service plans from SAP. Scheduled daily, since ST400.

RDSWPDOWNLOADDELETION report (Job SM:DOWNLOAD DELETION): This report deletes download data (transaction SDCCN), which is more than 30 days old. Scheduled every 3 days, in ST400 only.

RDSWPJOBSCHEDULER report (Job SM:SCHEDULER): This report triggers all the other background jobs in the old job framework (job entries from the DSWPJOB table not in SMCONFIGJOBS table). Scheduled hourly, since ST710 SP1.

RDSWPRULESUPDATE report (Job SM:UPDATE RULES): This report downloads a new set of rules for the Solution Manager. This set of rules controls the services and documents that can be offered (inline) for the information about system infrastructure and processes, which is maintained in the Solution Manager. Scheduled daily, in ST400 only.

RMIGRATE_LANG_DEP_SAPSCRIPT report (Job SM:MIGRATE_LANG_DEP_SAPSCRIPT): This report optimizes the data for the document references to achieve an optimized access for the where-used list. Scheduled weekly, since ST400.

RNOTIFUPDATE01 report (Job REFRESH MESSAGE STATUS): This report refreshes the contents of Support Desk or Expert-on-Demand messages that have been processed by SAP. Recommendation: use the Implementation Guide to schedule a customer-specific variant for the SAP Solution Manager. Scheduled hourly, in ST400 only. Replaced by AI_CRM_IM_UPDATE_FROM_SAP report since ST710 SP1.

RS_WBA_REFRESH_POWL_BUFFER report (Job SM:RS_WBA_REFRESH_POWL_BUFFER): This job ensures that the system lists in the work centers for the technical system administrator (System Administration, System Monitoring and System Landscape Management) are updated in the Solution Manager (that is, adjusted to changes in the system infrastructure). Scheduled hourly, since ST400 (defined in the old DSWPJOB job framework for ST400, activated in SMCONFIGJOBS new job framework since ST710 SP1).

RSGET_SMSY report (Job LANDSCAPE FETCH): This job gets system data for the Solution Manager system landscape by automatic data transfer from TMS/RFC or the System Landscape Directory (SLD). Scheduled daily, since ST400.

RWBA_RFC_WATCHER report (Job SM:RFC MONITORING): This report checks RFC connections using RFCPING or RFC_PING. Scheduled hourly, only in ST400 (but part of the old DSWPJOB framework in ST710).

SMO6_REORG2 report (Job SMO6_REORG2): This report reorganizes several kinds of data of CRM middleware such as BDOC messages and statistics, trace and key gen data... More details are available in SAP note 713173. Scheduled daily, since ST400.

SMWP_BATCH report (Job SMWP_BATCH): This report updates the data displayed in the CRM middleware monitoring cockpit (SMWP transaction). Scheduled daily, since ST400.

Old job framework of the SAP Solution Manager (SM:SCHEDULER)

No separate job is created for jobs that are executed INLINE, and for this reason no separate job logs are created either. The relevant job log is actually in the overall log of job SM:SCHEDULER.

If job SM:SCHEDULER is not scheduled, you can use the function module DSWP_BATCH_JOB_START_SCHEDULER to schedule it or the Job Wizard in transaction SM36 (the report RDSMOP
JOBSCHEDULER). If you use function module DSWP_BATCH_JOB_START_SCHEDULER, define import parameter PF_START_TIME for the start time only, and leave PF_ACTIVITY at the default value 'S'.

If you want to run the jobs under another user, you must log on under this user and use the function module DSWP_BATCH_JOB_START_SCHEDULER and the parameter value 'PF_ACTIVITY' = 'D' to deschedule the job 'SM:SCHEDULER'. Afterwards, proceed as described above to schedule the job.

Affected Releases

Software Component	Release	From Release	To Release	And subsequent
ST	700	400	400
ST	702	710	710

Correction delivered in Support Package

Support Packages	Release	Package Name
ST	400	SAPKITL425

Read More @ https://service.sap.com/sap/support/notes/894279

SAP Note 894279 - Background processing in SAP Solution Manager (Part II)

2012-05-11T02:16:00.001-07:00

(Part I Continuation)

The following section provides a detailed account of the programs that are executed:

Old job framework of the SAP Solution Manager (SM:SCHEDULER)

The program RDSWPRULESUPDATE: Downloading a new set of rules for the Solution Manager This set of rules controls the services and documents that can be offered (inline) for the information about system infrastructure and processes, which is maintained in the Solution Manager.

The program RDSWP_ISSUE_REFRESH: The table DSWPISSUE, which contains information from the CRM document and the support message (context), is updated. This function is required for issue tracking and Service Plan (inline, job SM:SYNC ISSUES FROM CRM).

The program RDSWPDOWNLOADDELETION: Download data (transaction SDCCN), which is more than 30 days old, is deleted (job SM:DOWNLOAD DELETION).

The program RDSMOP_SESSSION_RESET: The set-up sessions are automatically reset after a new ST-SER release is implemented or after a new Support Package is imported. This ensures that these sessions always run on the newest check source code (Job SM:SESSIONS RESET).

The program RDSMOPSOLUTIONLISTUPDATE: The status of every solution is determined for the overview list of all solutions (the access screen in transaction SOLUTION_MANAGER) (Job SM:REFRESH ENTRYSCREEN).

The program RDSWPCISERVICEPLAN: The session scheduling in the service plan is updated daily by SAP. This report is required to receive service plans from SAP (Job SM:SYNC SAP SESSIONS).

RDSMOPSERVICEINFOS: (Job SM:SYNC SOLMAN INFO)

The program RDSMOPBACK_AUTOSESSIONS: Carry out services daily (or weekly) and schedule new services. As described above, in the "Global Settings", you can change the time at which this job should be carried out. The system sets 6 AM by default (Job SM:EXEC SERVICES).

The program RDSMOPCOLLECTSOLUTIONDATA: This report sends the data of the appropriately configured solutions to SAP. (Job SM:SEND_SOLUTIONS_TO_SAP)

The program RSOLDIAG_CHECK_FOR_UPDATE: Checks your Solution Manager and notifies it about the changes made to relevant data and parameters (inline, job SM:SOLMAN_DIAG_UPDATE).

The program RDSWP_FILL_CCMS_ALERTS: Supplies the monitoring object of the CCMS for every solution with data from the Solution Manager, for example, EWA, SL Reporting and transaction SDCCN (Job SM:SOLMAN MONITORING).

The program RNOTIFUPDATE01: Deactivate this job if it is not yet available in your system and use the Implementation Guide to schedule a customer-specific variant for the SAP Solution Manager. This refreshes the contents of Support Desk or Expert-on-Demand messages that have been processed by SAP.

The program RDMD_REORG_APPLICATION_LOG: (Job SM:REORG APPLICATION LOG). Cleans up the SAP Solution Manager application log data after a certain retention period.

The program RDMD_INCONSISTENCIES: Checks the data model of a solution for inconsistencies (Job SM: DMD CONSISTENCY).

The program RDMD_DYNAMIC_TABU_UPDATE: Updates the table contents that are necessary to operate the Solution Manager (Job SM:DYNAMIC TABU UPDATE).

The program RDMD_ACCELERATE_DOC_USAGE: Accelerates the where-used list for documents in the Solution Manager (Job SM:ACCELERATEDOC USAGE).

The program RMIGRATE_LANG_DEP_SAPSCRIPT: (Job SM:MIGRATE_LANG_DEP_SAPSCRIPT). This optimizes the data for the document references to achieve an optimized access for the where-used list.

DSWP_GET_CSN_COMPONENTS: This updates the SAP components weekly (Job SM:GET CSN COMPONENTS).

RCSDCCHANDLETASKS: (Job SM:CSDCC HANDLE TASKS)

RDSWPCI_TOPISSUE_TRANSFER: This transfers the top issues that you have exchanged with SAP, once a week (Job SM:TOP ISSUE TRANSFER).

RDSWPCI_SURVEY_TRANSFER: This transfers the questionnaires for customer satisfaction with the service session and issue processing to SAP (Job SM:SURVEY TRANSFER).

RDSWP_SELF_DIAGNOSIS: Manages the self diagnosis for SAP Solution Manager (SM:SELFDIAGNOSIS)..

RDMD_REMOVE_INCON: Removes possible data inconsistencies in the solutions (Job SM:REMOVE INCONSISTENCIES).

RDSWP_CLEAN_DSWPJOB: Removes some jobs' unnecessary jobs (Job SM:RDSWP_CLEAN_DSWPJOB).

RDSWPMIGRATEEWACUSTOMIZING, RDMD_MIGRATE_OBJS_2_LANG_INDEP, RDSWPSETDEFAULTRATINGHIERARCHY, RDSWP_SSA_MIGRATE_SESS_DL: These programs execute a migration. These programs run once only (SM:MIGRATE EWACUSTOMIZING, SM:MIGRATE LANGU DMD OBJ, SM:SET DEFAULT RATING, SM:MIGRATE SESS DL).

RDSWP_SSA_MOVE_2_ARCHIVE_QUEUE: Archives the EWAs, for which the preset retention period was exceeded ((Job SM:MOVE 2 ARCHIVE QUEUE).

RDSWPCI_ISSUE_PROJECT_CONTEXT1: Migrates the project contexts for issues (Job SM:MIGRATE_ISSUE_PROJECT_CONTEXT).-

RWBA_RFC_WATCHER: This background job checks the RFC connections that you have selected in the Work Center System Monitoring in View Connectivity Monitoring. This job is available as of ST400 Support Package 15 (Job SM:RFC MONITORING). As of Support Package 15

RDSWP_DTM_UPDATE_DT_STATUS: Updates the Downtime Manager data to ensure semantic consistency (Job SM:UPDATE DOWNTIME STATUS). As of Support Package 15

RDSWP_CREATE_STANDARD_SOLUTION: If the Solution Manager system is not available in any other active solution, the system creates a standard one-time solution that only contains the Solution Manager system itself, and is active and scheduled in EarlyWatch Alert (Job SM:CREATE STANDARD SOLUTION). As of Support Package 15

RDSWP_NM_SYNC_USER_DATA: Synchronizes user data for the Notification Engine from Solution Manager satellite systems (Job SM:SYNCHRONIZE USER DATA FOR NOTIFICATIONS). As of Support Package 15

RS_WBA_REFRESH_POWL_BUFFER: The job ensures that the system lists in the work centers for the technical system administrator (System Administration, System Monitoring and System Landscape Management) are updated in the Solution Manager (that is, adjusted to changes in the system infrastructure). (Job SM:RS_WBA_REFRESH_POWL_BUFFER). As of Support Package 17.

RCSDCCHANDLETASKS: This daily job (Job SM:CSDCC HANDLE TASKS) synchronizes the list of requests for the SDCCN download with the list of SAP Solution Manager service sessions.

DSWP_CI_ISSUE_BUFFER_TABLE: Updates the buffer for the Issue Management. This runs once a day as the job SM:UPDATE ISSUE BUFFER. The determined and saved data is currently not used because the system does not use the optimized buffering for the Issue Management. This job can be deallocated.

RDMD_MIGRATE_TECH_INTERFACE: As of Support Package 15, it is possible to create and use interfaces in the solution directory of SAP Solution Manager. This report runs as the job SM:MIGRATE_TECH_INTERFACE and generates the interfaces for any existing technical interfaces.

RDMD_REFRESH_INDEX: This job (SM:REFRESH_INDEX) updates the index for solutions once a day. This is updated on demand for changes in solutions, but this job should run in order to obtain a secure status.

The program /TMWFLOW/CMSSYSCOL 2: (Job SM:TMWFLOW_CMSSYSCOL). Deactivate this job if it is still contained in the DSWPJOB. This job is scheduled automatically using SM CONFIG JOBS.

(Check Next Post)

SAP Note 894279 - Background processing in SAP Solution Manager (Part I)

2012-05-11T02:14:00.002-07:00

Symptom

This note relates to documentation for background processing in SAP Solution Manager.

Other terms
SAP SOLUTION_MANAGER, SOLUTION_MANAGER, DSWP, DSMOP, SM:SCHEDULER, DSWPJOB, SMCONFIGJOBS, SM:EXEC SERVICES

Reason and Prerequisites
Documentation is missing in background processing.

Solution
Below, you can find details about background processing, which is required to operate the Solution Manager.

Background processing in the Solution Manager System

Old job framework of the SAP Solution Manager (SM:SCHEDULER, valid up to and including Support Package 21)

SAP Solution Manager background processing does not require any administrative work by the customer.

All of the programs required by your Solution Manager system are automatically executed by the job SM:SCHEDULER (the program RDSWPJOBSCHEDULER), which runs hourly. The job is created automatically (under the current user) when you create the first solution landscape ("Solution" or "Solution Landscape") in SAP Solution Manager. SM:SCHEDULER manages all programs that are flagged as active in the table DSWPJOB according to their relevant configurations.

The configuration delivered by SAP (Customizing) is available in the table DSWPJOB. The table is delivered with a suitable default setting and should not be changed.

Once a day, SM:SCHEDULER starts an important job that automatically executes service sessions (for example, EarlyWatch Alert processing). This job is called SM:EXEC SERVICES. You can set the time at which this job is started in SAP Solution Manager "Global Settings". The default setting is 6 am.

Use the Solution Manager automatic diagnosis to obtain information about the status of the background processing. If jobs terminate or are not executed, you will find the relevant information here. The table DSWPJOBSTATUS contains information about the last run of individual programs.

Note: Continue to use your SAP system's underlying infrastructure, that is, transactions SM37 and SM36, for configuration-intensive programs (for example, customer-specific variants). Do not add any customer-specific programs.

New job framework 'Solution Manager Job Configuration' of the SAP Solution Manager

By definition, the SolMan job configuration delivers the required SolMan standard jobs with predefined start conditions. The scheduling is performed by the user in transaction SM_CONFIG_JOBS (relevant up to and including ST Support Package 17) or as of ST Support Package 18 in transaction SOLMAN_SETUP in the automatic configuration (in "Basic Configuration" scenario, under "Configure Automatically" step, "Schedule Background Jobs" activity). However jobs contained in the old configuration table (DSWPJOB) and not in the new one (SMCONFIGJOBS) will continue to be scheduled from the SM:SCHEDULER job, which is still active in the new job framework.

This SolMan jobs configuration is stored in SMCONFIGJOBS table and offers more flexibility than the old framework. The ISIMMEDIATE flag allows an immediate scheduling of the corresponding jobs when the "Schedule Background Jobs" activity in executed. Moreover the COMM2SAP flag is used to distinguish the jobs in communication with a SAP system. Starting from ST400 SP26 those kind of jobs which are declared as non immediate are started with a random time offset to ensure a randomly distributed access to SAP systems for all SAP customers of the same time zone. For more details about this global randomization and how to unschedule the existing jobs with a fixed start time causing problems to SAP systems, please see SAP notes 1538950 and 1604572.

(Check Next Post)

SAP Note 1538950 - Random scheduling of background jobs in SOLMAN_SETUP (Part II)

2012-05-11T02:11:00.003-07:00

(Part I Continuation)

Step D: (optional in case Step C fails)
------
In case the post-processing of the note did not work as expected (error logs messages), then you still have the possibility to perform the same operation manually using the SM37 transaction (or the RSBTCDEL standard report for mass deletion if you are familiar with) for each job listed above, as described below:

- Run transaction SM37
- Enter * for the Job Name
- Enter * for User Name
- You have to select at least the "Released" job status
- You have to set a quite large interval from today to at least 10 days later (one of the job listed above is scheduled weekly) for the start condition
- Enter the ABAP program name (right column from the list above)
- Press Execute button
- Select the job(s) with status "Released" (you can have several jobs with different job names, if you do not delete all of them you will not get a new schedule)
- In menu "Job", either select "Delete" (unschedule is recommended) or "Change"
- If you prefer to "Change", then choose "Start Condition" button and enter a new start time of your choice
- Then save

WARNING: If you have deleted some jobs, then you have to re-execute the "Schedule Background Jobs" automatic activity. The problem of this manual job by job deletion is that it is not possible to know if the start time of the jobs are correct (means not with a fixed offset time of 25 minutes) without knowing the planned start time defined in table SMCONFIGJOBS. So you have to unschedule or change all the jobs you will find from the list above (unschedule all the jobs is preferable because when the jobs are scheduled again by the automatic activity, the sequence of jobs execution is optimized so that each job may receive the most up-to-date data from predecessor jobs).

Additional information:
----------------------
From ST700 Ehp1 SP26 and ST710 SP01, the new random scheduling of jobs with communication with SAP systems not triggered immediately is included, there's no need to implement any correction. In case of an upgrade from ST700 SP 23, 24 or 25 to ST700 SP >= 26 or ST710 SP >= 01, the possible wrongly scheduled jobs have to be unscheduled manually via SM37 as explained above and the "Schedule Background Jobs" automatic activity has to be re-executed.

Starting from ST700 SP26 or ST710 SP01, the existing job SM:SELFDIAGNOSIS (RDSWP_SELF_DIAGNOSIS report) was moved to this category of jobs randomly scheduled. In case this job was already scheduled using an older ST version, it has to be unscheduled manually with SM37 as explained above then scheduled again using the automatic activity.

Affected Releases

Software Component	Release	From Release	To Release	And subsequent
ST	700	400	400

Correction delivered in Support Package

Support Packages	Release	Package Name
ST	400	SAPKITL436

Corrections Instructions

Correction Instruction	Valid from	Valid to	Software Component	Last Modifcation
1284136	400	400	ST	17.12.2010 13:40:18
1286047	400	400	ST	21.12.2010 15:32:48
1286048	400	400	ST	21.12.2010 15:47:02
1287222	400	400	ST	22.12.2010 18:03:12
1287223	400	400	ST	22.12.2010 18:13:46
1287224	400	400	ST	22.12.2010 18:15:21

More Info @ https://service.sap.com/sap/support/notes/1538950

SAP Note 1538950 - Random scheduling of background jobs in SOLMAN_SETUP (Part I)

2012-05-11T02:09:00.004-07:00

Symptom

Serious performance issue in OSS system caused by PPMS job (SM:GET_PPMS_DATA_FROM_OSS) running DSWP_GET_PPMS_DATA_AUS_OSS report

Other terms

DSWP_GET_PPMS_DATA_AUS_OSS, SM:GET_PPMS_DATA_FROM_OSS, random job scheduling, PPMS, dswp_dbppmscvsp table, SOLMAN_SETUP, Schedule Background Jobs

Reason and Prerequisites

SM:GET_PPMS_DATA_FROM_OSS job needs to be scheduled randomly on a 24hours basis. Until now this job was scheduled on each customer system at 23:25 due to a bug in the job scheduling automatic activity in solman_setup (from ST700 Ehp1 SP23 to SP25), which was responsible for a huge number of RFC calls to SAP Global Support Backbone (OSS) system at that point of time.

This was also the case for all the other existing jobs of the same category (communicating with SAP system and not started immediately), the same start time on all customer systems was used.
Solution

Step A:
------
For systems with ST700 Ehp1 from SP23 to SP25, please implement the attached correction instructions via SNOTE. These corrections contain the required random scheduling of jobs and a post-processing operation to remove the wrongly scheduled jobs.

Step B:
------
Then you also have to perform the following manual tasks concerning the log messages which can't be implemented via SNOTE.

1. In transaction SE91, choose the message class SISE_CONF in change       mode.

2. If you receive a message asking if you want to change the original    language of the message class, do not choose "Yes", as this will    bring you to the original language of the object.

3. Add the following new short texts 221, 222, 223 and 224

Remark: If the users in your system use only one language (for example Japanese), it is best to maintain the text in this language. When you import the next Support Package, the texts are overwritten in all implemented languages.

Enter the following texts:
221: &1 job planned the &2 at &3 by &4 was deleted
222: Re-execution of activity &1 is mandatory!
223: &1 job planned the &2 at &3 by &4 could not be deleted!
224: Some background jobs schedules were deleted by post-processing of note &1

Step C:
------
After successful implementation of changes (steps A and B), then (for ST700 SP 23, 24 or 25) you have to execute the post-processing operation available in SOLMAN_SETUP transaction under "Basic Configuration" scenario -> "Import Note" step, by clicking on the "Postprocessing" button (with change mode activated). This post-processing step will unschedule only the wrongly scheduled jobs (the ones scheduled at the specific time by the automatic activity containing the bug) and not the ones that may have been created/modified directly with SM36/SM37 transactions.

For ST700 SP25 this possibly impacts the following jobs (the ones defined in SMCONFIGJOBS table as communicating with SAP (=> COMM2SAP='X' flag) and not scheduled immediately (=> empty ISIMMEDIATE flag)):

JOBNAME: REPORT NAME:
------- -----------
SM:GET_PPMS_DATA_FROM_OSS DSWP_GET_PPMS_DATA_AUS_OSS
SM:EXEC SERVICES RDSMOPBACK_AUTOSESSIONS_ALL
SEND_SYSTEM_RELATIONSHIP_TO_SUPP  AI_SC_SEND_SYSTEM_RELATIONSHIP
SM:SERVICE CONTENT UPDATE RAGS_DSWP_SERV_CONTENT_UPDATE
SM:SEND_SOLUTIONS_TO_SAP RDSMOPCOLLECTSOLUTIONDATA
SM:SYNC SOLMAN INFO RDSMOPSERVICEINFOS
SM:SURVEY TRANSFER RDSWPCI_SURVEY_TRANSFER
SM:TOP ISSUE TRANSFER RDSWPCI_TOPISSUE_TRANSFER
SM:UPDATE RULES RDSWPRULESUPDATE

At the end of the post-processing, per each deleted job schedule a corresponding log message is displayed in the UI. In case of deleted schedules you will also receive a red log message to mention that it is MANDATORY to re-execute the "Schedule Background Jobs" activity in the "Automatic Configuration" step of "Basic Configuration" scenario. This automatic activity will be also marked red. Then re-execute this "Schedule Background Jobs" activity and check if the deleted job schedules also appear in the list of jobs scheduled. In case some jobs does not appear, it may indicate that some jobs running the same ABAP report are still scheduled (visible in SM37 transaction with status "Released", see explanation below).

-> To be Contd... Check Next Post

SAP Note 1447637 - Background Job for Index Table Report

2012-05-11T02:06:00.000-07:00

Symptom

Background Job for Index Table Report

Other terms
LO-BM-BH
Batch History
Background job for Index Table Update report

Reason and Prerequisites
New feature

Solution
Implement the note to solve the issue.

Follow the steps mentioned below to run the report RVBOBJTABUPD as a background job:

1. Go to transaction SA38.

2. Enter program RVBOBJTABUPD in the input field.

3. Click on BACKGROUND pushbutton.

4. Schedule the job as background.

Read Full Note @ https://service.sap.com/sap/support/notes/1447637

Affected Releases

Software Component	Release	From Release	To Release	And subsequent
SAP_APPL	604	604	604
SAP_APPL	605	605	605

Correction delivered in Support Package

Support Packages	Release	Package Name
SAP_APPL	604	SAPKH60407
SAP_APPL	605	SAPKH60501

Corrections Instructions

Correction Instruction	Valid from	Valid to	Software Component	Last Modifcation
850768	604	604	SAP_APPL	06.04.2010 09:40:01
850769	605	605	SAP_APPL	06.04.2010 09:40:23

1257108		Collective Note: Analyzing issues with Single Sign On (SSO)
114045		Consulting: Technical system security

1901252		PT Web Services- Online communication to AT:Solution Details
1901250		PT Web Services- Online communication to AT : Technical Req
1896961		HTTP/HTTPS Configuration for SAP NetWeaver Gateway
1872926		Obsolete Note: PT Web Service: LC Online communication with Tax Authorities
1841573		SAPCRYPTOLIB 555pl36: bugfixes, error details, new features
1688545		OAuth 2.0 Server in AS ABAP Troubleshooting
1619442		Error when automatically reloading changed SSL PSEs
1553301		7.20 EXT Kernel - Usage
1531399		Enabling SSL for Session Protection
1452833		Prerequisites for analyzing support messages on STRUST
1433874		SapSSLReloadCred fix, SSLv3/TLSv1.0 configurability, GOST
1408879		ELENA: Set Up HTTP(S) Connection for Communication Server
1375378		Select the right version of an SAP security toolkit
1257108		Collective Note: Analyzing issues with Single Sign On (SSO)
1178155		Replacing PSEs in productive SSL Servers
1175193		Login ticket and ICM information is missing in SSO profile
834039		Certificate extension problems, Verisign (Japan)
758667		iSeries: Installing sapcrypto library for R/3
745103		Problemanalyse bei HTTPS-Kommunikation
700659		Security Guide: mySAP Supply Chain Management
698459		Trust manager: New root certificates
662340		SSF Encryption Using the SAPCryptolib
599270		Portal Content performance - composite SAP Note
597959		Portal content performance on EP 5.0 SP 6 - Sammelhinweis
578377		Digital signatures with SAPCRYPTOLIB
517860		Logging on to BSP applications
509495		Trust manager: Generating PSEs with a key length > 512 bits
508307		Trust Manager: Problems importing certificate responses
455033		SAPCRYPTOLIB versions, bugs and fixes
397175		SAP Cryptographic Software - Export control
354819		Collective note SAPSECULIB

817529		Checking the SSO configuration
510007		Setting up SSL on Web Application Server ABAP

Release	Link to PAM - NWBC Destkop Client
700	https://go.sap.corp/hqw
701	https://go.sap.corp/hqx
702	https://go.sap.corp/huq
730	https://go.sap.corp/hur
731	https://go.sap.corp/hus
740	https://go.sap.corp/hut

Release	Link to PAM - NWBC HTML Client
700	https://go.sap.corp/huu
701	https://go.sap.corp/huv
702	https://go.sap.corp/huw
730	https://go.sap.corp/hux
731	https://go.sap.corp/huy
740	https://go.sap.corp/huz