ESS not working due to Access Denied error

[Former Member]

Hi Experts,

I have exported the Current EP DEV system to use it in the new installation of EP SANDBOX.

I installed the new system based on the exported CD, then I Applied the SP 19 into the new system.

I linked the new system with the R3 SSNDBOX.

after that I maintained the Webdynpro JCo's in the new system, also I maintained the SLD systems and XSS Aliases.

but when I tried to test any ESS links " for example Salary Statement or salary Pay Slip" Iu2019m getting message in the left corner ACCESS Denied.

And this message appear everywhere.

Please help

regards,

Sherif.

[Former Member]

Hi Sherif,

The fact that you could not find the folder Portal Content->Content Provided by SAP->srvconfig obviously indicates that users have no access to the said folder. Try to login as Administrator and see. Let me give you the step by step instruction.

1. Try to login as user with SuperAdmin role (e.g. Administrator user)

2. Go to System Administration->Permissions.

3. Browse to Portal Content->Content Provided by SAP->srvconfig

4. Double click on srvconfig to open the permissions.

5. Add Everyone group and under the Administrator column select Read from the dropdown.

6. Under the End User column, select the checkbox.

Let me know if you have any questions.

Regards,

Erwin

[Former Member]

Hi Erwin,

I checked using J2EE_ADMIN user, but still the folder Portal Content->Content Provided by SAP->srvconfig is not exist.

Note: my portal is runing on NW2004.

can you help on this?

Sherif

[Former Member]

Hi,

It seems problem in the backend, please check with SAP_ALL backend authorization. Request you to also check 104 infotype, it should not be empty.

Regards,

Sanjeev Mourya

[Former Member]

Hi Sherif,

Did you import the new certificate in ECC?

Regards

Eduardo

[Former Member]

Hi Sherif,

Compare the permissions of your Dev and Sandbox for the following folder:

Content Provided by SAP->srvconfig

Regards,

Erwin

[Former Member]

thanks all for your reply

Erwin,

I checked the new system, but the folder Content Provided by SAP->srvconfig

not there.

Eduardo,

i imported the certificate into the new ECC.

Sanjeev,

how can i check 104 infotype? I'm technical guy.

Regards,

Sherif

[Former Member]

Hi,

Login into SAP HR system, use transaction PA30, enter personal number, infotype 104 and check the details.

if 104 infotype is empty then make an entry of user id and save.

Regards,

Sanjeev Mourya

[Former Member]

Hi ,

i checked the PA20 but i got the following error message:

" Information type 'Bond Denominations (0104)' not permitted

Message no. PG628

Diagnosis

Infotype Bond Denominations (0104) cannot be maintained for this personnel number.

Procedure

The authorization of a country grouping for an infotype and type is specified in table T582L Infotypes - Country-Specific Settings. Make the missing entry or contact your administrator".

Regards,

Sherif

[Former Member]

Hi,

Please check with three four different pernr number and update the user id which allow you to save it.

Request you to contact your basis team or HR consultant for the resolution.

Regards,

Sanjeev Mourya

[Former Member]

Hi Sanjeev,

Thanks for your reply, i asked the HR guy regarding the infotype 104

but he said there is no relation between the ESS and the infotype 104.

and he told me that the infotype 105 maintained so the ESS should work.

Thanks

Sh.

[Former Member]

Hi,

I have been using infotype 104. well you can check 105 infotype as per your consultant and establish the relation between user id and pernr and check the result.

Regards,

Sanjeev mourya

[Former Member]

Hi Sanjeev,

i established the relation between the usr-id and pernr but the problem still exist.

Access Denied.

thanks

[Former Member]

Hi,

Try to add full control permissions for group Everyone(with ticks in options "end user" and "role assigner") to following portal folders:

pcd:portal_content/com.sap.pct/srvconfig (Portal Content - Content Provided by SAP - srvconfig)

pcd:portal_content/com.sap.pct/every_user (Portal Content - Content Provided by SAP - End User Content)

And one question. What packages have you uploaded?(which epa and sca files).

Best wishes,

Sergey.

[Former Member]

Hi,

Try to add full control permissions for group Everyone(with ticks in options "end user" and "role assigner") to following portal folders:

pcd:portal_content/com.sap.pct/srvconfig (Portal Content - Content Provided by SAP - srvconfig)

pcd:portal_content/com.sap.pct/every_user (Portal Content - Content Provided by SAP - End User Content)

And one question. What packages have you uploaded?(which epa and sca files).

Best wishes,

Sergey.

[Former Member]

Hi Sergey,

I can't find pcd:portal_content/com.sap.pct/srvconfig (Portal Content - Content Provided by SAP - srvconfig) in my portal content...!!!

the current SP level is:

sap.com_SAP-JEE_6.40 SP22 (1000.6.40.22.0.20080327025832)

sap.com_SAP_ESS_100 SP19 (1000.100.0.19.2.20080707044547)

sap.com_SAP-JEECOR_6.40 SP22 (1000.6.40.22.0.20080327030116)

sap.com_SAPPCUI_GP_100 SP19 (1000.100.0.19.0.20080418091205)

sap.com_SAP_JTECHF_6.40 SP22 (1000.6.40.22.0.20080327030308)

sap.com_SAP_JTECHS_6.40 SP22 (1000.6.40.22.0.20080327025640)

sap.com_BP_ERP4CSP_60.2 SP0 (1000.60.2.0.0.20041024061259)

sap.com_BP_ERP4ESS_60.2 SP0 (1000.60.2.0.0.20050419020715)

sap.com_BP_ERP4MSS_60.1 SP1 (1000.60.1.1.0.20050401171641)

sap.com_LM-TOOLS_6.40 SP22 (1000.6.40.22.0.20080327030643)

sap.com_NWMADMIN_6.40 SP22 (1000.6.40.22.0.20080327030743)

Regards,

Sherif

[Former Member]

Hi,

Try to install SAP_ASR component. It may help you to find srvconfig;))

http://help.sap.com/saphelp_erp60_sp/helpdata/EN/68/f8e7421b845b04e10000000a155106/content.htm

have you changed permissions to other folder? It didnt help you? (dont forget to delet cookies and relogon to portal)

Best wishes,

Sergey

Edited by: Sergey Kolbasov on Apr 13, 2009 5:02 PM

[Former Member]

Hi Sergey,

I checked the service.sap.com/swdc for the SAP_ASR package

and I found it is only related to ERP 2005. but my systems are ECC 500 and NW 2004.

I changed the permissions for the other folder. but nothing happen.

Regards,

Sherif

[Former Member]

Hi,

Is Overview page for ESS available? Have you maintained smth in Backend system(Areas, Subares, Services)?

Can you provide some portal log-files, etc.

Best wishes,

Sergey

[Former Member]

Hi Sergey,

The Overview page for ESS is available , but when i press any link i get access denied message.

And if i pressed the link again i get the following message "

500 Internal Server Error

The Web Dynpro Application 'XssMenu' has expired. Please restart the application either with the refresh button or click the following link XssMenu."

I didn't change any thing in the backend,

[Former Member]

Hi!

It is a sap note 901640 about Home and Area pages expiration. But your version is higher when described in this note.

Try to install SP20 for SAP PCUI_GP 100 .

Maybe it will help you.

Also provide some log-files for further analysis.

Best wishes,

Sergey

[Former Member]

Hi Sergey,

i restarted the system to reduce the log file size.

DefaultTrace log file:#1.5 #001F29C64236003E0000000400000CC40004676FD90C1250#1239629987325#com.sap.engine.services.dqe##com.sap.engine.services.dqe#######Thread[Log_Worker_0,10,SAPEngine_System_Thread[impl:5]_Group]##0#0#Error#1#/System/Server/DQE#Plain###Apr 13, 2009 15:39:47.294 [SAP_HOST|9692|SAPEngine_System_Thread[impl:5]_72] <CONTROLLER.ERROR> Error in com.metamatrix.platform.vm.VMController

[ServiceException]Property ServiceClassName not defined for service "bak" in VM "MetaMatrixProcess" on host "SAP_HOST"

at com.metamatrix.platform.vm.controller.VMController.startDeployedService(VMController.java:524)

at com.metamatrix.platform.vm.controller.VMController.startDeployedServices(VMController.java:416)

at com.metamatrix.platform.vm.controller.VMController.<init>(VMController.java:159)

at com.metamatrix.sap.service.MetaMatrixServiceFrame.start(MetaMatrixServiceFrame.java:161)

at com.sap.engine.core.service630.container.ServiceRunner.startApplicationServiceFrame(ServiceRunner.java:214)

at com.sap.engine.core.service630.container.ServiceRunner.run(ServiceRunner.java:144)

at com.sap.engine.frame.core.thread.Task.run(Task.java:64)

at com.sap.engine.core.thread.impl5.SingleThread.execute(SingleThread.java:81)

at com.sap.engine.core.thread.impl5.SingleThread.run(SingleThread.java:107)

#1.5 #001F29C6423600610000000400000CC40004676FDA69C019#1239630010231#com.sap.engine.services.security.roles.SecurityRoleImpl#sap.com/irj#com.sap.engine.services.security.roles.SecurityRoleImpl#J2EE_GUEST#0##n/a##9b8c54a0283011deb4ba001f29c64236#SAPEngine_Application_Thread[impl:3]_26##0#0#Error#1#/System/Security/Audit/J2EE#Java###: Authorization check for caller assignment to J2EE security role [ : ].#3#ACCESS.ERROR#SAP-J2EE-Engine#administrators# #1.5 #001F29C6423600610000001D00000CC40004676FDA6CA890#1239630010418#com.sap.portal.prt.runtime#sap.com/irj#com.sap.portal.prt.runtime#J2EE_GUEST#0##n/a##9b8c54a0283011deb4ba001f29c64236#SAPEngine_Application_Thread[impl:3]_26##0#0#Error#1#/System/Server#Plain###Logger Definition is duplicated! please check:lru_preemption_logger - 😧
usr
sap
JDE
JC00
j2ee
cluster
server0
apps
sap.com
irj
servlet_jsp
irj
root
WEB-INF
portal
system
xml
com.sap.portal.prt.cache
logger.xml# #1.5 #001F29C6423600610000002100000CC40004676FDA6CB57D#1239630010434#com.sap.portal.prt.runtime#sap.com/irj#com.sap.portal.prt.runtime#J2EE_GUEST#0##n/a##9b8c54a0283011deb4ba001f29c64236#SAPEngine_Application_Thread[impl:3]_26##0#0#Error#1#/System/Server#Plain###Logger Definition is duplicated! please check:SOAPLogger - 😧
usr
sap
JDE
JC00
j2ee
cluster
server0
apps
sap.com
irj
servlet_jsp
irj
root
WEB-INF
portal
system
xml
com.sap.portal.runtime.application.soap
logger.xml# #1.5 #001F29C6423600610000004500000CC40004676FDAEE9A5E#1239630018934#com.sapportals.config.fwk.meta.ConfigClassFormatter#sap.com/irj#com.sapportals.config.fwk.meta.ConfigClassFormatter#J2EE_GUEST#0##n/a##9b8c54a0283011deb4ba001f29c64236#SAPEngine_Application_Thread[impl:3]_26##0#0#Error##Plain###Invalid configclass file name : [config://coll.appl.room.templatemechanism.configmeta/collaboration/template/settings/settings.cc.xml]. The file name must correspond to the configclass name [setting] (uppercases must be escaped).# #1.5 #001F29C6423600610000004600000CC40004676FDAEEA5AB#1239630018949#com.sapportals.config.fwk.meta.ConfigClassFormatter#sap.com/irj#com.sapportals.config.fwk.meta.ConfigClassFormatter#J2EE_GUEST#0##n/a##9b8c54a0283011deb4ba001f29c64236#SAPEngine_Application_Thread[impl:3]_26##0#0#Error##Plain###Invalid configclass file name : [config://coll.appl.room.templatemechanism.configmeta/collaboration/template/settings/mappings/memory/memoryentry.cc.xml]. The file name must correspond to the configclass name [mapping] (uppercases must be escaped).# #1.5 #001F29C6423600610000004700000CC40004676FDAF11AF4#1239630019105#com.sapportals.config.fwk.meta.MetaConfigManager_V2#sap.com/irj#com.sapportals.config.fwk.meta.MetaConfigManager_V2#J2EE_GUEST#0##n/a##9b8c54a0283011deb4ba001f29c64236#SAPEngine_Application_Thread[impl:3]_26##0#0#Error##Plain###[meta_v2_config://local] error while migrating [metarchive_portal]. The configMetaArchive needs to be removed or migrated 'manually' : ConfigException: Configuration framework system error: "source [config://pcd/local/meta/lib] already contain the configMetaArchive."# #1.5 #001F29C6423600610000027400000CC40004676FDB5FCD91#1239630026355#com.sap.portal.RFCLogger#sap.com/irj#com.sap.portal.RFCLogger#J2EE_GUEST#0##n/a##9b8c54a0283011deb4ba001f29c64236#SAPEngine_Application_Thread[impl:3]_26##0#0#Info##Plain###[RFCEngineService]: AfterInit(): Try to register to portal Bridge# #1.5 #001F29C6423600610000027600000CC40004676FDB5FD1F9#1239630026355#com.sap.portal.RFCLogger#sap.com/irj#com.sap.portal.RFCLogger#J2EE_GUEST#0##n/a##9b8c54a0283011deb4ba001f29c64236#SAPEngine_Application_Thread[impl:3]_26##0#0#Info##Plain###[RFCEngineService]: registerToPortalBridge Ok# #1.5 #001F29C642360061000002DC00000CC40004676FDBFA8577#1239630036496#com.sap.workflow#sap.com/irj#com.sap.workflow.#J2EE_GUEST#0##n/a##9b8c54a0283011deb4ba001f29c64236#SAPEngine_Application_Thread[impl:3]_26##0#0#Error##Plain###Object not found in lookup of WF_DBPOOL.# #1.5 #001F29C642360061000002E000000CC40004676FDBFA8B60#1239630036496#com.sap.workflow#sap.com/irj#com.sap.workflow.#J2EE_GUEST#0##n/a##9b8c54a0283011deb4ba001f29c64236#SAPEngine_Application_Thread[impl:3]_26##0#0#Error##Plain###Path to object does not exist at java:comp, the whole lookup name is java:comp/env/jdbc/SAP/EP_PRT.# #1.5 #001F29C642360061000002E400000CC40004676FDC057863#1239630037214#com.sap.portal.RFCLogger#sap.com/irj#com.sap.portal.RFCLogger#J2EE_GUEST#0##n/a##9b8c54a0283011deb4ba001f29c64236#SAPEngine_Application_Thread[impl:3]_26##0#0#Info##Plain###[RFCEngineService]: registerToRFCDispatcher Ok# #1.5 #001F29C6423600650000001000000CC40004676FDD6E01A2#1239630060839#com.sap.jpe.engine.impl.common.AnalyzerModel#sap.com/com.sapportals.supportplatform#com.sap.jpe.engine.impl.common.AnalyzerModel#J2EE_ADMIN#57##n/a##b6446350283011de8406001f29c64236#SAPEngine_Application_Thread[impl:3]_6##0#0#Error##Plain###java.util.zip.ZipException: The system cannot find the path specified at java.util.zip.ZipFile.open(Native Method) at java.util.zip.ZipFile.<init>(ZipFile.java:111) at java.util.jar.JarFile.<init>(JarFile.java:127) at java.util.jar.JarFile.<init>(JarFile.java:65) at com.sap.jpe.engine.impl.pluginloading.PluginCollector.loadClass(PluginCollector.java:870) at com.sap.jpe.engine.impl.pluginloading.PluginCollector.getPluginDescFromXMLFile(PluginCollector.java:387) at com.sap.jpe.engine.impl.pluginloading.PluginCollector.getPluginDescFromXMLFile(PluginCollector.java:274) at com.sap.jpe.engine.impl.pluginloading.PluginCollector.loadPluginsFromJarFile(PluginCollector.java:169) at com.sap.jpe.engine.impl.pluginloading.PluginCollector.loadFromExtDirectory(PluginCollector.java:121) at com.sap.jpe.engine.impl.common.AnalyzerModel.loadPlugins(AnalyzerModel.java:411) at com.sap.jpe.engine.impl.common.AnalyzerModel.loadPlugins(AnalyzerModel.java:399) at com.sapportals.supportplatform.SupportPlatform.init(SupportPlatform.java:82) at com.sap.engine.services.servlets_jsp.server.security.PrivilegedActionImpl.run(PrivilegedActionImpl.java:59) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAs(Subject.java:379) at com.sap.engine.services.servlets_jsp.server.runtime.context.WebComponents.addServlet(WebComponents.java:141) at com.sap.engine.services.servlets_jsp.server.container.ApplicationThreadInitializer.loadServlets(ApplicationThreadInitializer.java:386) at com.sap.engine.services.servlets_jsp.server.container.ApplicationThreadInitializer.run(ApplicationThreadInitializer.java:110) at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37) at java.security.AccessController.doPrivileged(Native Method) at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:102) at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:172) # #1.5 #001F29C6423600650000001100000CC40004676FDD6E034E#1239630060839#com.sap.jpe.engine.impl.common.AnalyzerModel#sap.com/com.sapportals.supportplatform#com.sap.jpe.engine.impl.common.AnalyzerModel#J2EE_ADMIN#57##n/a##b6446350283011de8406001f29c64236#SAPEngine_Application_Thread[impl:3]_6##0#0#Error##Plain###java.util.zip.ZipException: The system cannot find the path specified at java.util.zip.ZipFile.open(Native Method) at java.util.zip.ZipFile.<init>(ZipFile.java:111) at java.util.jar.JarFile.<init>(JarFile.java:127) at java.util.jar.JarFile.<init>(JarFile.java:65) at com.sap.jpe.engine.impl.pluginloading.PluginCollector.loadClass(PluginCollector.java:870) at com.sap.jpe.engine.impl.pluginloading.PluginCollector.getPluginDescFromXMLFile(PluginCollector.java:387) at com.sap.jpe.engine.impl.pluginloading.PluginCollector.getPluginDescFromXMLFile(PluginCollector.java:274) at com.sap.jpe.engine.impl.pluginloading.PluginCollector.loadPluginsFromJarFile(PluginCollector.java:169) at com.sap.jpe.engine.impl.pluginloading.PluginCollector.loadFromExtDirectory(PluginCollector.java:121) at com.sap.jpe.engine.impl.common.AnalyzerModel.loadPlugins(AnalyzerModel.java:411) at com.sap.jpe.engine.impl.common.AnalyzerModel.loadPlugins(AnalyzerModel.java:399) at com.sapportals.supportplatform.SupportPlatform.init(SupportPlatform.java:82) at com.sap.engine.services.servlets_jsp.server.security.PrivilegedActionImpl.run(PrivilegedActionImpl.java:59) at java.security.AccessController.doPrivileged(Native Method) at javax.security.auth.Subject.doAs(Subject.java:379) at com.sap.engine.services.servlets_jsp.server.runtime.context.WebComponents.addServlet(WebComponents.java:141) at com.sap.engine.services.servlets_jsp.server.container.ApplicationThreadInitializer.loadServlets(ApplicationThreadInitializer.java:386) at com.sap.engine.services.servlets_jsp.server.container.ApplicationThreadInitializer.run(ApplicationThreadInitializer.java:110) at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37) at java.security.AccessController.doPrivileged(Native Method) at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:102) at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:172) # #1.5 #001F29C6423600400000014500000CC40004676FDD8133CA#1239630062104#com.sap.engine.services.deploy##com.sap.engine.services.deploy####n/a##8e0902b0283011de954e001f29c64236#SAPEngine_System_Thread[impl:5]_27##0#0#Error#1#/System/Server#Plain###Error occurred while initially starting application sap.com/com.sapportals.connectors.database:Cannot delete directory "D:
usr
sap
JDE
JC00
j2ee
cluster
server0
apps
sap.com
com.sapportals.connectors.database
connector".# #1.5 #001F29C6423600400000014700000CC40004676FDD81345D#1239630062104#com.sap.engine.services.deploy##com.sap.engine.services.deploy####n/a##8e0902b0283011de954e001f29c64236#SAPEngine_System_Thread[impl:5]_27##0#0#Error#1#/System/Server#Plain###Error occurred while initially starting application sap.com/tc_mobileadmin_{ea:Application sap.com/tc}mobile_adminea cannot be started. Reason: it has hard reference to resource tc_SL_SDM_Client with type library, which is not active on the server.# #1.5 #001F29C64236005E0000001400000CC40004676FE40142D1#1239630171148#com.sap.engine.services.security.roles.SecurityRoleImpl#sap.com/irj#com.sap.engine.services.security.roles.SecurityRoleImpl#SHERIF_EID#72##SAPEPDEV_JDE_1432450#Guest#fa9b0c20283011decbd0001f29c64236#SAPEngine_Application_Thread[impl:3]_12##0#0#Error#1#/System/Security/Audit/J2EE#Java###: Authorization check for caller assignment to J2EE security role [ : ].#3#ACCESS.ERROR#SAP-J2EE-Engine#administrators# #1.5 #001F29C6423600470000002500000CC40004676FEB4B2EFF#1239630293458#com.sap.engine.services.security.roles.SecurityRoleImpl##com.sap.engine.services.security.roles.SecurityRoleImpl#J2EE_ADMIN#90##SAPEPDEV_JDE_1432450#J2EE_ADMIN#446baf30283111dec823001f29c64236#SAPEngine_Application_Thread[impl:3]_19##0#0#Error#1#/System/Security/Audit/J2EE#Java###: Authorization check for caller assignment to J2EE security role [ : ].#3#ACCESS.ERROR#sap.com/com.sap.lcr*sld#LcrClassWriter#

//////////////////////////////

Regards,

Sherif

[Former Member]

Dear Sherif,

A couple of things you might want to look into.

1. Go to System Admin-System config-System landscape and right click and open the permissions and ensure you have a everyone group and enduser checked.

2. Test the JCos being used.

Good Luck!

Sandeep Tudumu

[Former Member]

Hi,

Do you set the value 000 for the client, when you import the ACL certificat?

Regards

Grilo

[Former Member]

Hi Sandeep,

I added the permissions for everyone group --- logout and re-logon again but nothing happen

then I tested all JCO --> and the result is successfully.

Please help.

Regards

[Former Member]

Hi Girlo,

yes i entered 000 during importing the ACL cer.

Regards,

Sherif

[Former Member]

could be a permissions problem

[Former Member]

thanks Anagha,

may be but how can i check?

regards,

Sherif

[Former Member]

Hello,

This is a permission issue. Since its a SANDBOX system, assign super_admin_role to the user and then try.

Regards

Deb