User IDs in adapters - XI Proxy, RFC

[Former Member]

Hi mates,

I've created receiver adapters of type XI and RFC for an SAP R/3 business system. In these adapter parameters, what is the <b>ideal</b> user ID that needs to be specified? Should it be a service user id or dialog user id? What should be the optimal authorizations for it.

At the moment, I've specified my own user id and the adapters are working successfully. But, I foresee an issue with this method as I would be required to change the password at regular intervals.

What are the best practices regd the user ids in adapters? Please share your experiences.

I appreciate your inputs.

thx in adv

praveen

[MichalKrawczyk · Accepted solution]

Hi,

it's best to use a service user

as dialog user's password may expire one day

and you'll end up with authorization errors

all other auth you will have depend on what

your processes mostly

REgards,

michal

[Former Member]

Hi Praveen,

normally you would take dedicated service users for that adapters. typically companies tend to have some standards around what kind of users they are using for communication so you might check with the according teams what they are using right now.

As authroizations the users will need role SAP_XI_APPL_SERV_USER plus any additional authorizations needed for the specific tasks in the backend. Meaning if you use the RFC adapter to create a Sales Order via a BAPI, the user in the adapter will need the authorizations to create a sales order which are checked in the BAPI.

Regards

Christine

[Former Member]

well and here is the link to the according section in the XI Security Guide:

http://help.sap.com/saphelp_nw04/helpdata/en/d4/d12940cbf2195de10000000a1550b0/content.htm

If you'll scroll down you'll see a table that lists the authorizations for the different types of communication.

Regards

Christine

[Former Member]

Thank you all for the info.

I will create a service user with XI_APPL_SERV_USER authorization + required RFC authorization for specific BAPIs and use that in proxy and RFC adapter.

praveen

[Former Member]

Hi Praveen,

I would suggest the use of a user of type "Communications" and have SAP_ALL assigned....

a user of type "Service" still has dialgo access whihc i donot think you would want...

pls see the types of users and their help...

User Type

Dialog 'A'

A normal dialog user is used by one person only for all types of logon.

During a dialog logon, the system checks for expired and initial passwords and provides an option to change the password.

Multiple dialog logons are checked and logged if necessary.

System 'B'

You use a user of type System for communication without dialog within one system (for RFC or CPIC service users) or for background processing within one system.

Dialog logon is not possible.

A user of this type is excluded from the general settings for password validity. Only the user administrator can change the password using transaction SU01 (Goto -> Change Password).

Communication 'C'

You use a user of type Communication for communication without dialog between systems (for RFC or CPIC service users for various applications, for example, ALE, Workflow, TMS, CUA).

Dialog logon is not possible.

Service 'S'

A user of the type Service is a dialog user that is available to an anonymous, larger group of users. Generally, this type of user should only be assigned very restricted authorizations.

For example, service users are used for anonymous system access via an ITS service. Once an individual has been authenticated, a session that started anonymously using a service user can be continued as a personal session using a dialog user.

During logon, the system does not check for expired and initial passwords. Only the user administrator can change the password.

Multiple logon is allowed.

Reference 'L'

Like the service user, a reference user is a general user, not assigned to a particular person. You cannot log on using a reference user. The reference user is only used to assign additional authorization. Reference users are implemented to equip Internet users with identical authorizations.

On the Roles tab, you can specify a reference user for additional rights for dialog users. Generally, the application controls the allocation of reference users. You can allocate the name of the reference user using variables. The variables should begin with "$". You assign variables to reference users in transaction SU_REFUSERVARIABLE.

This assignment applies to all systems in a CUA landscape. If the assigned reference user does not exist in one of the CUA child systems, the assignment is ignored.

Thanks,

Renjith.

[moorthy]

Hi Praveen,

Usually sevice user will be used. Dialogue users are not used in RFC/proxy adapters..

More-

http://help.sap.com/saphelp_nw2004s/helpdata/en/9f/d12940cbf2195de10000000a1550b0/content.htm

http://help.sap.com/saphelp_nw2004s/helpdata/en/d4/d12940cbf2195de10000000a1550b0/content.htm

Regards,

Moorthy

Message was edited by: Krishna Moorthy P