NWA Authorization Configuration

[Former Member]

I am configuring a new BW (dual) environment. This is my first attempt, and I am running into an issue.

I have installed both the AS ABAP and AS Java, and have configured the AS Java to use the the AS ABAP us Data Source for UME.

After this configuration, upon trying to log into the NWA with Administrator or SAP* I don't receive any error, the login screen simply returns as if awaiting a new login name.

What I really need to do is log in as J2EE_ADMIN in order to finish the post-installation configuration. The user I had initially set up during the installation was J2EE_ADM_PSJ. This user's password got locked, and I have had no luck getting it unlocked. I understand that there is a limitation w.r.t. using the ABAP Data Source as UME, requiring the administrator to give an initial password. However, I must be missing some key instruction since I have not been able to successfully do that.

In the mean time, I decided to create a new user, J2EE_ADMIN and assign the same role, profile, and group as J2EE_ADM_PSJ.

This user is able to log into the NWA, but now I get the message "You do not have the appropriate authorization to use NetWeaver Administrator; contact your system administrator".

Additionally, I get the same error when I log in with the 'DDIC' user.

The Role I assigned is: SAP_J2EE_ADMIN

The Profile is: SAP_ALL

The Group is: SUPER

What else to I need to give this user in order to give appropriate authorization?

Preferably, I would like to resolve the locked password with J2EE_ADM_PSJ, so if any hints there I would appreciate them.

Thank you.

[former_member208104 · Accepted solution]

Hi,

Assign following roles:

·

SAP_JAVA_NWADMIN_LOCAL

SAP_JAVA_NWADMIN_LOCAL_READONLY

SAP_JAVA_NWADMIN_CENTRAL

SAP_JAVA_NWADMIN_CENTRAL_READONLY

-Sanjay

[Former Member · Accepted solution]

Hi Sanjay,

None of those roles exist. Should they already exist, or do I need to create them?

[former_member208104 · Accepted solution]

Hi,

Are you checking in ABAP ? Assign these roles using JAVA UME.

-Sanjay

[Former Member · Accepted solution]

I'm unable to use the AS Java User Manager probably because of the same issue. I try using DDIC to log in, but I get errors. They seem to be authorization errors.

[former_member208104 · Accepted solution]

Hi,

Follow this link and activate sap, provide authorization and then disable sap

http://help.sap.com/saphelp_nw04s/helpdata/en/3a/4a0640d7b28f5ce10000000a155106/content.htm

-Sanjay

[Former Member · Accepted solution]

sap* is activated, however when I try to use that user, the login dialog just returns with no error as if nothing had been entered.

[former_member208104 · Accepted solution]

Hi,

Looks like you are confused with abap sap* user and java emergency sap* user. Even thou you have sap* user in abap you need to perform sap* activation steps mention in above link.

please follow the link and then try to login with sap*( emergency java user ) in java stak.

-Sanjay

[Former Member · Accepted solution]

Hi Sanjay,

I went and enabled the emergency sap* user through the configtool. When I tried to log in, I got a message about the sap* user being active and no other login will work. I used sap* with the password I configured. I got no message about incorrect password, just the message about the sap* user being active. It wouldn't get past the login screen.

Matt

[former_member208104 · Accepted solution]

Hi Matt,

Technically when you activate the sap, you will able to login with sap user only. This is emergency user using which you can

unlock and reset the user password.

I belive you used the password what you entered in config tool.

Once you are able to change your normal user you need to deactivate your sap* user and then you will able to use normal users.

-Sanjay

[Former Member · Accepted solution]

Unfortunately, the trouble that I'm having is that the system will not go past the login window. If I enter an invalid password, I get a message that I entered incorrect credentials. However, if I enter the correct password, then I just get the message about sap* being enabled, but it won't get past the login screen. This is regardless of case (sap* vs. SAP*).

[former_member208104 · Accepted solution]

Hi,

Let's try following setting:

1. login/no_automatic_user_sapstar to 1 ( in abap side).

2. restart system

3. Then try to login in java useing sap*

-Sanjay

[Former Member · Accepted solution]

Sanjay,

Thank you! This is the solution. I needed to disable the sap* user on the ABAP side, enable the emergency sap* user. I was then able to assign the roles for NWA Java administration that you mentioned earlier in this thread. All of this combination worked.

Thanks to everyone, especially Sanjay, for working through this with me.

I know this will be useful to others in the future.

-Matt

[patelyogesh]

Hello,

User: J2EE_ADMIN

Add Role: "Administrators" in NWA

Log off and login with J2EE_ADMIN user and try.

Regards,

Yogesh

[sivakumar_kilari3]

Hi,

Did you change any UME configuration settings?

In which you created J2EE_ADMIN user?

Check this J2EE_ADM_PSJ user at ABAP level. : you can unlock here or you can change password in 001 client.

Thanks

Siva

[Former Member]

Hi Siva,

I was able to unlock the user in the US01 transaction. But now I get the same error when I try to log into NWA:

You do not have the appropriate authorization to use NetWeaver Administrator; contact your system administrator

Thanks,

Matt

[sivakumar_kilari3]

>

> I was able to unlock the user in the US01 transaction. But now I get the same error when I try to log into NWA:

What is the role is there? Can you check. and assign this role SAP_BC_JSF_COMMUNICATION

Thanks

Siva

[Former Member]

Role is SAP_J2EE_ADMIN

[sivakumar_kilari3]

assign this role SAP_BC_JSF_COMMUNICATION

[Former Member]

Assigned SAP_BC_JSF_COMMUNICATION, but still get authorization message for NWA.

[sivakumar_kilari3]

Generate this role through PFCG and assign it or you copy this role as ZSAP_BC_JSF_COMMUNICATION and generate and assign.

[Former Member]

Hello Matt,

You need have SAP_J2EE_ADMIN authorization.

On PFCG check whether this role is properly set with all the authorizations attached to it before adding thsi role to any user who wants to be super user on Java system.

Regards

Vivek

[Former Member]

Using PFCG, I don't see any authorizations attached to the SAP_J2EE_ADMIN role.