Personas Error - You are not allowed to access this system

[Former Member]

We have installed Personas and done the configuration but in when we are trying to access Personas in browsers , we are getting "You are not allowed to access this system. If this is not correct , please contact your system administrator"

we have done all configurations in SPRO , managed system , created roles (tried with permission -1 also). How we can solve this issue?

Regards,

Vignesh P    

[balasubramaniyam_m]

Hi All,

i have solved the issue "you are not allowed to access the system",i got this error because of the url generating for rest gui is wrong(url came with space ),i have solved by using spro->maintainSystem->Systemsetting->removed the spave bar before "/restgui.

[Former Member]

HI All,

I also faced the same issue, resolved by upgrading the kernel. Please check your kernel level it has to be 7.21 or above. 

[madasamy_arunachalam]

Hi

Since this thread is not in completed status, I am updating it so that anyone come across the same error can be resolved.

System settings are entered as per below (instance # 00, so port used here is 8000) from Maintain Systems from SPRO --> SAP Customizing Implementation Guide  --> Cross Application Components --> SAP Screen Personas

regards

Swami

[TomCenens]

Dears

Just for completion if people look for possible solutions concerning the mentioned issue:

A lot of hanging (obsolete) HTTP sessions can also cause the error message "you're not allowed to access this system".

You can check in SM04 for hanging HTTP sessions, after I removed those, access was fine again.

Best regards

Tom

[Former Member]

Hi Vignesh,

be sure, that in your configuration in SPRO, the URL for the server setting "Server.Url" has no trailing "/" after the port.

E.g.:

Wrong: http://this.is.my.server.com:8000/

Right: http://this.is.my.server.com:8000

In my case, this solved the problem.

Another good idea is to debug the javascript consol in your browser.

Cheers,

Christian

[former_member149669]

Thanks Tamas.  Anyway to automatically assign any new flavors to a Global group? 

[tamas_hoznek]

I don't think so.

I could imagine having something like an ABAP utility that can be scheduled and would fulfill this purpose but I'm not aware of such a program provided in the standard. But it could be written

[Former Member]

Hi.

If there is anything suspicious in configuration according to configuration guide, I recommend to check your kernel release.

In my case, I configure system according to configuration guide (set up parameters, edit crossdomain.xml, clientaccesspolicy.xml, set up SPRO ... ), but it didn't work.

I finally found note 1848339 which suggests that we must use kernel release 721 or 740.

My kernel release was 720_EXT, then I updated my kernel release from 720_EXT to 721_EXT.

It works now.

[tamas_hoznek]

Well, kernel 7.21 or above is a basic requirement for Personas, so it is not really surprising that 7.20 didn't work.

[Former Member]

Yes, the prerequsite of SAP Screen Personas is kernel release, but I thnk that the real problem is the error message 'You are not allowed to access~~`. This message looks like authorization problem in the lower kernel release which does not fulfill system prerequisites..

[tamas_hoznek]

You're right, it is confusing.

Unfortunately this is not the only misleading message someone may receive... another example would be the one that appears when no Personas rule was assigned to the user, and a popup says something about 'A network error occured...'. Not sure if this was changed with the latest support package. Let's hope these will be corrected in the future

[former_member149669]

Is there anyway to disable flavor checking for an ID?  So, all flavors are allowed per user?

thanks,

chuck

[tamas_hoznek]

There sure is... create a global group and assign all flavors to the global group. Then all users will have access to all flavors.

Edit: Ah, you mean just a single ID, not all of them... hm... well, I don't have a good idea for that at the moment. Perhaps someone else has a tip?

Message was edited by: Tamas Hoznek

[Former Member]

All,

The response by Steve Rumsby pointed me to my solution as I was experiencing the exact same error.  In my case the Property Names in the System Settings of my only Personas Group in SPRO > Cross-Application Components>SAP Screen Personas>Maintain Systems was set to

Uri

Url

Instead of

Service.Uri

Server.Url

After correcting this and refreshing my browser, I was fine.  Thanks Steve

dennis b

[Former Member]

Hi Tobias / guys

For us I seem to have discovered the root cause of the message "You are not allowed to access this system". Supposedly there may a problem executing the Personas service if there are customer exits in the system. Appending ~NO_LOGON_USEREXIT = 1 in the GUI configuration solved my problem and I haven't received this message since.

Tobias I have activated compression, it does make a small marked difference, but we find over the past days that the largest factor of our latency issue appears to be network performance. If we execute web gui / personas url directly from the hosting server (Germany) the loading time is 1-2 seconds. Loading from our main office UK the loading speed as discussed is significatly higher.

Thanks all for your help.

;-Dave

[TobiasQueck]

Hi Dave,

What is the your user-exit on logon doing? Maybe it is calling a front-end service which is somehow failing? Could you please check if SAP Note 1787341 - "ABAP Interface Restgui" is applied, and if not, please apply it and test again without your parameter.

Now let's talk about performance. If there is a problem with latency then there is not really anything we can do. I assume you feel the same impact when using the SAP GUI for HTML. My only recommendation is to look into scripting when personalizing your screens because this allows to reduce the amount of roundtrips which usually has quite an impact if you have a high latency.

Cheers,

Tobias.

[Former Member]

Hi Tobias

Thank you for your help.

I could see that I had the client still defined in the Logon data, appart from that the only difference I can see is the "Deactivated system-wide" setting, where mine is deafulted (and can't change) to YES. I tried ensuring all the logon data was clear for the restgui service and re-tested in all browsers etc. It is strange, sometimes I get the cannot access message / sometimes not??

I also include a shot of the service data/GUI config. Does this look correct?

Also I notice that after logon the initail "home flavour take a very long time to load". We are talking 20-30 seconds... is this normal for personas. I feel that this may be ITS/Webgui parameter settings in the system?

Huge thanks again

;-Dave

[TobiasQueck]

Hi Dave,

No, 20s to 30s is not an acceptable response. Please turn compression on for your restgui service, this will significantly improve the performance. In addition, please check with transaction SITSPMON how much memory is allocated for ITS.

Otherwise, it is hard to say what might be responsible for your performance issues. So, I would recommend to create an OSS message so that support can help you.

Cheers,
Tobias.

[Former Member]

Hi Steve thank you very much for the responce.

As below I have had this configured like this for a while now as I seen this on a previous post.

Still at a loss. Even restarted the PC, lol.

[Former Member]

Hi, I am also experiencing the same issue, intermittantly I may add (i.e. on browser refresh the login eventually lets me in). I have tried everything upon installing Personas 1 month ago. I have been through the config over and over, checked auths / roles / browser trace etc.

Browser console suggests "sap-system-login-basic_auth=X failed. Please check your system configuration."  I have tried configuring / reconfiguring restgui, been over the roles and checked the service Url / Uri etc etc, as discussed in several discussions.

ECC 6.0, Kernal 721, Sup.Pkg.lvl 100

Has anyone got to the bottom of this by any chance? Any help would be very appreciated.;-)

[Former Member]

I can't tell from your message if this is what you've done but it reads like it might be...

Here's a mistake I've made that certainly causes this. In the server config in SPRO, note that it is Service.Uri but Server.Url. Before I realised they were different I had used Server.Uri and Server.Url, and Service.Uri and Service.Url, and both cause this problem.

Also note that if you change these values in SPRO, you need to refresh the browser page to force the Silverlight app to re-read the config, rather than just pushing the button for the server to try logging in again. That confused me for a while also.

Steve.

[TobiasQueck]

Hi Dave,

Please have a look at your restgui service in SICF. Please have a look at my setting below:

Cheers,

Tobias.

[christoph_rohatsch]

Hi Steve,

I would like to add that the property names are case-sensitive. If you i.e. type Service.URI instead of Service.Uri it won't work either.

BR

Christoph

[TobiasQueck]

Hi Vignesh,

Please have a look at the client-side (browser) logs to see what could be going wrong. I would recommend to follow the suggest process at  http://scn.sap.com/community/gui/blog/2013/06/28/sap-screen-personas--client-side-debugging.

Cheers,
Tobias.

[Former Member]

I am experiencing the same exact issue.  Where you able to resolve it?