keystore access in nwa

[Former Member]

Hi Experts,

I've got one question regarding the authorizations needed to access the keystore in NWA.

In UME there is a role "Administrator" which contains this authorization, but this role also contains full nwa Access.

So what I want is to give access to the keystore only with the rights to create, view and Change entries.

I want to create an own rule with the necessary Actions, but I don't know which Actions are necessary.

What I want in Detail is:

- Access to nwa

- Access to configuration tab in nwa

- Access to security area under the configuration tab

- full Access to the area "certificates and keys"

Do you have any experience with that and could give me some hints?

Thanks in advance

Best regards!

Christopher Kühn

[Former Member · Accepted solution]

Hi Guys,

thanks for all your helpful answers.

I figured it out:

I've added the Java role "NWA_READONLY" to the user to give him General NWA read only authorization. Additionally I've created a new role with two Actions:

1) NWA_SUPERADMIN_CKP (Type: UME; Service/application: tc~lm~webadmin~permissions; Name: NWA_SUPERADMIN_CKP)

2) domains.all.all (Type: UME; Service/application: security; Name: domains.all.all)

Best regards!

Christopher

[manumohandas82]

Hi Chris ,

Please close the thread if your query is answered

Thanks ,

Manu

[Former Member]

Dear Christopher,

Please go to the user management--> Enter User Name-->Open Assigned Role tab -->Open Role" Administrator". Here You can Restrict the user.

Please find the attached screen shot and assign some points also if answer is helpful....

[Former Member]

Hello Adarsh,

thanks for your reply but I don't want to give the user the Administrator role. I want to give the user only a dedicated authorization for the keystore.

Thanks and best regards!

Christopher

[former_member185954]

Hello Christopher,

This query has been answered in the past to some extent:  https://scn.sap.com/thread/950023

Have a look at the above thread, check the responses of people speaking about Visual Admin.

Regards,

Siddhesh

[Former Member]

Hello Siddhesh,

thanks for your reply, but the thread only says to give the users the role "Administrator" or "SAP_J2EE_ADMIN" in case of a double stack.

But this is not what I want. I want to give some users dedicated Access only to the keystore.

We have NW 7.4 SP8 (Double stack PI).

Thanks and best regards!

Christopher

[former_member185954]

Hello Christopher,

As I mentioned, read the responses in the thread, they speak about using Visual Admin tool to locate the relevant roles in visual admin.

Regards,

Siddhesh

[Former Member]

Hi Siddhesh,

the visual admin is not available in NW 7.4. The visual admin was replaced by the NetWeaver Administrator (NWA).

In NWA in the UME I cannot find any roles like "KeystoreAdministrator" or "KeystoreViewsCreator"

Best regards!

Christopher

[manumohandas82]

Hi Chris ,

Please check whether the following link helps you

Standard Roles - SAP NetWeaver Application Server Java Security Guide - SAP Library

The role should be "KeystoreAdministrator" / "KeystoreViewCreator"  If not present check for the locally defined roles

Also

Applying Security Constraints to a Security Role - AS Java User Management Using the Visual Administ...

Thanks ,

Manu

[former_member185954]

You are so right, my apologies, I missed this critical bit, anyways I found a document that tells you where to find the nodes that you should have found on visual admin.

Compare the nodes described in the thread I shared and see if you can find the corresponding nodes on NWA

Check the link below:

http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/80212ef7-d9c9-2b10-02bf-a2d1c1ed0...

Regards,

Siddhesh

[former_member185954]

Hello Christopher,

Manu is right, I was looking for this link, its interesting to know these details, I will bookmark this thread.

Thanks Manu

Regards,

Siddhesh