Windows Active Directory LDAP Integration - SAPGUI 7.1

[Former Member]

Hello

SAPGUI 6.20 & 6.40 has supported reading the list of SAP systems from an LDAP source (such as active directory).

I have recently setup some SAP systems to register in AD via the following profile parameters in the instance profile:

ldap/autoregister = 1

ldap/options = DirType=NT5ADS

This can be confirmed via AD and via the ldap trace files

I have then create a new sapmsg.ini in the c:\windows directory of the client PC and added these parameters:

Mode=LDAPdirectory

LDAPserver=

LDAPnode=

LDAPoptions="DirType=NT5ADS"

This is discussed in 608781 SAPLogon: Supporting for Active Directory (LDAP)

Does anybody know if the LDAP functionality has been "removed" from SAPGUI 7.1?

It would be nice to let some customers that are using this functionality know in advance.

Thanks

N.P.C

[Former Member]

Hello,

I would be very interested in knowing the status of this feature, and where to find documentation about it. All I found is how to register servers in LDAP at startup, and I have yet to find a documentation about possible values in sapmsg.ini...

Thanks in advance,

Xavier Scolard

[Former Member]

Hello Xavier,

This functionality is working in SAPGUI 7.1 - I have confirmed this.

There are 3 key steps:

1. Prepare the AD with a small change. SAPInst does this for you. It is a very minor change to AD and simply adds a few attributes that SAP needs. Use the latest version of NW2004s SR 2 SAPInst no matter which version of SAP you are using. It takes about 1 minute.

2. Set the following profile parameters for your Instance profiles

ldap/options = DirType=NT5ADS

ldap/autoregister = 1

3. On you SAPGUI - remove all contents from C:\WINDOWS\SAPMSG.INI and add only the following (make sure to include [ ] around Address)

[Address]

Mode=LDAPdirectory

LDAPserver=

LDAPnode=

LDAPoptions=DirType=NT5ADS

SAPGUI can now browse all registered SAP systems automatically finding the message server when you enter the SID of a system. It is very useful.

Production systems can even be separated into their own LDAP RDN

This is discussed in 608781 SAPLogon: Supporting for Active Directory (LDAP)

If you experience problems - check the files in the WORK directory "dev_ldap*" - most of the time you will need to add the SAPService<SID> service account to the SAP LDAP group so that it has permission to write to AD.

SAPMMC can also read this information - meaning you can run SAPMMC on your desktop and start and stop SAP systems.

If you have any questions - please post in this thread.

Thanks

N.P.C

[Former Member]

Hello,

Thank you for your quick answer N.P.C.,

I forgot to mention that we are not using Active Directory at all. The part I was interested in is LDAP, as we are using OpenLDAP for many other applications. And as we already managed to get a message server to be registered in LDAP (after finding out that ldappasswd does not like blanks in the ldap username....), I would like to get the list of currently registered servers in SAPGUI. I think I overestimated this feature, because I believed it would change the main list in SapLogon, but getting it in "Servers..." would be already something...

So I am still blocked at trying to get this list in SAPLogon... and this problably needs some different settings in sapmsg.ini...

Thanks in advance,

Xavier Scolard

[Former Member]

Hello

LDAP will not populate SAPLOGON with systems directly, LDAP will only provide a listing of available systems which must be manually added.

The file C:\WINDOWS\SAPLOGON.INI is where SAPLOGON persists configured systems. Adding systems to SAPLOGON.INI is a manual process I believe

LDAP registration allows users to add systems without the need to know the hostname or IP address of the message servers.

SAPGUI 7.1 has a new wizard for adding systems.

Thanks

N.P.C