SLD J2EE role "LcrAdministrator": UME Actions missing

[Former Member]

When trying to configure the SLD, I am not able to assign the "UME actions" to the built-in security roles such as LcrAdministrator (using NWA id mngmt). The required UME actions are missing.

When I view the roles using visual administrator:

runtime->policy configuration->sap.com/com.sap.lcr*sld:

Although the LCR security roles are listed, the corresponding Resources do not have any Actions to choose from.

Any idea how to fix this?

Thanks,

Christo.

(this question has also been posted on the "SECURITY" forum)

[Former Member · Accepted solution]

If your actions are missing, you may try undeploying, from SDM, the com.sap.lcr application and redeploying it. There are dependencies associated with it, so you'll need to re-deploy those as well. com.sap.lcr is located under Sapj2EEEngine > Sap-jTECHS hierarchy. The dependencies are under Sapj2EEEngine > LM-TOOLS (tc\sld\wd\...)

[Former Member]

For further clarification, here is SAP SUPPORT response:

The administration of the SLD isn't possible before the redeployment of

the "com.sap.lcr" application. This will recreate the corrupt Actions ofthis application, including the LcrAdministrator action. The whole

LMCORE*.SCA file has to be redeployed in order to be able to update the

"com.sap.lcr" application. The actions are contained in the com.sap.lcr

project within SCA LM-CORE. If there are deployment problems, perform a

forced redeployment.

[Former Member]

Great suggestion.

We reployed the sap.com.lcr app along with the dependencies, and all is well!

[Former Member]

Bottom line is this: no SLD expertise is required. The issue definition is rather simple:

A user is defined to a group.

The group has an assigned role.

There are NO ACTIONS available to assign.

When I work on another system, I have the same group&role assigment, and I have a list of available actions to assign.

[Former Member]

Thanks for clearing that up for me Michael.

For further clarification: I am following the SLD post install steps, where I have to assign actions to specific roles, and then assign these roles to groups. I compared the available roles and their respective actions with our Solution Manager system, and there I have a list of actions to choose from, but not in my new installed system. (When I launch the SLD, don't have any permissions, and I get an error message that states I need specific roles with specific permissions. I do have the roles assigned, but apparently the role is "empty")

So - from what I understand then is that the fact that the roles don't have any ACTIONS available for assignment in the UME (using the NWA ID management), there must be a problem with the application, or with some "actions.xml" file, right?

~Christo.

[MichaelShea]

I'm sorry Christo. I know very little about the SLD. I can only point you to the post-installation documentation for the SLD.

If the required roles are security roles, you need to assign them to the groups in the visual admin.

If actions are required you need to use the identity management UI. These you assign to the required roles. You can then assign the roles to the groups.

I can't really say much more about it.

-Michael

[MichaelShea]

Hi Christo,

It sounds to me like you are confusing the two different role types:

http://help.sap.com/saphelp_nw70/helpdata/en/44/7fdf2470a412d2e10000000a422035/frameset.htm

UME roles include UME actions. These you manage with the UME identity management tool.

J2EE security roles are collections of permissions from the applications. You can assign these roles with the visual admin.

In SAP NetWeaver 7.1 you can handle security roles like actions, but not in SAP NetWeaver 7.0.

-Michael