Wednesday 28 August 2013

SAP- GUI access with no password

For SAP BASIS Administrators who are managing many number of systems, might have difficulty to remember passwords for each and every system.

Here is a shortcut way were we can login to the SAP systems with out passwords.

We will Use SAP Shortcut to achieve the same.

Enable Password field

1) open regedit
2) go to HKEY_CURRENT_USER\Software\SAP\
3)Right Click on SAP -->New--> Key with name SAPShortcut--> Then using Same above Step create a key name "Security" under "SAPShortcut"
4)Now Right Click on the Security --> New --> String Value Give name "EnablePassword" to this and Set it Value 1
5) Close window

Create Shortcut 

6) Login to SAP
7) Got to Customize Local Layout or ALT+F12 , select create shortcut
8) Provide detail(Password etc) and save somewhere in desktop, we recommended to save in some secure folder as using this shortcut any one can login to SAP GUI without proving password

Integrate With Excel

9) Open excel , type SID or ant description you want to give for shortcut
10) Right click and select hyperlink (Select the shortcut you have created earlier)
11) Save file and then try to access , you will be routed to SAP GUI with couple of warnings , to avoid warning follow below steps

Microsoft Excel Warnings

12) Disable hyperlink warnings for 2007 Office programs

To disable the hyperlink warnings in 2007 Office Programs when an http:// address, notes:// or an ftp:// address is used, you must create a new registry subkey.

To do this, follow these steps:

Click Start, and then click Run.

In the Open dialog box, type regedit, and then click OK.

In Registry Editor, locate one of the following registry subkeys:

HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common

HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\12.0\Common

Note:- You  have to modify only one of these registry subkeys. You do not have to modify both of them.

Note:- If the Security subkey already exists, skip to Step 6 after selecting the Security subkey.

Click the registry subkey, point to New on the Edit menu, and then click Key.

Type Security, and then press ENTER to name the key.

On the Edit menu, point to New, and then click DWORD Value.

Type DisableHyperlinkWarning, and then press ENTER to name the entry.

In the right pane, right-click DisableHyperlinkWarning, and then click Modify.

In the Edit DWORD Value dialog box, click Decimal, and then type 1 under Value data.

Note:- A value of 0 enables the hyperlink warning message. A value of 1 disables the hyperlink warning message.

Click OK.

Exit Registry Editor.

Still you will get one more warning to avoid that

Turn off the "Confirm open after download" option for the file type that you are trying to open

Double-click My Computer.
On the Tools menu, click Folder Options.
On the File Types tab, select the appropriate file name extension SAP in the Registered File Types box, and then click Advanced.
Click to clear the Confirm open after download check box, and then click OK.
In the Folder Options dialog box, click Close.

Method 2: Modify the HKEY_CLASSES_ROOT\WMVFile\EditFlags registry subkey
Use this method if the warning message affects multiple computers.

Now you will be able to login without passwords , but dont forget to update shortcut if you change your SAP password .

Moreover you can put one extra password for excel sheet also .

Warning:- We recommend not to use this in any critical system as it can be a security issue.

SAP- E-Mail not sent to distribution list

In some cases after SAP upgrade to SAP ECC 6.0 EHP 6.0, mails triggered through custom program will not work.

The reason behind is, the functional module SO_NEW_DOCUMENT_SEND_API1 is no more valid, hence if this function module is used the mail send program will not work.

There are two solutions for this

1) Use CL_BCS function module instead of SO_NEW_DOCUMENT_SEND_API1.

2) Add parameter in the program for the function module SO_NEW_DOCUMENT_SEND_API1
with  COMMIT_WORK='X'.

Please check the following SAP Notes:-

Note 629786 - E-mail is not sent to distribution list

Note 759587 - E-mail is not sent to distribution list

For more information on different function modules used for mail sending is explained in the below link,



SAP-Oracle AWR Reporting

Oracle AWR report might be required to generate for SAP managed oracle databases (based on customer or technical requirement).

To perform the reporting, please follow the below steps.

Read the following SAP Notes:-

Note 1457893 - How to generate Oracle ADDM, ASH and AWR reports

Note 1326067 - Configure retention period for Automatic Workload Repository

1) check the AWR snap interval & Retention time – use following query:

Sql>SELECT * FROM DBA_HIST_WR_CONTROL

2) Oracle provides two scripts to produce workload repository reports (awrrpt.sql and awrrpti.sql).

Sql>@$ORACLE_HOME/rdbms/admin/awrrpt.sql

Sql>@$ORACLE_HOME/rdbms/admin/awrrpti.sql

Note: awrrpt.sql & awrrpti.sql are exactly same except that awrrpti report allows specific instance to report on. awrrpti.sql asks to enter dbid for particular instance of interest.

 The default settings (snapshot & Retention) for AWR report can be changed according to the requirement using SAP Note 1326067.

 

For more information on AWR Reporting, Please check the following link

http://adfoc.us/1746541

 

SAP-Oracle open resetlogs error

In a support project you may face a situation where you have created a control file for online backup and you do not have sufficient archive logs to recover database.

At this point you will face issue while openeing the database using open reset logs.

ORA-01152: file 1 was not restored from a sufficiently old backup
ORA-01110: data file 1: 'E:\ORACLE\PM1\SAPDATA1\SYSTEM_1\SYSTEM.DATA1'


In such cases you may try the below solution,

Set the parameter as below in oracle and open the database, now open resetlogs will not show any error messages.

_allow_resetlogs_corruption=true

Sql>alter system set _allow_resetlogs_corruption=true scope=memory;

Warning:- By setting this parameter to TRUE may cause the database to corrupt in many occassions, please use this solution wisely.

Tuesday 20 August 2013

SAP-Oracle controlfile creation issue during system copy

While performing system copy in any platform with Oracle DB using backup restore method, there may be situation where the basis consultant will re-create controlfile manually and then tries to continue the setup, but Sapinst will throw error during the controlfile creation phase.

This is a common manual issue, as of 700 sap version, there is no need of manual creation of controlfile in the target system DB.

Before starting target system installation, you may create controlfile trace from source system manually and modify contents or create the target controlfile using oradbatools from installation source directory.

Once the target controlfile script is ready just rename the file as control.sql and paste it in the sapinst directory of the target system and then continue setup from DB restore phase.

Just in case if basis consultant manually updated controlfile in DB and then continues setup, sapinst will throw error as could not create controlfile.

The simple solution to this issue is to create a control.sql file with a single command entry as exit and paste it in the sapinst directory of the target system and then continue setup from error page.

This will resolve the issue..

SAP-System copy issue in ECC6.0 EHP4 (with windows & Oracle)

In windows server while performing System copy in SAP ECC6.0 EHP4 with backup restore method, you may face issue during the phase when database creation where the oracle DB server for the DBSID not getting created.

This is a SAP bug, that SAPinst fails to create the database service & exits with error and this can be solved by

login as <SID>adm user

Open command prompt and type
oradim -new -SID <SID> -STARTMODE manual -SRVCSTART system
this will create the oracle instance.

Once created then modify keydb.xml in your installation dirctory:

search for createInstance_oradim and after 4 lines replace
"ERROR" with "OK"

The lines sample below to change

<row>
<fld name="STEPKEY"> <strval>
<![CDATA[ |NW_Doublestack_OneHost|ind|ind|ind|ind|0|0|NW_Onehost_System|ind|ind|ind|ind|2|0|NW_CreateDBandLoad|ind|ind|ind|ind|10|0|NW_CreateDB|ind|ind|ind|ind|0|0|NW_OraDBCheck|ind|ind|ind|
ind|0|0|NW_OraDBMain|ind|ind|ind|ind|0|0|NW_OraDBOBR|ind|ind|ind|ind|1|0|NW_OraOBR|ind|ind|ind|ind|5|0|
createInstance_oradim]]>
</strval>
</fld>
<fld name="STATUS">
<strval><![CDATA[ERROR]]> ###here write OK
</strval>
</fld>

Then stop and restart the installation with continue option...






SAP-Service in windows

There might be scenario's where SAP service in windows (in some cases) corrupts or needs to be re-created.

The solution is...

Run sapstartsrv.exe -t from SAP kernel executable folder.

Fill in the required fields as picture below.



Selection --> Register COM type library can be used if the registry entry is not present / deleted.
SID--> SID of your system
NR--> Instance number
Profile--> Use START profile and its location
User--> User SAPService<SID> which is created when you install SAP in Windows environment.
Click OK.


The command to uninstall the service is sapstartsrv.exe -u
                                        (or)
Use windows delete service command sc delete <sap_service_name>.

SAP-TMS Transport issue with DOM_CTL error message

You may face issue while performing transport request forward or import stage with error DOM_CTL with module "CALL_FUNCTION_CONNECT_ERROR".

The error mostly occur in QA systems after performing DB refresh or after performing system copy.

This error occur because of the wrong / non relevant entries of the current system in secure store of SAP.

If searched in google for this error, you may end up in executing SECSTORE_CLEANUP report to clean the secure store and refresh it.

This solution may not help in all kinds of scenario's, the below  mentioned were the best solution

Solution is by migrating the invalid SECSTORE entry HMAC_INDEP/RFC_EXTERNAL_TICKET_4_TRUSTED_SYSTEM, provided that SAP Note 1491645 was implemented.        

The validity check and the migration of an SECSTORE entry are described in SAP Note 816861.

1) Solution 1:- (Manually correct the SECSTORE)

Call transaction SECSTORE

Choose "Execute" (F8).

In the entries that are displayed, delete the entry /HMAC_INDEP/RFC_INTERNAL_TICKET_4_TRUSTED_SYSTEM if it is marked with a red traffic light.

In the entries that are shown, delete the entry /HMAC_INDEP/RFC_EXTERNAL_TICKET_4_TRUSTED_SYSTEM if it is marked with a red traffic light.

After the deletion of this entry, all the trust relationships to trusted systems (systems that are trusted by the current system) are invalid and, if required, have to be deleted in the current system using transaction SMT1 and then have to be recreated.

In transaction SE37, execute the function module RFC_PING with the destination NONE. If the system displays an error message, execute the function module RFC_PING again; the error message cannot appear a second time in this case.

2) Solution 2:- (Automatic SECSTORE cleanup)

As of SAP Basis Release 620:

Execute the report RS_TT_CLEANUP_SECSTORE.

If you cannot implement this report using transaction SNOTE if the report not available in the system Note 1532825 (due to the RFC problem), copy the source code of the report for the relevant release from the attachment of the Note 1532825.

This report deletes invalid secstore entries /HMAC_INDEP/RFC_INTERNAL_TICKET_4_TRUSTED_SYSTEM and /HMAC_INDEP/RFC_EXTERNAL_TICKET_4_TRUSTED_SYSTEM.

After the deletion of the entry for  /HMAC_INDEP/RFC_EXTERNAL_TICKET_4_TRUSTED_SYSTEM, all the trust relationships to trusted systems (systems that are trusted by the current system) are invalid and, if required, have to be deleted in the current system using transaction SMT1 and then have to be recreated.

SAP-Oracle Database Authorizations for DB users

For SAP managed Oracle databases the authorizations for DB users were automatically created/assigned during installation.

While maintaining the database, basis consultant should keep in mind that for security reasons, it does not make sense to grant database users access to all database resources, or to permit all actions. Therefore, it is usually cause for concern if a database user can read the tables of other users. In addition, critical actions, such as stopping the database or dropping tablespaces, should be restricted to only a small number of users.

To restrict a database user's options to the functions that are actually required by that user, you can assign database authorizations for these functions only. (If you create separate DB users).

For background information about database users and logon mechanisms, see Note 562863.

Types of database authorizations
1) Privileges
2) Roles
3) Profiles

Privileges
           A privilege is an authorization to perform a certain database action. There are different types of privileges:
      a)System privileges
      b)Object privileges 

Roles
           Roles are a collection of authorizations and consist of a number of privileges and/or subroles.

Profiles
           Password and resource authorizations are assigned as part of a profile. In the SAP environment, adjustments should not be made to the profile default settings (see below).

Pages