SAP Basis Tech Supports

Symptom
This note contains a troubleshooting guide which can be used for analysing security related problems in the SAP J2EE NetWeaver Engine. The guide is valid for the NW04 and NW04s releases, including EhP1 and EhP2 of NW04s.
Other terms
authentication, authorization, security session, single sign-on, SSO, SPNego, Kerberos, SSL, keystore, HeaderVariableLoginModule, ClientCertLoginModule, BasicPasswordLoginModule
Reason and Prerequisites
If you have a problem which is related to J2EE security, this guide will help you determine what the problem is and what the necessary steps to solve it are.
Solution
Download the PDF file attached to this note and follow the instructions in it. You can find a brief summary of the security areas described in the document below.
Chapter 1 – Authentication
Read this chapter if you have general problems logging in to a resource on the SAP J2EE Engine (NetWeaver Administrator, User Management, System Information) or to standalone SAP applications which connect to the SAP J2EE Engine (Visual Administrator). No single sign-on must be active on the system.Chapter 2 – Authorization
Read this chapter if you see error messages saying that the user is not authorized to access the requested resource.Chapter 3 – Session Management
Read this chapter if you think that the security sessions of the user expire when they should not or if a user is incorrectly logged in to the SAP J2EE Engine as another user.Chapter 4 – Single Sign-On
Read this chapter if you have a single sign-on scenario and it fails.Chapter 5 – SPNego
Read this chapter if you have setup the SAP J2EE Engine to use Kerberos authentication via SAP’s SPNego mechanism.Chapter 6 – SSL
Read this chapter if you have enabled communication over the SSL protocol and it fails.Chapter 7 – Key Storage
Read this chapter if you see error messages saying that there are problems with Key Storage views or if you have problems importing/exporting certificates.Chapter 8 – Others
Read this chapter if you have general problems with the Security Provider service itself – for instance, if it fails to start and prevents the whole J2EE engine from coming up.