Update Windows AD Group Graph and Aliases missing the FRS File Name after UMT process

[steve_bagdanovich]

Hello,

We recently migrated from boxi 3.1 to boxi 4.1 sp6. We soon realized that the ad aliasas sync was failing. When we look at the General Properties of the Update Windows AD Group Graph and Aliases app object we notice that there is no path or file name linking the object back to the FRS. I attempted to re import those objects from the 3.1 system using a bair file but we see the same results after the import. All of the users and groups were migrated successfully. I verified that the UpdateADPlugin.jar file is located in the FRS. I could really use some help with this. Thank you all!

[denis_konovalov]

I have fixed you tag to better align with the question content.

[BasicTek · Accepted solution]

To note the job for updating the plugins was changed from 3.1 to 4.x and it was hidden from both the CMC and query builder on purpose as it was getting damaged on 3.1. There should be no options to change or modify the job other than setting the schedule in 4.x. If it's not working I would think the attempt to migrate the objects from 3.1 or other attempted changes might be the problem rather than solution. Honestly a clean install or CMS DB may help and then troubleshooting any failure (which is rare) would normally be related to AD communication issues.

-Tim

[steve_bagdanovich · Accepted solution]

Thanks Tim,

I believe you are saying that in 4.1 I will not see the FRS path back to the updateadplugin.jar file as i did in 3.1? THis then means that I am troubleshooting in the wrong direction. IF this is the case then Thank you. I will focus on the Ad auth settings rather that thinking the app object was somehow corrupt. Please correct me if I am still going in the wrong direction.

[BasicTek · Accepted solution]

yes that is what's I'm saying, the objects have been hidden by design, so the good side is they don't get broken anymore, on the other side is there is no way to modify them. This has resulted in much less issues then we saw in 3.1

[steve_bagdanovich · Accepted solution]

Spot on Tim, thank you sir.

I was completely thrown off by this change in 4.x. I assumed that our Ad updates/sync was failing however that was not the case at all. I added a new user to the AD group that controls access to boxi and the user was able to log in and I see the account sync'd in cmc users folder. As you know in BOxi 3.1 one can see the run history for the AD graph applications by right clicking the app object and choosing history or Run now. I learned that this is no longer an option in 4.x. That process is done inside of Instance Manager. I first browse to the Administration Tools folder and then simply click find. I see nothing for Update Windows AD Graph and Update Windows AD Graph and Aliases.

Can you please tell me how I can see the history for the scheduled ad sync? It is set to sync every hour. I know it is working because I was able to add a new user.

Thank you.

[BasicTek]

The only info we were given was in this blog https://blogs.sap.com/2012/02/16/an-improvement-for-administrators-in-bi4/

In all the time 4.x has been out I've never tried to find any instances, looking myself I see the same as you the objects shows but I can't see any history except in the plugin it shows the last result. If I find anything differently I'll let you know but apparently that history isn't deemed as important anymore

-Tim

[steve_bagdanovich]

Thank you Ayman,

I have Run Java programs flagged already. Please elaborate what you mean b check User Security for jar file. Do you mean the actual .jar located in the FRS? I checked this file and it has exact same user security as the old platform. The service account that runs the SIA has full control of the .jar.

thank you

[ayman_salem]

Verify that "Run Java Programs" is enabled or disabled

....

Applications --> Centeral Management Console -> Program Object Right

(after that, it is better to restart CMS Server, then logout and logon again)

....

Also check the "User Security" (in your screenshot) for your JAR file

[steve_bagdanovich]

Thank you Ayman,

I have Run Java programs flagged already. Please elaborate what you mean b check User Security for jar file. Do you mean the actual .jar located in the FRS? I checked this file and it has exact same user security as the old platform. The service account that runs the SIA has full control of the .jar.

thank you

[ayman_salem]

What I mean is "User Security" in CMC (see your screenshot).

....

Also, use the "Query Builder" to check if the file is already listed or not and that it is in the correct frs. (SI_FILES -- SI_FILE1, SI_PATH)

select * from CI_INFOOBJECTS where SI_ID=868178 (ID is from screenshot)