SAP Note

Header Data
Symptom
Aut hor i zat i on pr obl ems occur f or t he f i l e I / O on net wor k dr i ves f r omt he R/ 3.

Such a pr obl emt ypi cal l y occur s af t er you successf ul l y set up a cent r al t r anspor t di r ect or y. The R/ 3 Syst ems bel ongi ng t o t he gr oup do not
bel ong t o t he same NT domai n. The par t i ci pant s of t he t r anspor t gr oup whi ch ar e i nf or med about t he modi f i ed t r anspor t di r ect or y vi a t he
DI R_TRANS par amet er i n t he i nst ance pr of i l e ar e not abl e t o access t hi s di r ect or y vi a Tr ansact i on AL11. The f ol l owi ng er r or message i s
displayed: Wrong order of calls <- CALL opendi r ( , , . . )
Message no. S1204
Addi t i onal sympt oms of t he pr obl emconcer ni ng t he cal l of TP or an ext er nal pr ogr amar e descr i bed i n Not e 48486. The causes of t he SYSLOG
messages ( f or exampl e TR010) or er r or messages of t he oper at i ng syst em( f or exampl e OS- er r or 1326) cont ai ned i n Not e 48486 can al so be
at t r i but ed t o t he pr obl emdescr i bed her e.

However , t hi s pr obl emcan gener al l y occur wi t h ever y f i l e access f r omwi t hi n t he R/ 3 ( f or exampl e wi t h OPEN_DATASET on a net wor k dr i ve) .

Ther e ar e, however , no pr obl ems wi t h ot her deskt op t ool s ( f or exampl e Fi l e Manager , Expl or er ) when you access t hi s net wor k dr i ve.

Other Terms
I / O, aut hor i zat i on, wor k gr oup, domai n, AL11, S1204

Reason and Prerequisites

Af t er an R/ 3 st andar d i nst al l at i on on Wi ndows NT, t wo di f f er ent oper at i ng syst emuser s exi st on one R/ 3 ser ver :
l User <SI D>admwhi ch i s used f or t he i nt er act i ve l ogon and
l User SAPSer vi ce<SI D> whi ch i s used t o st ar t t he SAP ser vi ces
I f user <SI D>admi ni t i at es t he st ar t of an R/ 3 i nst ance ( f or exampl e by pr essi ng t he ' St ar t ' pushbut t on i n t he SAP Ser vi ce Manager ) , t he SAP
ser vi ce SAP<SI D>_<i nst ance_no> get s a si gnal t o st ar t t he R/ 3 ker nel . Si nce t he SAP ser vi ce SAP<SI D>_<i nst ance_no> i s st ar t ed l i ke al l ot her
SAP ser vi ces wi t h t he user SAPSer vi ce<SI D> al so t he R/ 3 ker nel i s r unni ng i n i t s secur i t y cont ext .
I n ot her wor ds: Al t hough t he i nt er act i ve user <SI D>admi ni t i at es t he st ar t of t he R/ 3 i nst ance, t he R/ 3 ker nel accesses al l r esour ces wi t h t he
aut hor i zat i ons of user SAPSer vi ce<SI D>.
I n t he case descr i bed above, t he user under whomt he R/ 3 ker nel i s r unni ng, has no aut hor i zat i on t o access t he r emot e dr i ve.

Solution
I n or der t o sol ve t he pr obl emyou must di st i ngui sh bet ween di f f er ent cases concer ni ng t he par t i ci pat i on of t he R/ 3 ser ver s i n Wi ndows NT
domai ns
1. Al l par t i ci pat i ng R/ 3 i nst ances ar e member of onl y one NT domai n
The problem should not occur in this case as long as the above mentioned users were implemented as domain users (recommendation).
I f t he SAP user s wer e onl y cr eat ed as l ocal user s, t hei r ar ea of val i di t y i s r est r i ct ed t o t hi s l ocal ser ver , and you must pr oceed accor di ng t o
poi nt 2) .

______________________
/\Domain A
|o.k.|
HOST A - - - - - - - - - - - - - - - > HOST B( shar ed r esour ce)
| domain user : ABCadm |
\______________________/
The domain user account is valid in the whole domain.
2. Al l par t i ci pat i ng R/ 3 i nst ances ar e member s of an NT wor k gr oup or st andal one ser ver
I n t hi s case, t he r espect i ve oper at i ng syst emuser s ar e onl y l ocal l y val i d on t he ser ver s, and t he condi t i ons f or t he above er r or
ar e gi ven. A possi bl e sol ut i on i s t o i ncl ude t he ser ver i n a domai n and t o exchange t he l ocal user s wi t h domai n user s. Si nce t hi s i s qui t e an
ef f or t ( t he st ar t up user s f or ever y SAP ser vi ce must be changed) , you must deci de whet her t he f ol l owi ng met hod i s mor e usef ul .
The di sadvant age of l ocal val i di t y can be avoi ded by cr eat i ng t he r espect i ve user s who need access t o t he r emot e r esour ce ( f or exampl e t he
ser ver wi t h t he cent r al t r anspor t di r ect or y) wi t h t he same name and t he same passwor d on t he t ar get comput er .

Wor k gr oup or st andal one ser ver :

No Access
HOST A- - - - - - / - - - - - > HOST B ( shar ed r esour ce
user: A*
pwd : ABC
Access
HOST A- - - - - - - - - - - - > HOST B ( shar ed r esour ce)
user: Auser: A
pwd : ABCpwd : ABC
* t he SAP Syst emuses user s <SI D>admand SAPSer vi ce<SI D>

3. The par t i ci pat i ng R/ 3 i nst ances ar e member of sever al NT domai ns
If a what is known as 'trust relationship' exists between the domains, the users of a domain can also access resources of foreign
117395 - Authorization problems for file I/O on Windows NT
Version 6 Validity: 12.04.2002 - active Language Ingls
Released On 12.04.2002 10:34:04
Release Status Released for Customer
Component BC-OP-NT Windows
Priority Recommendations / Additional Info
Category Help for error analysis

domai ns. A ' t r ust r el at i onshi p' i s onl y uni di r ect i onal by def aul t . That means t hat onl y user s of t he one domai n may access t he r esour ces of t he
ot her . However , mut ual accesses ar e al so possi bl e by set t i ng up a mut ual st at us of conf i dence.
Wi t hout ' t r ust r el at i onshi p' t he pr econdi t i on f or t he above pr obl emi s gi ven because t he domai n user s ar e onl y val i d l ocal l y i n t hei r own
domai n. However , you an al so sol ve t he pr obl emwi t h a wor kar ound wi t h a second user of same name and same passwor d.

Domain ADomain B
____________
\No Trust/
|Relationship|
HOST A - - - - - - - - - - - - - - - - > HOST B ( shar ed r esour ce)
|No Access ! |
_____ /\ _______


Domain ADomain B
___________
\No Trust/
| Relationship |
HOST A - - - - - - - - - - - - - - - - > HOST B ( shar ed r esour ce)
|Access !|
______ /\ _______
user: A*user: A
pwd : ABCpwd : ABC
* t he SAP Syst emuses user s <SI D>admand SAPSer vi ce<SI D>

You must check whi ch met hod i s most appr opr i at e f or your i ndi vi dual case.

Other Attributes
Validity
This document is not restricted to a software component or software component version
References
This document refers to:
SAP Notes
This document is referenced by:
SAP Notes (4)


AL11

FILE

HIER

NT/ALPHA

NT/INTEL
556734 FAQ Transport: Setup and further information
99155 DATASET_WRITE_ERROR / DATASET_CANT_OPEN on NT
48486 R/3 server in different NT domains
48486 R/3 server in different NT domains
99155 DATASET_WRITE_ERROR / DATASET_CANT_OPEN on NT
1172252 CTS+, 'attach file': Troubleshooting Guide
556734 FAQ Transport: Setup and further information