Browsing File System of a Java-only System
NetWeaver Process Integration is transiting towards a single Java stack system – good examples here are new Java-only installation options that are available for it in NetWeaver 7.3 releases: Advanced Adapter Engine Extended (AEX) that became available as of release 7.3 and Process Orchestration (PO) that became available as of Enhancement Pack 1 for release 7.3. Having the system running in Java-only installation, there is still a demand to access its local file system – e.g. to browse local directories or to get access to specific files that are stored there. Log Viewer that is available as a part of NetWeaver Administrator and that is used to get access to log and trace files of AS Java does not fulfill this requirement absolutely since there are cases when it is necessary to just navigate some specific directory in order to retrieve a list of files that are stored there or to browse contents of the file that is not AS Java log/trace file. In AS ABAP, there is a useful transaction that was fulfilling these requirements and commonly used for these purposes – AL11 (Display SAP directories). And this is something that many users are missing in Java-only installations. Fortunately, AS Java provides analogous functionality for accessing file system as AS ABAP’s AL11 – this functionality will be discussed in this blog. The described functionality is not PI-specific, but is relevant for any AS Java system like Enterprise Portal, etc.
An integral part of any AS Java system is HTTP Provider that provides a low level communication and transportation service for AS Java over HTTP. One of important features of it is capability of accessing file system via HTTP – that is actually the key for the topic that is discussed in this blog.
In order to be able to get read access to some directory of the file system of AS Java system, it is necessary to configure the respective alias. To do this, follow steps described below:
1. Log in to NetWeaver Administrator of the corresponding AS Java system, navigate to work center Configuration, then choose option Infrastructure and run the tool Java HTTP Provider Configuration (it is also accessible via a short link: /nwa/http ).
2. Go to the tab Virtual Hosts, select the required virtual host for which file system you would like to grant HTTP based access to the file system.
3. On the tab General of the selected virtual host configuration, ensure that the check box Directory List is active.
4. Now switch to the tab Aliases of the selected virtual host configuration – here you can maintain an alias for the local directory that you would like to access via HTTP.
As soon as the alias is maintained, we now can access the respective file directory using it. In order to do it, just use the following URL syntax: http://<AS Java host>:<Java HTTP port>/<alias> . As a result, we get a web access over HTTP via any web browser supported by the queried AS Java system to the file system. We can now navigate to sub-folders and browse contents of files (text and binary) that are located there. Below are several screenshots demonstrating this functionality in action.
If the check box Directory List is not active on the tab General of the selected virtual host configuration, browsing file system of it will be denied and HTTP error 403 will be returned:
As it can be seen, there are technical possibilities of getting read access to file system of Java-only system without necessity of getting direct OS access (e.g. via shell/terminal access, etc.) to the corresponding host.
As mentioned by Hemanth Kumar in comments to this blog, the SAP Note 1877320 is useful reference and discusses how directory listing functionality may be enabled not only via NetWeaver Administrator, but also via AS Java Telnet.
This is a very handy feature, thanks for sharing!
Kr. Mark
Hello Mark,
You are welcome!
Regards,
Vadim
Hi Vadim,
this is a great hidden feature which I know will come in very handy. Thank you very much for sharing!
Hi Sascha,
Yes, I absolutely agree with you: this is a feature that is quite useful - but it is also a subject for precise attention from security perspective since it can be used for exposing sensitive data. So, it should be used very carefully in productive environments - for example, aliases that you maintain should point to only those file directories that are actually needed for monitoring and not to root catalogues / directories that can potentially contain sensitive information.
Regards,
Vadim
Hi there,
thanks for the valuable information. We implemented as suggested but found out that with opening the URL no authentication occured. There was just anonymous access to the folder / subfolders.
Is this what you mentioned above or should there be at least an initial authentication happening from your expertise?
Thanks and kind regards
Jens
Hello Jens,
You are right. Precisely speaking, it is possible to access alias via HTTP Provider service anonymously whereas underlying access to the mapped queried directory is automatically performed in the context of OS administrator user (like SAPService<SID>).
Regards,
Vadim
Hello Vadim,
thanks for the clarification. It's a bummer though, that one would not be able to add authentication to this feature to provide minimum security :-/
Anyway, thanks again for pointing out this really neat feature.
Hi Vadim,
Good one.But, can you please add to what kind of files/directories does this service provides access as I couldn't find all the available files/directories in a given folder. Thanks.
Regards
Anil Kumar Veepuri
Hello Anil,
Using Java HTTP Provider alias, the file system is accessed in the context of OS user of SAP service (e.g. SAPService<SID>). Thus, can you please check authorizations / access rights of that user to the file directory (and sub-directories/files located in it) that you attempt to access?
Regards,
Vadim
Thnx. Will check and update.
Nice useful blog Vadim..
Can we use this NWA feature even in double stack also?
Regards,
Pranil.
Hello Pranil,
Thank you for positive feedback!
Yes, you can use this functionality in dual-stack systems as well - from configuration and usability perspective, there will be no difference at all: identical functions of Java HTTP Provider will be utilized.
Regards,
Vadim
Excellent Blog Vadim..
Hi Vadim,
Thank you.
An excellent blog, straight forward and right to the point. It certainly resolved my issue.
Kind regards,
Kapila
Hi Vadim,
The only thing I had to do was clear the cache of the virtual hosts before I was able to use the URL alias. But works perfectly afterwards!
Thanks for the clear instructions!
Kind regards,
Maarten
Hi, this works excellent but i'm facing one issue. If the file in al11 is a softlink it does nor work to follow it down. You get error msg 404 not found and requested resource does not exist. Any suggestions how to solve that??
Regards Anna
Hi Anna,
Using the described functionality, the one lists directories and browses content of the selected file, but it is not possible to execute respective actions declared in those files - like to be redirected to the referred resource location based on execution of shortcut file, or execute script commands if the accessed file is a script file, etc.
Regards,
Vadim
Thanks for your Quick answer, then we continue to trouble shoot and see if we find a solution 🙂
Regards
Anna
Hi Vadim,
Great blog, it is very useful blog for me.
Just i want to implement the same for Netweaver 7.0 EHP1 version also, please let me know the steps.
Thank you once again for this wonderful blog.
regards,
Bhaskar
please see sap note 531495
Good work, please see note 1877320 - How to enable/disable directory listing on SAP J2EE 7.1 and higher .
This can also be enabled vua telnet.
I would also request that you put in a NOTE in the blog itself stating the below:
****************************
Yes, I absolutely agree with you: this is a feature that is quite useful - but it is also a subject for precise attention frorm security perspective since it can be used for exposing sensitive data. So, it should be used very carefully in productive environments - for example, aliases that you maintain should point to only those file directories that are actually needed for monitoring and not to root catalogues / directories that can potentially contain sensitive information.
****************************
Kind Regards,
Hemanth
Hi,
In my opinion, the HTTP File system should be authenticated for a user against UME.
I am not sure if this option is already available ( I don't see it anywhere it is mentioned atleast..)
If not, SAP should consider adding the below functionality
Note:- BASIS system should only create HTTP File browsing aliases only for PI interface data folders etc.. but not to system level core directories
Created an idea in SAP Ideas place: Improvements for browsng HTTP file system for JavaStack : View Idea
Please vote if you like the idea..
Best Regards,
Praveen Gujjeti
Hi Hemanth,
Thank you for quick response and that is great note. Now I am able to view the images.
Regards,
Bhaskar N
Hi All,
Just want to know is it possible to restrict this for a particular user.
Regards,
Vikas
Hi Vikas,
I'm not aware of such functionality as authorization based management of this kind of access feature (which is why this functionality shall be taken with caution from security perspective), and looking into SAP idea submitted by Praveen Gujjeti in SAP Idea Place, this feature doesn't seem to be implemented yet.
Regards,
Vadim
Hi,
Is it possible to mount PI single stack system with two different ECC systems (SysEQ1 & SysEQ2) directories for placing files from different parties.
Thanks
Hi Varun,
The described functionality is for listing and displaying files, you cannot place / upload files using it.
You mentioned those two remote systems are ECC - then you can use following transactions in respective ECC system:
Regards,
Vadim
Very Nice Blog Vadim.
Appreciate your Efforts in doing this. 🙂
Is there a way to upload the files and download the files( like we do using the transactions CG3Y and CG3Z in dual stack) in the single stack?
Regards,
Divya.
Hello Divya,
Thank you for your positive feedback. I'm glad if such tips are helpful for community.
Alternative to transaction CG3Y (download files from application server), is actually functionality described in this blog, browsing application server file system by means of Java HTTP Provider service.
Regarding alternative to transaction CG3Z (upload files to application server) in Java-only systems, it is not so straightforward. I haven't yet found anything that would be user-friendly and convenient and that would be shipped as a part of SAP application server Java delivery. Hence, I personally either use SFTP/SSH or Remote System Explorer perspective in Eclipse (see RSE User Guide). Both of them require corresponding services to run on OS level of the application server, it is not something that ships with SAP application server. SFTP/SSH is a more commonly faced option out of these two, since it is also commonly used by SAP Basis team / database administrators and is more likely to be set up. Remote System Explorer functionality available in Eclipse platform, on other hand, attracts my attention because I have to switch between fewer number of tools when developing for PI/PO systems and can access file system (including exchange of files between local machine and remote server) / execute shell commands on the remote application server right from the corresponding perspective in Eclipse / NWDS. This approach still requires a service (Eclipse's DataStore daemon) to run on the remote server.
Regards,
Vadim
Vadim,
I configured the same way as it is in the blog but facing issue Watching File System of Java Host PI can you please help here.
Thanks,
Kiran
Hello Kiran,
Let the mentioned issue be discussed outside of the blog, but within the referred forum thread. I've commented on it right in the thread.
Regards,
Vadim
Hi Vadim,
Is this applicable for the "default" virtual host only ? Because i created another virtual host and followed the same steps but i get 404 , where as i can access the folders in "default" virtual host with no issues.
Same settings are maintained for both default and custom virtual hosts.
Br,
Manoj
Hello Manoj,
The described functionality is not limited to only default virtual host and is also relevant for custom created virtual hosts within HTTP Provider. I think you get 404 "Not Found" because of configuration of virtual host and associated DNS settings required for it, rather than because of enabling directories listing for it. As mentioned in documentation for virtual hosts configuration (Virtual Host Configuration - Administration - SAP Library), these are name-based virtual hosts - so you need to map them using DNS before you can access them.
Regards,
Vadim
Hi, Thanks for this.
However, I am experiencing a strange behavior
by default, the root directory is: /usr/sap/J4H/J00/j2ee/docs (without the D:)
When i try to change it to look like your screenshot, on saving it automatically becomes: /usr/sap/J4H/J00/j2ee/cluster/server0/D:/usr/sap/J4H/J00/j2ee/docs
Ultimately, I am getting 404 error. Any input will be appreciated. As this is one step in solving a larger problem.
Hi Olubunmi,
Screenshots that I provided in the blog, were taken for the PO system running on OS Windows, so alias path follows Windows style directory reference. Looking into directory you mentioned for your case, your system is running on Unix/Linux-like OS, hence you shall not generally use logical drive notation (e.g. C:, D:, etc.), but instead configure alias using Unix style directory reference when setting up path for that alias - for example, /usr/sap/J4H/J00/j2ee/docs.
Regards,
Vadim
Really appreciate your input. I am also running a PO System on Windows OS, which is why I termed it a strange behavior.
I expected to see the exact same path as yours. When I tried to change it myself, I get a totally new path (see earlier comment).
I feel like I am missing a config. I have also read on other forums that SAP XI (now PO) is unix-based despite all other environments being windows. This is a bit confusing.
Looks like I have to revert to FTP.
I have not seen a single post/article with a successful File-to-File using NFS.
Hi,
If your PO system is running on Windows platform, you (or your colleagues from Basis team) can check the referred directory / path right from the OS of application instances of the PO system and check if they are valid and accessible. When configuring alias, path shall be specified in the same format as the one used from the OS level of the PO application instance.
It is not truly accurate to state that XI/PI/PO is Unix-based - it supports various operating systems, Lunux and Windows based. You can check full list of supported operating systems and their versions that are supported for the specific XI/PI/PO release, in Product Availability Matrix.
Regarding your last comment, I shall draw attention to separating functionality of HTTP Provider described in this blog, and functionality of PI/PO adapters used for file based message exchange (for example, in file-to-file integration scenarios) since these two do not have direct correlation and dependency to each other. Moreover, it shall be noted that NFS mode is well supported by some built-in adapters (like File adapter) and there are already examples of configuring this adapter in NFS mode in materials posted in SAP Community as well as documentation for this adapter provided in SAP Help. If you have concerns on usage of this kind of adapters in any specific scenario you encountered, I suggest creating a question for it in SAP Community to enable involvement of wider community in its discussion.
Regards,
Vadim
Hi Vadim,
As mentioned by you this is only for listing and displaying files, there is no possibility of GET/POST files from another server and vice versa. In my case scenario i wanted to GET/POST files.
IDOCs are send from SAP ECC system to Network File server(share folder) via SAP PI 7.4 Java stack and vice versa.
Is this requirement achievable through PI? PI ip address looks like xxx.xx.xx.56 and share folder ip like xx.xxx.xx.32. Can we proceed with file mounting? PI Operating system is Aix(ppc64) 7.1.
Hello Rajesh,
Yes, based on high level description of the requirement, this can be achieved through PI (assuming remote shared directory can be accessed from the PI system). But that one has nothing to do with the functionality described in this blog - the described functionality is used for listing and accessing files via web interface, mostly for administration/troubleshooting/development purposes (human centric activities), whereas the requirement you described fits well into PI mediated IDoc-to-File integration scenario (system centric).
Regards,
Vadim
Hi Vadim,
Could you please elucidate. Below thread for your valuable inputs and suggestions.
https://answers.sap.com/questions/98263/filenfs-to-idoc-scenario-and-viceversa-in-sap-pi-7.html
Thanks much.
Hi Vadim,
Below thread for your reference.
https://answers.sap.com/questions/98263/filenfs-to-idoc-scenario-and-viceversa-in-sap-pi-7.html