Configuration of Adobe Document Services

Adobe Document Services (ADS) comes installed by default with NetWeaver AS Java and is SAP’s standard way of creating PDFs by SAP applications. These PDFs can be normal PDFs or interactive (called Adobe Interactive Forms). The SAP system using ADS can be any NetWeaver ABAP or Java system. This makes the setup process a little bit more complex: it depends on your use case which steps have to be executed. You can have the ADS system that is a NW Java system, a NW ABAP system and another NW Java system that use ADS. And many times the calling NW Java system is the same system ADS is running on.

Tip

When you start configuring ADS, write down each system and its role. If not, it`s pretty likely you`ll have later some problems in identifying which connection and user you are configuring.

For this document I`ll consider the scenario of an ABAP system calling ADS to generate a PDF. In this scenario, the components involved are ADS, NW ABAP and NW Java. These are also the main areas to consider when setting up ADS.

Things are more complicated because the communication between the ADS and the calling system is bi-directional. For instance, the ABAP system calls ADS and sends the data to be converted and after ADS finished the conversion, ADS calls the ABAP system. After all, you want to use PDF in your ABAP system. Simplified, the information looks is like:

What does this mean now when you have to configure ADS together with ABAP?

1. Check that there is an ADS user with the right UME actions on NW Java
2. Check that there is an ABAP user with the right profile on NW ABAP
3. There needs to be a connection from ABAP to ADS (destination type web service)
4. There needs to be a connection from ADS to ABAP (as a destination: NW Java, as a SICF service: NW ABAP)

Configuration: ADS

As ADS is a JEE application it makes use of the security and authorization concept of JEE. This means that you

1. a) need an ADS user and
2. b) assign the right permissions to this user

to be capable of executing the application. As ADS is a NW Java application, to gain access the right assignment of UME action to the user executing / calling the application is needed (therefore, you can use any username). By default, the user ADSuser is created and the UME actions are made available in the NW Java system when ADS is installed. If they are missing, something is wrong with the ADS installation.

Short: on the Java side the ADS configuration is actually nothing more than assigning permissions.

Parameters to remember

While the SAP documentation talks about assigning a role, what counts are the UME actions assigned to that role. Looking up the UME actions for default user ADSuser.

ADSuser:

Role

UME actions

As soon as the user ADSuser is assigned to the role SAP_ADSCALLER the necessary permissions are available and this user can access and use ADS.

Remember

ADSuser is the user used by the ABAP system to call ADS. The ABAP system will use this user to log on to NW Java and to execute the ADS web services. This is not a service user used in the background by ADS.

Configuration: ABAP

In the ABAP system, configuration involves main tasks:

1. Set up a HTTP connection so the ABAP system can call ADS
2. Maintain user used by ADS to call the ABAP system
3. Set up the destination called by ADS to transfer the PDF

Let us go through each one of these three steps, starting with the user administration.

1. HTTP Connection

This configuration is needed so that the ABAP system can actually call ADS.

Transaction: SM59

Information flow: ABAP -> ADS

By default, the name of the destination is ADS and of type G (which means HTTP. After all, ADS is exposed as a web service).

The technical settings point to the NetWeaver Java server where ADS is running.

Logon tab

Here the logon information send by ABAP to Java to authenticate as an ADS user are given. The user entered here MUST have the right UME permissions assigned. The user information entered must match what was used in Configuration: ADS (see above).

2. User SAP Help

To send back the PDF, ADS invokes a ICF service on the ABAP server. To do so, it must authenticate on the ABAP server. Therefore, a user must be made available on the ABAP system that has the This is the user used by ADS to send back the generated PDF to the ABAP system.

Information flow: ADS -> ABAP.

Transaction: SU01

3. ICF service. SAP Help

This configuration is used by ADS to actually send back the generated PDF. ADS is not using a RFC / BAPI connection but a web URL. As in ABAP a URL is backed by a ABAP application, a valid ABAP user with the right permissions to execute the ABAP application is needed. This user was provisioned in the previous step. This implies also that the PDFs are not simply stored as pdf files in a file repository but processed by a SAP application.

Transaction: SICF

Information flow: ADS -> ABAP

Enter fp in the service name field and execute the report. The service will be shown. Ensure that the service is active.

Configuration: ADS to ABAP

Configure a connection between ADS and ABAP so that ADS can call the ABAP system and send back the generated PDF. This is done in NW Java using a destination. SAP Help

Open NWA and navigate to SOA -> Destinations

Create a new destination. The name of the destination needs to follow a certain naming convention: FP_ICF_DATA_<SID>

In case the <SID> of your ABAP system is SID, the correct name to enter here is FP_ICF_DATA_SID. (If your ABAP SID is AB1, it would be FP_ICF_DATA_AB1).

Next, enter the connection settings. These are needed by ADS to call the ABAP server using HTTP and for the logon information. In case the HTTP server of the ABAP server is listening on port 8000 on SID and client 100 with logon language English, the information to be entered looks like this:

The last step in the destination configuration wizard is to provide the logon information. Remember, this is how ADS will authenticate itself against the ABAP system. Therefore, a user with the right permissions on the ABAP system must be entered here. For basic authentication, (NetWeaver Java will transmit username and password) using the default user ADS_AGENT the information to be entered is:

Conclusion

After going through the basic setup, there are a few things to note.

1. On the Java ADS side, you can have more than one ADS user. They only have to be assigned to the correct UME actions. If you want, you can have N users: ADS1, ADS2, …, ADSN
2. For each ABAP system you`ll have to create a destination on the ADS NW system.
3. Each destination can have its own user, these do not have to be the same or even share the same password
4. Both the destination ADS uses as well as the URI of the ABAP service are fixed. While ADS uses the destination to resolve the host name (and user/password), the path on the ICF service cannot be configured through the destination and is fixed.

In case ADS is not working as expected, you can take a look at this document: Solving ADS related issues