SSO with SAP GUI and .NET Connector

[Former Member]

Hi,

I have an abap dynpro with an html viewer ctrl. This control is calling a .NET application on an additional server which in turn calls an RFC back on the same R/3 system.

The flow is as follows:

r/3 win gui -> asp.net -> .net connector -> r/3 rfc.

Since the r/3 systems on both ends are the same, I would like to reuse the credentials already entered by the user for the rfc calls using sso.

I have enabled sso on the html viewer control by calling:

call method html->enable_sapsso( 'X' ).

Now I get an http header (NOT a cookie) in the asp.net: sap-mysapsso.

How can I use this header to connect to the r/3 system.

I have noticed that the .NET connector Destination class has 2 relevant members: MySAP_SSO and MySAP_SSO2, but simply assigning the header value to any of them is not working.

What should I do to get this working.

Thanks,

Dani

[reiner_hille-doering]

OSS note 612670 mentiones this or similar scenarios - but I have no idea if the ticket is valid for RFC. You may try "UrlDecode" before you pass it to the destination and play with the parameters mentioned in the note.

[Former Member]

Thanks for the reply.

I allready tried to UrlDecode but to no avail.

Is there anyway to get to any elaborated documentation or samples of the .NET connector which actually use the sso functionality?

Dani

[reiner_hille-doering]

There is a quite complete chapter about SSO in the NCo online help. Additionally I published two technical articles in SDN, one about SNC trusted connections and one about SSO2. I always have problem finding them. Perhaps you have more luck.

[Former Member]

Thanks for your patience.

I have found your article and responses through your sdn business card (and some luck...). Actually it is not the first time I see them, as I searched through the sdn before posting my message and it is hard not to come across your help. I also read the NCo help.

Unfortunately for me, I am still confused: first, I am not sure which version of the ticket is generated by my SAP GUI - is it sso2 or older sso. What adds to the confusion is that it is not coming as a cookie but rather an http header. How can I know the version?

Second, there is no info regarding sso tickets generated by sap gui and used to connect the NCo only BSP. Can the SAP GUI html control ticket be used for NCo? Is the ticket that I get is the one I need for .NET?

Third, I am not sure whether the ticket is ok and whether my system is properly configured to generate and accept tickets. I used transaction ss02 and added login/*sso to the system default profile but this did not change anything.

Last, if all the above issues are solved how should I use the ticket I get from SAP GUI to get the NCo connect to the r/3? Which Destination properties should I set and which other APIs and transformation should I apply on the ticket (UrlDecode, base64…?)

Thanks again,

Dani

[reiner_hille-doering]

I understand your question, but unfortunately I can't answer them - I just don't know the SSO details in your scenario.

You could ask in some other forums, mainly in those where the security exoert Wolfgang Janzen reads and answers.

Message was edited by: Reiner Hille-Doering