Basic Authentication Issue

[Former Member]

Hi All,

We have created a BSP application, which is opened via a portal page in a new window. The portal is sso authentication that sits on a different domain than the BSP application. The issue we are having is when a user clicks on our link in the portal to go to the BSP application, a Basic Authentication dialog box pops up. We are trying to figure out a way to have this dialog box not pop up. We are thinking there must be some way to have Windows Integrated Authentication, but we are unsure how to get this functionality. The really odd part is if the user cancels the Basic Authentication dialog and closes the "unauthorized" window, then clicks the BSP link in the portal again, the Basic Auth dialog does not pop up and the user is allowed to view our BSP application. Any comments or help would be greatly appreciated. Thanks, Derek

[athavanraja · Accepted solution]

Welcome to SDN.

1. what sort of SSO are you using - logon ticket based or user mapping

2. is the WAS host, path are maintained in the system definition (of the back end system) in portal.

Regards

Raja

[Former Member · Accepted solution]

Hi Raja,

The SSO type is logon ticket based. I am unsure what is being asked in the second question "is the WAS host, path are maintained in the system definition (of the back end system) in portal"

Thanks,

Derek

[Former Member]

For any individuals interested, the solution to the issue was to adjust the service's security requirements to "Client Certificate w. SSL" in transaction SICF.

[athavanraja]

glad to know you have solved it.

about your question on <i>"is the WAS host, path are maintained in the system definition (of the back end system) in portal"</i>

when you define the backend system in portal (this is system on which the BSP will run) for bsps to run you should have maintained WAS host, path ,etc

Raja

[Former Member]

Hi Derek,

SSO with tickets (browser cookies) won't work if the systems are not in the same domain. What can be done is issuing the ticket for the toplevel domain. For example:

1.) Portalsystem is in portal.domain.com and

2.) WAS with BSP is in was.domain.com then you can configure the portal in that way that the SSO ticket is for domain.com. This way SSO between those two system should be okay because the SOO ticket is sent to the WAS system.

The downside is that the ticket is sent to every system within domain.com. This might be a security issue.

If this is not possible SSO with tickets will not work as far as I know. Windows integrated auth with NTLM is not supported anymore. SAP is heading towards a Kerberos implementation. At least this is supported in the newer releases...

Regards,

Alex